Merge branch '3.14-fixes' into mips-for-linux-next

532 files changed, 4722 insertions, 3444 deletions

diff --git a/Documentation/device-mapper/cache.txt b/Documentation/device-mapper/cache.txt
index e6b72d355151..68c0f517c60e 100644
--- a/Documentation/device-mapper/cache.txt
+++ b/Documentation/device-mapper/cache.txt
@@ -124,12 +124,11 @@ the default being 204800 sectors (or 100MB).
 Updating on-disk metadata
 -------------------------
 
-On-disk metadata is committed every time a REQ_SYNC or REQ_FUA bio is
-written.  If no such requests are made then commits will occur every
-second.  This means the cache behaves like a physical disk that has a
-write cache (the same is true of the thin-provisioning target).  If
-power is lost you may lose some recent writes.  The metadata should
-always be consistent in spite of any crash.
+On-disk metadata is committed every time a FLUSH or FUA bio is written.
+If no such requests are made then commits will occur every second.  This
+means the cache behaves like a physical disk that has a volatile write
+cache.  If power is lost you may lose some recent writes.  The metadata
+should always be consistent in spite of any crash.
 
 The 'dirty' state for a cache block changes far too frequently for us
 to keep updating it on the fly.  So we treat it as a hint.  In normal
diff --git a/Documentation/device-mapper/thin-provisioning.txt b/Documentation/device-mapper/thin-provisioning.txt
index 8a7a3d46e0da..05a27e9442bd 100644
--- a/Documentation/device-mapper/thin-provisioning.txt
+++ b/Documentation/device-mapper/thin-provisioning.txt
@@ -116,6 +116,35 @@ Resuming a device with a new table itself triggers an event so the
 userspace daemon can use this to detect a situation where a new table
 already exceeds the threshold.
 
+A low water mark for the metadata device is maintained in the kernel and
+will trigger a dm event if free space on the metadata device drops below
+it.
+
+Updating on-disk metadata
+-------------------------
+
+On-disk metadata is committed every time a FLUSH or FUA bio is written.
+If no such requests are made then commits will occur every second.  This
+means the thin-provisioning target behaves like a physical disk that has
+a volatile write cache.  If power is lost you may lose some recent
+writes.  The metadata should always be consistent in spite of any crash.
+
+If data space is exhausted the pool will either error or queue IO
+according to the configuration (see: error_if_no_space).  If metadata
+space is exhausted or a metadata operation fails: the pool will error IO
+until the pool is taken offline and repair is performed to 1) fix any
+potential inconsistencies and 2) clear the flag that imposes repair.
+Once the pool's metadata device is repaired it may be resized, which
+will allow the pool to return to normal operation.  Note that if a pool
+is flagged as needing repair, the pool's data and metadata devices
+cannot be resized until repair is performed.  It should also be noted
+that when the pool's metadata space is exhausted the current metadata
+transaction is aborted.  Given that the pool will cache IO whose
+completion may have already been acknowledged to upper IO layers
+(e.g. filesystem) it is strongly suggested that consistency checks
+(e.g. fsck) be performed on those layers when repair of the pool is
+required.
+
 Thin provisioning
 -----------------
 
@@ -258,10 +287,9 @@ ii) Status
         should register for the event and then check the target's status.
 
     held metadata root:
-        The location, in sectors, of the metadata root that has been
+        The location, in blocks, of the metadata root that has been
         'held' for userspace read access.  '-' indicates there is no
-        held root.  This feature is not yet implemented so '-' is
-        always returned.
+        held root.
 
     discard_passdown|no_discard_passdown
         Whether or not discards are actually being passed down to the
diff --git a/Documentation/devicetree/bindings/clock/renesas,cpg-mstp-clocks.txt b/Documentation/devicetree/bindings/clock/renesas,cpg-mstp-clocks.txt
index a6a352c2771e..5992dceec7af 100644
--- a/Documentation/devicetree/bindings/clock/renesas,cpg-mstp-clocks.txt
+++ b/Documentation/devicetree/bindings/clock/renesas,cpg-mstp-clocks.txt
@@ -21,9 +21,9 @@ Required Properties:
     must appear in the same order as the output clocks.
   - #clock-cells: Must be 1
   - clock-output-names: The name of the clocks as free-form strings
-  - renesas,indices: Indices of the gate clocks into the group (0 to 31)
+  - renesas,clock-indices: Indices of the gate clocks into the group (0 to 31)
 
-The clocks, clock-output-names and renesas,indices properties contain one
+The clocks, clock-output-names and renesas,clock-indices properties contain one
 entry per gate clock. The MSTP groups are sparsely populated. Unimplemented
 gate clocks must not be declared.
 
diff --git a/Documentation/devicetree/bindings/net/micrel-ks8851.txt b/Documentation/devicetree/bindings/net/micrel-ks8851.txt
index 11ace3c3d805..4fc392763611 100644
--- a/Documentation/devicetree/bindings/net/micrel-ks8851.txt
+++ b/Documentation/devicetree/bindings/net/micrel-ks8851.txt
@@ -7,3 +7,4 @@ Required properties:
 
 Optional properties:
 - local-mac-address : Ethernet mac address to use
+- vdd-supply:   supply for Ethernet mac
diff --git a/Documentation/devicetree/bindings/net/opencores-ethoc.txt b/Documentation/devicetree/bindings/net/opencores-ethoc.txt
new file mode 100644
index 000000000000..2dc127c30d9b
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/opencores-ethoc.txt
@@ -0,0 +1,22 @@
+* OpenCores MAC 10/100 Mbps
+
+Required properties:
+- compatible: Should be "opencores,ethoc".
+- reg: two memory regions (address and length),
+  first region is for the device registers and descriptor rings,
+  second is for the device packet memory.
+- interrupts: interrupt for the device.
+
+Optional properties:
+- clocks: phandle to refer to the clk used as per
+  Documentation/devicetree/bindings/clock/clock-bindings.txt
+
+Examples:
+
+        enet0: ethoc@fd030000 {
+                compatible = "opencores,ethoc";
+                reg = <0xfd030000 0x4000 0xfd800000 0x4000>;
+                interrupts = <1>;
+                local-mac-address = [00 50 c2 13 6f 00];
+                clocks = <&osc>;
+        };
diff --git a/Documentation/devicetree/bindings/pinctrl/brcm,capri-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/brcm,bcm11351-pinctrl.txt
index 9e9e9ef9f852..c119debe6bab 100644
--- a/Documentation/devicetree/bindings/pinctrl/brcm,capri-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/brcm,bcm11351-pinctrl.txt
@@ -1,4 +1,4 @@
-Broadcom Capri Pin Controller
+Broadcom BCM281xx Pin Controller
 
 This is a pin controller for the Broadcom BCM281xx SoC family, which includes
 BCM11130, BCM11140, BCM11351, BCM28145, and BCM28155 SoCs.
@@ -7,14 +7,14 @@ BCM11130, BCM11140, BCM11351, BCM28145, and BCM28155 SoCs.
 
 Required Properties:
 
-- compatible:   Must be "brcm,capri-pinctrl".
+- compatible:   Must be "brcm,bcm11351-pinctrl"
 - reg:          Base address of the PAD Controller register block and the size
                 of the block.
 
 For example, the following is the bare minimum node:
 
         pinctrl@35004800 {
-                compatible = "brcm,capri-pinctrl";
+                compatible = "brcm,bcm11351-pinctrl";
                 reg = <0x35004800 0x430>;
         };
 
@@ -119,7 +119,7 @@ Optional Properties (for HDMI pins):
 Example:
 // pin controller node
 pinctrl@35004800 {
-        compatible = "brcm,capri-pinctrl";
+        compatible = "brcmbcm11351-pinctrl";
         reg = <0x35004800 0x430>;
 
         // pin configuration node
diff --git a/Documentation/networking/can.txt b/Documentation/networking/can.txt
index f3089d423515..0cbe6ec22d6f 100644
--- a/Documentation/networking/can.txt
+++ b/Documentation/networking/can.txt
@@ -554,12 +554,6 @@ solution for a couple of reasons:
   not specified in the struct can_frame and therefore it is only valid in
   CANFD_MTU sized CAN FD frames.
 
-  As long as the payload length is <=8 the received CAN frames from CAN FD
-  capable CAN devices can be received and read by legacy sockets too. When
-  user-generated CAN FD frames have a payload length <=8 these can be send
-  by legacy CAN network interfaces too. Sending CAN FD frames with payload
-  length > 8 to a legacy CAN network interface returns an -EMSGSIZE error.
-
   Implementation hint for new CAN applications:
 
   To build a CAN FD aware application use struct canfd_frame as basic CAN
diff --git a/Documentation/networking/netlink_mmap.txt b/Documentation/networking/netlink_mmap.txt
index b26122973525..c6af4bac5aa8 100644
--- a/Documentation/networking/netlink_mmap.txt
+++ b/Documentation/networking/netlink_mmap.txt
@@ -226,9 +226,9 @@ Ring setup:
         void *rx_ring, *tx_ring;
 
         /* Configure ring parameters */
-        if (setsockopt(fd, NETLINK_RX_RING, &req, sizeof(req)) < 0)
+        if (setsockopt(fd, SOL_NETLINK, NETLINK_RX_RING, &req, sizeof(req)) < 0)
                 exit(1);
-        if (setsockopt(fd, NETLINK_TX_RING, &req, sizeof(req)) < 0)
+        if (setsockopt(fd, SOL_NETLINK, NETLINK_TX_RING, &req, sizeof(req)) < 0)
                 exit(1)
 
         /* Calculate size of each individual ring */
diff --git a/Documentation/networking/packet_mmap.txt b/Documentation/networking/packet_mmap.txt
index 1404674c0a02..6fea79efb4cb 100644
--- a/Documentation/networking/packet_mmap.txt
+++ b/Documentation/networking/packet_mmap.txt
@@ -453,7 +453,7 @@ TP_STATUS_COPY        : This flag indicates that the frame (and associated
                         enabled previously with setsockopt() and 
                         the PACKET_COPY_THRESH option. 
 
-                        The number of frames than can be buffered to 
+                        The number of frames that can be buffered to
                         be read with recvfrom is limited like a normal socket.
                         See the SO_RCVBUF option in the socket (7) man page.
 
diff --git a/Documentation/networking/timestamping.txt b/Documentation/networking/timestamping.txt
index 661d3c316a17..048c92b487f6 100644
--- a/Documentation/networking/timestamping.txt
+++ b/Documentation/networking/timestamping.txt
@@ -21,26 +21,38 @@ has such a feature).
 
 SO_TIMESTAMPING:
 
-Instructs the socket layer which kind of information is wanted. The
-parameter is an integer with some of the following bits set. Setting
-other bits is an error and doesn't change the current state.
-
-SOF_TIMESTAMPING_TX_HARDWARE:  try to obtain send time stamp in hardware
-SOF_TIMESTAMPING_TX_SOFTWARE:  if SOF_TIMESTAMPING_TX_HARDWARE is off or
-                               fails, then do it in software
-SOF_TIMESTAMPING_RX_HARDWARE:  return the original, unmodified time stamp
-                               as generated by the hardware
-SOF_TIMESTAMPING_RX_SOFTWARE:  if SOF_TIMESTAMPING_RX_HARDWARE is off or
-                               fails, then do it in software
-SOF_TIMESTAMPING_RAW_HARDWARE: return original raw hardware time stamp
-SOF_TIMESTAMPING_SYS_HARDWARE: return hardware time stamp transformed to
-                               the system time base
-SOF_TIMESTAMPING_SOFTWARE:     return system time stamp generated in
-                               software
-
-SOF_TIMESTAMPING_TX/RX determine how time stamps are generated.
-SOF_TIMESTAMPING_RAW/SYS determine how they are reported in the
-following control message:
+Instructs the socket layer which kind of information should be collected
+and/or reported.  The parameter is an integer with some of the following
+bits set. Setting other bits is an error and doesn't change the current
+state.
+
+Four of the bits are requests to the stack to try to generate
+timestamps.  Any combination of them is valid.
+
+SOF_TIMESTAMPING_TX_HARDWARE:  try to obtain send time stamps in hardware
+SOF_TIMESTAMPING_TX_SOFTWARE:  try to obtain send time stamps in software
+SOF_TIMESTAMPING_RX_HARDWARE:  try to obtain receive time stamps in hardware
+SOF_TIMESTAMPING_RX_SOFTWARE:  try to obtain receive time stamps in software
+
+The other three bits control which timestamps will be reported in a
+generated control message.  If none of these bits are set or if none of
+the set bits correspond to data that is available, then the control
+message will not be generated:
+
+SOF_TIMESTAMPING_SOFTWARE:     report systime if available
+SOF_TIMESTAMPING_SYS_HARDWARE: report hwtimetrans if available
+SOF_TIMESTAMPING_RAW_HARDWARE: report hwtimeraw if available
+
+It is worth noting that timestamps may be collected for reasons other
+than being requested by a particular socket with
+SOF_TIMESTAMPING_[TR]X_(HARD|SOFT)WARE.  For example, most drivers that
+can generate hardware receive timestamps ignore
+SOF_TIMESTAMPING_RX_HARDWARE.  It is still a good idea to set that flag
+in case future drivers pay attention.
+
+If timestamps are reported, they will appear in a control message with
+cmsg_level==SOL_SOCKET, cmsg_type==SO_TIMESTAMPING, and a payload like
+this:
 
 struct scm_timestamping {
         struct timespec systime;
diff --git a/MAINTAINERS b/MAINTAINERS
index c6d0e93eff62..82640e640f36 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -73,7 +73,8 @@ Descriptions of section entries:
         L: Mailing list that is relevant to this area
         W: Web-page with status/info
         Q: Patchwork web based patch tracking system site
-        T: SCM tree type and location.  Type is one of: git, hg, quilt, stgit, topgit.
+        T: SCM tree type and location.
+           Type is one of: git, hg, quilt, stgit, topgit
         S: Status, one of the following:
            Supported:   Someone is actually paid to look after this.
            Maintained:  Someone actually looks after it.
@@ -473,7 +474,7 @@ F:	net/rxrpc/af_rxrpc.c
 
 AGPGART DRIVER
 M:      David Airlie <airlied@linux.ie>
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6.git
+T:      git git://people.freedesktop.org/~airlied/linux (part of drm maint)
 S:      Maintained
 F:      drivers/char/agp/
 F:      include/linux/agp*
@@ -910,11 +911,11 @@ F:	arch/arm/include/asm/hardware/dec21285.h
 F:      arch/arm/mach-footbridge/
 
 ARM/FREESCALE IMX / MXC ARM ARCHITECTURE
-M:      Shawn Guo <shawn.guo@linaro.org>
+M:      Shawn Guo <shawn.guo@freescale.com>
 M:      Sascha Hauer <kernel@pengutronix.de>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-T:      git git://git.linaro.org/people/shawnguo/linux-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux.git
 F:      arch/arm/mach-imx/
 F:      arch/arm/boot/dts/imx*
 F:      arch/arm/configs/imx*_defconfig
@@ -1612,11 +1613,11 @@ S:	Maintained
 F:      drivers/net/wireless/atmel*
 
 ATTO EXPRESSSAS SAS/SATA RAID SCSI DRIVER
-M:      Bradley Grove <linuxdrivers@attotech.com>
-L:      linux-scsi@vger.kernel.org
-W:      http://www.attotech.com
-S:      Supported
-F:      drivers/scsi/esas2r
+M:      Bradley Grove <linuxdrivers@attotech.com>
+L:      linux-scsi@vger.kernel.org
+W:      http://www.attotech.com
+S:      Supported
+F:      drivers/scsi/esas2r
 
 AUDIT SUBSYSTEM
 M:      Eric Paris <eparis@redhat.com>
@@ -1737,6 +1738,7 @@ F:	include/uapi/linux/bfs_fs.h
 BLACKFIN ARCHITECTURE
 M:      Steven Miao <realmz6@gmail.com>
 L:      adi-buildroot-devel@lists.sourceforge.net
+T:      git git://git.code.sf.net/p/adi-linux/code
 W:      http://blackfin.uclinux.org
 S:      Supported
 F:      arch/blackfin/
@@ -2159,7 +2161,7 @@ F:	Documentation/zh_CN/
 
 CHIPIDEA USB HIGH SPEED DUAL ROLE CONTROLLER
 M:      Peter Chen <Peter.Chen@freescale.com>
-T:      git://github.com/hzpeterchen/linux-usb.git
+T:      git git://github.com/hzpeterchen/linux-usb.git
 L:      linux-usb@vger.kernel.org
 S:      Maintained
 F:      drivers/usb/chipidea/
@@ -2179,9 +2181,9 @@ S:	Supported
 F:      drivers/net/ethernet/cisco/enic/
 
 CISCO VIC LOW LATENCY NIC DRIVER
-M:      Upinder Malhi <umalhi@cisco.com>
-S:      Supported
-F:      drivers/infiniband/hw/usnic
+M:      Upinder Malhi <umalhi@cisco.com>
+S:      Supported
+F:      drivers/infiniband/hw/usnic
 
 CIRRUS LOGIC EP93XX ETHERNET DRIVER
 M:      Hartley Sweeten <hsweeten@visionengravers.com>
@@ -2378,20 +2380,20 @@ F:	drivers/cpufreq/arm_big_little.c
 F:      drivers/cpufreq/arm_big_little_dt.c
 
 CPUIDLE DRIVER - ARM BIG LITTLE
-M:      Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
-M:      Daniel Lezcano <daniel.lezcano@linaro.org>
-L:      linux-pm@vger.kernel.org
-L:      linux-arm-kernel@lists.infradead.org
-T:      git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git
-S:      Maintained
-F:      drivers/cpuidle/cpuidle-big_little.c
+M:      Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+M:      Daniel Lezcano <daniel.lezcano@linaro.org>
+L:      linux-pm@vger.kernel.org
+L:      linux-arm-kernel@lists.infradead.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git
+S:      Maintained
+F:      drivers/cpuidle/cpuidle-big_little.c
 
 CPUIDLE DRIVERS
 M:      Rafael J. Wysocki <rjw@rjwysocki.net>
 M:      Daniel Lezcano <daniel.lezcano@linaro.org>
 L:      linux-pm@vger.kernel.org
 S:      Maintained
-T:      git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git
 F:      drivers/cpuidle/*
 F:      include/linux/cpuidle.h
 
@@ -2458,9 +2460,9 @@ S:	Maintained
 F:      sound/pci/cs5535audio/
 
 CW1200 WLAN driver
-M:     Solomon Peachy <pizza@shaftnet.org>
-S:     Maintained
-F:     drivers/net/wireless/cw1200/
+M:      Solomon Peachy <pizza@shaftnet.org>
+S:      Maintained
+F:      drivers/net/wireless/cw1200/
 
 CX18 VIDEO4LINUX DRIVER
 M:      Andy Walls <awalls@md.metrocast.net>
@@ -3095,6 +3097,8 @@ F:	fs/ecryptfs/
 
 EDAC-CORE
 M:      Doug Thompson <dougthompson@xmission.com>
+M:      Borislav Petkov <bp@alien8.de>
+M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
 L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Supported
@@ -4541,6 +4545,7 @@ M:	Greg Rose <gregory.v.rose@intel.com>
 M:      Alex Duyck <alexander.h.duyck@intel.com>
 M:      John Ronciak <john.ronciak@intel.com>
 M:      Mitch Williams <mitch.a.williams@intel.com>
+M:      Linux NICS <linux.nics@intel.com>
 L:      e1000-devel@lists.sourceforge.net
 W:      http://www.intel.com/support/feedback.htm
 W:      http://e1000.sourceforge.net/
@@ -4558,6 +4563,7 @@ F:	Documentation/networking/ixgbevf.txt
 F:      Documentation/networking/i40e.txt
 F:      Documentation/networking/i40evf.txt
 F:      drivers/net/ethernet/intel/
+F:      drivers/net/ethernet/intel/*/
 
 INTEL-MID GPIO DRIVER
 M:      David Cohen <david.a.cohen@linux.intel.com>
@@ -4914,7 +4920,7 @@ F:	drivers/staging/ktap/
 KCONFIG
 M:      "Yann E. MORIN" <yann.morin.1998@free.fr>
 L:      linux-kbuild@vger.kernel.org
-T:      git://gitorious.org/linux-kconfig/linux-kconfig
+T:      git git://gitorious.org/linux-kconfig/linux-kconfig
 S:      Maintained
 F:      Documentation/kbuild/kconfig-language.txt
 F:      scripts/kconfig/
@@ -5471,11 +5477,11 @@ S:	Maintained
 F:      drivers/media/tuners/m88ts2022*
 
 MA901 MASTERKIT USB FM RADIO DRIVER
-M:      Alexey Klimov <klimov.linux@gmail.com>
-L:      linux-media@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
-S:      Maintained
-F:      drivers/media/radio/radio-ma901.c
+M:      Alexey Klimov <klimov.linux@gmail.com>
+L:      linux-media@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+S:      Maintained
+F:      drivers/media/radio/radio-ma901.c
 
 MAC80211
 M:      Johannes Berg <johannes@sipsolutions.net>
@@ -5636,7 +5642,7 @@ F:	drivers/scsi/megaraid/
 
 MELLANOX ETHERNET DRIVER (mlx4_en)
 M:      Amir Vadai <amirv@mellanox.com>
-L:      netdev@vger.kernel.org
+L:      netdev@vger.kernel.org
 S:      Supported
 W:      http://www.mellanox.com
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
@@ -5677,7 +5683,7 @@ F:	include/linux/mtd/
 F:      include/uapi/mtd/
 
 MEN A21 WATCHDOG DRIVER
-M:      Johannes Thumshirn <johannes.thumshirn@men.de>
+M:      Johannes Thumshirn <johannes.thumshirn@men.de>
 L:      linux-watchdog@vger.kernel.org
 S:      Supported
 F:      drivers/watchdog/mena21_wdt.c
@@ -5733,20 +5739,20 @@ L:	linux-rdma@vger.kernel.org
 W:      http://www.mellanox.com
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
 Q:      http://patchwork.kernel.org/project/linux-rdma/list/
-T:      git://openfabrics.org/~eli/connect-ib.git
+T:      git git://openfabrics.org/~eli/connect-ib.git
 S:      Supported
 F:      drivers/net/ethernet/mellanox/mlx5/core/
 F:      include/linux/mlx5/
 
 Mellanox MLX5 IB driver
-M:      Eli Cohen <eli@mellanox.com>
-L:      linux-rdma@vger.kernel.org
-W:      http://www.mellanox.com
-Q:      http://patchwork.kernel.org/project/linux-rdma/list/
-T:      git://openfabrics.org/~eli/connect-ib.git
-S:      Supported
-F:      include/linux/mlx5/
-F:      drivers/infiniband/hw/mlx5/
+M:      Eli Cohen <eli@mellanox.com>
+L:      linux-rdma@vger.kernel.org
+W:      http://www.mellanox.com
+Q:      http://patchwork.kernel.org/project/linux-rdma/list/
+T:      git git://openfabrics.org/~eli/connect-ib.git
+S:      Supported
+F:      include/linux/mlx5/
+F:      drivers/infiniband/hw/mlx5/
 
 MODULE SUPPORT
 M:      Rusty Russell <rusty@rustcorp.com.au>
@@ -5998,6 +6004,8 @@ F:	include/linux/netdevice.h
 F:      include/uapi/linux/in.h
 F:      include/uapi/linux/net.h
 F:      include/uapi/linux/netdevice.h
+F:      tools/net/
+F:      tools/testing/selftests/net/
 
 NETWORKING [IPv4/IPv6]
 M:      "David S. Miller" <davem@davemloft.net>
@@ -6171,6 +6179,12 @@ S:	Supported
 F:      drivers/block/nvme*
 F:      include/linux/nvme.h
 
+NXP TDA998X DRM DRIVER
+M:      Russell King <rmk+kernel@arm.linux.org.uk>
+S:      Supported
+F:      drivers/gpu/drm/i2c/tda998x_drv.c
+F:      include/drm/i2c/tda998x.h
+
 OMAP SUPPORT
 M:      Tony Lindgren <tony@atomide.com>
 L:      linux-omap@vger.kernel.org
@@ -8700,17 +8714,17 @@ S:	Maintained
 F:      drivers/media/radio/radio-raremono.c
 
 THERMAL
-M:      Zhang Rui <rui.zhang@intel.com>
-M:      Eduardo Valentin <eduardo.valentin@ti.com>
-L:      linux-pm@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux.git
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal.git
-Q:      https://patchwork.kernel.org/project/linux-pm/list/
-S:      Supported
-F:      drivers/thermal/
-F:      include/linux/thermal.h
-F:      include/linux/cpu_cooling.h
-F:      Documentation/devicetree/bindings/thermal/
+M:      Zhang Rui <rui.zhang@intel.com>
+M:      Eduardo Valentin <eduardo.valentin@ti.com>
+L:      linux-pm@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal.git
+Q:      https://patchwork.kernel.org/project/linux-pm/list/
+S:      Supported
+F:      drivers/thermal/
+F:      include/linux/thermal.h
+F:      include/linux/cpu_cooling.h
+F:      Documentation/devicetree/bindings/thermal/
 
 THINGM BLINK(1) USB RGB LED DRIVER
 M:      Vivien Didelot <vivien.didelot@savoirfairelinux.com>
@@ -9812,7 +9826,7 @@ ZR36067 VIDEO FOR LINUX DRIVER
 L:      mjpeg-users@lists.sourceforge.net
 L:      linux-media@vger.kernel.org
 W:      http://mjpeg.sourceforge.net/driver-zoran/
-T:      Mercurial http://linuxtv.org/hg/v4l-dvb
+T:      hg http://linuxtv.org/hg/v4l-dvb
 S:      Odd Fixes
 F:      drivers/media/pci/zoran/
 
diff --git a/Makefile b/Makefile
index 78209ee1f981..c10b734339db 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 14
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc8
 NAME = Shuffling Zombie Juror
 
 # *DOCUMENTATION*
diff --git a/arch/arc/mm/cache_arc700.c b/arch/arc/mm/cache_arc700.c
index 6b58c1de7577..400c663b21c2 100644
--- a/arch/arc/mm/cache_arc700.c
+++ b/arch/arc/mm/cache_arc700.c
@@ -282,7 +282,7 @@ static inline void __cache_line_loop(unsigned long paddr, unsigned long vaddr,
 #else
         /* if V-P const for loop, PTAG can be written once outside loop */
         if (full_page_op)
-                write_aux_reg(ARC_REG_DC_PTAG, paddr);
+                write_aux_reg(aux_tag, paddr);
 #endif
 
         while (num_lines-- > 0) {
@@ -296,7 +296,7 @@ static inline void __cache_line_loop(unsigned long paddr, unsigned long vaddr,
                 write_aux_reg(aux_cmd, vaddr);
                 vaddr += L1_CACHE_BYTES;
 #else
-                write_aux_reg(aux, paddr);
+                write_aux_reg(aux_cmd, paddr);
                 paddr += L1_CACHE_BYTES;
 #endif
         }
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index e25419817791..15949459611f 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1578,6 +1578,7 @@ config BL_SWITCHER_DUMMY_IF
 
 choice
         prompt "Memory split"
+        depends on MMU
         default VMSPLIT_3G
         help
           Select the desired split between kernel and user memory.
@@ -1595,6 +1596,7 @@ endchoice
 
 config PAGE_OFFSET
         hex
+        default PHYS_OFFSET if !MMU
         default 0x40000000 if VMSPLIT_1G
         default 0x80000000 if VMSPLIT_2G
         default 0xC0000000
@@ -1903,6 +1905,7 @@ config XEN
         depends on ARM && AEABI && OF
         depends on CPU_V7 && !CPU_V6
         depends on !GENERIC_ATOMIC64
+        depends on MMU
         select ARM_PSCI
         select SWIOTLB_XEN
         select ARCH_DMA_ADDR_T_64BIT
diff --git a/arch/arm/boot/compressed/.gitignore b/arch/arm/boot/compressed/.gitignore
index 47279aa96a6a..0714e0334e33 100644
--- a/arch/arm/boot/compressed/.gitignore
+++ b/arch/arm/boot/compressed/.gitignore
@@ -1,4 +1,5 @@
 ashldi3.S
+bswapsdi2.S
 font.c
 lib1funcs.S
 hyp-stub.S
diff --git a/arch/arm/boot/dts/bcm11351.dtsi b/arch/arm/boot/dts/bcm11351.dtsi
index e491b82f8d67..792fde1b7f75 100644
--- a/arch/arm/boot/dts/bcm11351.dtsi
+++ b/arch/arm/boot/dts/bcm11351.dtsi
@@ -147,7 +147,7 @@
         };
 
         pinctrl@35004800 {
-                compatible = "brcm,capri-pinctrl";
+                compatible = "brcm,bcm11351-pinctrl";
                 reg = <0x35004800 0x430>;
         };
 
diff --git a/arch/arm/boot/dts/keystone-clocks.dtsi b/arch/arm/boot/dts/keystone-clocks.dtsi
index 2363593e1050..ef58d1c24313 100644
--- a/arch/arm/boot/dts/keystone-clocks.dtsi
+++ b/arch/arm/boot/dts/keystone-clocks.dtsi
@@ -612,7 +612,7 @@ clocks {
                 compatible = "ti,keystone,psc-clock";
                 clocks = <&chipclk13>;
                 clock-output-names = "vcp-3";
-                reg = <0x0235000a8 0xb00>, <0x02350060 0x400>;
+                reg = <0x023500a8 0xb00>, <0x02350060 0x400>;
                 reg-names = "control", "domain";
                 domain-id = <24>;
         };
diff --git a/arch/arm/boot/dts/omap3-gta04.dts b/arch/arm/boot/dts/omap3-gta04.dts
index c551e4af4d83..d3b253bbc885 100644
--- a/arch/arm/boot/dts/omap3-gta04.dts
+++ b/arch/arm/boot/dts/omap3-gta04.dts
@@ -13,7 +13,7 @@
 
 / {
         model = "OMAP3 GTA04";
-        compatible = "ti,omap3-gta04", "ti,omap3";
+        compatible = "ti,omap3-gta04", "ti,omap36xx", "ti,omap3";
 
         cpus {
                 cpu@0 {
diff --git a/arch/arm/boot/dts/omap3-igep0020.dts b/arch/arm/boot/dts/omap3-igep0020.dts
index 25a2b5f652fd..f2779ac75872 100644
--- a/arch/arm/boot/dts/omap3-igep0020.dts
+++ b/arch/arm/boot/dts/omap3-igep0020.dts
@@ -14,7 +14,7 @@
 
 / {
         model = "IGEPv2 (TI OMAP AM/DM37x)";
-        compatible = "isee,omap3-igep0020", "ti,omap3";
+        compatible = "isee,omap3-igep0020", "ti,omap36xx", "ti,omap3";
 
         leds {
                 pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/omap3-igep0030.dts b/arch/arm/boot/dts/omap3-igep0030.dts
index 145c58cfc8ac..2793749eb1ba 100644
--- a/arch/arm/boot/dts/omap3-igep0030.dts
+++ b/arch/arm/boot/dts/omap3-igep0030.dts
@@ -13,7 +13,7 @@
 
 / {
         model = "IGEP COM MODULE (TI OMAP AM/DM37x)";
-        compatible = "isee,omap3-igep0030", "ti,omap3";
+        compatible = "isee,omap3-igep0030", "ti,omap36xx", "ti,omap3";
 
         leds {
                 pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sama5d36.dtsi b/arch/arm/boot/dts/sama5d36.dtsi
index 6c31c26e6cc0..db58cad6acd3 100644
--- a/arch/arm/boot/dts/sama5d36.dtsi
+++ b/arch/arm/boot/dts/sama5d36.dtsi
@@ -8,8 +8,8 @@
  */
 #include "sama5d3.dtsi"
 #include "sama5d3_can.dtsi"
-#include "sama5d3_emac.dtsi"
 #include "sama5d3_gmac.dtsi"
+#include "sama5d3_emac.dtsi"
 #include "sama5d3_lcd.dtsi"
 #include "sama5d3_mci2.dtsi"
 #include "sama5d3_tcb1.dtsi"
diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
index 10666ca8aee1..d4d2763f4794 100644
--- a/arch/arm/boot/dts/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/sun4i-a10.dtsi
@@ -426,7 +426,7 @@
                 };
 
                 rtp: rtp@01c25000 {
-                        compatible = "allwinner,sun4i-ts";
+                        compatible = "allwinner,sun4i-a10-ts";
                         reg = <0x01c25000 0x100>;
                         interrupts = <29>;
                 };
diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
index 64961595e8d6..79fd412005b0 100644
--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
+++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
@@ -383,7 +383,7 @@
                 };
 
                 rtp: rtp@01c25000 {
-                        compatible = "allwinner,sun4i-ts";
+                        compatible = "allwinner,sun4i-a10-ts";
                         reg = <0x01c25000 0x100>;
                         interrupts = <29>;
                 };
diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
index 320335abfccd..c463fd730c91 100644
--- a/arch/arm/boot/dts/sun5i-a13.dtsi
+++ b/arch/arm/boot/dts/sun5i-a13.dtsi
@@ -346,7 +346,7 @@
                 };
 
                 rtp: rtp@01c25000 {
-                        compatible = "allwinner,sun4i-ts";
+                        compatible = "allwinner,sun4i-a10-ts";
                         reg = <0x01c25000 0x100>;
                         interrupts = <29>;
                 };
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index 9ff09484847b..6f25cf559ad0 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -454,7 +454,7 @@
                 rtc: rtc@01c20d00 {
                         compatible = "allwinner,sun7i-a20-rtc";
                         reg = <0x01c20d00 0x20>;
-                        interrupts = <0 24 1>;
+                        interrupts = <0 24 4>;
                 };
 
                 sid: eeprom@01c23800 {
@@ -463,7 +463,7 @@
                 };
 
                 rtp: rtp@01c25000 {
-                        compatible = "allwinner,sun4i-ts";
+                        compatible = "allwinner,sun4i-a10-ts";
                         reg = <0x01c25000 0x100>;
                         interrupts = <0 29 4>;
                 };
@@ -596,10 +596,10 @@
                 hstimer@01c60000 {
                         compatible = "allwinner,sun7i-a20-hstimer";
                         reg = <0x01c60000 0x1000>;
-                        interrupts = <0 81 1>,
-                                     <0 82 1>,
-                                     <0 83 1>,
-                                     <0 84 1>;
+                        interrupts = <0 81 4>,
+                                     <0 82 4>,
+                                     <0 83 4>,
+                                     <0 84 4>;
                         clocks = <&ahb_gates 28>;
                 };
 
diff --git a/arch/arm/configs/tegra_defconfig b/arch/arm/configs/tegra_defconfig
index 00fe9e9710fd..27d69b558c5d 100644
--- a/arch/arm/configs/tegra_defconfig
+++ b/arch/arm/configs/tegra_defconfig
@@ -204,7 +204,10 @@ CONFIG_MMC_BLOCK_MINORS=16
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_SDHCI_TEGRA=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_ONESHOT=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index 8756e4bcdba0..4afb376d9c7c 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -30,14 +30,15 @@
  */
 #define UL(x) _AC(x, UL)
 
+/* PAGE_OFFSET - the virtual address of the start of the kernel image */
+#define PAGE_OFFSET             UL(CONFIG_PAGE_OFFSET)
+
 #ifdef CONFIG_MMU
 
 /*
- * PAGE_OFFSET - the virtual address of the start of the kernel image
  * TASK_SIZE - the maximum size of a user space task.
  * TASK_UNMAPPED_BASE - the lower boundary of the mmap VM area
  */
-#define PAGE_OFFSET             UL(CONFIG_PAGE_OFFSET)
 #define TASK_SIZE               (UL(CONFIG_PAGE_OFFSET) - UL(SZ_16M))
 #define TASK_UNMAPPED_BASE      ALIGN(TASK_SIZE / 3, SZ_16M)
 
@@ -104,10 +105,6 @@
 #define END_MEM                 (UL(CONFIG_DRAM_BASE) + CONFIG_DRAM_SIZE)
 #endif
 
-#ifndef PAGE_OFFSET
-#define PAGE_OFFSET             PLAT_PHYS_OFFSET
-#endif
-
 /*
  * The module can be at any place in ram in nommu mode.
  */
diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S
index 47cd974e57ea..c96ecacb2021 100644
--- a/arch/arm/kernel/head-common.S
+++ b/arch/arm/kernel/head-common.S
@@ -177,6 +177,18 @@ __lookup_processor_type_data:
         .long   __proc_info_end
         .size   __lookup_processor_type_data, . - __lookup_processor_type_data
 
+__error_lpae:
+#ifdef CONFIG_DEBUG_LL
+        adr     r0, str_lpae
+        bl      printascii
+        b       __error
+str_lpae: .asciz "\nError: Kernel with LPAE support, but CPU does not support LPAE.\n"
+#else
+        b       __error
+#endif
+        .align
+ENDPROC(__error_lpae)
+
 __error_p:
 #ifdef CONFIG_DEBUG_LL
         adr     r0, str_p1
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 914616e0bdcd..f5f381d91556 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -102,7 +102,7 @@ ENTRY(stext)
         and     r3, r3, #0xf                    @ extract VMSA support
         cmp     r3, #5                          @ long-descriptor translation table format?
  THUMB( it      lo )                            @ force fixup-able long branch encoding
-        blo     __error_p                       @ only classic page table format
+        blo     __error_lpae                    @ only classic page table format
 #endif
 
 #ifndef CONFIG_XIP_KERNEL
diff --git a/arch/arm/mach-omap2/cclock3xxx_data.c b/arch/arm/mach-omap2/cclock3xxx_data.c
index 3b05aea56d1f..11ed9152e665 100644
--- a/arch/arm/mach-omap2/cclock3xxx_data.c
+++ b/arch/arm/mach-omap2/cclock3xxx_data.c
@@ -433,7 +433,9 @@ static const struct clk_ops dpll4_m5x2_ck_ops = {
         .enable         = &omap2_dflt_clk_enable,
         .disable        = &omap2_dflt_clk_disable,
         .is_enabled     = &omap2_dflt_clk_is_enabled,
+        .set_rate       = &omap3_clkoutx2_set_rate,
         .recalc_rate    = &omap3_clkoutx2_recalc,
+        .round_rate     = &omap3_clkoutx2_round_rate,
 };
 
 static const struct clk_ops dpll4_m5x2_ck_3630_ops = {
diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
index 4c158c838d40..01fc710c8181 100644
--- a/arch/arm/mach-omap2/cpuidle44xx.c
+++ b/arch/arm/mach-omap2/cpuidle44xx.c
@@ -23,6 +23,8 @@
 #include "prm.h"
 #include "clockdomain.h"
 
+#define MAX_CPUS        2
+
 /* Machine specific information */
 struct idle_statedata {
         u32 cpu_state;
@@ -48,11 +50,11 @@ static struct idle_statedata omap4_idle_data[] = {
         },
 };
 
-static struct powerdomain *mpu_pd, *cpu_pd[NR_CPUS];
-static struct clockdomain *cpu_clkdm[NR_CPUS];
+static struct powerdomain *mpu_pd, *cpu_pd[MAX_CPUS];
+static struct clockdomain *cpu_clkdm[MAX_CPUS];
 
 static atomic_t abort_barrier;
-static bool cpu_done[NR_CPUS];
+static bool cpu_done[MAX_CPUS];
 static struct idle_statedata *state_ptr = &omap4_idle_data[0];
 
 /* Private functions */
diff --git a/arch/arm/mach-omap2/dpll3xxx.c b/arch/arm/mach-omap2/dpll3xxx.c
index 3185ced807c9..3c418ea54bbe 100644
--- a/arch/arm/mach-omap2/dpll3xxx.c
+++ b/arch/arm/mach-omap2/dpll3xxx.c
@@ -623,6 +623,32 @@ void omap3_dpll_deny_idle(struct clk_hw_omap *clk)
 
 /* Clock control for DPLL outputs */
 
+/* Find the parent DPLL for the given clkoutx2 clock */
+static struct clk_hw_omap *omap3_find_clkoutx2_dpll(struct clk_hw *hw)
+{
+        struct clk_hw_omap *pclk = NULL;
+        struct clk *parent;
+
+        /* Walk up the parents of clk, looking for a DPLL */
+        do {
+                do {
+                        parent = __clk_get_parent(hw->clk);
+                        hw = __clk_get_hw(parent);
+                } while (hw && (__clk_get_flags(hw->clk) & CLK_IS_BASIC));
+                if (!hw)
+                        break;
+                pclk = to_clk_hw_omap(hw);
+        } while (pclk && !pclk->dpll_data);
+
+        /* clk does not have a DPLL as a parent?  error in the clock data */
+        if (!pclk) {
+                WARN_ON(1);
+                return NULL;
+        }
+
+        return pclk;
+}
+
 /**
  * omap3_clkoutx2_recalc - recalculate DPLL X2 output virtual clock rate
  * @clk: DPLL output struct clk
@@ -637,27 +663,14 @@ unsigned long omap3_clkoutx2_recalc(struct clk_hw *hw,
         unsigned long rate;
         u32 v;
         struct clk_hw_omap *pclk = NULL;
-        struct clk *parent;
 
         if (!parent_rate)
                 return 0;
 
-        /* Walk up the parents of clk, looking for a DPLL */
-        do {
-                do {
-                        parent = __clk_get_parent(hw->clk);
-                        hw = __clk_get_hw(parent);
-                } while (hw && (__clk_get_flags(hw->clk) & CLK_IS_BASIC));
-                if (!hw)
-                        break;
-                pclk = to_clk_hw_omap(hw);
-        } while (pclk && !pclk->dpll_data);
+        pclk = omap3_find_clkoutx2_dpll(hw);
 
-        /* clk does not have a DPLL as a parent?  error in the clock data */
-        if (!pclk) {
-                WARN_ON(1);
+        if (!pclk)
                 return 0;
-        }
 
         dd = pclk->dpll_data;
 
@@ -672,6 +685,55 @@ unsigned long omap3_clkoutx2_recalc(struct clk_hw *hw,
         return rate;
 }
 
+int omap3_clkoutx2_set_rate(struct clk_hw *hw, unsigned long rate,
+                                        unsigned long parent_rate)
+{
+        return 0;
+}
+
+long omap3_clkoutx2_round_rate(struct clk_hw *hw, unsigned long rate,
+                unsigned long *prate)
+{
+        const struct dpll_data *dd;
+        u32 v;
+        struct clk_hw_omap *pclk = NULL;
+
+        if (!*prate)
+                return 0;
+
+        pclk = omap3_find_clkoutx2_dpll(hw);
+
+        if (!pclk)
+                return 0;
+
+        dd = pclk->dpll_data;
+
+        /* TYPE J does not have a clkoutx2 */
+        if (dd->flags & DPLL_J_TYPE) {
+                *prate = __clk_round_rate(__clk_get_parent(pclk->hw.clk), rate);
+                return *prate;
+        }
+
+        WARN_ON(!dd->enable_mask);
+
+        v = omap2_clk_readl(pclk, dd->control_reg) & dd->enable_mask;
+        v >>= __ffs(dd->enable_mask);
+
+        /* If in bypass, the rate is fixed to the bypass rate*/
+        if (v != OMAP3XXX_EN_DPLL_LOCKED)
+                return *prate;
+
+        if (__clk_get_flags(hw->clk) & CLK_SET_RATE_PARENT) {
+                unsigned long best_parent;
+
+                best_parent = (rate / 2);
+                *prate = __clk_round_rate(__clk_get_parent(hw->clk),
+                                best_parent);
+        }
+
+        return *prate * 2;
+}
+
 /* OMAP3/4 non-CORE DPLL clkops */
 const struct clk_hw_omap_ops clkhwops_omap3_dpll = {
         .allow_idle     = omap3_dpll_allow_idle,
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 42d81885c700..1f33f5db10d5 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1947,29 +1947,31 @@ static int _ocp_softreset(struct omap_hwmod *oh)
                 goto dis_opt_clks;
 
         _write_sysconfig(v, oh);
-        ret = _clear_softreset(oh, &v);
-        if (ret)
-                goto dis_opt_clks;
-
-        _write_sysconfig(v, oh);
 
         if (oh->class->sysc->srst_udelay)
                 udelay(oh->class->sysc->srst_udelay);
 
         c = _wait_softreset_complete(oh);
-        if (c == MAX_MODULE_SOFTRESET_WAIT)
+        if (c == MAX_MODULE_SOFTRESET_WAIT) {
                 pr_warning("omap_hwmod: %s: softreset failed (waited %d usec)\n",
                            oh->name, MAX_MODULE_SOFTRESET_WAIT);
-        else
+                ret = -ETIMEDOUT;
+                goto dis_opt_clks;
+        } else {
                 pr_debug("omap_hwmod: %s: softreset in %d usec\n", oh->name, c);
+        }
+
+        ret = _clear_softreset(oh, &v);
+        if (ret)
+                goto dis_opt_clks;
+
+        _write_sysconfig(v, oh);
 
         /*
          * XXX add _HWMOD_STATE_WEDGED for modules that don't come back from
          * _wait_target_ready() or _reset()
          */
 
-        ret = (c == MAX_MODULE_SOFTRESET_WAIT) ? -ETIMEDOUT : 0;
-
 dis_opt_clks:
         if (oh->flags & HWMOD_CONTROL_OPT_CLKS_IN_RESET)
                 _disable_optional_clocks(oh);
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index 18f333c440db..810c205d668b 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -1365,11 +1365,10 @@ static struct omap_hwmod_class_sysconfig dra7xx_spinlock_sysc = {
         .rev_offs       = 0x0000,
         .sysc_offs      = 0x0010,
         .syss_offs      = 0x0014,
-        .sysc_flags     = (SYSC_HAS_AUTOIDLE | SYSC_HAS_CLOCKACTIVITY |
-                           SYSC_HAS_ENAWAKEUP | SYSC_HAS_SIDLEMODE |
-                           SYSC_HAS_SOFTRESET | SYSS_HAS_RESET_STATUS),
-        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
-                           SIDLE_SMART_WKUP),
+        .sysc_flags     = (SYSC_HAS_AUTOIDLE | SYSC_HAS_ENAWAKEUP |
+                           SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET |
+                           SYSS_HAS_RESET_STATUS),
+        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
         .sysc_fields    = &omap_hwmod_sysc_type1,
 };
 
diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
index 3d5b24dcd9a4..c33e07e2f0d4 100644
--- a/arch/arm/mach-omap2/pdata-quirks.c
+++ b/arch/arm/mach-omap2/pdata-quirks.c
@@ -22,6 +22,8 @@
 #include "common-board-devices.h"
 #include "dss-common.h"
 #include "control.h"
+#include "omap-secure.h"
+#include "soc.h"
 
 struct pdata_init {
         const char *compatible;
@@ -169,6 +171,22 @@ static void __init am3517_evm_legacy_init(void)
         omap_ctrl_writel(v, AM35XX_CONTROL_IP_SW_RESET);
         omap_ctrl_readl(AM35XX_CONTROL_IP_SW_RESET); /* OCP barrier */
 }
+
+static void __init nokia_n900_legacy_init(void)
+{
+        hsmmc2_internal_input_clk();
+
+        if (omap_type() == OMAP2_DEVICE_TYPE_SEC) {
+                if (IS_ENABLED(CONFIG_ARM_ERRATA_430973)) {
+                        pr_info("RX-51: Enabling ARM errata 430973 workaround\n");
+                        /* set IBE to 1 */
+                        rx51_secure_update_aux_cr(BIT(6), 0);
+                } else {
+                        pr_warning("RX-51: Not enabling ARM errata 430973 workaround\n");
+                        pr_warning("Thumb binaries may crash randomly without this workaround\n");
+                }
+        }
+}
 #endif /* CONFIG_ARCH_OMAP3 */
 
 #ifdef CONFIG_ARCH_OMAP4
@@ -239,6 +257,7 @@ struct of_dev_auxdata omap_auxdata_lookup[] __initdata = {
 #endif
 #ifdef CONFIG_ARCH_OMAP3
         OF_DEV_AUXDATA("ti,omap3-padconf", 0x48002030, "48002030.pinmux", &pcs_pdata),
+        OF_DEV_AUXDATA("ti,omap3-padconf", 0x480025a0, "480025a0.pinmux", &pcs_pdata),
         OF_DEV_AUXDATA("ti,omap3-padconf", 0x48002a00, "48002a00.pinmux", &pcs_pdata),
         /* Only on am3517 */
         OF_DEV_AUXDATA("ti,davinci_mdio", 0x5c030000, "davinci_mdio.0", NULL),
@@ -259,7 +278,7 @@ struct of_dev_auxdata omap_auxdata_lookup[] __initdata = {
 static struct pdata_init pdata_quirks[] __initdata = {
 #ifdef CONFIG_ARCH_OMAP3
         { "compulab,omap3-sbc-t3730", omap3_sbc_t3730_legacy_init, },
-        { "nokia,omap3-n900", hsmmc2_internal_input_clk, },
+        { "nokia,omap3-n900", nokia_n900_legacy_init, },
         { "nokia,omap3-n9", hsmmc2_internal_input_clk, },
         { "nokia,omap3-n950", hsmmc2_internal_input_clk, },
         { "isee,omap3-igep0020", omap3_igep0020_legacy_init, },
diff --git a/arch/arm/mach-omap2/prminst44xx.c b/arch/arm/mach-omap2/prminst44xx.c
index 6334b96b4097..280f3c58abe5 100644
--- a/arch/arm/mach-omap2/prminst44xx.c
+++ b/arch/arm/mach-omap2/prminst44xx.c
@@ -183,11 +183,11 @@ void omap4_prminst_global_warm_sw_reset(void)
                                         OMAP4_PRM_RSTCTRL_OFFSET);
         v |= OMAP4430_RST_GLOBAL_WARM_SW_MASK;
         omap4_prminst_write_inst_reg(v, OMAP4430_PRM_PARTITION,
-                                 OMAP4430_PRM_DEVICE_INST,
+                                 dev_inst,
                                  OMAP4_PRM_RSTCTRL_OFFSET);
 
         /* OCP barrier */
         v = omap4_prminst_read_inst_reg(OMAP4430_PRM_PARTITION,
-                                    OMAP4430_PRM_DEVICE_INST,
+                                    dev_inst,
                                     OMAP4_PRM_RSTCTRL_OFFSET);
 }
diff --git a/arch/arm/mach-sa1100/include/mach/collie.h b/arch/arm/mach-sa1100/include/mach/collie.h
index f33679d2d3ee..50e1d850ee2e 100644
--- a/arch/arm/mach-sa1100/include/mach/collie.h
+++ b/arch/arm/mach-sa1100/include/mach/collie.h
@@ -13,6 +13,8 @@
 #ifndef __ASM_ARCH_COLLIE_H
 #define __ASM_ARCH_COLLIE_H
 
+#include "hardware.h" /* Gives GPIO_MAX */
+
 extern void locomolcd_power(int on);
 
 #define COLLIE_SCOOP_GPIO_BASE  (GPIO_MAX + 1)
diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c
index 2b3a56414271..ef69152f9b52 100644
--- a/arch/arm/mm/dump.c
+++ b/arch/arm/mm/dump.c
@@ -264,6 +264,9 @@ static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
                         note_page(st, addr, 3, pmd_val(*pmd));
                 else
                         walk_pte(st, pmd, addr);
+
+                if (SECTION_SIZE < PMD_SIZE && pmd_large(pmd[1]))
+                        note_page(st, addr + SECTION_SIZE, 3, pmd_val(pmd[1]));
         }
 }
 
diff --git a/arch/c6x/include/asm/cache.h b/arch/c6x/include/asm/cache.h
index 09c5a0f5f4d1..86648c083bb4 100644
--- a/arch/c6x/include/asm/cache.h
+++ b/arch/c6x/include/asm/cache.h
@@ -12,6 +12,7 @@
 #define _ASM_C6X_CACHE_H
 
 #include <linux/irqflags.h>
+#include <linux/init.h>
 
 /*
  * Cache line size
diff --git a/arch/cris/include/asm/bitops.h b/arch/cris/include/asm/bitops.h
index 184066ceb1f6..053c17b36559 100644
--- a/arch/cris/include/asm/bitops.h
+++ b/arch/cris/include/asm/bitops.h
@@ -144,7 +144,7 @@ static inline int test_and_change_bit(int nr, volatile unsigned long *addr)
  * definition, which doesn't have the same semantics.  We don't want to
  * use -fno-builtin, so just hide the name ffs.
  */
-#define ffs kernel_ffs
+#define ffs(x) kernel_ffs(x)
 
 #include <asm-generic/bitops/fls.h>
 #include <asm-generic/bitops/__fls.h>
diff --git a/arch/ia64/kernel/uncached.c b/arch/ia64/kernel/uncached.c
index a96bcf83a735..20e8a9b21d75 100644
--- a/arch/ia64/kernel/uncached.c
+++ b/arch/ia64/kernel/uncached.c
@@ -98,7 +98,7 @@ static int uncached_add_chunk(struct uncached_pool *uc_pool, int nid)
         /* attempt to allocate a granule's worth of cached memory pages */
 
         page = alloc_pages_exact_node(nid,
-                                GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                 IA64_GRANULE_SHIFT-PAGE_SHIFT);
         if (!page) {
                 mutex_unlock(&uc_pool->add_chunk_mutex);
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 14aeb174e00f..fc9be7c8c5aa 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -125,7 +125,7 @@ config BCM47XX
         select SYS_SUPPORTS_32BIT_KERNEL
         select SYS_SUPPORTS_LITTLE_ENDIAN
         select SYS_HAS_EARLY_PRINTK
-        select EARLY_PRINTK_8250 if EARLY_PRINTK
+        select USE_GENERIC_EARLY_PRINTK_8250
         help
          Support for BCM47XX based boards
 
@@ -152,7 +152,6 @@ config MIPS_COBALT
         select CSRC_R4K
         select CEVT_GT641XX
         select DMA_NONCOHERENT
-        select EARLY_PRINTK_8250 if EARLY_PRINTK
         select HW_HAS_PCI
         select I8253
         select I8259
@@ -165,6 +164,7 @@ config MIPS_COBALT
         select SYS_SUPPORTS_32BIT_KERNEL
         select SYS_SUPPORTS_64BIT_KERNEL
         select SYS_SUPPORTS_LITTLE_ENDIAN
+        select USE_GENERIC_EARLY_PRINTK_8250
 
 config MACH_DECSTATION
         bool "DECstations"
@@ -677,6 +677,7 @@ config SNI_RM
         select SYS_SUPPORTS_BIG_ENDIAN
         select SYS_SUPPORTS_HIGHMEM
         select SYS_SUPPORTS_LITTLE_ENDIAN
+        select USE_GENERIC_EARLY_PRINTK_8250
         help
           The SNI RM200/300/400 are MIPS-based machines manufactured by
           Siemens Nixdorf Informationssysteme (SNI), parent company of Pyramid
@@ -1824,12 +1825,12 @@ endchoice
 
 config FORCE_MAX_ZONEORDER
         int "Maximum zone order"
-        range 14 64 if HUGETLB_PAGE && PAGE_SIZE_64KB
-        default "14" if HUGETLB_PAGE && PAGE_SIZE_64KB
-        range 13 64 if HUGETLB_PAGE && PAGE_SIZE_32KB
-        default "13" if HUGETLB_PAGE && PAGE_SIZE_32KB
-        range 12 64 if HUGETLB_PAGE && PAGE_SIZE_16KB
-        default "12" if HUGETLB_PAGE && PAGE_SIZE_16KB
+        range 14 64 if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_64KB
+        default "14" if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_64KB
+        range 13 64 if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_32KB
+        default "13" if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_32KB
+        range 12 64 if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_16KB
+        default "12" if MIPS_HUGE_TLB_SUPPORT && PAGE_SIZE_16KB
         range 11 64
         default "11"
         help
@@ -2456,9 +2457,8 @@ config SECCOMP
           If unsure, say Y. Only embedded should say N here.
 
 config MIPS_O32_FP64_SUPPORT
-        bool "Support for O32 binaries using 64-bit FP"
+        bool "Support for O32 binaries using 64-bit FP (EXPERIMENTAL)"
         depends on 32BIT || MIPS32_O32
-        default y
         help
           When this is enabled, the kernel will support use of 64-bit floating
           point registers with binaries using the O32 ABI along with the
@@ -2470,7 +2470,14 @@ config MIPS_O32_FP64_SUPPORT
           of your kernel & potentially improve FP emulation performance by
           saying N here.
 
-          If unsure, say Y.
+          Although binutils currently supports use of this flag the details
+          concerning its effect upon the O32 ABI in userland are still being
+          worked on. In order to avoid userland becoming dependant upon current
+          behaviour before the details have been finalised, this option should
+          be considered experimental and only enabled by those working upon
+          said details.
+
+          If unsure, say N.
 
 config USE_OF
         bool
diff --git a/arch/mips/Kconfig.debug b/arch/mips/Kconfig.debug
index b147e7038ff0..25de29211d76 100644
--- a/arch/mips/Kconfig.debug
+++ b/arch/mips/Kconfig.debug
@@ -21,13 +21,17 @@ config EARLY_PRINTK
           unless you want to debug such a crash.
 
 config EARLY_PRINTK_8250
-        bool "8250/16550 and compatible serial early printk driver"
-        depends on EARLY_PRINTK
-        default n
+        bool
+        depends on EARLY_PRINTK && USE_GENERIC_EARLY_PRINTK_8250
+        default y
         help
+          "8250/16550 and compatible serial early printk driver"
           If you say Y here, it will be possible to use a 8250/16550 serial
           port as the boot console.
 
+config USE_GENERIC_EARLY_PRINTK_8250
+        bool
+
 config CMDLINE_BOOL
         bool "Built-in kernel command line"
         default n
diff --git a/arch/mips/alchemy/board-gpr.c b/arch/mips/alchemy/board-gpr.c
index 9edc35ff8cf1..acf9a2a37f5a 100644
--- a/arch/mips/alchemy/board-gpr.c
+++ b/arch/mips/alchemy/board-gpr.c
@@ -53,10 +53,8 @@ void __init prom_init(void)
         prom_init_cmdline();
 
         memsize_str = prom_getenv("memsize");
-        if (!memsize_str)
+        if (!memsize_str || kstrtoul(memsize_str, 0, &memsize))
                 memsize = 0x04000000;
-        else
-                strict_strtoul(memsize_str, 0, &memsize);
         add_memory_region(0, memsize, BOOT_MEM_RAM);
 }
 
diff --git a/arch/mips/alchemy/board-mtx1.c b/arch/mips/alchemy/board-mtx1.c
index 9969dbab19e3..25a59a23547e 100644
--- a/arch/mips/alchemy/board-mtx1.c
+++ b/arch/mips/alchemy/board-mtx1.c
@@ -52,10 +52,8 @@ void __init prom_init(void)
         prom_init_cmdline();
 
         memsize_str = prom_getenv("memsize");
-        if (!memsize_str)
+        if (!memsize_str || kstrtoul(memsize_str, 0, &memsize))
                 memsize = 0x04000000;
-        else
-                strict_strtoul(memsize_str, 0, &memsize);
         add_memory_region(0, memsize, BOOT_MEM_RAM);
 }
 
diff --git a/arch/mips/bcm47xx/board.c b/arch/mips/bcm47xx/board.c
index adf1ca83f800..44ab1be68c3c 100644
--- a/arch/mips/bcm47xx/board.c
+++ b/arch/mips/bcm47xx/board.c
@@ -1,3 +1,4 @@
+#include <linux/errno.h>
 #include <linux/export.h>
 #include <linux/string.h>
 #include <bcm47xx_board.h>
diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
index 6decb27cf48b..2bed73a684ae 100644
--- a/arch/mips/bcm47xx/nvram.c
+++ b/arch/mips/bcm47xx/nvram.c
@@ -196,7 +196,7 @@ int bcm47xx_nvram_gpio_pin(const char *name)
         char nvram_var[10];
         char buf[30];
 
-        for (i = 0; i < 16; i++) {
+        for (i = 0; i < 32; i++) {
                 err = snprintf(nvram_var, sizeof(nvram_var), "gpio%i", i);
                 if (err <= 0)
                         continue;
diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
index 25fbfae06c1f..c2bb4f896ce7 100644
--- a/arch/mips/cavium-octeon/octeon-irq.c
+++ b/arch/mips/cavium-octeon/octeon-irq.c
@@ -975,10 +975,6 @@ static int octeon_irq_ciu_xlat(struct irq_domain *d,
         if (ciu > 1 || bit > 63)
                 return -EINVAL;
 
-        /* These are the GPIO lines */
-        if (ciu == 0 && bit >= 16 && bit < 32)
-                return -EINVAL;
-
         *out_hwirq = (ciu << 6) | bit;
         *out_type = 0;
 
@@ -1007,6 +1003,10 @@ static int octeon_irq_ciu_map(struct irq_domain *d,
         if (!octeon_irq_virq_in_range(virq))
                 return -EINVAL;
 
+        /* Don't map irq if it is reserved for GPIO. */
+        if (line == 0 && bit >= 16 && bit <32)
+                return 0;
+
         if (line > 1 || octeon_irq_ciu_to_irq[line][bit] != 0)
                 return -EINVAL;
 
@@ -1525,10 +1525,6 @@ static int octeon_irq_ciu2_xlat(struct irq_domain *d,
         ciu = intspec[0];
         bit = intspec[1];
 
-        /* Line 7  are the GPIO lines */
-        if (ciu > 6 || bit > 63)
-                return -EINVAL;
-
         *out_hwirq = (ciu << 6) | bit;
         *out_type = 0;
 
@@ -1570,8 +1566,14 @@ static int octeon_irq_ciu2_map(struct irq_domain *d,
         if (!octeon_irq_virq_in_range(virq))
                 return -EINVAL;
 
-        /* Line 7  are the GPIO lines */
-        if (line > 6 || octeon_irq_ciu_to_irq[line][bit] != 0)
+        /*
+         * Don't map irq if it is reserved for GPIO.
+         * (Line 7 are the GPIO lines.)
+         */
+        if (line == 7)
+                return 0;
+
+        if (line > 7 || octeon_irq_ciu_to_irq[line][bit] != 0)
                 return -EINVAL;
 
         if (octeon_irq_ciu2_is_edge(line, bit))
diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
index fe3b03c793e5..b464b8b1147a 100644
--- a/arch/mips/include/asm/asmmacro.h
+++ b/arch/mips/include/asm/asmmacro.h
@@ -9,6 +9,7 @@
 #define _ASM_ASMMACRO_H
 
 #include <asm/hazards.h>
+#include <asm/asm-offsets.h>
 
 #ifdef CONFIG_32BIT
 #include <asm/asmmacro-32.h>
@@ -54,11 +55,21 @@
         .endm
 
         .macro  local_irq_disable reg=t0
+#ifdef CONFIG_PREEMPT
+        lw      \reg, TI_PRE_COUNT($28)
+        addi    \reg, \reg, 1
+        sw      \reg, TI_PRE_COUNT($28)
+#endif
         mfc0    \reg, CP0_STATUS
         ori     \reg, \reg, 1
         xori    \reg, \reg, 1
         mtc0    \reg, CP0_STATUS
         irq_disable_hazard
+#ifdef CONFIG_PREEMPT
+        lw      \reg, TI_PRE_COUNT($28)
+        addi    \reg, \reg, -1
+        sw      \reg, TI_PRE_COUNT($28)
+#endif
         .endm
 #endif /* CONFIG_MIPS_MT_SMTC */
 
@@ -106,7 +117,7 @@
         .endm
 
         .macro  fpu_save_double thread status tmp
-#if defined(CONFIG_MIPS64) || defined(CONFIG_CPU_MIPS32_R2)
+#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
         sll     \tmp, \status, 5
         bgez    \tmp, 10f
         fpu_save_16odd \thread
@@ -159,7 +170,7 @@
         .endm
 
         .macro  fpu_restore_double thread status tmp
-#if defined(CONFIG_MIPS64) || defined(CONFIG_CPU_MIPS32_R2)
+#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
         sll     \tmp, \status, 5
         bgez    \tmp, 10f                               # 16 register mode?
 
diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
index 8a3d61f0017f..4d86b72750c7 100644
--- a/arch/mips/include/asm/fpu.h
+++ b/arch/mips/include/asm/fpu.h
@@ -57,7 +57,7 @@ static inline int __enable_fpu(enum fpu_mode mode)
                 return 0;
 
         case FPU_64BIT:
-#if !(defined(CONFIG_CPU_MIPS32_R2) || defined(CONFIG_MIPS64))
+#if !(defined(CONFIG_CPU_MIPS32_R2) || defined(CONFIG_64BIT))
                 /* we only have a 32-bit FPU */
                 return SIGFPE;
 #endif
diff --git a/arch/mips/include/asm/ftrace.h b/arch/mips/include/asm/ftrace.h
index ce35c9af0c28..992aaba603b5 100644
--- a/arch/mips/include/asm/ftrace.h
+++ b/arch/mips/include/asm/ftrace.h
@@ -22,12 +22,12 @@ extern void _mcount(void);
 #define safe_load(load, src, dst, error)                \
 do {                                                    \
         asm volatile (                                  \
-                "1: " load " %[" STR(dst) "], 0(%[" STR(src) "])\n"\
-                "   li %[" STR(error) "], 0\n"          \
+                "1: " load " %[tmp_dst], 0(%[tmp_src])\n"       \
+                "   li %[tmp_err], 0\n"                 \
                 "2:\n"                                  \
                                                         \
                 ".section .fixup, \"ax\"\n"             \
-                "3: li %[" STR(error) "], 1\n"          \
+                "3: li %[tmp_err], 1\n"                 \
                 "   j 2b\n"                             \
                 ".previous\n"                           \
                                                         \
@@ -35,8 +35,8 @@ do {							\
                 STR(PTR) "\t1b, 3b\n\t"                 \
                 ".previous\n"                           \
                                                         \
-                : [dst] "=&r" (dst), [error] "=r" (error)\
-                : [src] "r" (src)                       \
+                : [tmp_dst] "=&r" (dst), [tmp_err] "=r" (error)\
+                : [tmp_src] "r" (src)                   \
                 : "memory"                              \
         );                                              \
 } while (0)
@@ -44,12 +44,12 @@ do {							\
 #define safe_store(store, src, dst, error)      \
 do {                                            \
         asm volatile (                          \
-                "1: " store " %[" STR(src) "], 0(%[" STR(dst) "])\n"\
-                "   li %[" STR(error) "], 0\n"  \
+                "1: " store " %[tmp_src], 0(%[tmp_dst])\n"\
+                "   li %[tmp_err], 0\n"         \
                 "2:\n"                          \
                                                 \
                 ".section .fixup, \"ax\"\n"     \
-                "3: li %[" STR(error) "], 1\n"  \
+                "3: li %[tmp_err], 1\n"         \
                 "   j 2b\n"                     \
                 ".previous\n"                   \
                                                 \
@@ -57,8 +57,8 @@ do {						\
                 STR(PTR) "\t1b, 3b\n\t"         \
                 ".previous\n"                   \
                                                 \
-                : [error] "=r" (error)          \
-                : [dst] "r" (dst), [src] "r" (src)\
+                : [tmp_err] "=r" (error)        \
+                : [tmp_dst] "r" (dst), [tmp_src] "r" (src)\
                 : "memory"                      \
         );                                      \
 } while (0)
diff --git a/arch/mips/include/asm/mach-au1x00/au1000.h b/arch/mips/include/asm/mach-au1x00/au1000.h
index 54f9e84db8ac..b4c3ecb17d48 100644
--- a/arch/mips/include/asm/mach-au1x00/au1000.h
+++ b/arch/mips/include/asm/mach-au1x00/au1000.h
@@ -1161,18 +1161,6 @@ enum soc_au1200_ints {
 #define MAC_RX_BUFF3_STATUS     0x30
 #define MAC_RX_BUFF3_ADDR       0x34
 
-#define UART_RX         0       /* Receive buffer */
-#define UART_TX         4       /* Transmit buffer */
-#define UART_IER        8       /* Interrupt Enable Register */
-#define UART_IIR        0xC     /* Interrupt ID Register */
-#define UART_FCR        0x10    /* FIFO Control Register */
-#define UART_LCR        0x14    /* Line Control Register */
-#define UART_MCR        0x18    /* Modem Control Register */
-#define UART_LSR        0x1C    /* Line Status Register */
-#define UART_MSR        0x20    /* Modem Status Register */
-#define UART_CLK        0x28    /* Baud Rate Clock Divider */
-#define UART_MOD_CNTRL  0x100   /* Module Control */
-
 /* SSIO */
 #define SSI0_STATUS             0xB1600000
 #  define SSI_STATUS_BF         (1 << 4)
diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
index 9031745cec1b..6c488c85d791 100644
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -13,6 +13,7 @@
 #ifndef __ASM_MIPS_SYSCALL_H
 #define __ASM_MIPS_SYSCALL_H
 
+#include <linux/compiler.h>
 #include <linux/audit.h>
 #include <linux/elf-em.h>
 #include <linux/kernel.h>
@@ -50,14 +51,14 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
 
 #ifdef CONFIG_32BIT
         case 4: case 5: case 6: case 7:
-                return get_user(*arg, (int *)usp + 4 * n);
+                return get_user(*arg, (int *)usp + n);
 #endif
 
 #ifdef CONFIG_64BIT
         case 4: case 5: case 6: case 7:
 #ifdef CONFIG_MIPS32_O32
                 if (test_thread_flag(TIF_32BIT_REGS))
-                        return get_user(*arg, (int *)usp + 4 * n);
+                        return get_user(*arg, (int *)usp + n);
                 else
 #endif
                         *arg = regs->regs[4 + n];
@@ -68,6 +69,8 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
         default:
                 BUG();
         }
+
+        unreachable();
 }
 
 static inline long syscall_get_return_value(struct task_struct *task,
@@ -100,7 +103,6 @@ static inline void syscall_get_arguments(struct task_struct *task,
                                          unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
-        unsigned long arg;
         int ret;
         /* O32 ABI syscall() - Either 64-bit with O32 or 32-bit */
         if ((config_enabled(CONFIG_32BIT) ||
@@ -111,7 +113,7 @@ static inline void syscall_get_arguments(struct task_struct *task,
         }
 
         while (n--)
-                ret |= mips_get_syscall_arg(&arg, task, regs, i++);
+                ret |= mips_get_syscall_arg(args++, task, regs, i++);
 
         /*
          * No way to communicate an error because this is a void function.
diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h
index 1a44c5ac6f4f..df6e775f3fef 100644
--- a/arch/mips/include/uapi/asm/inst.h
+++ b/arch/mips/include/uapi/asm/inst.h
@@ -170,8 +170,8 @@ enum cop1_sdw_func {
  */
 enum cop1x_func {
         lwxc1_op     =  0x00, ldxc1_op     =  0x01,
-        pfetch_op    =  0x07, swxc1_op     =  0x08,
-        sdxc1_op     =  0x09, madd_s_op    =  0x20,
+        swxc1_op     =  0x08, sdxc1_op     =  0x09,
+        pfetch_op    =  0x0f, madd_s_op    =  0x20,
         madd_d_op    =  0x21, madd_e_op    =  0x22,
         msub_s_op    =  0x28, msub_d_op    =  0x29,
         msub_e_op    =  0x2a, nmadd_s_op   =  0x30,
diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
index ddcc3500248d..74fe73506d8f 100644
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -115,11 +115,10 @@ static int ftrace_modify_code_2(unsigned long ip, unsigned int new_code1,
         safe_store_code(new_code1, ip, faulted);
         if (unlikely(faulted))
                 return -EFAULT;
-        ip += 4;
-        safe_store_code(new_code2, ip, faulted);
+        safe_store_code(new_code2, ip + 4, faulted);
         if (unlikely(faulted))
                 return -EFAULT;
-        flush_icache_range(ip, ip + 8); /* original ip + 12 */
+        flush_icache_range(ip, ip + 8);
         return 0;
 }
 #endif
diff --git a/arch/mips/kernel/r4k_fpu.S b/arch/mips/kernel/r4k_fpu.S
index 0cfa7a56a153..71814272d148 100644
--- a/arch/mips/kernel/r4k_fpu.S
+++ b/arch/mips/kernel/r4k_fpu.S
@@ -36,9 +36,9 @@
 LEAF(_save_fp_context)
         cfc1    t1, fcr31
 
-#if defined(CONFIG_64BIT) || defined(CONFIG_MIPS32_R2)
+#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
         .set    push
-#ifdef CONFIG_MIPS32_R2
+#ifdef CONFIG_CPU_MIPS32_R2
         .set    mips64r2
         mfc0    t0, CP0_STATUS
         sll     t0, t0, 5
@@ -147,11 +147,11 @@ LEAF(_save_fp_context32)
  *  - cp1 status/control register
  */
 LEAF(_restore_fp_context)
-        EX      lw t0, SC_FPC_CSR(a0)
+        EX      lw t1, SC_FPC_CSR(a0)
 
-#if defined(CONFIG_64BIT) || defined(CONFIG_MIPS32_R2)
+#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)
         .set    push
-#ifdef CONFIG_MIPS32_R2
+#ifdef CONFIG_CPU_MIPS32_R2
         .set    mips64r2
         mfc0    t0, CP0_STATUS
         sll     t0, t0, 5
@@ -192,7 +192,7 @@ LEAF(_restore_fp_context)
         EX      ldc1 $f26, SC_FPREGS+208(a0)
         EX      ldc1 $f28, SC_FPREGS+224(a0)
         EX      ldc1 $f30, SC_FPREGS+240(a0)
-        ctc1    t0, fcr31
+        ctc1    t1, fcr31
         jr      ra
          li     v0, 0                                   # success
         END(_restore_fp_context)
@@ -200,7 +200,7 @@ LEAF(_restore_fp_context)
 #ifdef CONFIG_MIPS32_COMPAT
 LEAF(_restore_fp_context32)
         /* Restore an o32 sigcontext.  */
-        EX      lw t0, SC32_FPC_CSR(a0)
+        EX      lw t1, SC32_FPC_CSR(a0)
 
         mfc0    t0, CP0_STATUS
         sll     t0, t0, 5
@@ -240,7 +240,7 @@ LEAF(_restore_fp_context32)
         EX      ldc1 $f26, SC32_FPREGS+208(a0)
         EX      ldc1 $f28, SC32_FPREGS+224(a0)
         EX      ldc1 $f30, SC32_FPREGS+240(a0)
-        ctc1    t0, fcr31
+        ctc1    t1, fcr31
         jr      ra
          li     v0, 0                                   # success
         END(_restore_fp_context32)
diff --git a/arch/mips/kernel/rtlx-cmp.c b/arch/mips/kernel/rtlx-cmp.c
index 56dc69635153..758fb3cd2326 100644
--- a/arch/mips/kernel/rtlx-cmp.c
+++ b/arch/mips/kernel/rtlx-cmp.c
@@ -112,5 +112,8 @@ void __exit rtlx_module_exit(void)
 
         for (i = 0; i < RTLX_CHANNELS; i++)
                 device_destroy(mt_class, MKDEV(major, i));
+
         unregister_chrdev(major, RTLX_MODULE_NAME);
+
+        aprp_hook = NULL;
 }
diff --git a/arch/mips/kernel/rtlx-mt.c b/arch/mips/kernel/rtlx-mt.c
index 91d61ba422b4..9c1aca00fd54 100644
--- a/arch/mips/kernel/rtlx-mt.c
+++ b/arch/mips/kernel/rtlx-mt.c
@@ -144,5 +144,8 @@ void __exit rtlx_module_exit(void)
 
         for (i = 0; i < RTLX_CHANNELS; i++)
                 device_destroy(mt_class, MKDEV(major, i));
+
         unregister_chrdev(major, RTLX_MODULE_NAME);
+
+        aprp_hook = NULL;
 }
diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index 71a697c9d385..7b3c9acae689 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -1561,10 +1561,10 @@ static int fpux_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
                 break;
         }
 
-        case 0x7:               /* 7 */
-                if (MIPSInst_FUNC(ir) != pfetch_op) {
+        case 0x3:
+                if (MIPSInst_FUNC(ir) != pfetch_op)
                         return SIGILL;
-                }
+
                 /* ignore prefx operation */
                 break;
 
diff --git a/arch/mips/mti-malta/malta-amon.c b/arch/mips/mti-malta/malta-amon.c
index 592ac0427426..84ac523b0ce0 100644
--- a/arch/mips/mti-malta/malta-amon.c
+++ b/arch/mips/mti-malta/malta-amon.c
@@ -72,7 +72,7 @@ int amon_cpu_start(int cpu,
         return 0;
 }
 
-#ifdef CONFIG_MIPS_VPE_LOADER
+#ifdef CONFIG_MIPS_VPE_LOADER_CMP
 int vpe_run(struct vpe *v)
 {
         struct vpe_notifications *n;
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index c6cbfebcac9b..b71ee809191a 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -117,7 +117,7 @@ static void malta_hw0_irqdispatch(void)
 
         do_IRQ(MALTA_INT_BASE + irq);
 
-#ifdef MIPS_VPE_APSP_API
+#ifdef CONFIG_MIPS_VPE_APSP_API_MT
         if (aprp_hook)
                 aprp_hook();
 #endif
@@ -311,7 +311,7 @@ static void ipi_call_dispatch(void)
 
 static irqreturn_t ipi_resched_interrupt(int irq, void *dev_id)
 {
-#ifdef MIPS_VPE_APSP_API
+#ifdef CONFIG_MIPS_VPE_APSP_API_CMP
         if (aprp_hook)
                 aprp_hook();
 #endif
diff --git a/arch/mips/pci/msi-octeon.c b/arch/mips/pci/msi-octeon.c
index d37be36dc659..2b91b0e61566 100644
--- a/arch/mips/pci/msi-octeon.c
+++ b/arch/mips/pci/msi-octeon.c
@@ -150,6 +150,7 @@ msi_irq_allocated:
                 msg.address_lo =
                         ((128ul << 20) + CVMX_PCI_MSI_RCV) & 0xffffffff;
                 msg.address_hi = ((128ul << 20) + CVMX_PCI_MSI_RCV) >> 32;
+                break;
         case OCTEON_DMA_BAR_TYPE_BIG:
                 /* When using big bar, Bar 0 is based at 0 */
                 msg.address_lo = (0 + CVMX_PCI_MSI_RCV) & 0xffffffff;
diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S
index 7e0277a1048f..32a7c828f073 100644
--- a/arch/mips/power/hibernate.S
+++ b/arch/mips/power/hibernate.S
@@ -43,6 +43,7 @@ LEAF(swsusp_arch_resume)
         bne t1, t3, 1b
         PTR_L t0, PBE_NEXT(t0)
         bnez t0, 0b
+        jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */
         PTR_LA t0, saved_regs
         PTR_L ra, PT_R31(t0)
         PTR_L sp, PT_R29(t0)
diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h
index 637fe031aa84..60d5d174dfe4 100644
--- a/arch/parisc/include/asm/page.h
+++ b/arch/parisc/include/asm/page.h
@@ -32,17 +32,6 @@ void copy_page_asm(void *to, void *from);
 void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
                         struct page *pg);
 
-/* #define CONFIG_PARISC_TMPALIAS */
-
-#ifdef CONFIG_PARISC_TMPALIAS
-void clear_user_highpage(struct page *page, unsigned long vaddr);
-#define clear_user_highpage clear_user_highpage
-struct vm_area_struct;
-void copy_user_highpage(struct page *to, struct page *from,
-        unsigned long vaddr, struct vm_area_struct *vma);
-#define __HAVE_ARCH_COPY_USER_HIGHPAGE
-#endif
-
 /*
  * These are used to make use of C type-checking..
  */
diff --git a/arch/parisc/include/asm/spinlock.h b/arch/parisc/include/asm/spinlock.h
index 3516e0b27044..64f2992e439f 100644
--- a/arch/parisc/include/asm/spinlock.h
+++ b/arch/parisc/include/asm/spinlock.h
@@ -191,8 +191,4 @@ static __inline__ int arch_write_can_lock(arch_rwlock_t *rw)
 #define arch_read_lock_flags(lock, flags) arch_read_lock(lock)
 #define arch_write_lock_flags(lock, flags) arch_write_lock(lock)
 
-#define arch_spin_relax(lock)   cpu_relax()
-#define arch_read_relax(lock)   cpu_relax()
-#define arch_write_relax(lock)  cpu_relax()
-
 #endif /* __ASM_SPINLOCK_H */
diff --git a/arch/parisc/include/uapi/asm/unistd.h b/arch/parisc/include/uapi/asm/unistd.h
index 42706794a36f..265ae5190b0a 100644
--- a/arch/parisc/include/uapi/asm/unistd.h
+++ b/arch/parisc/include/uapi/asm/unistd.h
@@ -828,13 +828,13 @@
 #define __NR_finit_module       (__NR_Linux + 333)
 #define __NR_sched_setattr      (__NR_Linux + 334)
 #define __NR_sched_getattr      (__NR_Linux + 335)
+#define __NR_utimes             (__NR_Linux + 336)
 
-#define __NR_Linux_syscalls     (__NR_sched_getattr + 1)
+#define __NR_Linux_syscalls     (__NR_utimes + 1)
 
 
 #define __IGNORE_select         /* newselect */
 #define __IGNORE_fadvise64      /* fadvise64_64 */
-#define __IGNORE_utimes         /* utime */
 
 
 #define HPUX_GATEWAY_ADDR       0xC0000004
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index ac87a40502e6..a6ffc775a9f8 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -581,67 +581,3 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
                 __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
         }
 }
-
-#ifdef CONFIG_PARISC_TMPALIAS
-
-void clear_user_highpage(struct page *page, unsigned long vaddr)
-{
-        void *vto;
-        unsigned long flags;
-
-        /* Clear using TMPALIAS region.  The page doesn't need to
-           be flushed but the kernel mapping needs to be purged.  */
-
-        vto = kmap_atomic(page);
-
-        /* The PA-RISC 2.0 Architecture book states on page F-6:
-           "Before a write-capable translation is enabled, *all*
-           non-equivalently-aliased translations must be removed
-           from the page table and purged from the TLB.  (Note
-           that the caches are not required to be flushed at this
-           time.)  Before any non-equivalent aliased translation
-           is re-enabled, the virtual address range for the writeable
-           page (the entire page) must be flushed from the cache,
-           and the write-capable translation removed from the page
-           table and purged from the TLB."  */
-
-        purge_kernel_dcache_page_asm((unsigned long)vto);
-        purge_tlb_start(flags);
-        pdtlb_kernel(vto);
-        purge_tlb_end(flags);
-        preempt_disable();
-        clear_user_page_asm(vto, vaddr);
-        preempt_enable();
-
-        pagefault_enable();             /* kunmap_atomic(addr, KM_USER0); */
-}
-
-void copy_user_highpage(struct page *to, struct page *from,
-        unsigned long vaddr, struct vm_area_struct *vma)
-{
-        void *vfrom, *vto;
-        unsigned long flags;
-
-        /* Copy using TMPALIAS region.  This has the advantage
-           that the `from' page doesn't need to be flushed.  However,
-           the `to' page must be flushed in copy_user_page_asm since
-           it can be used to bring in executable code.  */
-
-        vfrom = kmap_atomic(from);
-        vto = kmap_atomic(to);
-
-        purge_kernel_dcache_page_asm((unsigned long)vto);
-        purge_tlb_start(flags);
-        pdtlb_kernel(vto);
-        pdtlb_kernel(vfrom);
-        purge_tlb_end(flags);
-        preempt_disable();
-        copy_user_page_asm(vto, vfrom, vaddr);
-        flush_dcache_page_asm(__pa(vto), vaddr);
-        preempt_enable();
-
-        pagefault_enable();             /* kunmap_atomic(addr, KM_USER1); */
-        pagefault_enable();             /* kunmap_atomic(addr, KM_USER0); */
-}
-
-#endif /* CONFIG_PARISC_TMPALIAS */
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 8fa3fbb3e4d3..80e5dd248934 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -431,6 +431,7 @@
         ENTRY_SAME(finit_module)
         ENTRY_SAME(sched_setattr)
         ENTRY_SAME(sched_getattr)       /* 335 */
+        ENTRY_COMP(utimes)
 
         /* Nothing yet */
 
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 8d4c247f1738..af064d28b365 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1048,6 +1048,15 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
         flush_altivec_to_thread(src);
         flush_vsx_to_thread(src);
         flush_spe_to_thread(src);
+        /*
+         * Flush TM state out so we can copy it.  __switch_to_tm() does this
+         * flush but it removes the checkpointed state from the current CPU and
+         * transitions the CPU out of TM mode.  Hence we need to call
+         * tm_recheckpoint_new_task() (on the same task) to restore the
+         * checkpointed state back and the TM mode.
+         */
+        __switch_to_tm(src);
+        tm_recheckpoint_new_task(src);
 
         *dst = *src;
 
diff --git a/arch/powerpc/kernel/reloc_64.S b/arch/powerpc/kernel/reloc_64.S
index 1482327cfeba..d88736fbece6 100644
--- a/arch/powerpc/kernel/reloc_64.S
+++ b/arch/powerpc/kernel/reloc_64.S
@@ -81,6 +81,7 @@ _GLOBAL(relocate)
 
 6:      blr
 
+.balign 8
 p_dyn:  .llong  __dynamic_start - 0b
 p_rela: .llong  __rela_dyn_start - 0b
 p_st:   .llong  _stext - 0b
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index e66d4ec04d95..818dce344e82 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1504,73 +1504,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
 1:      addi    r8,r8,16
         .endr
 
-        /* Save DEC */
-        mfspr   r5,SPRN_DEC
-        mftb    r6
-        extsw   r5,r5
-        add     r5,r5,r6
-        std     r5,VCPU_DEC_EXPIRES(r9)
-
-BEGIN_FTR_SECTION
-        b       8f
-END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
-        /* Turn on TM so we can access TFHAR/TFIAR/TEXASR */
-        mfmsr   r8
-        li      r0, 1
-        rldimi  r8, r0, MSR_TM_LG, 63-MSR_TM_LG
-        mtmsrd  r8
-
-        /* Save POWER8-specific registers */
-        mfspr   r5, SPRN_IAMR
-        mfspr   r6, SPRN_PSPB
-        mfspr   r7, SPRN_FSCR
-        std     r5, VCPU_IAMR(r9)
-        stw     r6, VCPU_PSPB(r9)
-        std     r7, VCPU_FSCR(r9)
-        mfspr   r5, SPRN_IC
-        mfspr   r6, SPRN_VTB
-        mfspr   r7, SPRN_TAR
-        std     r5, VCPU_IC(r9)
-        std     r6, VCPU_VTB(r9)
-        std     r7, VCPU_TAR(r9)
-#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-        mfspr   r5, SPRN_TFHAR
-        mfspr   r6, SPRN_TFIAR
-        mfspr   r7, SPRN_TEXASR
-        std     r5, VCPU_TFHAR(r9)
-        std     r6, VCPU_TFIAR(r9)
-        std     r7, VCPU_TEXASR(r9)
-#endif
-        mfspr   r8, SPRN_EBBHR
-        std     r8, VCPU_EBBHR(r9)
-        mfspr   r5, SPRN_EBBRR
-        mfspr   r6, SPRN_BESCR
-        mfspr   r7, SPRN_CSIGR
-        mfspr   r8, SPRN_TACR
-        std     r5, VCPU_EBBRR(r9)
-        std     r6, VCPU_BESCR(r9)
-        std     r7, VCPU_CSIGR(r9)
-        std     r8, VCPU_TACR(r9)
-        mfspr   r5, SPRN_TCSCR
-        mfspr   r6, SPRN_ACOP
-        mfspr   r7, SPRN_PID
-        mfspr   r8, SPRN_WORT
-        std     r5, VCPU_TCSCR(r9)
-        std     r6, VCPU_ACOP(r9)
-        stw     r7, VCPU_GUEST_PID(r9)
-        std     r8, VCPU_WORT(r9)
-8:
-
-        /* Save and reset AMR and UAMOR before turning on the MMU */
-BEGIN_FTR_SECTION
-        mfspr   r5,SPRN_AMR
-        mfspr   r6,SPRN_UAMOR
-        std     r5,VCPU_AMR(r9)
-        std     r6,VCPU_UAMOR(r9)
-        li      r6,0
-        mtspr   SPRN_AMR,r6
-END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206)
-
         /* Unset guest mode */
         li      r0, KVM_GUEST_MODE_NONE
         stb     r0, HSTATE_IN_GUEST(r13)
@@ -2203,7 +2136,7 @@ BEGIN_FTR_SECTION
 END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 #endif
         mfspr   r6,SPRN_VRSAVE
-        stw     r6,VCPU_VRSAVE(r3)
+        stw     r6,VCPU_VRSAVE(r31)
         mtlr    r30
         mtmsrd  r5
         isync
@@ -2240,7 +2173,7 @@ BEGIN_FTR_SECTION
         bl      .load_vr_state
 END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 #endif
-        lwz     r7,VCPU_VRSAVE(r4)
+        lwz     r7,VCPU_VRSAVE(r31)
         mtspr   SPRN_VRSAVE,r7
         mtlr    r30
         mr      r4,r31
diff --git a/arch/powerpc/platforms/cell/ras.c b/arch/powerpc/platforms/cell/ras.c
index 5ec1e47a0d77..e865d748179b 100644
--- a/arch/powerpc/platforms/cell/ras.c
+++ b/arch/powerpc/platforms/cell/ras.c
@@ -123,7 +123,8 @@ static int __init cbe_ptcal_enable_on_node(int nid, int order)
 
         area->nid = nid;
         area->order = order;
-        area->pages = alloc_pages_exact_node(area->nid, GFP_KERNEL|GFP_THISNODE,
+        area->pages = alloc_pages_exact_node(area->nid,
+                                                GFP_KERNEL|__GFP_THISNODE,
                                                 area->order);
 
         if (!area->pages) {
diff --git a/arch/sh/include/cpu-sh2/cpu/cache.h b/arch/sh/include/cpu-sh2/cpu/cache.h
index 673515bc4135..aa1b2b9088a7 100644
--- a/arch/sh/include/cpu-sh2/cpu/cache.h
+++ b/arch/sh/include/cpu-sh2/cpu/cache.h
@@ -18,7 +18,7 @@
 #define SH_CACHE_ASSOC          8
 
 #if defined(CONFIG_CPU_SUBTYPE_SH7619)
-#define CCR             0xffffffec
+#define SH_CCR          0xffffffec
 
 #define CCR_CACHE_CE    0x01    /* Cache enable */
 #define CCR_CACHE_WT    0x02    /* CCR[bit1=1,bit2=1] */
diff --git a/arch/sh/include/cpu-sh2a/cpu/cache.h b/arch/sh/include/cpu-sh2a/cpu/cache.h
index defb0baa5a06..b27ce92cb600 100644
--- a/arch/sh/include/cpu-sh2a/cpu/cache.h
+++ b/arch/sh/include/cpu-sh2a/cpu/cache.h
@@ -17,8 +17,8 @@
 #define SH_CACHE_COMBINED       4
 #define SH_CACHE_ASSOC          8
 
-#define CCR             0xfffc1000 /* CCR1 */
-#define CCR2            0xfffc1004
+#define SH_CCR          0xfffc1000 /* CCR1 */
+#define SH_CCR2         0xfffc1004
 
 /*
  * Most of the SH-2A CCR1 definitions resemble the SH-4 ones. All others not
diff --git a/arch/sh/include/cpu-sh3/cpu/cache.h b/arch/sh/include/cpu-sh3/cpu/cache.h
index bee2d81c56bf..29700fd88c75 100644
--- a/arch/sh/include/cpu-sh3/cpu/cache.h
+++ b/arch/sh/include/cpu-sh3/cpu/cache.h
@@ -17,7 +17,7 @@
 #define SH_CACHE_COMBINED       4
 #define SH_CACHE_ASSOC          8
 
-#define CCR             0xffffffec      /* Address of Cache Control Register */
+#define SH_CCR          0xffffffec      /* Address of Cache Control Register */
 
 #define CCR_CACHE_CE    0x01    /* Cache Enable */
 #define CCR_CACHE_WT    0x02    /* Write-Through (for P0,U0,P3) (else writeback) */
diff --git a/arch/sh/include/cpu-sh4/cpu/cache.h b/arch/sh/include/cpu-sh4/cpu/cache.h
index 7bfb9e8b069c..92c4cd119b66 100644
--- a/arch/sh/include/cpu-sh4/cpu/cache.h
+++ b/arch/sh/include/cpu-sh4/cpu/cache.h
@@ -17,7 +17,7 @@
 #define SH_CACHE_COMBINED       4
 #define SH_CACHE_ASSOC          8
 
-#define CCR             0xff00001c      /* Address of Cache Control Register */
+#define SH_CCR          0xff00001c      /* Address of Cache Control Register */
 #define CCR_CACHE_OCE   0x0001  /* Operand Cache Enable */
 #define CCR_CACHE_WT    0x0002  /* Write-Through (for P0,U0,P3) (else writeback)*/
 #define CCR_CACHE_CB    0x0004  /* Copy-Back (for P1) (else writethrough) */
diff --git a/arch/sh/kernel/cpu/init.c b/arch/sh/kernel/cpu/init.c
index ecf83cd158dc..0d7360d549c1 100644
--- a/arch/sh/kernel/cpu/init.c
+++ b/arch/sh/kernel/cpu/init.c
@@ -112,7 +112,7 @@ static void cache_init(void)
         unsigned long ccr, flags;
 
         jump_to_uncached();
-        ccr = __raw_readl(CCR);
+        ccr = __raw_readl(SH_CCR);
 
         /*
          * At this point we don't know whether the cache is enabled or not - a
@@ -189,7 +189,7 @@ static void cache_init(void)
 
         l2_cache_init();
 
-        __raw_writel(flags, CCR);
+        __raw_writel(flags, SH_CCR);
         back_to_cached();
 }
 #else
diff --git a/arch/sh/mm/cache-debugfs.c b/arch/sh/mm/cache-debugfs.c
index 115725198038..777e50f33c00 100644
--- a/arch/sh/mm/cache-debugfs.c
+++ b/arch/sh/mm/cache-debugfs.c
@@ -36,7 +36,7 @@ static int cache_seq_show(struct seq_file *file, void *iter)
          */
         jump_to_uncached();
 
-        ccr = __raw_readl(CCR);
+        ccr = __raw_readl(SH_CCR);
         if ((ccr & CCR_CACHE_ENABLE) == 0) {
                 back_to_cached();
 
diff --git a/arch/sh/mm/cache-sh2.c b/arch/sh/mm/cache-sh2.c
index defcf719f2e8..a74259f2f981 100644
--- a/arch/sh/mm/cache-sh2.c
+++ b/arch/sh/mm/cache-sh2.c
@@ -63,9 +63,9 @@ static void sh2__flush_invalidate_region(void *start, int size)
         local_irq_save(flags);
         jump_to_uncached();
 
-        ccr = __raw_readl(CCR);
+        ccr = __raw_readl(SH_CCR);
         ccr |= CCR_CACHE_INVALIDATE;
-        __raw_writel(ccr, CCR);
+        __raw_writel(ccr, SH_CCR);
 
         back_to_cached();
         local_irq_restore(flags);
diff --git a/arch/sh/mm/cache-sh2a.c b/arch/sh/mm/cache-sh2a.c
index 949e2d3138a0..ee87d081259b 100644
--- a/arch/sh/mm/cache-sh2a.c
+++ b/arch/sh/mm/cache-sh2a.c
@@ -134,7 +134,8 @@ static void sh2a__flush_invalidate_region(void *start, int size)
 
         /* If there are too many pages then just blow the cache */
         if (((end - begin) >> PAGE_SHIFT) >= MAX_OCACHE_PAGES) {
-                __raw_writel(__raw_readl(CCR) | CCR_OCACHE_INVALIDATE, CCR);
+                __raw_writel(__raw_readl(SH_CCR) | CCR_OCACHE_INVALIDATE,
+                             SH_CCR);
         } else {
                 for (v = begin; v < end; v += L1_CACHE_BYTES)
                         sh2a_invalidate_line(CACHE_OC_ADDRESS_ARRAY, v);
@@ -167,7 +168,8 @@ static void sh2a_flush_icache_range(void *args)
         /* I-Cache invalidate */
         /* If there are too many pages then just blow the cache */
         if (((end - start) >> PAGE_SHIFT) >= MAX_ICACHE_PAGES) {
-                __raw_writel(__raw_readl(CCR) | CCR_ICACHE_INVALIDATE, CCR);
+                __raw_writel(__raw_readl(SH_CCR) | CCR_ICACHE_INVALIDATE,
+                             SH_CCR);
         } else {
                 for (v = start; v < end; v += L1_CACHE_BYTES)
                         sh2a_invalidate_line(CACHE_IC_ADDRESS_ARRAY, v);
diff --git a/arch/sh/mm/cache-sh4.c b/arch/sh/mm/cache-sh4.c
index 0e529285b28d..51d8f7f31d1d 100644
--- a/arch/sh/mm/cache-sh4.c
+++ b/arch/sh/mm/cache-sh4.c
@@ -133,9 +133,9 @@ static void flush_icache_all(void)
         jump_to_uncached();
 
         /* Flush I-cache */
-        ccr = __raw_readl(CCR);
+        ccr = __raw_readl(SH_CCR);
         ccr |= CCR_CACHE_ICI;
-        __raw_writel(ccr, CCR);
+        __raw_writel(ccr, SH_CCR);
 
         /*
          * back_to_cached() will take care of the barrier for us, don't add
diff --git a/arch/sh/mm/cache-shx3.c b/arch/sh/mm/cache-shx3.c
index c0adbee97b5f..24c58b7dc022 100644
--- a/arch/sh/mm/cache-shx3.c
+++ b/arch/sh/mm/cache-shx3.c
@@ -19,7 +19,7 @@ void __init shx3_cache_init(void)
 {
         unsigned int ccr;
 
-        ccr = __raw_readl(CCR);
+        ccr = __raw_readl(SH_CCR);
 
         /*
          * If we've got cache aliases, resolve them in hardware.
@@ -40,5 +40,5 @@ void __init shx3_cache_init(void)
         ccr |= CCR_CACHE_IBE;
 #endif
 
-        writel_uncached(ccr, CCR);
+        writel_uncached(ccr, SH_CCR);
 }
diff --git a/arch/sh/mm/cache.c b/arch/sh/mm/cache.c
index 616966a96cba..097c2cdd117f 100644
--- a/arch/sh/mm/cache.c
+++ b/arch/sh/mm/cache.c
@@ -285,8 +285,8 @@ void __init cpu_cache_init(void)
 {
         unsigned int cache_disabled = 0;
 
-#ifdef CCR
-        cache_disabled = !(__raw_readl(CCR) & CCR_CACHE_ENABLE);
+#ifdef SH_CCR
+        cache_disabled = !(__raw_readl(SH_CCR) & CCR_CACHE_ENABLE);
 #endif
 
         compute_alias(&boot_cpu_data.icache);
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index 32a280ec38c1..d7b4967f8fa6 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -58,9 +58,12 @@ void arch_cpu_idle(void)
 {
         if (tlb_type != hypervisor) {
                 touch_nmi_watchdog();
+                local_irq_enable();
         } else {
                 unsigned long pstate;
 
+                local_irq_enable();
+
                 /* The sun4v sleeping code requires that we have PSTATE.IE cleared over
                  * the cpu sleep hypervisor call.
                  */
@@ -82,7 +85,6 @@ void arch_cpu_idle(void)
                         : "=&r" (pstate)
                         : "i" (PSTATE_IE));
         }
-        local_irq_enable();
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
index 87729fff13b9..33a17e7b3ccd 100644
--- a/arch/sparc/kernel/syscalls.S
+++ b/arch/sparc/kernel/syscalls.S
@@ -189,7 +189,8 @@ linux_sparc_syscall32:
          mov    %i0, %l5                                ! IEU1
 5:      call    %l7                                     ! CTI   Group brk forced
          srl    %i5, 0, %o5                             ! IEU1
-        ba,a,pt %xcc, 3f
+        ba,pt   %xcc, 3f
+         sra    %o0, 0, %o0
 
         /* Linux native system calls enter here... */
         .align  32
@@ -217,7 +218,6 @@ linux_sparc_syscall:
 3:      stx     %o0, [%sp + PTREGS_OFF + PT_V9_I0]
 ret_sys_call:
         ldx     [%sp + PTREGS_OFF + PT_V9_TSTATE], %g3
-        sra     %o0, 0, %o0
         mov     %ulo(TSTATE_XCARRY | TSTATE_ICARRY), %g2
         sllx    %g2, 32, %g2
 
diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
index 3b3a360b429a..f5d506fdddad 100644
--- a/arch/sparc/mm/tsb.c
+++ b/arch/sparc/mm/tsb.c
@@ -273,7 +273,7 @@ void __init pgtable_cache_init(void)
                 prom_halt();
         }
 
-        for (i = 0; i < 8; i++) {
+        for (i = 0; i < ARRAY_SIZE(tsb_cache_names); i++) {
                 unsigned long size = 8192 << i;
                 const char *name = tsb_cache_names[i];
 
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index c026cca5602c..f3aaf231b4e5 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -341,10 +341,6 @@ config X86_USE_3DNOW
         def_bool y
         depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
 
-config X86_OOSTORE
-        def_bool y
-        depends on (MWINCHIP3D || MWINCHIPC6) && MTRR
-
 #
 # P6_NOPs are a relatively minor optimization that require a family >=
 # 6 processor, except that it is broken on certain VIA chips.
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index 04a48903b2eb..69bbb4845020 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -85,11 +85,7 @@
 #else
 # define smp_rmb()      barrier()
 #endif
-#ifdef CONFIG_X86_OOSTORE
-# define smp_wmb()      wmb()
-#else
-# define smp_wmb()      barrier()
-#endif
+#define smp_wmb()       barrier()
 #define smp_read_barrier_depends()      read_barrier_depends()
 #define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
 #else /* !SMP */
@@ -100,7 +96,7 @@
 #define set_mb(var, value) do { var = value; barrier(); } while (0)
 #endif /* SMP */
 
-#if defined(CONFIG_X86_OOSTORE) || defined(CONFIG_X86_PPRO_FENCE)
+#if defined(CONFIG_X86_PPRO_FENCE)
 
 /*
  * For either of these options x86 doesn't have a strong TSO memory
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index 3d6b9f81cc68..acd86c850414 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -134,6 +134,7 @@ extern void efi_setup_page_tables(void);
 extern void __init old_map_region(efi_memory_desc_t *md);
 extern void __init runtime_code_page_mkexec(void);
 extern void __init efi_runtime_mkexec(void);
+extern void __init efi_apply_memmap_quirks(void);
 
 struct efi_setup_data {
         u64 fw_vendor;
diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
index 34f69cb9350a..91d9c69a629e 100644
--- a/arch/x86/include/asm/io.h
+++ b/arch/x86/include/asm/io.h
@@ -237,7 +237,7 @@ memcpy_toio(volatile void __iomem *dst, const void *src, size_t count)
 
 static inline void flush_write_buffers(void)
 {
-#if defined(CONFIG_X86_OOSTORE) || defined(CONFIG_X86_PPRO_FENCE)
+#if defined(CONFIG_X86_PPRO_FENCE)
         asm volatile("lock; addl $0,0(%%esp)": : :"memory");
 #endif
 }
diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
index bf156ded74b5..0f62f5482d91 100644
--- a/arch/x86/include/asm/spinlock.h
+++ b/arch/x86/include/asm/spinlock.h
@@ -26,10 +26,9 @@
 # define LOCK_PTR_REG "D"
 #endif
 
-#if defined(CONFIG_X86_32) && \
-        (defined(CONFIG_X86_OOSTORE) || defined(CONFIG_X86_PPRO_FENCE))
+#if defined(CONFIG_X86_32) && (defined(CONFIG_X86_PPRO_FENCE))
 /*
- * On PPro SMP or if we are using OOSTORE, we use a locked operation to unlock
+ * On PPro SMP, we use a locked operation to unlock
  * (PPro errata 66, 92)
  */
 # define UNLOCK_LOCK_PREFIX LOCK_PREFIX
diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
index fd972a3e4cbb..9fa8aa051f54 100644
--- a/arch/x86/kernel/aperture_64.c
+++ b/arch/x86/kernel/aperture_64.c
@@ -18,7 +18,6 @@
 #include <linux/pci_ids.h>
 #include <linux/pci.h>
 #include <linux/bitops.h>
-#include <linux/ioport.h>
 #include <linux/suspend.h>
 #include <asm/e820.h>
 #include <asm/io.h>
@@ -54,18 +53,6 @@ int fallback_aper_force __initdata;
 
 int fix_aperture __initdata = 1;
 
-static struct resource gart_resource = {
-        .name   = "GART",
-        .flags  = IORESOURCE_MEM,
-};
-
-static void __init insert_aperture_resource(u32 aper_base, u32 aper_size)
-{
-        gart_resource.start = aper_base;
-        gart_resource.end = aper_base + aper_size - 1;
-        insert_resource(&iomem_resource, &gart_resource);
-}
-
 /* This code runs before the PCI subsystem is initialized, so just
    access the northbridge directly. */
 
@@ -96,7 +83,6 @@ static u32 __init allocate_aperture(void)
         memblock_reserve(addr, aper_size);
         printk(KERN_INFO "Mapping aperture over %d KB of RAM @ %lx\n",
                         aper_size >> 10, addr);
-        insert_aperture_resource((u32)addr, aper_size);
         register_nosave_region(addr >> PAGE_SHIFT,
                                (addr+aper_size) >> PAGE_SHIFT);
 
@@ -444,12 +430,8 @@ int __init gart_iommu_hole_init(void)
 
 out:
         if (!fix && !fallback_aper_force) {
-                if (last_aper_base) {
-                        unsigned long n = (32 * 1024 * 1024) << last_aper_order;
-
-                        insert_aperture_resource((u32)last_aper_base, n);
+                if (last_aper_base)
                         return 1;
-                }
                 return 0;
         }
 
diff --git a/arch/x86/kernel/cpu/centaur.c b/arch/x86/kernel/cpu/centaur.c
index 8779edab684e..d8fba5c15fbd 100644
--- a/arch/x86/kernel/cpu/centaur.c
+++ b/arch/x86/kernel/cpu/centaur.c
@@ -8,236 +8,6 @@
 
 #include "cpu.h"
 
-#ifdef CONFIG_X86_OOSTORE
-
-static u32 power2(u32 x)
-{
-        u32 s = 1;
-
-        while (s <= x)
-                s <<= 1;
-
-        return s >>= 1;
-}
-
-
-/*
- * Set up an actual MCR
- */
-static void centaur_mcr_insert(int reg, u32 base, u32 size, int key)
-{
-        u32 lo, hi;
-
-        hi = base & ~0xFFF;
-        lo = ~(size-1);         /* Size is a power of 2 so this makes a mask */
-        lo &= ~0xFFF;           /* Remove the ctrl value bits */
-        lo |= key;              /* Attribute we wish to set */
-        wrmsr(reg+MSR_IDT_MCR0, lo, hi);
-        mtrr_centaur_report_mcr(reg, lo, hi);   /* Tell the mtrr driver */
-}
-
-/*
- * Figure what we can cover with MCR's
- *
- * Shortcut: We know you can't put 4Gig of RAM on a winchip
- */
-static u32 ramtop(void)
-{
-        u32 clip = 0xFFFFFFFFUL;
-        u32 top = 0;
-        int i;
-
-        for (i = 0; i < e820.nr_map; i++) {
-                unsigned long start, end;
-
-                if (e820.map[i].addr > 0xFFFFFFFFUL)
-                        continue;
-                /*
-                 * Don't MCR over reserved space. Ignore the ISA hole
-                 * we frob around that catastrophe already
-                 */
-                if (e820.map[i].type == E820_RESERVED) {
-                        if (e820.map[i].addr >= 0x100000UL &&
-                            e820.map[i].addr < clip)
-                                clip = e820.map[i].addr;
-                        continue;
-                }
-                start = e820.map[i].addr;
-                end = e820.map[i].addr + e820.map[i].size;
-                if (start >= end)
-                        continue;
-                if (end > top)
-                        top = end;
-        }
-        /*
-         * Everything below 'top' should be RAM except for the ISA hole.
-         * Because of the limited MCR's we want to map NV/ACPI into our
-         * MCR range for gunk in RAM
-         *
-         * Clip might cause us to MCR insufficient RAM but that is an
-         * acceptable failure mode and should only bite obscure boxes with
-         * a VESA hole at 15Mb
-         *
-         * The second case Clip sometimes kicks in is when the EBDA is marked
-         * as reserved. Again we fail safe with reasonable results
-         */
-        if (top > clip)
-                top = clip;
-
-        return top;
-}
-
-/*
- * Compute a set of MCR's to give maximum coverage
- */
-static int centaur_mcr_compute(int nr, int key)
-{
-        u32 mem = ramtop();
-        u32 root = power2(mem);
-        u32 base = root;
-        u32 top = root;
-        u32 floor = 0;
-        int ct = 0;
-
-        while (ct < nr) {
-                u32 fspace = 0;
-                u32 high;
-                u32 low;
-
-                /*
-                 * Find the largest block we will fill going upwards
-                 */
-                high = power2(mem-top);
-
-                /*
-                 * Find the largest block we will fill going downwards
-                 */
-                low = base/2;
-
-                /*
-                 * Don't fill below 1Mb going downwards as there
-                 * is an ISA hole in the way.
-                 */
-                if (base <= 1024*1024)
-                        low = 0;
-
-                /*
-                 * See how much space we could cover by filling below
-                 * the ISA hole
-                 */
-
-                if (floor == 0)
-                        fspace = 512*1024;
-                else if (floor == 512*1024)
-                        fspace = 128*1024;
-
-                /* And forget ROM space */
-
-                /*
-                 * Now install the largest coverage we get
-                 */
-                if (fspace > high && fspace > low) {
-                        centaur_mcr_insert(ct, floor, fspace, key);
-                        floor += fspace;
-                } else if (high > low) {
-                        centaur_mcr_insert(ct, top, high, key);
-                        top += high;
-                } else if (low > 0) {
-                        base -= low;
-                        centaur_mcr_insert(ct, base, low, key);
-                } else
-                        break;
-                ct++;
-        }
-        /*
-         * We loaded ct values. We now need to set the mask. The caller
-         * must do this bit.
-         */
-        return ct;
-}
-
-static void centaur_create_optimal_mcr(void)
-{
-        int used;
-        int i;
-
-        /*
-         * Allocate up to 6 mcrs to mark as much of ram as possible
-         * as write combining and weak write ordered.
-         *
-         * To experiment with: Linux never uses stack operations for
-         * mmio spaces so we could globally enable stack operation wc
-         *
-         * Load the registers with type 31 - full write combining, all
-         * writes weakly ordered.
-         */
-        used = centaur_mcr_compute(6, 31);
-
-        /*
-         * Wipe unused MCRs
-         */
-        for (i = used; i < 8; i++)
-                wrmsr(MSR_IDT_MCR0+i, 0, 0);
-}
-
-static void winchip2_create_optimal_mcr(void)
-{
-        u32 lo, hi;
-        int used;
-        int i;
-
-        /*
-         * Allocate up to 6 mcrs to mark as much of ram as possible
-         * as write combining, weak store ordered.
-         *
-         * Load the registers with type 25
-         *      8       -       weak write ordering
-         *      16      -       weak read ordering
-         *      1       -       write combining
-         */
-        used = centaur_mcr_compute(6, 25);
-
-        /*
-         * Mark the registers we are using.
-         */
-        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        for (i = 0; i < used; i++)
-                lo |= 1<<(9+i);
-        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-
-        /*
-         * Wipe unused MCRs
-         */
-
-        for (i = used; i < 8; i++)
-                wrmsr(MSR_IDT_MCR0+i, 0, 0);
-}
-
-/*
- * Handle the MCR key on the Winchip 2.
- */
-static void winchip2_unprotect_mcr(void)
-{
-        u32 lo, hi;
-        u32 key;
-
-        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        lo &= ~0x1C0;   /* blank bits 8-6 */
-        key = (lo>>17) & 7;
-        lo |= key<<6;   /* replace with unlock key */
-        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-}
-
-static void winchip2_protect_mcr(void)
-{
-        u32 lo, hi;
-
-        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-        lo &= ~0x1C0;   /* blank bits 8-6 */
-        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-}
-#endif /* CONFIG_X86_OOSTORE */
-
 #define ACE_PRESENT     (1 << 6)
 #define ACE_ENABLED     (1 << 7)
 #define ACE_FCR         (1 << 28)       /* MSR_VIA_FCR */
@@ -362,20 +132,6 @@ static void init_centaur(struct cpuinfo_x86 *c)
                         fcr_clr = DPDC;
                         printk(KERN_NOTICE "Disabling bugged TSC.\n");
                         clear_cpu_cap(c, X86_FEATURE_TSC);
-#ifdef CONFIG_X86_OOSTORE
-                        centaur_create_optimal_mcr();
-                        /*
-                         * Enable:
-                         *      write combining on non-stack, non-string
-                         *      write combining on string, all types
-                         *      weak write ordering
-                         *
-                         * The C6 original lacks weak read order
-                         *
-                         * Note 0x120 is write only on Winchip 1
-                         */
-                        wrmsr(MSR_IDT_MCR_CTRL, 0x01F0001F, 0);
-#endif
                         break;
                 case 8:
                         switch (c->x86_mask) {
@@ -392,40 +148,12 @@ static void init_centaur(struct cpuinfo_x86 *c)
                         fcr_set = ECX8|DSMC|DTLOCK|EMMX|EBRPRED|ERETSTK|
                                   E2MMX|EAMD3D;
                         fcr_clr = DPDC;
-#ifdef CONFIG_X86_OOSTORE
-                        winchip2_unprotect_mcr();
-                        winchip2_create_optimal_mcr();
-                        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        /*
-                         * Enable:
-                         *      write combining on non-stack, non-string
-                         *      write combining on string, all types
-                         *      weak write ordering
-                         */
-                        lo |= 31;
-                        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        winchip2_protect_mcr();
-#endif
                         break;
                 case 9:
                         name = "3";
                         fcr_set = ECX8|DSMC|DTLOCK|EMMX|EBRPRED|ERETSTK|
                                   E2MMX|EAMD3D;
                         fcr_clr = DPDC;
-#ifdef CONFIG_X86_OOSTORE
-                        winchip2_unprotect_mcr();
-                        winchip2_create_optimal_mcr();
-                        rdmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        /*
-                         * Enable:
-                         *      write combining on non-stack, non-string
-                         *      write combining on string, all types
-                         *      weak write ordering
-                         */
-                        lo |= 31;
-                        wrmsr(MSR_IDT_MCR_CTRL, lo, hi);
-                        winchip2_protect_mcr();
-#endif
                         break;
                 default:
                         name = "??";
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index c88f7f4b03ee..047f540cf3f7 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -3334,6 +3334,8 @@ static int __init uncore_type_init(struct intel_uncore_type *type)
         if (!pmus)
                 return -ENOMEM;
 
+        type->pmus = pmus;
+
         type->unconstrainted = (struct event_constraint)
                 __EVENT_CONSTRAINT(0, (1ULL << type->num_counters) - 1,
                                 0, type->num_counters, 0, 0);
@@ -3369,7 +3371,6 @@ static int __init uncore_type_init(struct intel_uncore_type *type)
         }
 
         type->pmu_group = &uncore_pmu_attr_group;
-        type->pmus = pmus;
         return 0;
 fail:
         uncore_type_exit(type);
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index 81ba27679f18..f36bd42d6f0c 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -544,6 +544,10 @@ ENDPROC(early_idt_handlers)
         /* This is global to keep gas from relaxing the jumps */
 ENTRY(early_idt_handler)
         cld
+
+        cmpl $2,(%esp)          # X86_TRAP_NMI
+        je is_nmi               # Ignore NMI
+
         cmpl $2,%ss:early_recursion_flag
         je hlt_loop
         incl %ss:early_recursion_flag
@@ -594,8 +598,9 @@ ex_entry:
         pop %edx
         pop %ecx
         pop %eax
-        addl $8,%esp            /* drop vector number and error code */
         decl %ss:early_recursion_flag
+is_nmi:
+        addl $8,%esp            /* drop vector number and error code */
         iret
 ENDPROC(early_idt_handler)
 
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index e1aabdb314c8..a468c0a65c42 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -343,6 +343,9 @@ early_idt_handlers:
 ENTRY(early_idt_handler)
         cld
 
+        cmpl $2,(%rsp)          # X86_TRAP_NMI
+        je is_nmi               # Ignore NMI
+
         cmpl $2,early_recursion_flag(%rip)
         jz  1f
         incl early_recursion_flag(%rip)
@@ -405,8 +408,9 @@ ENTRY(early_idt_handler)
         popq %rdx
         popq %rcx
         popq %rax
-        addq $16,%rsp           # drop vector number and error code
         decl early_recursion_flag(%rip)
+is_nmi:
+        addq $16,%rsp           # drop vector number and error code
         INTERRUPT_RETURN
 ENDPROC(early_idt_handler)
 
diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
index e8368c6dd2a2..d5dd80814419 100644
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -86,10 +86,19 @@ EXPORT_SYMBOL(__kernel_fpu_begin);
 
 void __kernel_fpu_end(void)
 {
-        if (use_eager_fpu())
-                math_state_restore();
-        else
+        if (use_eager_fpu()) {
+                /*
+                 * For eager fpu, most the time, tsk_used_math() is true.
+                 * Restore the user math as we are done with the kernel usage.
+                 * At few instances during thread exit, signal handling etc,
+                 * tsk_used_math() is false. Those few places will take proper
+                 * actions, so we don't need to restore the math here.
+                 */
+                if (likely(tsk_used_math(current)))
+                        math_state_restore();
+        } else {
                 stts();
+        }
 }
 EXPORT_SYMBOL(__kernel_fpu_end);
 
diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
index 7c6acd4b8995..ff898bbf579d 100644
--- a/arch/x86/kernel/quirks.c
+++ b/arch/x86/kernel/quirks.c
@@ -529,7 +529,7 @@ static void quirk_amd_nb_node(struct pci_dev *dev)
                 return;
 
         pci_read_config_dword(nb_ht, 0x60, &val);
-        node = val & 7;
+        node = pcibus_to_node(dev->bus) | (val & 7);
         /*
          * Some hardware may return an invalid node ID,
          * so check it first:
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 06853e670354..ce72964b2f46 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1239,14 +1239,8 @@ void __init setup_arch(char **cmdline_p)
         register_refined_jiffies(CLOCK_TICK_RATE);
 
 #ifdef CONFIG_EFI
-        /* Once setup is done above, unmap the EFI memory map on
-         * mismatched firmware/kernel archtectures since there is no
-         * support for runtime services.
-         */
-        if (efi_enabled(EFI_BOOT) && !efi_is_native()) {
-                pr_info("efi: Setup done, disabling due to 32/64-bit mismatch\n");
-                efi_unmap_memmap();
-        }
+        if (efi_enabled(EFI_BOOT))
+                efi_apply_memmap_quirks();
 #endif
 }
 
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index e81df8fce027..2de1bc09a8d4 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3002,10 +3002,8 @@ static int cr8_write_interception(struct vcpu_svm *svm)
         u8 cr8_prev = kvm_get_cr8(&svm->vcpu);
         /* instruction emulation calls kvm_set_cr8() */
         r = cr_interception(svm);
-        if (irqchip_in_kernel(svm->vcpu.kvm)) {
-                clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
+        if (irqchip_in_kernel(svm->vcpu.kvm))
                 return r;
-        }
         if (cr8_prev <= kvm_get_cr8(&svm->vcpu))
                 return r;
         kvm_run->exit_reason = KVM_EXIT_SET_TPR;
@@ -3567,6 +3565,8 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
         if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
                 return;
 
+        clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
+
         if (irr == -1)
                 return;
 
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 6dea040cc3a1..a10c8c792161 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1020,13 +1020,17 @@ static inline bool smap_violation(int error_code, struct pt_regs *regs)
  * This routine handles page faults.  It determines the address,
  * and the problem, and then passes it off to one of the appropriate
  * routines.
+ *
+ * This function must have noinline because both callers
+ * {,trace_}do_page_fault() have notrace on. Having this an actual function
+ * guarantees there's a function trace entry.
  */
-static void __kprobes
-__do_page_fault(struct pt_regs *regs, unsigned long error_code)
+static void __kprobes noinline
+__do_page_fault(struct pt_regs *regs, unsigned long error_code,
+                unsigned long address)
 {
         struct vm_area_struct *vma;
         struct task_struct *tsk;
-        unsigned long address;
         struct mm_struct *mm;
         int fault;
         unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
@@ -1034,9 +1038,6 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
         tsk = current;
         mm = tsk->mm;
 
-        /* Get the faulting address: */
-        address = read_cr2();
-
         /*
          * Detect and handle instructions that would cause a page fault for
          * both a tracked kernel page and a userspace page.
@@ -1248,32 +1249,50 @@ good_area:
         up_read(&mm->mmap_sem);
 }
 
-dotraplinkage void __kprobes
+dotraplinkage void __kprobes notrace
 do_page_fault(struct pt_regs *regs, unsigned long error_code)
 {
+        unsigned long address = read_cr2(); /* Get the faulting address */
         enum ctx_state prev_state;
 
+        /*
+         * We must have this function tagged with __kprobes, notrace and call
+         * read_cr2() before calling anything else. To avoid calling any kind
+         * of tracing machinery before we've observed the CR2 value.
+         *
+         * exception_{enter,exit}() contain all sorts of tracepoints.
+         */
+
         prev_state = exception_enter();
-        __do_page_fault(regs, error_code);
+        __do_page_fault(regs, error_code, address);
         exception_exit(prev_state);
 }
 
-static void trace_page_fault_entries(struct pt_regs *regs,
+#ifdef CONFIG_TRACING
+static void trace_page_fault_entries(unsigned long address, struct pt_regs *regs,
                                      unsigned long error_code)
 {
         if (user_mode(regs))
-                trace_page_fault_user(read_cr2(), regs, error_code);
+                trace_page_fault_user(address, regs, error_code);
         else
-                trace_page_fault_kernel(read_cr2(), regs, error_code);
+                trace_page_fault_kernel(address, regs, error_code);
 }
 
-dotraplinkage void __kprobes
+dotraplinkage void __kprobes notrace
 trace_do_page_fault(struct pt_regs *regs, unsigned long error_code)
 {
+        /*
+         * The exception_enter and tracepoint processing could
+         * trigger another page faults (user space callchain
+         * reading) and destroy the original cr2 value, so read
+         * the faulting address now.
+         */
+        unsigned long address = read_cr2();
         enum ctx_state prev_state;
 
         prev_state = exception_enter();
-        trace_page_fault_entries(regs, error_code);
-        __do_page_fault(regs, error_code);
+        trace_page_fault_entries(address, regs, error_code);
+        __do_page_fault(regs, error_code, address);
         exception_exit(prev_state);
 }
+#endif /* CONFIG_TRACING */
diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S
index 877b9a1b2152..01495755701b 100644
--- a/arch/x86/net/bpf_jit.S
+++ b/arch/x86/net/bpf_jit.S
@@ -140,7 +140,7 @@ bpf_slow_path_byte_msh:
         push    %r9;                                            \
         push    SKBDATA;                                        \
 /* rsi already has offset */                                    \
-        mov     $SIZE,%ecx;     /* size */                      \
+        mov     $SIZE,%edx;     /* size */                      \
         call    bpf_internal_load_pointer_neg_helper;           \
         test    %rax,%rax;                                      \
         pop     SKBDATA;                                        \
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 1a201ac7cef8..b97acecf3fd9 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -52,6 +52,7 @@
 #include <asm/tlbflush.h>
 #include <asm/x86_init.h>
 #include <asm/rtc.h>
+#include <asm/uv/uv.h>
 
 #define EFI_DEBUG
 
@@ -1210,3 +1211,22 @@ static int __init parse_efi_cmdline(char *str)
         return 0;
 }
 early_param("efi", parse_efi_cmdline);
+
+void __init efi_apply_memmap_quirks(void)
+{
+        /*
+         * Once setup is done earlier, unmap the EFI memory map on mismatched
+         * firmware/kernel architectures since there is no support for runtime
+         * services.
+         */
+        if (!efi_is_native()) {
+                pr_info("efi: Setup done, disabling due to 32/64-bit mismatch\n");
+                efi_unmap_memmap();
+        }
+
+        /*
+         * UV doesn't support the new EFI pagetable mapping yet.
+         */
+        if (is_uv_system())
+                set_bit(EFI_OLD_MEMMAP, &x86_efi_facility);
+}
diff --git a/arch/x86/um/asm/barrier.h b/arch/x86/um/asm/barrier.h
index 7d01b8c56c00..cc04e67bfd05 100644
--- a/arch/x86/um/asm/barrier.h
+++ b/arch/x86/um/asm/barrier.h
@@ -40,11 +40,7 @@
 #define smp_rmb()       barrier()
 #endif /* CONFIG_X86_PPRO_FENCE */
 
-#ifdef CONFIG_X86_OOSTORE
-#define smp_wmb()       wmb()
-#else /* CONFIG_X86_OOSTORE */
 #define smp_wmb()       barrier()
-#endif /* CONFIG_X86_OOSTORE */
 
 #define smp_read_barrier_depends()      read_barrier_depends()
 #define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
diff --git a/block/blk-core.c b/block/blk-core.c
index 853f92749202..bfe16d5af9f9 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -693,20 +693,11 @@ blk_init_queue_node(request_fn_proc *rfn, spinlock_t *lock, int node_id)
         if (!uninit_q)
                 return NULL;
 
-        uninit_q->flush_rq = kzalloc(sizeof(struct request), GFP_KERNEL);
-        if (!uninit_q->flush_rq)
-                goto out_cleanup_queue;
-
         q = blk_init_allocated_queue(uninit_q, rfn, lock);
         if (!q)
-                goto out_free_flush_rq;
-        return q;
+                blk_cleanup_queue(uninit_q);
 
-out_free_flush_rq:
-        kfree(uninit_q->flush_rq);
-out_cleanup_queue:
-        blk_cleanup_queue(uninit_q);
-        return NULL;
+        return q;
 }
 EXPORT_SYMBOL(blk_init_queue_node);
 
@@ -717,9 +708,13 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
         if (!q)
                 return NULL;
 
-        if (blk_init_rl(&q->root_rl, q, GFP_KERNEL))
+        q->flush_rq = kzalloc(sizeof(struct request), GFP_KERNEL);
+        if (!q->flush_rq)
                 return NULL;
 
+        if (blk_init_rl(&q->root_rl, q, GFP_KERNEL))
+                goto fail;
+
         q->request_fn           = rfn;
         q->prep_rq_fn           = NULL;
         q->unprep_rq_fn         = NULL;
@@ -742,12 +737,16 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn,
         /* init elevator */
         if (elevator_init(q, NULL)) {
                 mutex_unlock(&q->sysfs_lock);
-                return NULL;
+                goto fail;
         }
 
         mutex_unlock(&q->sysfs_lock);
 
         return q;
+
+fail:
+        kfree(q->flush_rq);
+        return NULL;
 }
 EXPORT_SYMBOL(blk_init_allocated_queue);
 
diff --git a/block/blk-exec.c b/block/blk-exec.c
index c68613bb4c79..dbf4502b1d67 100644
--- a/block/blk-exec.c
+++ b/block/blk-exec.c
@@ -65,7 +65,7 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk,
          * be resued after dying flag is set
          */
         if (q->mq_ops) {
-                blk_mq_insert_request(q, rq, at_head, true);
+                blk_mq_insert_request(rq, at_head, true, false);
                 return;
         }
 
diff --git a/block/blk-flush.c b/block/blk-flush.c
index 66e2b697f5db..43e6b4755e9a 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -137,17 +137,20 @@ static void mq_flush_run(struct work_struct *work)
         rq = container_of(work, struct request, mq_flush_work);
 
         memset(&rq->csd, 0, sizeof(rq->csd));
-        blk_mq_run_request(rq, true, false);
+        blk_mq_insert_request(rq, false, true, false);
 }
 
-static bool blk_flush_queue_rq(struct request *rq)
+static bool blk_flush_queue_rq(struct request *rq, bool add_front)
 {
         if (rq->q->mq_ops) {
                 INIT_WORK(&rq->mq_flush_work, mq_flush_run);
                 kblockd_schedule_work(rq->q, &rq->mq_flush_work);
                 return false;
         } else {
-                list_add_tail(&rq->queuelist, &rq->q->queue_head);
+                if (add_front)
+                        list_add(&rq->queuelist, &rq->q->queue_head);
+                else
+                        list_add_tail(&rq->queuelist, &rq->q->queue_head);
                 return true;
         }
 }
@@ -193,7 +196,7 @@ static bool blk_flush_complete_seq(struct request *rq, unsigned int seq,
 
         case REQ_FSEQ_DATA:
                 list_move_tail(&rq->flush.list, &q->flush_data_in_flight);
-                queued = blk_flush_queue_rq(rq);
+                queued = blk_flush_queue_rq(rq, true);
                 break;
 
         case REQ_FSEQ_DONE:
@@ -326,7 +329,7 @@ static bool blk_kick_flush(struct request_queue *q)
         q->flush_rq->rq_disk = first_rq->rq_disk;
         q->flush_rq->end_io = flush_end_io;
 
-        return blk_flush_queue_rq(q->flush_rq);
+        return blk_flush_queue_rq(q->flush_rq, false);
 }
 
 static void flush_data_end_io(struct request *rq, int error)
@@ -411,7 +414,7 @@ void blk_insert_flush(struct request *rq)
         if ((policy & REQ_FSEQ_DATA) &&
             !(policy & (REQ_FSEQ_PREFLUSH | REQ_FSEQ_POSTFLUSH))) {
                 if (q->mq_ops) {
-                        blk_mq_run_request(rq, false, true);
+                        blk_mq_insert_request(rq, false, false, true);
                 } else
                         list_add_tail(&rq->queuelist, &q->queue_head);
                 return;
diff --git a/block/blk-mq-cpu.c b/block/blk-mq-cpu.c
index 3146befb56aa..136ef8643bba 100644
--- a/block/blk-mq-cpu.c
+++ b/block/blk-mq-cpu.c
@@ -11,7 +11,7 @@
 #include "blk-mq.h"
 
 static LIST_HEAD(blk_mq_cpu_notify_list);
-static DEFINE_SPINLOCK(blk_mq_cpu_notify_lock);
+static DEFINE_RAW_SPINLOCK(blk_mq_cpu_notify_lock);
 
 static int blk_mq_main_cpu_notify(struct notifier_block *self,
                                   unsigned long action, void *hcpu)
@@ -19,12 +19,12 @@ static int blk_mq_main_cpu_notify(struct notifier_block *self,
         unsigned int cpu = (unsigned long) hcpu;
         struct blk_mq_cpu_notifier *notify;
 
-        spin_lock(&blk_mq_cpu_notify_lock);
+        raw_spin_lock(&blk_mq_cpu_notify_lock);
 
         list_for_each_entry(notify, &blk_mq_cpu_notify_list, list)
                 notify->notify(notify->data, action, cpu);
 
-        spin_unlock(&blk_mq_cpu_notify_lock);
+        raw_spin_unlock(&blk_mq_cpu_notify_lock);
         return NOTIFY_OK;
 }
 
@@ -32,16 +32,16 @@ void blk_mq_register_cpu_notifier(struct blk_mq_cpu_notifier *notifier)
 {
         BUG_ON(!notifier->notify);
 
-        spin_lock(&blk_mq_cpu_notify_lock);
+        raw_spin_lock(&blk_mq_cpu_notify_lock);
         list_add_tail(&notifier->list, &blk_mq_cpu_notify_list);
-        spin_unlock(&blk_mq_cpu_notify_lock);
+        raw_spin_unlock(&blk_mq_cpu_notify_lock);
 }
 
 void blk_mq_unregister_cpu_notifier(struct blk_mq_cpu_notifier *notifier)
 {
-        spin_lock(&blk_mq_cpu_notify_lock);
+        raw_spin_lock(&blk_mq_cpu_notify_lock);
         list_del(&notifier->list);
-        spin_unlock(&blk_mq_cpu_notify_lock);
+        raw_spin_unlock(&blk_mq_cpu_notify_lock);
 }
 
 void blk_mq_init_cpu_notifier(struct blk_mq_cpu_notifier *notifier,
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 1fa9dd153fde..883f72089015 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -73,8 +73,8 @@ static void blk_mq_hctx_mark_pending(struct blk_mq_hw_ctx *hctx,
                 set_bit(ctx->index_hw, hctx->ctx_map);
 }
 
-static struct request *blk_mq_alloc_rq(struct blk_mq_hw_ctx *hctx, gfp_t gfp,
-                                       bool reserved)
+static struct request *__blk_mq_alloc_request(struct blk_mq_hw_ctx *hctx,
+                                              gfp_t gfp, bool reserved)
 {
         struct request *rq;
         unsigned int tag;
@@ -193,12 +193,6 @@ static void blk_mq_rq_ctx_init(struct request_queue *q, struct blk_mq_ctx *ctx,
         ctx->rq_dispatched[rw_is_sync(rw_flags)]++;
 }
 
-static struct request *__blk_mq_alloc_request(struct blk_mq_hw_ctx *hctx,
-                                              gfp_t gfp, bool reserved)
-{
-        return blk_mq_alloc_rq(hctx, gfp, reserved);
-}
-
 static struct request *blk_mq_alloc_request_pinned(struct request_queue *q,
                                                    int rw, gfp_t gfp,
                                                    bool reserved)
@@ -289,38 +283,10 @@ void blk_mq_free_request(struct request *rq)
         __blk_mq_free_request(hctx, ctx, rq);
 }
 
-static void blk_mq_bio_endio(struct request *rq, struct bio *bio, int error)
-{
-        if (error)
-                clear_bit(BIO_UPTODATE, &bio->bi_flags);
-        else if (!test_bit(BIO_UPTODATE, &bio->bi_flags))
-                error = -EIO;
-
-        if (unlikely(rq->cmd_flags & REQ_QUIET))
-                set_bit(BIO_QUIET, &bio->bi_flags);
-
-        /* don't actually finish bio if it's part of flush sequence */
-        if (!(rq->cmd_flags & REQ_FLUSH_SEQ))
-                bio_endio(bio, error);
-}
-
-void blk_mq_end_io(struct request *rq, int error)
+bool blk_mq_end_io_partial(struct request *rq, int error, unsigned int nr_bytes)
 {
-        struct bio *bio = rq->bio;
-        unsigned int bytes = 0;
-
-        trace_block_rq_complete(rq->q, rq);
-
-        while (bio) {
-                struct bio *next = bio->bi_next;
-
-                bio->bi_next = NULL;
-                bytes += bio->bi_iter.bi_size;
-                blk_mq_bio_endio(rq, bio, error);
-                bio = next;
-        }
-
-        blk_account_io_completion(rq, bytes);
+        if (blk_update_request(rq, error, blk_rq_bytes(rq)))
+                return true;
 
         blk_account_io_done(rq);
 
@@ -328,8 +294,9 @@ void blk_mq_end_io(struct request *rq, int error)
                 rq->end_io(rq, error);
         else
                 blk_mq_free_request(rq);
+        return false;
 }
-EXPORT_SYMBOL(blk_mq_end_io);
+EXPORT_SYMBOL(blk_mq_end_io_partial);
 
 static void __blk_mq_complete_request_remote(void *data)
 {
@@ -730,60 +697,27 @@ static void __blk_mq_insert_request(struct blk_mq_hw_ctx *hctx,
         blk_mq_add_timer(rq);
 }
 
-void blk_mq_insert_request(struct request_queue *q, struct request *rq,
-                           bool at_head, bool run_queue)
+void blk_mq_insert_request(struct request *rq, bool at_head, bool run_queue,
+                bool async)
 {
+        struct request_queue *q = rq->q;
         struct blk_mq_hw_ctx *hctx;
-        struct blk_mq_ctx *ctx, *current_ctx;
+        struct blk_mq_ctx *ctx = rq->mq_ctx, *current_ctx;
+
+        current_ctx = blk_mq_get_ctx(q);
+        if (!cpu_online(ctx->cpu))
+                rq->mq_ctx = ctx = current_ctx;
 
-        ctx = rq->mq_ctx;
         hctx = q->mq_ops->map_queue(q, ctx->cpu);
 
-        if (rq->cmd_flags & (REQ_FLUSH | REQ_FUA)) {
+        if (rq->cmd_flags & (REQ_FLUSH | REQ_FUA) &&
+            !(rq->cmd_flags & (REQ_FLUSH_SEQ))) {
                 blk_insert_flush(rq);
         } else {
-                current_ctx = blk_mq_get_ctx(q);
-
-                if (!cpu_online(ctx->cpu)) {
-                        ctx = current_ctx;
-                        hctx = q->mq_ops->map_queue(q, ctx->cpu);
-                        rq->mq_ctx = ctx;
-                }
                 spin_lock(&ctx->lock);
                 __blk_mq_insert_request(hctx, rq, at_head);
                 spin_unlock(&ctx->lock);
-
-                blk_mq_put_ctx(current_ctx);
-        }
-
-        if (run_queue)
-                __blk_mq_run_hw_queue(hctx);
-}
-EXPORT_SYMBOL(blk_mq_insert_request);
-
-/*
- * This is a special version of blk_mq_insert_request to bypass FLUSH request
- * check. Should only be used internally.
- */
-void blk_mq_run_request(struct request *rq, bool run_queue, bool async)
-{
-        struct request_queue *q = rq->q;
-        struct blk_mq_hw_ctx *hctx;
-        struct blk_mq_ctx *ctx, *current_ctx;
-
-        current_ctx = blk_mq_get_ctx(q);
-
-        ctx = rq->mq_ctx;
-        if (!cpu_online(ctx->cpu)) {
-                ctx = current_ctx;
-                rq->mq_ctx = ctx;
         }
-        hctx = q->mq_ops->map_queue(q, ctx->cpu);
-
-        /* ctx->cpu might be offline */
-        spin_lock(&ctx->lock);
-        __blk_mq_insert_request(hctx, rq, false);
-        spin_unlock(&ctx->lock);
 
         blk_mq_put_ctx(current_ctx);
 
@@ -926,6 +860,8 @@ static void blk_mq_make_request(struct request_queue *q, struct bio *bio)
         ctx = blk_mq_get_ctx(q);
         hctx = q->mq_ops->map_queue(q, ctx->cpu);
 
+        if (is_sync)
+                rw |= REQ_SYNC;
         trace_block_getrq(q, bio, rw);
         rq = __blk_mq_alloc_request(hctx, GFP_ATOMIC, false);
         if (likely(rq))
diff --git a/block/blk-mq.h b/block/blk-mq.h
index ed0035cd458e..72beba1f9d55 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -23,7 +23,6 @@ struct blk_mq_ctx {
 };
 
 void __blk_mq_complete_request(struct request *rq);
-void blk_mq_run_request(struct request *rq, bool run_queue, bool async);
 void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async);
 void blk_mq_init_flush(struct request_queue *q);
 void blk_mq_drain_queue(struct request_queue *q);
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 959d41acc108..d7d32c28829b 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -67,6 +67,8 @@ enum ec_command {
 #define ACPI_EC_DELAY           500     /* Wait 500ms max. during EC ops */
 #define ACPI_EC_UDELAY_GLK      1000    /* Wait 1ms max. to get global lock */
 #define ACPI_EC_MSI_UDELAY      550     /* Wait 550us for MSI EC */
+#define ACPI_EC_CLEAR_MAX       100     /* Maximum number of events to query
+                                         * when trying to clear the EC */
 
 enum {
         EC_FLAGS_QUERY_PENDING,         /* Query is pending */
@@ -116,6 +118,7 @@ EXPORT_SYMBOL(first_ec);
 static int EC_FLAGS_MSI; /* Out-of-spec MSI controller */
 static int EC_FLAGS_VALIDATE_ECDT; /* ASUStec ECDTs need to be validated */
 static int EC_FLAGS_SKIP_DSDT_SCAN; /* Not all BIOS survive early DSDT scan */
+static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
 
 /* --------------------------------------------------------------------------
                              Transaction Management
@@ -440,6 +443,29 @@ acpi_handle ec_get_handle(void)
 
 EXPORT_SYMBOL(ec_get_handle);
 
+static int acpi_ec_query_unlocked(struct acpi_ec *ec, u8 *data);
+
+/*
+ * Clears stale _Q events that might have accumulated in the EC.
+ * Run with locked ec mutex.
+ */
+static void acpi_ec_clear(struct acpi_ec *ec)
+{
+        int i, status;
+        u8 value = 0;
+
+        for (i = 0; i < ACPI_EC_CLEAR_MAX; i++) {
+                status = acpi_ec_query_unlocked(ec, &value);
+                if (status || !value)
+                        break;
+        }
+
+        if (unlikely(i == ACPI_EC_CLEAR_MAX))
+                pr_warn("Warning: Maximum of %d stale EC events cleared\n", i);
+        else
+                pr_info("%d stale EC events cleared\n", i);
+}
+
 void acpi_ec_block_transactions(void)
 {
         struct acpi_ec *ec = first_ec;
@@ -463,6 +489,10 @@ void acpi_ec_unblock_transactions(void)
         mutex_lock(&ec->mutex);
         /* Allow transactions to be carried out again */
         clear_bit(EC_FLAGS_BLOCKED, &ec->flags);
+
+        if (EC_FLAGS_CLEAR_ON_RESUME)
+                acpi_ec_clear(ec);
+
         mutex_unlock(&ec->mutex);
 }
 
@@ -821,6 +851,13 @@ static int acpi_ec_add(struct acpi_device *device)
 
         /* EC is fully operational, allow queries */
         clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
+
+        /* Clear stale _Q events if hardware might require that */
+        if (EC_FLAGS_CLEAR_ON_RESUME) {
+                mutex_lock(&ec->mutex);
+                acpi_ec_clear(ec);
+                mutex_unlock(&ec->mutex);
+        }
         return ret;
 }
 
@@ -922,6 +959,30 @@ static int ec_enlarge_storm_threshold(const struct dmi_system_id *id)
         return 0;
 }
 
+/*
+ * On some hardware it is necessary to clear events accumulated by the EC during
+ * sleep. These ECs stop reporting GPEs until they are manually polled, if too
+ * many events are accumulated. (e.g. Samsung Series 5/9 notebooks)
+ *
+ * https://bugzilla.kernel.org/show_bug.cgi?id=44161
+ *
+ * Ideally, the EC should also be instructed NOT to accumulate events during
+ * sleep (which Windows seems to do somehow), but the interface to control this
+ * behaviour is not known at this time.
+ *
+ * Models known to be affected are Samsung 530Uxx/535Uxx/540Uxx/550Pxx/900Xxx,
+ * however it is very likely that other Samsung models are affected.
+ *
+ * On systems which don't accumulate _Q events during sleep, this extra check
+ * should be harmless.
+ */
+static int ec_clear_on_resume(const struct dmi_system_id *id)
+{
+        pr_debug("Detected system needing EC poll on resume.\n");
+        EC_FLAGS_CLEAR_ON_RESUME = 1;
+        return 0;
+}
+
 static struct dmi_system_id ec_dmi_table[] __initdata = {
         {
         ec_skip_dsdt_scan, "Compal JFL92", {
@@ -965,6 +1026,9 @@ static struct dmi_system_id ec_dmi_table[] __initdata = {
         ec_validate_ecdt, "ASUS hardware", {
         DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek Computer Inc."),
         DMI_MATCH(DMI_PRODUCT_NAME, "L4R"),}, NULL},
+        {
+        ec_clear_on_resume, "Samsung hardware", {
+        DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL},
         {},
 };
 
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index b7201fc6f1e1..0bdacc5e26a3 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -77,18 +77,24 @@ bool acpi_dev_resource_memory(struct acpi_resource *ares, struct resource *res)
         switch (ares->type) {
         case ACPI_RESOURCE_TYPE_MEMORY24:
                 memory24 = &ares->data.memory24;
+                if (!memory24->address_length)
+                        return false;
                 acpi_dev_get_memresource(res, memory24->minimum,
                                          memory24->address_length,
                                          memory24->write_protect);
                 break;
         case ACPI_RESOURCE_TYPE_MEMORY32:
                 memory32 = &ares->data.memory32;
+                if (!memory32->address_length)
+                        return false;
                 acpi_dev_get_memresource(res, memory32->minimum,
                                          memory32->address_length,
                                          memory32->write_protect);
                 break;
         case ACPI_RESOURCE_TYPE_FIXED_MEMORY32:
                 fixed_memory32 = &ares->data.fixed_memory32;
+                if (!fixed_memory32->address_length)
+                        return false;
                 acpi_dev_get_memresource(res, fixed_memory32->address,
                                          fixed_memory32->address_length,
                                          fixed_memory32->write_protect);
@@ -144,12 +150,16 @@ bool acpi_dev_resource_io(struct acpi_resource *ares, struct resource *res)
         switch (ares->type) {
         case ACPI_RESOURCE_TYPE_IO:
                 io = &ares->data.io;
+                if (!io->address_length)
+                        return false;
                 acpi_dev_get_ioresource(res, io->minimum,
                                         io->address_length,
                                         io->io_decode);
                 break;
         case ACPI_RESOURCE_TYPE_FIXED_IO:
                 fixed_io = &ares->data.fixed_io;
+                if (!fixed_io->address_length)
+                        return false;
                 acpi_dev_get_ioresource(res, fixed_io->address,
                                         fixed_io->address_length,
                                         ACPI_DECODE_10);
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index b718806657cd..c40fb2e81bbc 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -71,6 +71,17 @@ static int acpi_sleep_prepare(u32 acpi_state)
         return 0;
 }
 
+static bool acpi_sleep_state_supported(u8 sleep_state)
+{
+        acpi_status status;
+        u8 type_a, type_b;
+
+        status = acpi_get_sleep_type_data(sleep_state, &type_a, &type_b);
+        return ACPI_SUCCESS(status) && (!acpi_gbl_reduced_hardware
+                || (acpi_gbl_FADT.sleep_control.address
+                        && acpi_gbl_FADT.sleep_status.address));
+}
+
 #ifdef CONFIG_ACPI_SLEEP
 static u32 acpi_target_sleep_state = ACPI_STATE_S0;
 
@@ -604,15 +615,9 @@ static void acpi_sleep_suspend_setup(void)
 {
         int i;
 
-        for (i = ACPI_STATE_S1; i < ACPI_STATE_S4; i++) {
-                acpi_status status;
-                u8 type_a, type_b;
-
-                status = acpi_get_sleep_type_data(i, &type_a, &type_b);
-                if (ACPI_SUCCESS(status)) {
+        for (i = ACPI_STATE_S1; i < ACPI_STATE_S4; i++)
+                if (acpi_sleep_state_supported(i))
                         sleep_states[i] = 1;
-                }
-        }
 
         suspend_set_ops(old_suspend_ordering ?
                 &acpi_suspend_ops_old : &acpi_suspend_ops);
@@ -740,11 +745,7 @@ static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
 
 static void acpi_sleep_hibernate_setup(void)
 {
-        acpi_status status;
-        u8 type_a, type_b;
-
-        status = acpi_get_sleep_type_data(ACPI_STATE_S4, &type_a, &type_b);
-        if (ACPI_FAILURE(status))
+        if (!acpi_sleep_state_supported(ACPI_STATE_S4))
                 return;
 
         hibernation_set_ops(old_suspend_ordering ?
@@ -793,8 +794,6 @@ static void acpi_power_off(void)
 
 int __init acpi_sleep_init(void)
 {
-        acpi_status status;
-        u8 type_a, type_b;
         char supported[ACPI_S_STATE_COUNT * 3 + 1];
         char *pos = supported;
         int i;
@@ -806,8 +805,7 @@ int __init acpi_sleep_init(void)
         acpi_sleep_suspend_setup();
         acpi_sleep_hibernate_setup();
 
-        status = acpi_get_sleep_type_data(ACPI_STATE_S5, &type_a, &type_b);
-        if (ACPI_SUCCESS(status)) {
+        if (acpi_sleep_state_supported(ACPI_STATE_S5)) {
                 sleep_states[ACPI_STATE_S5] = 1;
                 pm_power_off_prepare = acpi_power_off_prepare;
                 pm_power_off = acpi_power_off;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 1a3dbd1b196e..8cb2522d592a 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4175,6 +4175,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
 
         /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
         { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
+        { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
 
         /* Blacklist entries taken from Silicon Image 3124/3132
            Windows driver .inf file - also several Linux problem reports */
@@ -4224,7 +4225,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
 
         /* devices that don't properly handle queued TRIM commands */
         { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Crucial_CT???M500SSD1",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M500SSD*",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
 
         /*
          * Some WD SATA-I drives spin up and down erratically when the link
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 8184451b57c0..422b7d84f686 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -874,7 +874,7 @@ bio_pageinc(struct bio *bio)
                 /* Non-zero page count for non-head members of
                  * compound pages is no longer allowed by the kernel.
                  */
-                page = compound_trans_head(bv.bv_page);
+                page = compound_head(bv.bv_page);
                 atomic_inc(&page->_count);
         }
 }
@@ -887,7 +887,7 @@ bio_pagedec(struct bio *bio)
         struct bvec_iter iter;
 
         bio_for_each_segment(bv, bio, iter) {
-                page = compound_trans_head(bv.bv_page);
+                page = compound_head(bv.bv_page);
                 atomic_dec(&page->_count);
         }
 }
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 516026954be6..d777bb7cea93 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -4498,7 +4498,7 @@ static int mtip_pci_probe(struct pci_dev *pdev,
         }
         dev_info(&pdev->dev, "NUMA node %d (closest: %d,%d, probe on %d:%d)\n",
                 my_node, pcibus_to_node(pdev->bus), dev_to_node(&pdev->dev),
-                cpu_to_node(smp_processor_id()), smp_processor_id());
+                cpu_to_node(raw_smp_processor_id()), raw_smp_processor_id());
 
         dd = kzalloc_node(sizeof(struct driver_data), GFP_KERNEL, my_node);
         if (dd == NULL) {
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index b52e9a6d6aad..54174cb32feb 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -53,7 +53,7 @@
 #define MTIP_FTL_REBUILD_TIMEOUT_MS     2400000
 
 /* unaligned IO handling */
-#define MTIP_MAX_UNALIGNED_SLOTS        8
+#define MTIP_MAX_UNALIGNED_SLOTS        2
 
 /* Macro to extract the tag bit number from a tag value. */
 #define MTIP_TAG_BIT(tag)       (tag & 0x1F)
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 011e55d820b1..51c557cfd92b 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -612,6 +612,8 @@ static ssize_t disksize_store(struct device *dev,
 
         disksize = PAGE_ALIGN(disksize);
         meta = zram_meta_alloc(disksize);
+        if (!meta)
+                return -ENOMEM;
         down_write(&zram->init_lock);
         if (zram->init_done) {
                 up_write(&zram->init_lock);
diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c
index bd313f7816a8..c1af80bcdf20 100644
--- a/drivers/clk/at91/clk-master.c
+++ b/drivers/clk/at91/clk-master.c
@@ -242,7 +242,7 @@ of_at91_clk_master_setup(struct device_node *np, struct at91_pmc *pmc,
 
         irq = irq_of_parse_and_map(np, 0);
         if (!irq)
-                return;
+                goto out_free_characteristics;
 
         clk = at91_clk_register_master(pmc, irq, name, num_parents,
                                        parent_names, layout,
diff --git a/drivers/clk/clk-nomadik.c b/drivers/clk/clk-nomadik.c
index 6a934a5296bd..05e04ce0f148 100644
--- a/drivers/clk/clk-nomadik.c
+++ b/drivers/clk/clk-nomadik.c
@@ -494,6 +494,9 @@ static const struct file_operations nomadik_src_clk_debugfs_ops = {
 
 static int __init nomadik_src_clk_init_debugfs(void)
 {
+        /* Vital for multiplatform */
+        if (!src_base)
+                return -ENODEV;
         src_pcksr0_boot = readl(src_base + SRC_PCKSR0);
         src_pcksr1_boot = readl(src_base + SRC_PCKSR1);
         debugfs_create_file("nomadik-src-clk", S_IFREG | S_IRUGO,
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 5517944495d8..c42e608af6bb 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -2226,24 +2226,25 @@ EXPORT_SYMBOL_GPL(devm_clk_unregister);
  */
 int __clk_get(struct clk *clk)
 {
-        if (clk && !try_module_get(clk->owner))
-                return 0;
+        if (clk) {
+                if (!try_module_get(clk->owner))
+                        return 0;
 
-        kref_get(&clk->ref);
+                kref_get(&clk->ref);
+        }
         return 1;
 }
 
 void __clk_put(struct clk *clk)
 {
-        if (WARN_ON_ONCE(IS_ERR(clk)))
+        if (!clk || WARN_ON_ONCE(IS_ERR(clk)))
                 return;
 
         clk_prepare_lock();
         kref_put(&clk->ref, __clk_release);
         clk_prepare_unlock();
 
-        if (clk)
-                module_put(clk->owner);
+        module_put(clk->owner);
 }
 
 /***        clk rate change notifiers        ***/
diff --git a/drivers/clk/keystone/gate.c b/drivers/clk/keystone/gate.c
index 17a598398a53..86f1e362eafb 100644
--- a/drivers/clk/keystone/gate.c
+++ b/drivers/clk/keystone/gate.c
@@ -179,6 +179,7 @@ static struct clk *clk_register_psc(struct device *dev,
 
         init.name = name;
         init.ops = &clk_psc_ops;
+        init.flags = 0;
         init.parent_names = (parent_name ? &parent_name : NULL);
         init.num_parents = (parent_name ? 1 : 0);
 
diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
index 81a202d12a7a..bef198a83863 100644
--- a/drivers/clk/mvebu/armada-370.c
+++ b/drivers/clk/mvebu/armada-370.c
@@ -141,13 +141,6 @@ static const struct coreclk_soc_desc a370_coreclks = {
         .num_ratios = ARRAY_SIZE(a370_coreclk_ratios),
 };
 
-static void __init a370_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &a370_coreclks);
-}
-CLK_OF_DECLARE(a370_core_clk, "marvell,armada-370-core-clock",
-               a370_coreclk_init);
-
 /*
  * Clock Gating Control
  */
@@ -168,9 +161,15 @@ static const struct clk_gating_soc_desc a370_gating_desc[] __initconst = {
         { }
 };
 
-static void __init a370_clk_gating_init(struct device_node *np)
+static void __init a370_clk_init(struct device_node *np)
 {
-        mvebu_clk_gating_setup(np, a370_gating_desc);
+        struct device_node *cgnp =
+                of_find_compatible_node(NULL, NULL, "marvell,armada-370-gating-clock");
+
+        mvebu_coreclk_setup(np, &a370_coreclks);
+
+        if (cgnp)
+                mvebu_clk_gating_setup(cgnp, a370_gating_desc);
 }
-CLK_OF_DECLARE(a370_clk_gating, "marvell,armada-370-gating-clock",
-               a370_clk_gating_init);
+CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init);
+
diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c
index 9922c4475aa8..b3094315a3c0 100644
--- a/drivers/clk/mvebu/armada-xp.c
+++ b/drivers/clk/mvebu/armada-xp.c
@@ -158,13 +158,6 @@ static const struct coreclk_soc_desc axp_coreclks = {
         .num_ratios = ARRAY_SIZE(axp_coreclk_ratios),
 };
 
-static void __init axp_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &axp_coreclks);
-}
-CLK_OF_DECLARE(axp_core_clk, "marvell,armada-xp-core-clock",
-               axp_coreclk_init);
-
 /*
  * Clock Gating Control
  */
@@ -202,9 +195,14 @@ static const struct clk_gating_soc_desc axp_gating_desc[] __initconst = {
         { }
 };
 
-static void __init axp_clk_gating_init(struct device_node *np)
+static void __init axp_clk_init(struct device_node *np)
 {
-        mvebu_clk_gating_setup(np, axp_gating_desc);
+        struct device_node *cgnp =
+                of_find_compatible_node(NULL, NULL, "marvell,armada-xp-gating-clock");
+
+        mvebu_coreclk_setup(np, &axp_coreclks);
+
+        if (cgnp)
+                mvebu_clk_gating_setup(cgnp, axp_gating_desc);
 }
-CLK_OF_DECLARE(axp_clk_gating, "marvell,armada-xp-gating-clock",
-               axp_clk_gating_init);
+CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init);
diff --git a/drivers/clk/mvebu/dove.c b/drivers/clk/mvebu/dove.c
index 38aee1e3f242..b8c2424ac926 100644
--- a/drivers/clk/mvebu/dove.c
+++ b/drivers/clk/mvebu/dove.c
@@ -154,12 +154,6 @@ static const struct coreclk_soc_desc dove_coreclks = {
         .num_ratios = ARRAY_SIZE(dove_coreclk_ratios),
 };
 
-static void __init dove_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &dove_coreclks);
-}
-CLK_OF_DECLARE(dove_core_clk, "marvell,dove-core-clock", dove_coreclk_init);
-
 /*
  * Clock Gating Control
  */
@@ -186,9 +180,14 @@ static const struct clk_gating_soc_desc dove_gating_desc[] __initconst = {
         { }
 };
 
-static void __init dove_clk_gating_init(struct device_node *np)
+static void __init dove_clk_init(struct device_node *np)
 {
-        mvebu_clk_gating_setup(np, dove_gating_desc);
+        struct device_node *cgnp =
+                of_find_compatible_node(NULL, NULL, "marvell,dove-gating-clock");
+
+        mvebu_coreclk_setup(np, &dove_coreclks);
+
+        if (cgnp)
+                mvebu_clk_gating_setup(cgnp, dove_gating_desc);
 }
-CLK_OF_DECLARE(dove_clk_gating, "marvell,dove-gating-clock",
-               dove_clk_gating_init);
+CLK_OF_DECLARE(dove_clk, "marvell,dove-core-clock", dove_clk_init);
diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c
index 2636a55f29f9..ddb666a86500 100644
--- a/drivers/clk/mvebu/kirkwood.c
+++ b/drivers/clk/mvebu/kirkwood.c
@@ -193,13 +193,6 @@ static const struct coreclk_soc_desc kirkwood_coreclks = {
         .num_ratios = ARRAY_SIZE(kirkwood_coreclk_ratios),
 };
 
-static void __init kirkwood_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &kirkwood_coreclks);
-}
-CLK_OF_DECLARE(kirkwood_core_clk, "marvell,kirkwood-core-clock",
-               kirkwood_coreclk_init);
-
 static const struct coreclk_soc_desc mv88f6180_coreclks = {
         .get_tclk_freq = kirkwood_get_tclk_freq,
         .get_cpu_freq = mv88f6180_get_cpu_freq,
@@ -208,13 +201,6 @@ static const struct coreclk_soc_desc mv88f6180_coreclks = {
         .num_ratios = ARRAY_SIZE(kirkwood_coreclk_ratios),
 };
 
-static void __init mv88f6180_coreclk_init(struct device_node *np)
-{
-        mvebu_coreclk_setup(np, &mv88f6180_coreclks);
-}
-CLK_OF_DECLARE(mv88f6180_core_clk, "marvell,mv88f6180-core-clock",
-               mv88f6180_coreclk_init);
-
 /*
  * Clock Gating Control
  */
@@ -239,9 +225,21 @@ static const struct clk_gating_soc_desc kirkwood_gating_desc[] __initconst = {
         { }
 };
 
-static void __init kirkwood_clk_gating_init(struct device_node *np)
+static void __init kirkwood_clk_init(struct device_node *np)
 {
-        mvebu_clk_gating_setup(np, kirkwood_gating_desc);
+        struct device_node *cgnp =
+                of_find_compatible_node(NULL, NULL, "marvell,kirkwood-gating-clock");
+
+
+        if (of_device_is_compatible(np, "marvell,mv88f6180-core-clock"))
+                mvebu_coreclk_setup(np, &mv88f6180_coreclks);
+        else
+                mvebu_coreclk_setup(np, &kirkwood_coreclks);
+
+        if (cgnp)
+                mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc);
 }
-CLK_OF_DECLARE(kirkwood_clk_gating, "marvell,kirkwood-gating-clock",
-               kirkwood_clk_gating_init);
+CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock",
+               kirkwood_clk_init);
+CLK_OF_DECLARE(mv88f6180_clk, "marvell,mv88f6180-core-clock",
+               kirkwood_clk_init);
diff --git a/drivers/clk/shmobile/clk-rcar-gen2.c b/drivers/clk/shmobile/clk-rcar-gen2.c
index a59ec217a124..99c27b1c625b 100644
--- a/drivers/clk/shmobile/clk-rcar-gen2.c
+++ b/drivers/clk/shmobile/clk-rcar-gen2.c
@@ -26,6 +26,8 @@ struct rcar_gen2_cpg {
         void __iomem *reg;
 };
 
+#define CPG_FRQCRB                      0x00000004
+#define CPG_FRQCRB_KICK                 BIT(31)
 #define CPG_SDCKCR                      0x00000074
 #define CPG_PLL0CR                      0x000000d8
 #define CPG_FRQCRC                      0x000000e0
@@ -45,6 +47,7 @@ struct rcar_gen2_cpg {
 struct cpg_z_clk {
         struct clk_hw hw;
         void __iomem *reg;
+        void __iomem *kick_reg;
 };
 
 #define to_z_clk(_hw)   container_of(_hw, struct cpg_z_clk, hw)
@@ -83,17 +86,45 @@ static int cpg_z_clk_set_rate(struct clk_hw *hw, unsigned long rate,
 {
         struct cpg_z_clk *zclk = to_z_clk(hw);
         unsigned int mult;
-        u32 val;
+        u32 val, kick;
+        unsigned int i;
 
         mult = div_u64((u64)rate * 32, parent_rate);
         mult = clamp(mult, 1U, 32U);
 
+        if (clk_readl(zclk->kick_reg) & CPG_FRQCRB_KICK)
+                return -EBUSY;
+
         val = clk_readl(zclk->reg);
         val &= ~CPG_FRQCRC_ZFC_MASK;
         val |= (32 - mult) << CPG_FRQCRC_ZFC_SHIFT;
         clk_writel(val, zclk->reg);
 
-        return 0;
+        /*
+         * Set KICK bit in FRQCRB to update hardware setting and wait for
+         * clock change completion.
+         */
+        kick = clk_readl(zclk->kick_reg);
+        kick |= CPG_FRQCRB_KICK;
+        clk_writel(kick, zclk->kick_reg);
+
+        /*
+         * Note: There is no HW information about the worst case latency.
+         *
+         * Using experimental measurements, it seems that no more than
+         * ~10 iterations are needed, independently of the CPU rate.
+         * Since this value might be dependant of external xtal rate, pll1
+         * rate or even the other emulation clocks rate, use 1000 as a
+         * "super" safe value.
+         */
+        for (i = 1000; i; i--) {
+                if (!(clk_readl(zclk->kick_reg) & CPG_FRQCRB_KICK))
+                        return 0;
+
+                cpu_relax();
+        }
+
+        return -ETIMEDOUT;
 }
 
 static const struct clk_ops cpg_z_clk_ops = {
@@ -120,6 +151,7 @@ static struct clk * __init cpg_z_clk_register(struct rcar_gen2_cpg *cpg)
         init.num_parents = 1;
 
         zclk->reg = cpg->reg + CPG_FRQCRC;
+        zclk->kick_reg = cpg->reg + CPG_FRQCRB;
         zclk->hw.init = &init;
 
         clk = clk_register(NULL, &zclk->hw);
@@ -186,7 +218,7 @@ rcar_gen2_cpg_register_clock(struct device_node *np, struct rcar_gen2_cpg *cpg,
                              const char *name)
 {
         const struct clk_div_table *table = NULL;
-        const char *parent_name = "main";
+        const char *parent_name;
         unsigned int shift;
         unsigned int mult = 1;
         unsigned int div = 1;
@@ -201,23 +233,31 @@ rcar_gen2_cpg_register_clock(struct device_node *np, struct rcar_gen2_cpg *cpg,
                  * the multiplier value.
                  */
                 u32 value = clk_readl(cpg->reg + CPG_PLL0CR);
+                parent_name = "main";
                 mult = ((value >> 24) & ((1 << 7) - 1)) + 1;
         } else if (!strcmp(name, "pll1")) {
+                parent_name = "main";
                 mult = config->pll1_mult / 2;
         } else if (!strcmp(name, "pll3")) {
+                parent_name = "main";
                 mult = config->pll3_mult;
         } else if (!strcmp(name, "lb")) {
+                parent_name = "pll1_div2";
                 div = cpg_mode & BIT(18) ? 36 : 24;
         } else if (!strcmp(name, "qspi")) {
+                parent_name = "pll1_div2";
                 div = (cpg_mode & (BIT(3) | BIT(2) | BIT(1))) == BIT(2)
-                    ? 16 : 20;
+                    ? 8 : 10;
         } else if (!strcmp(name, "sdh")) {
+                parent_name = "pll1_div2";
                 table = cpg_sdh_div_table;
                 shift = 8;
         } else if (!strcmp(name, "sd0")) {
+                parent_name = "pll1_div2";
                 table = cpg_sd01_div_table;
                 shift = 4;
         } else if (!strcmp(name, "sd1")) {
+                parent_name = "pll1_div2";
                 table = cpg_sd01_div_table;
                 shift = 0;
         } else if (!strcmp(name, "z")) {
diff --git a/drivers/clk/tegra/clk-divider.c b/drivers/clk/tegra/clk-divider.c
index 4d75b1f37e3a..290f9c1a3749 100644
--- a/drivers/clk/tegra/clk-divider.c
+++ b/drivers/clk/tegra/clk-divider.c
@@ -59,7 +59,7 @@ static int get_div(struct tegra_clk_frac_div *divider, unsigned long rate,
                 return 0;
 
         if (divider_ux1 > get_max_div(divider))
-                return -EINVAL;
+                return get_max_div(divider);
 
         return divider_ux1;
 }
diff --git a/drivers/clk/tegra/clk-id.h b/drivers/clk/tegra/clk-id.h
index cf0c323f2c36..c39613c519af 100644
--- a/drivers/clk/tegra/clk-id.h
+++ b/drivers/clk/tegra/clk-id.h
@@ -180,9 +180,13 @@ enum clk_id {
         tegra_clk_sbc6_8,
         tegra_clk_sclk,
         tegra_clk_sdmmc1,
+        tegra_clk_sdmmc1_8,
         tegra_clk_sdmmc2,
+        tegra_clk_sdmmc2_8,
         tegra_clk_sdmmc3,
+        tegra_clk_sdmmc3_8,
         tegra_clk_sdmmc4,
+        tegra_clk_sdmmc4_8,
         tegra_clk_se,
         tegra_clk_soc_therm,
         tegra_clk_sor0,
diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c
index 5c35885f4a7c..1fa5c3f33b20 100644
--- a/drivers/clk/tegra/clk-tegra-periph.c
+++ b/drivers/clk/tegra/clk-tegra-periph.c
@@ -371,9 +371,7 @@ static const char *mux_pllp3_pllc_clkm[] = {
 static const char *mux_pllm_pllc_pllp_plla_pllc2_c3_clkm[] = {
         "pll_m", "pll_c", "pll_p", "pll_a", "pll_c2", "pll_c3", "clk_m"
 };
-static u32 mux_pllm_pllc_pllp_plla_pllc2_c3_clkm_idx[] = {
-        [0] = 0, [1] = 1, [2] = 2, [3] = 3, [4] = 4, [5] = 6,
-};
+#define mux_pllm_pllc_pllp_plla_pllc2_c3_clkm_idx NULL
 
 static const char *mux_pllm_pllc2_c_c3_pllp_plla_pllc4[] = {
         "pll_m", "pll_c2", "pll_c", "pll_c3", "pll_p", "pll_a_out0", "pll_c4",
@@ -465,6 +463,10 @@ static struct tegra_periph_init_data periph_clks[] = {
         MUX("adx1", mux_plla_pllc_pllp_clkm, CLK_SOURCE_ADX1, 180, TEGRA_PERIPH_ON_APB, tegra_clk_adx1),
         MUX("amx1", mux_plla_pllc_pllp_clkm, CLK_SOURCE_AMX1, 185, TEGRA_PERIPH_ON_APB, tegra_clk_amx1),
         MUX("vi_sensor2", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_VI_SENSOR2, 20, TEGRA_PERIPH_NO_RESET, tegra_clk_vi_sensor2),
+        MUX8("sdmmc1", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SDMMC1, 14, 0, tegra_clk_sdmmc1_8),
+        MUX8("sdmmc2", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SDMMC2, 9, 0, tegra_clk_sdmmc2_8),
+        MUX8("sdmmc3", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SDMMC3, 69, 0, tegra_clk_sdmmc3_8),
+        MUX8("sdmmc4", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SDMMC4, 15, 0, tegra_clk_sdmmc4_8),
         MUX8("sbc1", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SBC1, 41, TEGRA_PERIPH_ON_APB, tegra_clk_sbc1_8),
         MUX8("sbc2", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SBC2, 44, TEGRA_PERIPH_ON_APB, tegra_clk_sbc2_8),
         MUX8("sbc3", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SBC3, 46, TEGRA_PERIPH_ON_APB, tegra_clk_sbc3_8),
@@ -492,7 +494,7 @@ static struct tegra_periph_init_data periph_clks[] = {
         UART("uartb", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTB, 7, tegra_clk_uartb),
         UART("uartc", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTC, 55, tegra_clk_uartc),
         UART("uartd", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTD, 65, tegra_clk_uartd),
-        UART("uarte", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTE, 65, tegra_clk_uarte),
+        UART("uarte", mux_pllp_pllc_pllm_clkm, CLK_SOURCE_UARTE, 66, tegra_clk_uarte),
         XUSB("xusb_host_src", mux_clkm_pllp_pllc_pllre, CLK_SOURCE_XUSB_HOST_SRC, 143, TEGRA_PERIPH_ON_APB | TEGRA_PERIPH_NO_RESET, tegra_clk_xusb_host_src),
         XUSB("xusb_falcon_src", mux_clkm_pllp_pllc_pllre, CLK_SOURCE_XUSB_FALCON_SRC, 143, TEGRA_PERIPH_NO_RESET, tegra_clk_xusb_falcon_src),
         XUSB("xusb_fs_src", mux_clkm_48M_pllp_480M, CLK_SOURCE_XUSB_FS_SRC, 143, TEGRA_PERIPH_NO_RESET, tegra_clk_xusb_fs_src),
diff --git a/drivers/clk/tegra/clk-tegra-super-gen4.c b/drivers/clk/tegra/clk-tegra-super-gen4.c
index 05dce4aa2c11..feb3201c85ce 100644
--- a/drivers/clk/tegra/clk-tegra-super-gen4.c
+++ b/drivers/clk/tegra/clk-tegra-super-gen4.c
@@ -120,7 +120,7 @@ void __init tegra_super_clk_gen4_init(void __iomem *clk_base,
                                         ARRAY_SIZE(cclk_lp_parents),
                                         CLK_SET_RATE_PARENT,
                                         clk_base + CCLKLP_BURST_POLICY,
-                                        0, 4, 8, 9, NULL);
+                                        TEGRA_DIVIDER_2, 4, 8, 9, NULL);
                 *dt_clk = clk;
         }
 
diff --git a/drivers/clk/tegra/clk-tegra114.c b/drivers/clk/tegra/clk-tegra114.c
index 90d9d25f2228..80431f0fb268 100644
--- a/drivers/clk/tegra/clk-tegra114.c
+++ b/drivers/clk/tegra/clk-tegra114.c
@@ -682,12 +682,12 @@ static struct tegra_clk tegra114_clks[tegra_clk_max] __initdata = {
         [tegra_clk_timer] = { .dt_id = TEGRA114_CLK_TIMER, .present = true },
         [tegra_clk_uarta] = { .dt_id = TEGRA114_CLK_UARTA, .present = true },
         [tegra_clk_uartd] = { .dt_id = TEGRA114_CLK_UARTD, .present = true },
-        [tegra_clk_sdmmc2] = { .dt_id = TEGRA114_CLK_SDMMC2, .present = true },
+        [tegra_clk_sdmmc2_8] = { .dt_id = TEGRA114_CLK_SDMMC2, .present = true },
         [tegra_clk_i2s1] = { .dt_id = TEGRA114_CLK_I2S1, .present = true },
         [tegra_clk_i2c1] = { .dt_id = TEGRA114_CLK_I2C1, .present = true },
         [tegra_clk_ndflash] = { .dt_id = TEGRA114_CLK_NDFLASH, .present = true },
-        [tegra_clk_sdmmc1] = { .dt_id = TEGRA114_CLK_SDMMC1, .present = true },
-        [tegra_clk_sdmmc4] = { .dt_id = TEGRA114_CLK_SDMMC4, .present = true },
+        [tegra_clk_sdmmc1_8] = { .dt_id = TEGRA114_CLK_SDMMC1, .present = true },
+        [tegra_clk_sdmmc4_8] = { .dt_id = TEGRA114_CLK_SDMMC4, .present = true },
         [tegra_clk_pwm] = { .dt_id = TEGRA114_CLK_PWM, .present = true },
         [tegra_clk_i2s0] = { .dt_id = TEGRA114_CLK_I2S0, .present = true },
         [tegra_clk_i2s2] = { .dt_id = TEGRA114_CLK_I2S2, .present = true },
@@ -723,7 +723,7 @@ static struct tegra_clk tegra114_clks[tegra_clk_max] __initdata = {
         [tegra_clk_bsev] = { .dt_id = TEGRA114_CLK_BSEV, .present = true },
         [tegra_clk_i2c3] = { .dt_id = TEGRA114_CLK_I2C3, .present = true },
         [tegra_clk_sbc4_8] = { .dt_id = TEGRA114_CLK_SBC4, .present = true },
-        [tegra_clk_sdmmc3] = { .dt_id = TEGRA114_CLK_SDMMC3, .present = true },
+        [tegra_clk_sdmmc3_8] = { .dt_id = TEGRA114_CLK_SDMMC3, .present = true },
         [tegra_clk_owr] = { .dt_id = TEGRA114_CLK_OWR, .present = true },
         [tegra_clk_csite] = { .dt_id = TEGRA114_CLK_CSITE, .present = true },
         [tegra_clk_la] = { .dt_id = TEGRA114_CLK_LA, .present = true },
diff --git a/drivers/clk/tegra/clk-tegra124.c b/drivers/clk/tegra/clk-tegra124.c
index aff86b5bc745..166e02f16c8a 100644
--- a/drivers/clk/tegra/clk-tegra124.c
+++ b/drivers/clk/tegra/clk-tegra124.c
@@ -516,11 +516,11 @@ static struct div_nmp pllp_nmp = {
 };
 
 static struct tegra_clk_pll_freq_table pll_p_freq_table[] = {
-        {12000000, 216000000, 432, 12, 1, 8},
-        {13000000, 216000000, 432, 13, 1, 8},
-        {16800000, 216000000, 360, 14, 1, 8},
-        {19200000, 216000000, 360, 16, 1, 8},
-        {26000000, 216000000, 432, 26, 1, 8},
+        {12000000, 408000000, 408, 12, 0, 8},
+        {13000000, 408000000, 408, 13, 0, 8},
+        {16800000, 408000000, 340, 14, 0, 8},
+        {19200000, 408000000, 340, 16, 0, 8},
+        {26000000, 408000000, 408, 26, 0, 8},
         {0, 0, 0, 0, 0, 0},
 };
 
@@ -570,6 +570,15 @@ static struct tegra_clk_pll_params pll_a_params = {
         .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_USE_LOCK,
 };
 
+static struct div_nmp plld_nmp = {
+        .divm_shift = 0,
+        .divm_width = 5,
+        .divn_shift = 8,
+        .divn_width = 11,
+        .divp_shift = 20,
+        .divp_width = 3,
+};
+
 static struct tegra_clk_pll_freq_table pll_d_freq_table[] = {
         {12000000, 216000000, 864, 12, 4, 12},
         {13000000, 216000000, 864, 13, 4, 12},
@@ -603,19 +612,18 @@ static struct tegra_clk_pll_params pll_d_params = {
         .lock_mask = PLL_BASE_LOCK,
         .lock_enable_bit_idx = PLLDU_MISC_LOCK_ENABLE,
         .lock_delay = 1000,
-        .div_nmp = &pllp_nmp,
+        .div_nmp = &plld_nmp,
         .freq_table = pll_d_freq_table,
         .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_SET_LFCON |
                  TEGRA_PLL_USE_LOCK,
 };
 
 static struct tegra_clk_pll_freq_table tegra124_pll_d2_freq_table[] = {
-        { 12000000, 148500000,  99, 1, 8},
-        { 12000000, 594000000,  99, 1, 1},
-        { 13000000, 594000000,  91, 1, 1},      /* actual: 591.5 MHz */
-        { 16800000, 594000000,  71, 1, 1},      /* actual: 596.4 MHz */
-        { 19200000, 594000000,  62, 1, 1},      /* actual: 595.2 MHz */
-        { 26000000, 594000000,  91, 2, 1},      /* actual: 591.5 MHz */
+        { 12000000, 594000000,  99, 1, 2},
+        { 13000000, 594000000,  91, 1, 2},      /* actual: 591.5 MHz */
+        { 16800000, 594000000,  71, 1, 2},      /* actual: 596.4 MHz */
+        { 19200000, 594000000,  62, 1, 2},      /* actual: 595.2 MHz */
+        { 26000000, 594000000,  91, 2, 2},      /* actual: 591.5 MHz */
         { 0, 0, 0, 0, 0, 0 },
 };
 
@@ -753,21 +761,19 @@ static struct tegra_clk tegra124_clks[tegra_clk_max] __initdata = {
         [tegra_clk_rtc] = { .dt_id = TEGRA124_CLK_RTC, .present = true },
         [tegra_clk_timer] = { .dt_id = TEGRA124_CLK_TIMER, .present = true },
         [tegra_clk_uarta] = { .dt_id = TEGRA124_CLK_UARTA, .present = true },
-        [tegra_clk_sdmmc2] = { .dt_id = TEGRA124_CLK_SDMMC2, .present = true },
+        [tegra_clk_sdmmc2_8] = { .dt_id = TEGRA124_CLK_SDMMC2, .present = true },
         [tegra_clk_i2s1] = { .dt_id = TEGRA124_CLK_I2S1, .present = true },
         [tegra_clk_i2c1] = { .dt_id = TEGRA124_CLK_I2C1, .present = true },
         [tegra_clk_ndflash] = { .dt_id = TEGRA124_CLK_NDFLASH, .present = true },
-        [tegra_clk_sdmmc1] = { .dt_id = TEGRA124_CLK_SDMMC1, .present = true },
-        [tegra_clk_sdmmc4] = { .dt_id = TEGRA124_CLK_SDMMC4, .present = true },
+        [tegra_clk_sdmmc1_8] = { .dt_id = TEGRA124_CLK_SDMMC1, .present = true },
+        [tegra_clk_sdmmc4_8] = { .dt_id = TEGRA124_CLK_SDMMC4, .present = true },
         [tegra_clk_pwm] = { .dt_id = TEGRA124_CLK_PWM, .present = true },
         [tegra_clk_i2s2] = { .dt_id = TEGRA124_CLK_I2S2, .present = true },
-        [tegra_clk_gr2d] = { .dt_id = TEGRA124_CLK_GR_2D, .present = true },
         [tegra_clk_usbd] = { .dt_id = TEGRA124_CLK_USBD, .present = true },
         [tegra_clk_isp_8] = { .dt_id = TEGRA124_CLK_ISP, .present = true },
-        [tegra_clk_gr3d] = { .dt_id = TEGRA124_CLK_GR_3D, .present = true },
         [tegra_clk_disp2] = { .dt_id = TEGRA124_CLK_DISP2, .present = true },
         [tegra_clk_disp1] = { .dt_id = TEGRA124_CLK_DISP1, .present = true },
-        [tegra_clk_host1x] = { .dt_id = TEGRA124_CLK_HOST1X, .present = true },
+        [tegra_clk_host1x_8] = { .dt_id = TEGRA124_CLK_HOST1X, .present = true },
         [tegra_clk_vcp] = { .dt_id = TEGRA124_CLK_VCP, .present = true },
         [tegra_clk_i2s0] = { .dt_id = TEGRA124_CLK_I2S0, .present = true },
         [tegra_clk_apbdma] = { .dt_id = TEGRA124_CLK_APBDMA, .present = true },
@@ -794,7 +800,7 @@ static struct tegra_clk tegra124_clks[tegra_clk_max] __initdata = {
         [tegra_clk_uartd] = { .dt_id = TEGRA124_CLK_UARTD, .present = true },
         [tegra_clk_i2c3] = { .dt_id = TEGRA124_CLK_I2C3, .present = true },
         [tegra_clk_sbc4] = { .dt_id = TEGRA124_CLK_SBC4, .present = true },
-        [tegra_clk_sdmmc3] = { .dt_id = TEGRA124_CLK_SDMMC3, .present = true },
+        [tegra_clk_sdmmc3_8] = { .dt_id = TEGRA124_CLK_SDMMC3, .present = true },
         [tegra_clk_pcie] = { .dt_id = TEGRA124_CLK_PCIE, .present = true },
         [tegra_clk_owr] = { .dt_id = TEGRA124_CLK_OWR, .present = true },
         [tegra_clk_afi] = { .dt_id = TEGRA124_CLK_AFI, .present = true },
@@ -1286,9 +1292,9 @@ static void __init tegra124_pll_init(void __iomem *clk_base,
         clk_register_clkdev(clk, "pll_d2", NULL);
         clks[TEGRA124_CLK_PLL_D2] = clk;
 
-        /* PLLD2_OUT0 ?? */
+        /* PLLD2_OUT0 */
         clk = clk_register_fixed_factor(NULL, "pll_d2_out0", "pll_d2",
-                                        CLK_SET_RATE_PARENT, 1, 2);
+                                        CLK_SET_RATE_PARENT, 1, 1);
         clk_register_clkdev(clk, "pll_d2_out0", NULL);
         clks[TEGRA124_CLK_PLL_D2_OUT0] = clk;
 
diff --git a/drivers/clk/tegra/clk-tegra20.c b/drivers/clk/tegra/clk-tegra20.c
index dbace152b2fa..dace2b1b5ae6 100644
--- a/drivers/clk/tegra/clk-tegra20.c
+++ b/drivers/clk/tegra/clk-tegra20.c
@@ -574,6 +574,8 @@ static struct tegra_clk tegra20_clks[tegra_clk_max] __initdata = {
         [tegra_clk_tvdac] = { .dt_id = TEGRA20_CLK_TVDAC, .present = true },
         [tegra_clk_vi_sensor] = { .dt_id = TEGRA20_CLK_VI_SENSOR, .present = true },
         [tegra_clk_afi] = { .dt_id = TEGRA20_CLK_AFI, .present = true },
+        [tegra_clk_fuse] = { .dt_id = TEGRA20_CLK_FUSE, .present = true },
+        [tegra_clk_kfuse] = { .dt_id = TEGRA20_CLK_KFUSE, .present = true },
 };
 
 static unsigned long tegra20_clk_measure_input_freq(void)
diff --git a/drivers/clocksource/vf_pit_timer.c b/drivers/clocksource/vf_pit_timer.c
index 02821b06a39e..a918bc481c52 100644
--- a/drivers/clocksource/vf_pit_timer.c
+++ b/drivers/clocksource/vf_pit_timer.c
@@ -54,7 +54,7 @@ static inline void pit_irq_acknowledge(void)
 
 static u64 pit_read_sched_clock(void)
 {
-        return __raw_readl(clksrc_base + PITCVAL);
+        return ~__raw_readl(clksrc_base + PITCVAL);
 }
 
 static int __init pit_clocksource_init(unsigned long rate)
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index cb003a6b72c8..199b52b7c3e1 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1109,12 +1109,27 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                 goto err_set_policy_cpu;
         }
 
+        /* related cpus should atleast have policy->cpus */
+        cpumask_or(policy->related_cpus, policy->related_cpus, policy->cpus);
+
+        /*
+         * affected cpus must always be the one, which are online. We aren't
+         * managing offline cpus here.
+         */
+        cpumask_and(policy->cpus, policy->cpus, cpu_online_mask);
+
+        if (!frozen) {
+                policy->user_policy.min = policy->min;
+                policy->user_policy.max = policy->max;
+        }
+
+        down_write(&policy->rwsem);
         write_lock_irqsave(&cpufreq_driver_lock, flags);
         for_each_cpu(j, policy->cpus)
                 per_cpu(cpufreq_cpu_data, j) = policy;
         write_unlock_irqrestore(&cpufreq_driver_lock, flags);
 
-        if (cpufreq_driver->get) {
+        if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
                 policy->cur = cpufreq_driver->get(policy->cpu);
                 if (!policy->cur) {
                         pr_err("%s: ->get() failed\n", __func__);
@@ -1162,20 +1177,6 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                 }
         }
 
-        /* related cpus should atleast have policy->cpus */
-        cpumask_or(policy->related_cpus, policy->related_cpus, policy->cpus);
-
-        /*
-         * affected cpus must always be the one, which are online. We aren't
-         * managing offline cpus here.
-         */
-        cpumask_and(policy->cpus, policy->cpus, cpu_online_mask);
-
-        if (!frozen) {
-                policy->user_policy.min = policy->min;
-                policy->user_policy.max = policy->max;
-        }
-
         blocking_notifier_call_chain(&cpufreq_policy_notifier_list,
                                      CPUFREQ_START, policy);
 
@@ -1206,6 +1207,7 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                 policy->user_policy.policy = policy->policy;
                 policy->user_policy.governor = policy->governor;
         }
+        up_write(&policy->rwsem);
 
         kobject_uevent(&policy->kobj, KOBJ_ADD);
         up_read(&cpufreq_rwsem);
@@ -1546,23 +1548,16 @@ static unsigned int __cpufreq_get(unsigned int cpu)
  */
 unsigned int cpufreq_get(unsigned int cpu)
 {
-        struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
+        struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
         unsigned int ret_freq = 0;
 
-        if (cpufreq_disabled() || !cpufreq_driver)
-                return -ENOENT;
-
-        BUG_ON(!policy);
-
-        if (!down_read_trylock(&cpufreq_rwsem))
-                return 0;
-
-        down_read(&policy->rwsem);
-
-        ret_freq = __cpufreq_get(cpu);
+        if (policy) {
+                down_read(&policy->rwsem);
+                ret_freq = __cpufreq_get(cpu);
+                up_read(&policy->rwsem);
 
-        up_read(&policy->rwsem);
-        up_read(&cpufreq_rwsem);
+                cpufreq_cpu_put(policy);
+        }
 
         return ret_freq;
 }
@@ -2148,7 +2143,7 @@ int cpufreq_update_policy(unsigned int cpu)
          * BIOS might change freq behind our back
          * -> ask driver for current freq and notify governors about a change
          */
-        if (cpufreq_driver->get) {
+        if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
                 new_policy.cur = cpufreq_driver->get(cpu);
                 if (!policy->cur) {
                         pr_debug("Driver did not initialize current freq");
diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index de4aa409abe2..2c6d5e118ac1 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c
@@ -916,7 +916,7 @@ static int lookup_existing_device(struct device *dev, void *data)
                 old->config_rom_retries = 0;
                 fw_notice(card, "rediscovered device %s\n", dev_name(dev));
 
-                PREPARE_DELAYED_WORK(&old->work, fw_device_update);
+                old->workfn = fw_device_update;
                 fw_schedule_device_work(old, 0);
 
                 if (current_node == card->root_node)
@@ -1075,7 +1075,7 @@ static void fw_device_init(struct work_struct *work)
         if (atomic_cmpxchg(&device->state,
                            FW_DEVICE_INITIALIZING,
                            FW_DEVICE_RUNNING) == FW_DEVICE_GONE) {
-                PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
+                device->workfn = fw_device_shutdown;
                 fw_schedule_device_work(device, SHUTDOWN_DELAY);
         } else {
                 fw_notice(card, "created device %s: GUID %08x%08x, S%d00\n",
@@ -1196,13 +1196,20 @@ static void fw_device_refresh(struct work_struct *work)
                   dev_name(&device->device), fw_rcode_string(ret));
  gone:
         atomic_set(&device->state, FW_DEVICE_GONE);
-        PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
+        device->workfn = fw_device_shutdown;
         fw_schedule_device_work(device, SHUTDOWN_DELAY);
  out:
         if (node_id == card->root_node->node_id)
                 fw_schedule_bm_work(card, 0);
 }
 
+static void fw_device_workfn(struct work_struct *work)
+{
+        struct fw_device *device = container_of(to_delayed_work(work),
+                                                struct fw_device, work);
+        device->workfn(work);
+}
+
 void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
 {
         struct fw_device *device;
@@ -1252,7 +1259,8 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                  * power-up after getting plugged in.  We schedule the
                  * first config rom scan half a second after bus reset.
                  */
-                INIT_DELAYED_WORK(&device->work, fw_device_init);
+                device->workfn = fw_device_init;
+                INIT_DELAYED_WORK(&device->work, fw_device_workfn);
                 fw_schedule_device_work(device, INITIAL_DELAY);
                 break;
 
@@ -1268,7 +1276,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                 if (atomic_cmpxchg(&device->state,
                             FW_DEVICE_RUNNING,
                             FW_DEVICE_INITIALIZING) == FW_DEVICE_RUNNING) {
-                        PREPARE_DELAYED_WORK(&device->work, fw_device_refresh);
+                        device->workfn = fw_device_refresh;
                         fw_schedule_device_work(device,
                                 device->is_local ? 0 : INITIAL_DELAY);
                 }
@@ -1283,7 +1291,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                 smp_wmb();  /* update node_id before generation */
                 device->generation = card->generation;
                 if (atomic_read(&device->state) == FW_DEVICE_RUNNING) {
-                        PREPARE_DELAYED_WORK(&device->work, fw_device_update);
+                        device->workfn = fw_device_update;
                         fw_schedule_device_work(device, 0);
                 }
                 break;
@@ -1308,7 +1316,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                 device = node->data;
                 if (atomic_xchg(&device->state,
                                 FW_DEVICE_GONE) == FW_DEVICE_RUNNING) {
-                        PREPARE_DELAYED_WORK(&device->work, fw_device_shutdown);
+                        device->workfn = fw_device_shutdown;
                         fw_schedule_device_work(device,
                                 list_empty(&card->link) ? 0 : SHUTDOWN_DELAY);
                 }
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index 6b895986dc22..4af0a7bad7f2 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -929,8 +929,6 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
         if (rcode == RCODE_COMPLETE) {
                 fwnet_transmit_packet_done(ptask);
         } else {
-                fwnet_transmit_packet_failed(ptask);
-
                 if (printk_timed_ratelimit(&j,  1000) || rcode != last_rcode) {
                         dev_err(&ptask->dev->netdev->dev,
                                 "fwnet_write_complete failed: %x (skipped %d)\n",
@@ -938,8 +936,10 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
 
                         errors_skipped = 0;
                         last_rcode = rcode;
-                } else
+                } else {
                         errors_skipped++;
+                }
+                fwnet_transmit_packet_failed(ptask);
         }
 }
 
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 6f74d8d3f700..8db663219560 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -290,7 +290,6 @@ static char ohci_driver_name[] = KBUILD_MODNAME;
 #define QUIRK_NO_MSI                    0x10
 #define QUIRK_TI_SLLZ059                0x20
 #define QUIRK_IR_WAKE                   0x40
-#define QUIRK_PHY_LCTRL_TIMEOUT         0x80
 
 /* In case of multiple matches in ohci_quirks[], only the first one is used. */
 static const struct {
@@ -303,10 +302,7 @@ static const struct {
                 QUIRK_BE_HEADERS},
 
         {PCI_VENDOR_ID_ATT, PCI_DEVICE_ID_AGERE_FW643, 6,
-                QUIRK_PHY_LCTRL_TIMEOUT | QUIRK_NO_MSI},
-
-        {PCI_VENDOR_ID_ATT, PCI_ANY_ID, PCI_ANY_ID,
-                QUIRK_PHY_LCTRL_TIMEOUT},
+                QUIRK_NO_MSI},
 
         {PCI_VENDOR_ID_CREATIVE, PCI_DEVICE_ID_CREATIVE_SB1394, PCI_ANY_ID,
                 QUIRK_RESET_PACKET},
@@ -353,7 +349,6 @@ MODULE_PARM_DESC(quirks, "Chip quirks (default = 0"
         ", disable MSI = "              __stringify(QUIRK_NO_MSI)
         ", TI SLLZ059 erratum = "       __stringify(QUIRK_TI_SLLZ059)
         ", IR wake unreliable = "       __stringify(QUIRK_IR_WAKE)
-        ", phy LCtrl timeout = "        __stringify(QUIRK_PHY_LCTRL_TIMEOUT)
         ")");
 
 #define OHCI_PARAM_DEBUG_AT_AR          1
@@ -2299,9 +2294,6 @@ static int ohci_enable(struct fw_card *card,
          * TI TSB82AA2 + TSB81BA3(A) cards signal LPS enabled early but
          * cannot actually use the phy at that time.  These need tens of
          * millisecods pause between LPS write and first phy access too.
-         *
-         * But do not wait for 50msec on Agere/LSI cards.  Their phy
-         * arbitration state machine may time out during such a long wait.
          */
 
         reg_write(ohci, OHCI1394_HCControlSet,
@@ -2309,11 +2301,8 @@ static int ohci_enable(struct fw_card *card,
                   OHCI1394_HCControl_postedWriteEnable);
         flush_writes(ohci);
 
-        if (!(ohci->quirks & QUIRK_PHY_LCTRL_TIMEOUT))
+        for (lps = 0, i = 0; !lps && i < 3; i++) {
                 msleep(50);
-
-        for (lps = 0, i = 0; !lps && i < 150; i++) {
-                msleep(1);
                 lps = reg_read(ohci, OHCI1394_HCControlSet) &
                       OHCI1394_HCControl_LPS;
         }
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 281029daf98c..7aef911fdc71 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -146,6 +146,7 @@ struct sbp2_logical_unit {
          */
         int generation;
         int retries;
+        work_func_t workfn;
         struct delayed_work work;
         bool has_sdev;
         bool blocked;
@@ -864,7 +865,7 @@ static void sbp2_login(struct work_struct *work)
         /* set appropriate retry limit(s) in BUSY_TIMEOUT register */
         sbp2_set_busy_timeout(lu);
 
-        PREPARE_DELAYED_WORK(&lu->work, sbp2_reconnect);
+        lu->workfn = sbp2_reconnect;
         sbp2_agent_reset(lu);
 
         /* This was a re-login. */
@@ -918,7 +919,7 @@ static void sbp2_login(struct work_struct *work)
          * If a bus reset happened, sbp2_update will have requeued
          * lu->work already.  Reset the work from reconnect to login.
          */
-        PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
+        lu->workfn = sbp2_login;
 }
 
 static void sbp2_reconnect(struct work_struct *work)
@@ -952,7 +953,7 @@ static void sbp2_reconnect(struct work_struct *work)
                     lu->retries++ >= 5) {
                         dev_err(tgt_dev(tgt), "failed to reconnect\n");
                         lu->retries = 0;
-                        PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
+                        lu->workfn = sbp2_login;
                 }
                 sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
 
@@ -972,6 +973,13 @@ static void sbp2_reconnect(struct work_struct *work)
         sbp2_conditionally_unblock(lu);
 }
 
+static void sbp2_lu_workfn(struct work_struct *work)
+{
+        struct sbp2_logical_unit *lu = container_of(to_delayed_work(work),
+                                                struct sbp2_logical_unit, work);
+        lu->workfn(work);
+}
+
 static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
 {
         struct sbp2_logical_unit *lu;
@@ -998,7 +1006,8 @@ static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
         lu->blocked  = false;
         ++tgt->dont_block;
         INIT_LIST_HEAD(&lu->orb_list);
-        INIT_DELAYED_WORK(&lu->work, sbp2_login);
+        lu->workfn = sbp2_login;
+        INIT_DELAYED_WORK(&lu->work, sbp2_lu_workfn);
 
         list_add_tail(&lu->link, &tgt->lu_list);
         return 0;
diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c
index acf3a36c9ebc..32982da82694 100644
--- a/drivers/gpu/drm/armada/armada_drv.c
+++ b/drivers/gpu/drm/armada/armada_drv.c
@@ -68,15 +68,7 @@ void __armada_drm_queue_unref_work(struct drm_device *dev,
 {
         struct armada_private *priv = dev->dev_private;
 
-        /*
-         * Yes, we really must jump through these hoops just to store a
-         * _pointer_ to something into the kfifo.  This is utterly insane
-         * and idiotic, because it kfifo requires the _data_ pointed to by
-         * the pointer const, not the pointer itself.  Not only that, but
-         * you have to pass a pointer _to_ the pointer you want stored.
-         */
-        const struct drm_framebuffer *silly_api_alert = fb;
-        WARN_ON(!kfifo_put(&priv->fb_unref, &silly_api_alert));
+        WARN_ON(!kfifo_put(&priv->fb_unref, fb));
         schedule_work(&priv->fb_unref_work);
 }
 
diff --git a/drivers/gpu/drm/bochs/Kconfig b/drivers/gpu/drm/bochs/Kconfig
index c8fcf12019f0..5f8b0c2b9a44 100644
--- a/drivers/gpu/drm/bochs/Kconfig
+++ b/drivers/gpu/drm/bochs/Kconfig
@@ -2,6 +2,7 @@ config DRM_BOCHS
         tristate "DRM Support for bochs dispi vga interface (qemu stdvga)"
         depends on DRM && PCI
         select DRM_KMS_HELPER
+        select DRM_KMS_FB_HELPER
         select FB_SYS_FILLRECT
         select FB_SYS_COPYAREA
         select FB_SYS_IMAGEBLIT
diff --git a/drivers/gpu/drm/drm_pci.c b/drivers/gpu/drm/drm_pci.c
index 5736aaa7e86c..f7af69bcf3f4 100644
--- a/drivers/gpu/drm/drm_pci.c
+++ b/drivers/gpu/drm/drm_pci.c
@@ -468,8 +468,8 @@ void drm_pci_exit(struct drm_driver *driver, struct pci_driver *pdriver)
         } else {
                 list_for_each_entry_safe(dev, tmp, &driver->legacy_dev_list,
                                          legacy_dev_list) {
-                        drm_put_dev(dev);
                         list_del(&dev->legacy_dev_list);
+                        drm_put_dev(dev);
                 }
         }
         DRM_INFO("Module unloaded\n");
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 215131ab1dd2..c204b4e3356e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -172,20 +172,24 @@ static int exynos_drm_open(struct drm_device *dev, struct drm_file *file)
 
         ret = exynos_drm_subdrv_open(dev, file);
         if (ret)
-                goto out;
+                goto err_file_priv_free;
 
         anon_filp = anon_inode_getfile("exynos_gem", &exynos_drm_gem_fops,
                                         NULL, 0);
         if (IS_ERR(anon_filp)) {
                 ret = PTR_ERR(anon_filp);
-                goto out;
+                goto err_subdrv_close;
         }
 
         anon_filp->f_mode = FMODE_READ | FMODE_WRITE;
         file_priv->anon_filp = anon_filp;
 
         return ret;
-out:
+
+err_subdrv_close:
+        exynos_drm_subdrv_close(dev, file);
+
+err_file_priv_free:
         kfree(file_priv);
         file->driver_priv = NULL;
         return ret;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 04f1f02c4019..ec7bb0fc71bc 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -403,7 +403,7 @@ MODULE_DEVICE_TABLE(pci, pciidlist);
 void intel_detect_pch(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct pci_dev *pch;
+        struct pci_dev *pch = NULL;
 
         /* In all current cases, num_pipes is equivalent to the PCH_NOP setting
          * (which really amounts to a PCH but no South Display).
@@ -424,12 +424,9 @@ void intel_detect_pch(struct drm_device *dev)
          * all the ISA bridge devices and check for the first match, instead
          * of only checking the first one.
          */
-        pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, NULL);
-        while (pch) {
-                struct pci_dev *curr = pch;
+        while ((pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, pch))) {
                 if (pch->vendor == PCI_VENDOR_ID_INTEL) {
-                        unsigned short id;
-                        id = pch->device & INTEL_PCH_DEVICE_ID_MASK;
+                        unsigned short id = pch->device & INTEL_PCH_DEVICE_ID_MASK;
                         dev_priv->pch_id = id;
 
                         if (id == INTEL_PCH_IBX_DEVICE_ID_TYPE) {
@@ -461,18 +458,16 @@ void intel_detect_pch(struct drm_device *dev)
                                 DRM_DEBUG_KMS("Found LynxPoint LP PCH\n");
                                 WARN_ON(!IS_HASWELL(dev));
                                 WARN_ON(!IS_ULT(dev));
-                        } else {
-                                goto check_next;
-                        }
-                        pci_dev_put(pch);
+                        } else
+                                continue;
+
                         break;
                 }
-check_next:
-                pch = pci_get_class(PCI_CLASS_BRIDGE_ISA << 8, curr);
-                pci_dev_put(curr);
         }
         if (!pch)
-                DRM_DEBUG_KMS("No PCH found?\n");
+                DRM_DEBUG_KMS("No PCH found.\n");
+
+        pci_dev_put(pch);
 }
 
 bool i915_semaphore_is_enabled(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index 1a24e84f2315..28d24caa49f3 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -82,9 +82,22 @@ static unsigned long i915_stolen_to_physical(struct drm_device *dev)
         r = devm_request_mem_region(dev->dev, base, dev_priv->gtt.stolen_size,
                                     "Graphics Stolen Memory");
         if (r == NULL) {
-                DRM_ERROR("conflict detected with stolen region: [0x%08x - 0x%08x]\n",
-                          base, base + (uint32_t)dev_priv->gtt.stolen_size);
-                base = 0;
+                /*
+                 * One more attempt but this time requesting region from
+                 * base + 1, as we have seen that this resolves the region
+                 * conflict with the PCI Bus.
+                 * This is a BIOS w/a: Some BIOS wrap stolen in the root
+                 * PCI bus, but have an off-by-one error. Hence retry the
+                 * reservation starting from 1 instead of 0.
+                 */
+                r = devm_request_mem_region(dev->dev, base + 1,
+                                            dev_priv->gtt.stolen_size - 1,
+                                            "Graphics Stolen Memory");
+                if (r == NULL) {
+                        DRM_ERROR("conflict detected with stolen region: [0x%08x - 0x%08x]\n",
+                                  base, base + (uint32_t)dev_priv->gtt.stolen_size);
+                        base = 0;
+                }
         }
 
         return base;
@@ -201,6 +214,13 @@ int i915_gem_init_stolen(struct drm_device *dev)
         struct drm_i915_private *dev_priv = dev->dev_private;
         int bios_reserved = 0;
 
+#ifdef CONFIG_INTEL_IOMMU
+        if (intel_iommu_gfx_mapped) {
+                DRM_INFO("DMAR active, disabling use of stolen memory\n");
+                return 0;
+        }
+#endif
+
         if (dev_priv->gtt.stolen_size == 0)
                 return 0;
 
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 9fec71175571..d554169ac592 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -618,33 +618,25 @@ static u32 gm45_get_vblank_counter(struct drm_device *dev, int pipe)
 
 /* raw reads, only for fast reads of display block, no need for forcewake etc. */
 #define __raw_i915_read32(dev_priv__, reg__) readl((dev_priv__)->regs + (reg__))
-#define __raw_i915_read16(dev_priv__, reg__) readw((dev_priv__)->regs + (reg__))
 
 static bool ilk_pipe_in_vblank_locked(struct drm_device *dev, enum pipe pipe)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         uint32_t status;
-
-        if (INTEL_INFO(dev)->gen < 7) {
-                status = pipe == PIPE_A ?
-                        DE_PIPEA_VBLANK :
-                        DE_PIPEB_VBLANK;
+        int reg;
+
+        if (INTEL_INFO(dev)->gen >= 8) {
+                status = GEN8_PIPE_VBLANK;
+                reg = GEN8_DE_PIPE_ISR(pipe);
+        } else if (INTEL_INFO(dev)->gen >= 7) {
+                status = DE_PIPE_VBLANK_IVB(pipe);
+                reg = DEISR;
         } else {
-                switch (pipe) {
-                default:
-                case PIPE_A:
-                        status = DE_PIPEA_VBLANK_IVB;
-                        break;
-                case PIPE_B:
-                        status = DE_PIPEB_VBLANK_IVB;
-                        break;
-                case PIPE_C:
-                        status = DE_PIPEC_VBLANK_IVB;
-                        break;
-                }
+                status = DE_PIPE_VBLANK(pipe);
+                reg = DEISR;
         }
 
-        return __raw_i915_read32(dev_priv, DEISR) & status;
+        return __raw_i915_read32(dev_priv, reg) & status;
 }
 
 static int i915_get_crtc_scanoutpos(struct drm_device *dev, int pipe,
@@ -702,7 +694,28 @@ static int i915_get_crtc_scanoutpos(struct drm_device *dev, int pipe,
                 else
                         position = __raw_i915_read32(dev_priv, PIPEDSL(pipe)) & DSL_LINEMASK_GEN3;
 
-                if (HAS_PCH_SPLIT(dev)) {
+                if (HAS_DDI(dev)) {
+                        /*
+                         * On HSW HDMI outputs there seems to be a 2 line
+                         * difference, whereas eDP has the normal 1 line
+                         * difference that earlier platforms have. External
+                         * DP is unknown. For now just check for the 2 line
+                         * difference case on all output types on HSW+.
+                         *
+                         * This might misinterpret the scanline counter being
+                         * one line too far along on eDP, but that's less
+                         * dangerous than the alternative since that would lead
+                         * the vblank timestamp code astray when it sees a
+                         * scanline count before vblank_start during a vblank
+                         * interrupt.
+                         */
+                        in_vbl = ilk_pipe_in_vblank_locked(dev, pipe);
+                        if ((in_vbl && (position == vbl_start - 2 ||
+                                        position == vbl_start - 1)) ||
+                            (!in_vbl && (position == vbl_end - 2 ||
+                                         position == vbl_end - 1)))
+                                position = (position + 2) % vtotal;
+                } else if (HAS_PCH_SPLIT(dev)) {
                         /*
                          * The scanline counter increments at the leading edge
                          * of hsync, ie. it completely misses the active portion
@@ -2769,10 +2782,9 @@ static void ibx_irq_postinstall(struct drm_device *dev)
                 return;
 
         if (HAS_PCH_IBX(dev)) {
-                mask = SDE_GMBUS | SDE_AUX_MASK | SDE_TRANSB_FIFO_UNDER |
-                       SDE_TRANSA_FIFO_UNDER | SDE_POISON;
+                mask = SDE_GMBUS | SDE_AUX_MASK | SDE_POISON;
         } else {
-                mask = SDE_GMBUS_CPT | SDE_AUX_MASK_CPT | SDE_ERROR_CPT;
+                mask = SDE_GMBUS_CPT | SDE_AUX_MASK_CPT;
 
                 I915_WRITE(SERR_INT, I915_READ(SERR_INT));
         }
@@ -2832,20 +2844,19 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
                 display_mask = (DE_MASTER_IRQ_CONTROL | DE_GSE_IVB |
                                 DE_PCH_EVENT_IVB | DE_PLANEC_FLIP_DONE_IVB |
                                 DE_PLANEB_FLIP_DONE_IVB |
-                                DE_PLANEA_FLIP_DONE_IVB | DE_AUX_CHANNEL_A_IVB |
-                                DE_ERR_INT_IVB);
+                                DE_PLANEA_FLIP_DONE_IVB | DE_AUX_CHANNEL_A_IVB);
                 extra_mask = (DE_PIPEC_VBLANK_IVB | DE_PIPEB_VBLANK_IVB |
-                              DE_PIPEA_VBLANK_IVB);
+                              DE_PIPEA_VBLANK_IVB | DE_ERR_INT_IVB);
 
                 I915_WRITE(GEN7_ERR_INT, I915_READ(GEN7_ERR_INT));
         } else {
                 display_mask = (DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
                                 DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE |
                                 DE_AUX_CHANNEL_A |
-                                DE_PIPEB_FIFO_UNDERRUN | DE_PIPEA_FIFO_UNDERRUN |
                                 DE_PIPEB_CRC_DONE | DE_PIPEA_CRC_DONE |
                                 DE_POISON);
-                extra_mask = DE_PIPEA_VBLANK | DE_PIPEB_VBLANK | DE_PCU_EVENT;
+                extra_mask = DE_PIPEA_VBLANK | DE_PIPEB_VBLANK | DE_PCU_EVENT |
+                                DE_PIPEB_FIFO_UNDERRUN | DE_PIPEA_FIFO_UNDERRUN;
         }
 
         dev_priv->irq_mask = ~display_mask;
@@ -2961,9 +2972,9 @@ static void gen8_de_irq_postinstall(struct drm_i915_private *dev_priv)
         struct drm_device *dev = dev_priv->dev;
         uint32_t de_pipe_masked = GEN8_PIPE_FLIP_DONE |
                 GEN8_PIPE_CDCLK_CRC_DONE |
-                GEN8_PIPE_FIFO_UNDERRUN |
                 GEN8_DE_PIPE_IRQ_FAULT_ERRORS;
-        uint32_t de_pipe_enables = de_pipe_masked | GEN8_PIPE_VBLANK;
+        uint32_t de_pipe_enables = de_pipe_masked | GEN8_PIPE_VBLANK |
+                GEN8_PIPE_FIFO_UNDERRUN;
         int pipe;
         dev_priv->de_irq_mask[PIPE_A] = ~de_pipe_masked;
         dev_priv->de_irq_mask[PIPE_B] = ~de_pipe_masked;
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index e06b9e017d6b..234ac5f7bc5a 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1244,6 +1244,7 @@ static void intel_ddi_post_disable(struct intel_encoder *intel_encoder)
         if (type == INTEL_OUTPUT_DISPLAYPORT || type == INTEL_OUTPUT_EDP) {
                 struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
                 intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
+                ironlake_edp_panel_vdd_on(intel_dp);
                 ironlake_edp_panel_off(intel_dp);
         }
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 4c1672809493..9b8a7c7ea7fc 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1092,12 +1092,12 @@ static void assert_cursor(struct drm_i915_private *dev_priv,
         struct drm_device *dev = dev_priv->dev;
         bool cur_state;
 
-        if (IS_IVYBRIDGE(dev) || IS_HASWELL(dev))
-                cur_state = I915_READ(CURCNTR_IVB(pipe)) & CURSOR_MODE;
-        else if (IS_845G(dev) || IS_I865G(dev))
+        if (IS_845G(dev) || IS_I865G(dev))
                 cur_state = I915_READ(_CURACNTR) & CURSOR_ENABLE;
-        else
+        else if (INTEL_INFO(dev)->gen <= 6 || IS_VALLEYVIEW(dev))
                 cur_state = I915_READ(CURCNTR(pipe)) & CURSOR_MODE;
+        else
+                cur_state = I915_READ(CURCNTR_IVB(pipe)) & CURSOR_MODE;
 
         WARN(cur_state != state,
              "cursor on pipe %c assertion failure (expected %s, current %s)\n",
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 57552eb386b0..2688f6d64bb9 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1249,17 +1249,24 @@ void ironlake_edp_panel_off(struct intel_dp *intel_dp)
 
         DRM_DEBUG_KMS("Turn eDP power off\n");
 
+        WARN(!intel_dp->want_panel_vdd, "Need VDD to turn off panel\n");
+
         pp = ironlake_get_pp_control(intel_dp);
         /* We need to switch off panel power _and_ force vdd, for otherwise some
          * panels get very unhappy and cease to work. */
-        pp &= ~(POWER_TARGET_ON | PANEL_POWER_RESET | EDP_BLC_ENABLE);
+        pp &= ~(POWER_TARGET_ON | EDP_FORCE_VDD | PANEL_POWER_RESET | EDP_BLC_ENABLE);
 
         pp_ctrl_reg = _pp_ctrl_reg(intel_dp);
 
         I915_WRITE(pp_ctrl_reg, pp);
         POSTING_READ(pp_ctrl_reg);
 
+        intel_dp->want_panel_vdd = false;
+
         ironlake_wait_panel_off(intel_dp);
+
+        /* We got a reference when we enabled the VDD. */
+        intel_runtime_pm_put(dev_priv);
 }
 
 void ironlake_edp_backlight_on(struct intel_dp *intel_dp)
@@ -1639,7 +1646,7 @@ static void intel_edp_psr_enable_source(struct intel_dp *intel_dp)
                 val |= EDP_PSR_LINK_DISABLE;
 
         I915_WRITE(EDP_PSR_CTL(dev), val |
-                   IS_BROADWELL(dev) ? 0 : link_entry_time |
+                   (IS_BROADWELL(dev) ? 0 : link_entry_time) |
                    max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT |
                    idle_frames << EDP_PSR_IDLE_FRAME_SHIFT |
                    EDP_PSR_ENABLE);
@@ -1784,6 +1791,7 @@ static void intel_disable_dp(struct intel_encoder *encoder)
 
         /* Make sure the panel is off before trying to change the mode. But also
          * ensure that we have vdd while we switch off the panel. */
+        ironlake_edp_panel_vdd_on(intel_dp);
         ironlake_edp_backlight_off(intel_dp);
         intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
         ironlake_edp_panel_off(intel_dp);
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 6db0d9d17f47..ee3181ebcc92 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -845,7 +845,7 @@ static int hdmi_portclock_limit(struct intel_hdmi *hdmi)
 {
         struct drm_device *dev = intel_hdmi_to_dev(hdmi);
 
-        if (IS_G4X(dev))
+        if (!hdmi->has_hdmi_sink || IS_G4X(dev))
                 return 165000;
         else if (IS_HASWELL(dev) || INTEL_INFO(dev)->gen >= 8)
                 return 300000;
@@ -899,8 +899,8 @@ bool intel_hdmi_compute_config(struct intel_encoder *encoder,
          * outputs. We also need to check that the higher clock still fits
          * within limits.
          */
-        if (pipe_config->pipe_bpp > 8*3 && clock_12bpc <= portclock_limit
-            && HAS_PCH_SPLIT(dev)) {
+        if (pipe_config->pipe_bpp > 8*3 && intel_hdmi->has_hdmi_sink &&
+            clock_12bpc <= portclock_limit && HAS_PCH_SPLIT(dev)) {
                 DRM_DEBUG_KMS("picking bpc to 12 for HDMI output\n");
                 desired_bpp = 12*3;
 
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 350de359123a..079ea38f14d9 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -698,7 +698,7 @@ static void i9xx_enable_backlight(struct intel_connector *connector)
                 freq /= 0xff;
 
         ctl = freq << 17;
-        if (IS_GEN2(dev) && panel->backlight.combination_mode)
+        if (panel->backlight.combination_mode)
                 ctl |= BLM_LEGACY_MODE;
         if (IS_PINEVIEW(dev) && panel->backlight.active_low_pwm)
                 ctl |= BLM_POLARITY_PNV;
@@ -979,7 +979,7 @@ static int i9xx_setup_backlight(struct intel_connector *connector)
 
         ctl = I915_READ(BLC_PWM_CTL);
 
-        if (IS_GEN2(dev))
+        if (IS_GEN2(dev) || IS_I915GM(dev) || IS_I945GM(dev))
                 panel->backlight.combination_mode = ctl & BLM_LEGACY_MODE;
 
         if (IS_PINEVIEW(dev))
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index d77cc81900f9..e1fc35a72656 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3493,6 +3493,8 @@ static void valleyview_setup_pctx(struct drm_device *dev)
         u32 pcbr;
         int pctx_size = 24*1024;
 
+        WARN_ON(!mutex_is_locked(&dev->struct_mutex));
+
         pcbr = I915_READ(VLV_PCBR);
         if (pcbr) {
                 /* BIOS set it up already, grab the pre-alloc'd space */
@@ -3542,8 +3544,6 @@ static void valleyview_enable_rps(struct drm_device *dev)
                 I915_WRITE(GTFIFODBG, gtfifodbg);
         }
 
-        valleyview_setup_pctx(dev);
-
         /* If VLV, Forcewake all wells, else re-direct to regular path */
         gen6_gt_force_wake_get(dev_priv, FORCEWAKE_ALL);
 
@@ -4395,6 +4395,8 @@ void intel_enable_gt_powersave(struct drm_device *dev)
                 ironlake_enable_rc6(dev);
                 intel_init_emon(dev);
         } else if (IS_GEN6(dev) || IS_GEN7(dev)) {
+                if (IS_VALLEYVIEW(dev))
+                        valleyview_setup_pctx(dev);
                 /*
                  * PCU communication is slow and this doesn't need to be
                  * done at any specific time, so do this out of our fast path
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 2cec2ab02f80..607dc14d195e 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -1314,7 +1314,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
                         }
                         if (is_dp)
                                 args.v5.ucLaneNum = dp_lane_count;
-                        else if (radeon_encoder->pixel_clock > 165000)
+                        else if (radeon_dig_monitor_is_duallink(encoder, radeon_encoder->pixel_clock))
                                 args.v5.ucLaneNum = 8;
                         else
                                 args.v5.ucLaneNum = 4;
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index e6419ca7cd37..bbb17841a9e5 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3046,7 +3046,7 @@ static u32 cik_create_bitmask(u32 bit_width)
 }
 
 /**
- * cik_select_se_sh - select which SE, SH to address
+ * cik_get_rb_disabled - computes the mask of disabled RBs
  *
  * @rdev: radeon_device pointer
  * @max_rb_num: max RBs (render backends) for the asic
@@ -4134,8 +4134,11 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable)
 {
         if (enable)
                 WREG32(CP_MEC_CNTL, 0);
-        else
+        else {
                 WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT));
+                rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false;
+                rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
+        }
         udelay(50);
 }
 
@@ -7902,7 +7905,8 @@ int cik_resume(struct radeon_device *rdev)
         /* init golden registers */
         cik_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = cik_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index 1ecb3f1070e3..94626ea90fa5 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -264,6 +264,8 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev)
                 WREG32(SDMA0_GFX_RB_CNTL + reg_offset, rb_cntl);
                 WREG32(SDMA0_GFX_IB_CNTL + reg_offset, 0);
         }
+        rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false;
+        rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false;
 }
 
 /**
@@ -291,6 +293,11 @@ void cik_sdma_enable(struct radeon_device *rdev, bool enable)
         u32 me_cntl, reg_offset;
         int i;
 
+        if (enable == false) {
+                cik_sdma_gfx_stop(rdev);
+                cik_sdma_rlc_stop(rdev);
+        }
+
         for (i = 0; i < 2; i++) {
                 if (i == 0)
                         reg_offset = SDMA0_REGISTER_OFFSET;
@@ -420,10 +427,6 @@ static int cik_sdma_load_microcode(struct radeon_device *rdev)
         if (!rdev->sdma_fw)
                 return -EINVAL;
 
-        /* stop the gfx rings and rlc compute queues */
-        cik_sdma_gfx_stop(rdev);
-        cik_sdma_rlc_stop(rdev);
-
         /* halt the MEs */
         cik_sdma_enable(rdev, false);
 
@@ -492,9 +495,6 @@ int cik_sdma_resume(struct radeon_device *rdev)
  */
 void cik_sdma_fini(struct radeon_device *rdev)
 {
-        /* stop the gfx rings and rlc compute queues */
-        cik_sdma_gfx_stop(rdev);
-        cik_sdma_rlc_stop(rdev);
         /* halt the MEs */
         cik_sdma_enable(rdev, false);
         radeon_ring_fini(rdev, &rdev->ring[R600_RING_TYPE_DMA_INDEX]);
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 8a2c010b7dc5..27b0ff16082e 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -5299,7 +5299,8 @@ int evergreen_resume(struct radeon_device *rdev)
         /* init golden registers */
         evergreen_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = evergreen_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/evergreen_smc.h b/drivers/gpu/drm/radeon/evergreen_smc.h
index 76ada8cfe902..3a03ba37d043 100644
--- a/drivers/gpu/drm/radeon/evergreen_smc.h
+++ b/drivers/gpu/drm/radeon/evergreen_smc.h
@@ -57,7 +57,7 @@ typedef struct SMC_Evergreen_MCRegisters SMC_Evergreen_MCRegisters;
 
 #define EVERGREEN_SMC_FIRMWARE_HEADER_LOCATION 0x100
 
-#define EVERGREEN_SMC_FIRMWARE_HEADER_softRegisters   0x0
+#define EVERGREEN_SMC_FIRMWARE_HEADER_softRegisters   0x8
 #define EVERGREEN_SMC_FIRMWARE_HEADER_stateTable      0xC
 #define EVERGREEN_SMC_FIRMWARE_HEADER_mcRegisterTable 0x20
 
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index ea932ac66fc6..bf6300cfd62d 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -2105,7 +2105,8 @@ int cayman_resume(struct radeon_device *rdev)
         /* init golden registers */
         ni_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = cayman_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index ef024ce3f7cc..3cc78bb66042 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -3942,8 +3942,6 @@ int r100_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = r100_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 7c63ef840e86..0b658b34b33a 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -1430,8 +1430,6 @@ int r300_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = r300_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 3768aab2710b..802b19220a21 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -325,8 +325,6 @@ int r420_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = r420_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index e209eb75024f..98d6053c36c6 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -240,8 +240,6 @@ int r520_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = r520_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index cdbc4171fe73..647ef4079217 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2968,7 +2968,8 @@ int r600_resume(struct radeon_device *rdev)
         /* post card */
         atom_asic_init(rdev->mode_info.atom_context);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = r600_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index b012cbbc3ed5..044bc98fb459 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1521,13 +1521,16 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
         if (r)
                 DRM_ERROR("ib ring test failed (%d).\n", r);
 
-        if (rdev->pm.dpm_enabled) {
+        if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) {
                 /* do dpm late init */
                 r = radeon_pm_late_init(rdev);
                 if (r) {
                         rdev->pm.dpm_enabled = false;
                         DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n");
                 }
+        } else {
+                /* resume old pm late */
+                radeon_pm_resume(rdev);
         }
 
         radeon_restore_bios_scratch_regs(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 2aecd6dc2610..66ed3ea71440 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -33,6 +33,13 @@
 #include <linux/vga_switcheroo.h>
 #include <linux/slab.h>
 #include <linux/pm_runtime.h>
+
+#if defined(CONFIG_VGA_SWITCHEROO)
+bool radeon_is_px(void);
+#else
+static inline bool radeon_is_px(void) { return false; }
+#endif
+
 /**
  * radeon_driver_unload_kms - Main unload function for KMS.
  *
@@ -130,7 +137,8 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
                                 "Error during ACPI methods call\n");
         }
 
-        if (radeon_runtime_pm != 0) {
+        if ((radeon_runtime_pm == 1) ||
+            ((radeon_runtime_pm == -1) && radeon_is_px())) {
                 pm_runtime_use_autosuspend(dev->dev);
                 pm_runtime_set_autosuspend_delay(dev->dev, 5000);
                 pm_runtime_set_active(dev->dev);
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 77f5b0c3edb8..040a2a10ea17 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -714,6 +714,9 @@ int radeon_ttm_init(struct radeon_device *rdev)
                 DRM_ERROR("Failed initializing VRAM heap.\n");
                 return r;
         }
+        /* Change the size here instead of the init above so only lpfn is affected */
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
+
         r = radeon_bo_create(rdev, 256 * 1024, PAGE_SIZE, true,
                              RADEON_GEM_DOMAIN_VRAM,
                              NULL, &rdev->stollen_vga_memory);
@@ -935,7 +938,7 @@ static ssize_t radeon_ttm_gtt_read(struct file *f, char __user *buf,
         while (size) {
                 loff_t p = *pos / PAGE_SIZE;
                 unsigned off = *pos & ~PAGE_MASK;
-                ssize_t cur_size = min(size, PAGE_SIZE - off);
+                size_t cur_size = min_t(size_t, size, PAGE_SIZE - off);
                 struct page *page;
                 void *ptr;
 
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index b5c2369cda2f..130d5cc50d43 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -474,8 +474,6 @@ int rs400_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = rs400_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index fdcde7693032..72d3616de08e 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -1048,8 +1048,6 @@ int rs600_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = rs600_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 35950738bd5e..3462b64369bf 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -756,8 +756,6 @@ int rs690_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r = rs690_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 98e8138ff779..237dd29d9f1c 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -586,8 +586,6 @@ int rv515_resume(struct radeon_device *rdev)
         /* Initialize surface registers */
         radeon_surface_init(rdev);
 
-        radeon_pm_resume(rdev);
-
         rdev->accel_working = true;
         r =  rv515_startup(rdev);
         if (r) {
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 4e37a42305d8..fef310773aad 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -1811,7 +1811,8 @@ int rv770_resume(struct radeon_device *rdev)
         /* init golden registers */
         rv770_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = rv770_startup(rdev);
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 83578324e5d1..9a124d0608b3 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -6618,7 +6618,8 @@ int si_resume(struct radeon_device *rdev)
         /* init golden registers */
         si_init_golden_registers(rdev);
 
-        radeon_pm_resume(rdev);
+        if (rdev->pm.pm_method == PM_METHOD_DPM)
+                radeon_pm_resume(rdev);
 
         rdev->accel_working = true;
         r = si_startup(rdev);
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index a06651309388..214b7992a3aa 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -351,9 +351,11 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
 
 moved:
         if (bo->evicted) {
-                ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement);
-                if (ret)
-                        pr_err("Can not flush read caches\n");
+                if (bdev->driver->invalidate_caches) {
+                        ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement);
+                        if (ret)
+                                pr_err("Can not flush read caches\n");
+                }
                 bo->evicted = false;
         }
 
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index 801231c9ae48..0ce48e5a9cb4 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -339,11 +339,13 @@ int ttm_bo_mmap(struct file *filp, struct vm_area_struct *vma,
         vma->vm_private_data = bo;
 
         /*
-         * PFNMAP is faster than MIXEDMAP due to reduced page
-         * administration. So use MIXEDMAP only if private VMA, where
-         * we need to support COW.
+         * We'd like to use VM_PFNMAP on shared mappings, where
+         * (vma->vm_flags & VM_SHARED) != 0, for performance reasons,
+         * but for some reason VM_PFNMAP + x86 PAT + write-combine is very
+         * bad for performance. Until that has been sorted out, use
+         * VM_MIXEDMAP on all mappings. See freedesktop.org bug #75719
          */
-        vma->vm_flags |= (vma->vm_flags & VM_SHARED) ? VM_PFNMAP : VM_MIXEDMAP;
+        vma->vm_flags |= VM_MIXEDMAP;
         vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
         return 0;
 out_unref:
@@ -359,7 +361,7 @@ int ttm_fbdev_mmap(struct vm_area_struct *vma, struct ttm_buffer_object *bo)
 
         vma->vm_ops = &ttm_bo_vm_ops;
         vma->vm_private_data = ttm_bo_reference(bo);
-        vma->vm_flags |= (vma->vm_flags & VM_SHARED) ? VM_PFNMAP : VM_MIXEDMAP;
+        vma->vm_flags |= VM_MIXEDMAP;
         vma->vm_flags |= VM_IO | VM_DONTEXPAND;
         return 0;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 82468d902915..e7af580ab977 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -830,6 +830,24 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
         if (unlikely(ret != 0))
                 goto out_unlock;
 
+        /*
+         * A gb-aware client referencing a shared surface will
+         * expect a backup buffer to be present.
+         */
+        if (dev_priv->has_mob && req->shareable) {
+                uint32_t backup_handle;
+
+                ret = vmw_user_dmabuf_alloc(dev_priv, tfile,
+                                            res->backup_size,
+                                            true,
+                                            &backup_handle,
+                                            &res->backup);
+                if (unlikely(ret != 0)) {
+                        vmw_resource_unreference(&res);
+                        goto out_unlock;
+                }
+        }
+
         tmp = vmw_resource_reference(&srf->res);
         ret = ttm_prime_object_init(tfile, res->backup_size, &user_srf->prime,
                                     req->shareable, VMW_RES_SURFACE,
diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
index befe0e336471..24883b4d1a49 100644
--- a/drivers/hid/hid-lg4ff.c
+++ b/drivers/hid/hid-lg4ff.c
@@ -43,6 +43,7 @@
 #define G25_REV_MIN 0x22
 #define G27_REV_MAJ 0x12
 #define G27_REV_MIN 0x38
+#define G27_2_REV_MIN 0x39
 
 #define to_hid_device(pdev) container_of(pdev, struct hid_device, dev)
 
@@ -130,6 +131,7 @@ static const struct lg4ff_usb_revision lg4ff_revs[] = {
         {DFP_REV_MAJ,  DFP_REV_MIN,  &native_dfp},      /* Driving Force Pro */
         {G25_REV_MAJ,  G25_REV_MIN,  &native_g25},      /* G25 */
         {G27_REV_MAJ,  G27_REV_MIN,  &native_g27},      /* G27 */
+        {G27_REV_MAJ,  G27_2_REV_MIN,  &native_g27},    /* G27 v2 */
 };
 
 /* Recalculates X axis value accordingly to currently selected range */
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 12354055d474..2f19b15f47f2 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -42,6 +42,7 @@
 #define DUALSHOCK4_CONTROLLER_BT  BIT(6)
 
 #define SONY_LED_SUPPORT (SIXAXIS_CONTROLLER_USB | BUZZ_CONTROLLER | DUALSHOCK4_CONTROLLER_USB)
+#define SONY_FF_SUPPORT (SIXAXIS_CONTROLLER_USB | DUALSHOCK4_CONTROLLER_USB)
 
 #define MAX_LEDS 4
 
@@ -499,6 +500,7 @@ struct sony_sc {
         __u8 right;
 #endif
 
+        __u8 worker_initialized;
         __u8 led_state[MAX_LEDS];
         __u8 led_count;
 };
@@ -993,22 +995,11 @@ static int sony_init_ff(struct hid_device *hdev)
         return input_ff_create_memless(input_dev, NULL, sony_play_effect);
 }
 
-static void sony_destroy_ff(struct hid_device *hdev)
-{
-        struct sony_sc *sc = hid_get_drvdata(hdev);
-
-        cancel_work_sync(&sc->state_worker);
-}
-
 #else
 static int sony_init_ff(struct hid_device *hdev)
 {
         return 0;
 }
-
-static void sony_destroy_ff(struct hid_device *hdev)
-{
-}
 #endif
 
 static int sony_set_output_report(struct sony_sc *sc, int req_id, int req_size)
@@ -1077,6 +1068,8 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
         if (sc->quirks & SIXAXIS_CONTROLLER_USB) {
                 hdev->hid_output_raw_report = sixaxis_usb_output_raw_report;
                 ret = sixaxis_set_operational_usb(hdev);
+
+                sc->worker_initialized = 1;
                 INIT_WORK(&sc->state_worker, sixaxis_state_worker);
         }
         else if (sc->quirks & SIXAXIS_CONTROLLER_BT)
@@ -1087,6 +1080,7 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 if (ret < 0)
                         goto err_stop;
 
+                sc->worker_initialized = 1;
                 INIT_WORK(&sc->state_worker, dualshock4_state_worker);
         } else {
                 ret = 0;
@@ -1101,9 +1095,11 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
                         goto err_stop;
         }
 
-        ret = sony_init_ff(hdev);
-        if (ret < 0)
-                goto err_stop;
+        if (sc->quirks & SONY_FF_SUPPORT) {
+                ret = sony_init_ff(hdev);
+                if (ret < 0)
+                        goto err_stop;
+        }
 
         return 0;
 err_stop:
@@ -1120,7 +1116,8 @@ static void sony_remove(struct hid_device *hdev)
         if (sc->quirks & SONY_LED_SUPPORT)
                 sony_leds_remove(hdev);
 
-        sony_destroy_ff(hdev);
+        if (sc->worker_initialized)
+                cancel_work_sync(&sc->state_worker);
 
         hid_hw_stop(hdev);
 }
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index cb0137b3718d..ab24ce2eb28f 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -320,13 +320,13 @@ static void drop_ref(struct hidraw *hidraw, int exists_bit)
                         hid_hw_close(hidraw->hid);
                         wake_up_interruptible(&hidraw->wait);
                 }
+                device_destroy(hidraw_class,
+                               MKDEV(hidraw_major, hidraw->minor));
         } else {
                 --hidraw->open;
         }
         if (!hidraw->open) {
                 if (!hidraw->exist) {
-                        device_destroy(hidraw_class,
-                                        MKDEV(hidraw_major, hidraw->minor));
                         hidraw_table[hidraw->minor] = NULL;
                         kfree(hidraw);
                 } else {
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index f5ed03164d86..de17c5593d97 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -387,7 +387,7 @@ config I2C_CBUS_GPIO
 
 config I2C_CPM
         tristate "Freescale CPM1 or CPM2 (MPC8xx/826x)"
-        depends on (CPM1 || CPM2) && OF_I2C
+        depends on CPM1 || CPM2
         help
           This supports the use of the I2C interface on Freescale
           processors with CPM1 or CPM2.
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index e81c5547e647..f9c12e92fdd6 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -53,8 +53,8 @@
 #include "user.h"
 
 #define DRV_NAME        MLX4_IB_DRV_NAME
-#define DRV_VERSION     "1.0"
-#define DRV_RELDATE     "April 4, 2008"
+#define DRV_VERSION     "2.2-1"
+#define DRV_RELDATE     "Feb 2014"
 
 #define MLX4_IB_FLOW_MAX_PRIO 0xFFF
 #define MLX4_IB_FLOW_QPN_MASK 0xFFFFFF
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index aa03e732b6a8..bf900579ac08 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -46,8 +46,8 @@
 #include "mlx5_ib.h"
 
 #define DRIVER_NAME "mlx5_ib"
-#define DRIVER_VERSION "1.0"
-#define DRIVER_RELDATE  "June 2013"
+#define DRIVER_VERSION "2.2-1"
+#define DRIVER_RELDATE  "Feb 2014"
 
 MODULE_AUTHOR("Eli Cohen <eli@mellanox.com>");
 MODULE_DESCRIPTION("Mellanox Connect-IB HCA IB driver");
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index d18d08a076e8..8ee228e9ab5a 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -492,12 +492,11 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
         isert_conn->state = ISER_CONN_INIT;
         INIT_LIST_HEAD(&isert_conn->conn_accept_node);
         init_completion(&isert_conn->conn_login_comp);
-        init_waitqueue_head(&isert_conn->conn_wait);
-        init_waitqueue_head(&isert_conn->conn_wait_comp_err);
+        init_completion(&isert_conn->conn_wait);
+        init_completion(&isert_conn->conn_wait_comp_err);
         kref_init(&isert_conn->conn_kref);
         kref_get(&isert_conn->conn_kref);
         mutex_init(&isert_conn->conn_mutex);
-        mutex_init(&isert_conn->conn_comp_mutex);
         spin_lock_init(&isert_conn->conn_lock);
 
         cma_id->context = isert_conn;
@@ -688,11 +687,11 @@ isert_disconnect_work(struct work_struct *work)
 
         pr_debug("isert_disconnect_work(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
         mutex_lock(&isert_conn->conn_mutex);
-        isert_conn->state = ISER_CONN_DOWN;
+        if (isert_conn->state == ISER_CONN_UP)
+                isert_conn->state = ISER_CONN_TERMINATING;
 
         if (isert_conn->post_recv_buf_count == 0 &&
             atomic_read(&isert_conn->post_send_buf_count) == 0) {
-                pr_debug("Calling wake_up(&isert_conn->conn_wait);\n");
                 mutex_unlock(&isert_conn->conn_mutex);
                 goto wake_up;
         }
@@ -712,7 +711,7 @@ isert_disconnect_work(struct work_struct *work)
         mutex_unlock(&isert_conn->conn_mutex);
 
 wake_up:
-        wake_up(&isert_conn->conn_wait);
+        complete(&isert_conn->conn_wait);
         isert_put_conn(isert_conn);
 }
 
@@ -888,16 +887,17 @@ isert_init_send_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
          * Coalesce send completion interrupts by only setting IB_SEND_SIGNALED
          * bit for every ISERT_COMP_BATCH_COUNT number of ib_post_send() calls.
          */
-        mutex_lock(&isert_conn->conn_comp_mutex);
-        if (coalesce &&
+        mutex_lock(&isert_conn->conn_mutex);
+        if (coalesce && isert_conn->state == ISER_CONN_UP &&
             ++isert_conn->conn_comp_batch < ISERT_COMP_BATCH_COUNT) {
+                tx_desc->llnode_active = true;
                 llist_add(&tx_desc->comp_llnode, &isert_conn->conn_comp_llist);
-                mutex_unlock(&isert_conn->conn_comp_mutex);
+                mutex_unlock(&isert_conn->conn_mutex);
                 return;
         }
         isert_conn->conn_comp_batch = 0;
         tx_desc->comp_llnode_batch = llist_del_all(&isert_conn->conn_comp_llist);
-        mutex_unlock(&isert_conn->conn_comp_mutex);
+        mutex_unlock(&isert_conn->conn_mutex);
 
         send_wr->send_flags = IB_SEND_SIGNALED;
 }
@@ -1464,7 +1464,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
         case ISCSI_OP_SCSI_CMD:
                 spin_lock_bh(&conn->cmd_lock);
                 if (!list_empty(&cmd->i_conn_node))
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 if (cmd->data_direction == DMA_TO_DEVICE)
@@ -1476,7 +1476,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
         case ISCSI_OP_SCSI_TMFUNC:
                 spin_lock_bh(&conn->cmd_lock);
                 if (!list_empty(&cmd->i_conn_node))
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 transport_generic_free_cmd(&cmd->se_cmd, 0);
@@ -1486,7 +1486,7 @@ isert_put_cmd(struct isert_cmd *isert_cmd)
         case ISCSI_OP_TEXT:
                 spin_lock_bh(&conn->cmd_lock);
                 if (!list_empty(&cmd->i_conn_node))
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 /*
@@ -1549,6 +1549,7 @@ isert_completion_rdma_read(struct iser_tx_desc *tx_desc,
         iscsit_stop_dataout_timer(cmd);
         device->unreg_rdma_mem(isert_cmd, isert_conn);
         cmd->write_data_done = wr->cur_rdma_length;
+        wr->send_wr_num = 0;
 
         pr_debug("Cmd: %p RDMA_READ comp calling execute_cmd\n", isert_cmd);
         spin_lock_bh(&cmd->istate_lock);
@@ -1589,7 +1590,7 @@ isert_do_control_comp(struct work_struct *work)
                 pr_debug("Calling iscsit_logout_post_handler >>>>>>>>>>>>>>\n");
                 /*
                  * Call atomic_dec(&isert_conn->post_send_buf_count)
-                 * from isert_free_conn()
+                 * from isert_wait_conn()
                  */
                 isert_conn->logout_posted = true;
                 iscsit_logout_post_handler(cmd, cmd->conn);
@@ -1613,6 +1614,7 @@ isert_response_completion(struct iser_tx_desc *tx_desc,
                           struct ib_device *ib_dev)
 {
         struct iscsi_cmd *cmd = isert_cmd->iscsi_cmd;
+        struct isert_rdma_wr *wr = &isert_cmd->rdma_wr;
 
         if (cmd->i_state == ISTATE_SEND_TASKMGTRSP ||
             cmd->i_state == ISTATE_SEND_LOGOUTRSP ||
@@ -1624,7 +1626,7 @@ isert_response_completion(struct iser_tx_desc *tx_desc,
                 queue_work(isert_comp_wq, &isert_cmd->comp_work);
                 return;
         }
-        atomic_dec(&isert_conn->post_send_buf_count);
+        atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
 
         cmd->i_state = ISTATE_SENT_STATUS;
         isert_completion_put(tx_desc, isert_cmd, ib_dev);
@@ -1662,7 +1664,7 @@ __isert_send_completion(struct iser_tx_desc *tx_desc,
         case ISER_IB_RDMA_READ:
                 pr_debug("isert_send_completion: Got ISER_IB_RDMA_READ:\n");
 
-                atomic_dec(&isert_conn->post_send_buf_count);
+                atomic_sub(wr->send_wr_num, &isert_conn->post_send_buf_count);
                 isert_completion_rdma_read(tx_desc, isert_cmd);
                 break;
         default:
@@ -1691,31 +1693,76 @@ isert_send_completion(struct iser_tx_desc *tx_desc,
 }
 
 static void
-isert_cq_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn)
+isert_cq_drain_comp_llist(struct isert_conn *isert_conn, struct ib_device *ib_dev)
+{
+        struct llist_node *llnode;
+        struct isert_rdma_wr *wr;
+        struct iser_tx_desc *t;
+
+        mutex_lock(&isert_conn->conn_mutex);
+        llnode = llist_del_all(&isert_conn->conn_comp_llist);
+        isert_conn->conn_comp_batch = 0;
+        mutex_unlock(&isert_conn->conn_mutex);
+
+        while (llnode) {
+                t = llist_entry(llnode, struct iser_tx_desc, comp_llnode);
+                llnode = llist_next(llnode);
+                wr = &t->isert_cmd->rdma_wr;
+
+                atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
+                isert_completion_put(t, t->isert_cmd, ib_dev);
+        }
+}
+
+static void
+isert_cq_tx_comp_err(struct iser_tx_desc *tx_desc, struct isert_conn *isert_conn)
 {
         struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
+        struct isert_cmd *isert_cmd = tx_desc->isert_cmd;
+        struct llist_node *llnode = tx_desc->comp_llnode_batch;
+        struct isert_rdma_wr *wr;
+        struct iser_tx_desc *t;
 
-        if (tx_desc) {
-                struct isert_cmd *isert_cmd = tx_desc->isert_cmd;
+        while (llnode) {
+                t = llist_entry(llnode, struct iser_tx_desc, comp_llnode);
+                llnode = llist_next(llnode);
+                wr = &t->isert_cmd->rdma_wr;
 
-                if (!isert_cmd)
-                        isert_unmap_tx_desc(tx_desc, ib_dev);
-                else
-                        isert_completion_put(tx_desc, isert_cmd, ib_dev);
+                atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
+                isert_completion_put(t, t->isert_cmd, ib_dev);
         }
+        tx_desc->comp_llnode_batch = NULL;
 
-        if (isert_conn->post_recv_buf_count == 0 &&
-            atomic_read(&isert_conn->post_send_buf_count) == 0) {
-                pr_debug("isert_cq_comp_err >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
-                pr_debug("Calling wake_up from isert_cq_comp_err\n");
+        if (!isert_cmd)
+                isert_unmap_tx_desc(tx_desc, ib_dev);
+        else
+                isert_completion_put(tx_desc, isert_cmd, ib_dev);
+}
 
-                mutex_lock(&isert_conn->conn_mutex);
-                if (isert_conn->state != ISER_CONN_DOWN)
-                        isert_conn->state = ISER_CONN_TERMINATING;
-                mutex_unlock(&isert_conn->conn_mutex);
+static void
+isert_cq_rx_comp_err(struct isert_conn *isert_conn)
+{
+        struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
+        struct iscsi_conn *conn = isert_conn->conn;
 
-                wake_up(&isert_conn->conn_wait_comp_err);
+        if (isert_conn->post_recv_buf_count)
+                return;
+
+        isert_cq_drain_comp_llist(isert_conn, ib_dev);
+
+        if (conn->sess) {
+                target_sess_cmd_list_set_waiting(conn->sess->se_sess);
+                target_wait_for_sess_cmds(conn->sess->se_sess);
         }
+
+        while (atomic_read(&isert_conn->post_send_buf_count))
+                msleep(3000);
+
+        mutex_lock(&isert_conn->conn_mutex);
+        isert_conn->state = ISER_CONN_DOWN;
+        mutex_unlock(&isert_conn->conn_mutex);
+
+        complete(&isert_conn->conn_wait_comp_err);
 }
 
 static void
@@ -1740,8 +1787,14 @@ isert_cq_tx_work(struct work_struct *work)
                         pr_debug("TX wc.status != IB_WC_SUCCESS >>>>>>>>>>>>>>\n");
                         pr_debug("TX wc.status: 0x%08x\n", wc.status);
                         pr_debug("TX wc.vendor_err: 0x%08x\n", wc.vendor_err);
-                        atomic_dec(&isert_conn->post_send_buf_count);
-                        isert_cq_comp_err(tx_desc, isert_conn);
+
+                        if (wc.wr_id != ISER_FASTREG_LI_WRID) {
+                                if (tx_desc->llnode_active)
+                                        continue;
+
+                                atomic_dec(&isert_conn->post_send_buf_count);
+                                isert_cq_tx_comp_err(tx_desc, isert_conn);
+                        }
                 }
         }
 
@@ -1784,7 +1837,7 @@ isert_cq_rx_work(struct work_struct *work)
                                          wc.vendor_err);
                         }
                         isert_conn->post_recv_buf_count--;
-                        isert_cq_comp_err(NULL, isert_conn);
+                        isert_cq_rx_comp_err(isert_conn);
                 }
         }
 
@@ -2202,6 +2255,7 @@ isert_fast_reg_mr(struct fast_reg_descriptor *fr_desc,
 
         if (!fr_desc->valid) {
                 memset(&inv_wr, 0, sizeof(inv_wr));
+                inv_wr.wr_id = ISER_FASTREG_LI_WRID;
                 inv_wr.opcode = IB_WR_LOCAL_INV;
                 inv_wr.ex.invalidate_rkey = fr_desc->data_mr->rkey;
                 wr = &inv_wr;
@@ -2212,6 +2266,7 @@ isert_fast_reg_mr(struct fast_reg_descriptor *fr_desc,
 
         /* Prepare FASTREG WR */
         memset(&fr_wr, 0, sizeof(fr_wr));
+        fr_wr.wr_id = ISER_FASTREG_LI_WRID;
         fr_wr.opcode = IB_WR_FAST_REG_MR;
         fr_wr.wr.fast_reg.iova_start =
                 fr_desc->data_frpl->page_list[0] + page_off;
@@ -2377,12 +2432,12 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
         isert_init_send_wr(isert_conn, isert_cmd,
                            &isert_cmd->tx_desc.send_wr, true);
 
-        atomic_inc(&isert_conn->post_send_buf_count);
+        atomic_add(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
 
         rc = ib_post_send(isert_conn->conn_qp, wr->send_wr, &wr_failed);
         if (rc) {
                 pr_warn("ib_post_send() failed for IB_WR_RDMA_WRITE\n");
-                atomic_dec(&isert_conn->post_send_buf_count);
+                atomic_sub(wr->send_wr_num + 1, &isert_conn->post_send_buf_count);
         }
         pr_debug("Cmd: %p posted RDMA_WRITE + Response for iSER Data READ\n",
                  isert_cmd);
@@ -2410,12 +2465,12 @@ isert_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd, bool recovery)
                 return rc;
         }
 
-        atomic_inc(&isert_conn->post_send_buf_count);
+        atomic_add(wr->send_wr_num, &isert_conn->post_send_buf_count);
 
         rc = ib_post_send(isert_conn->conn_qp, wr->send_wr, &wr_failed);
         if (rc) {
                 pr_warn("ib_post_send() failed for IB_WR_RDMA_READ\n");
-                atomic_dec(&isert_conn->post_send_buf_count);
+                atomic_sub(wr->send_wr_num, &isert_conn->post_send_buf_count);
         }
         pr_debug("Cmd: %p posted RDMA_READ memory for ISER Data WRITE\n",
                  isert_cmd);
@@ -2702,22 +2757,11 @@ isert_free_np(struct iscsi_np *np)
         kfree(isert_np);
 }
 
-static int isert_check_state(struct isert_conn *isert_conn, int state)
-{
-        int ret;
-
-        mutex_lock(&isert_conn->conn_mutex);
-        ret = (isert_conn->state == state);
-        mutex_unlock(&isert_conn->conn_mutex);
-
-        return ret;
-}
-
-static void isert_free_conn(struct iscsi_conn *conn)
+static void isert_wait_conn(struct iscsi_conn *conn)
 {
         struct isert_conn *isert_conn = conn->context;
 
-        pr_debug("isert_free_conn: Starting \n");
+        pr_debug("isert_wait_conn: Starting \n");
         /*
          * Decrement post_send_buf_count for special case when called
          * from isert_do_control_comp() -> iscsit_logout_post_handler()
@@ -2727,38 +2771,29 @@ static void isert_free_conn(struct iscsi_conn *conn)
                 atomic_dec(&isert_conn->post_send_buf_count);
 
         if (isert_conn->conn_cm_id && isert_conn->state != ISER_CONN_DOWN) {
-                pr_debug("Calling rdma_disconnect from isert_free_conn\n");
+                pr_debug("Calling rdma_disconnect from isert_wait_conn\n");
                 rdma_disconnect(isert_conn->conn_cm_id);
         }
         /*
          * Only wait for conn_wait_comp_err if the isert_conn made it
          * into full feature phase..
          */
-        if (isert_conn->state == ISER_CONN_UP) {
-                pr_debug("isert_free_conn: Before wait_event comp_err %d\n",
-                         isert_conn->state);
-                mutex_unlock(&isert_conn->conn_mutex);
-
-                wait_event(isert_conn->conn_wait_comp_err,
-                          (isert_check_state(isert_conn, ISER_CONN_TERMINATING)));
-
-                wait_event(isert_conn->conn_wait,
-                          (isert_check_state(isert_conn, ISER_CONN_DOWN)));
-
-                isert_put_conn(isert_conn);
-                return;
-        }
         if (isert_conn->state == ISER_CONN_INIT) {
                 mutex_unlock(&isert_conn->conn_mutex);
-                isert_put_conn(isert_conn);
                 return;
         }
-        pr_debug("isert_free_conn: wait_event conn_wait %d\n",
-                 isert_conn->state);
+        if (isert_conn->state == ISER_CONN_UP)
+                isert_conn->state = ISER_CONN_TERMINATING;
         mutex_unlock(&isert_conn->conn_mutex);
 
-        wait_event(isert_conn->conn_wait,
-                  (isert_check_state(isert_conn, ISER_CONN_DOWN)));
+        wait_for_completion(&isert_conn->conn_wait_comp_err);
+
+        wait_for_completion(&isert_conn->conn_wait);
+}
+
+static void isert_free_conn(struct iscsi_conn *conn)
+{
+        struct isert_conn *isert_conn = conn->context;
 
         isert_put_conn(isert_conn);
 }
@@ -2771,6 +2806,7 @@ static struct iscsit_transport iser_target_transport = {
         .iscsit_setup_np        = isert_setup_np,
         .iscsit_accept_np       = isert_accept_np,
         .iscsit_free_np         = isert_free_np,
+        .iscsit_wait_conn       = isert_wait_conn,
         .iscsit_free_conn       = isert_free_conn,
         .iscsit_get_login_rx    = isert_get_login_rx,
         .iscsit_put_login_tx    = isert_put_login_tx,
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index 708a069002f3..f6ae7f5dd408 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -6,6 +6,7 @@
 
 #define ISERT_RDMA_LISTEN_BACKLOG       10
 #define ISCSI_ISER_SG_TABLESIZE         256
+#define ISER_FASTREG_LI_WRID            0xffffffffffffffffULL
 
 enum isert_desc_type {
         ISCSI_TX_CONTROL,
@@ -45,6 +46,7 @@ struct iser_tx_desc {
         struct isert_cmd *isert_cmd;
         struct llist_node *comp_llnode_batch;
         struct llist_node comp_llnode;
+        bool            llnode_active;
         struct ib_send_wr send_wr;
 } __packed;
 
@@ -116,8 +118,8 @@ struct isert_conn {
         struct isert_device     *conn_device;
         struct work_struct      conn_logout_work;
         struct mutex            conn_mutex;
-        wait_queue_head_t       conn_wait;
-        wait_queue_head_t       conn_wait_comp_err;
+        struct completion       conn_wait;
+        struct completion       conn_wait_comp_err;
         struct kref             conn_kref;
         struct list_head        conn_fr_pool;
         int                     conn_fr_pool_size;
@@ -126,7 +128,6 @@ struct isert_conn {
 #define ISERT_COMP_BATCH_COUNT  8
         int                     conn_comp_batch;
         struct llist_head       conn_comp_llist;
-        struct mutex            conn_comp_mutex;
 };
 
 #define ISERT_MAX_CQ 64
diff --git a/drivers/isdn/capi/Kconfig b/drivers/isdn/capi/Kconfig
index f04686580040..9816c51eb5c2 100644
--- a/drivers/isdn/capi/Kconfig
+++ b/drivers/isdn/capi/Kconfig
@@ -16,9 +16,17 @@ config CAPI_TRACE
           This will increase the size of the kernelcapi module by 20 KB.
           If unsure, say Y.
 
+config ISDN_CAPI_CAPI20
+        tristate "CAPI2.0 /dev/capi support"
+        help
+          This option will provide the CAPI 2.0 interface to userspace
+          applications via /dev/capi20. Applications should use the
+          standardized libcapi20 to access this functionality.  You should say
+          Y/M here.
+
 config ISDN_CAPI_MIDDLEWARE
         bool "CAPI2.0 Middleware support"
-        depends on TTY
+        depends on ISDN_CAPI_CAPI20 && TTY
         help
           This option will enhance the capabilities of the /dev/capi20
           interface.  It will provide a means of moving a data connection,
@@ -26,14 +34,6 @@ config ISDN_CAPI_MIDDLEWARE
           device.  If you want to use pppd with pppdcapiplugin to dial up to
           your ISP, say Y here.
 
-config ISDN_CAPI_CAPI20
-        tristate "CAPI2.0 /dev/capi support"
-        help
-          This option will provide the CAPI 2.0 interface to userspace
-          applications via /dev/capi20. Applications should use the
-          standardized libcapi20 to access this functionality.  You should say
-          Y/M here.
-
 config ISDN_CAPI_CAPIDRV
         tristate "CAPI2.0 capidrv interface support"
         depends on ISDN_I4L
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index 9a06fe883766..95ad936e6048 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -254,16 +254,6 @@ config DM_THIN_PROVISIONING
        ---help---
          Provides thin provisioning and snapshots that share a data store.
 
-config DM_DEBUG_BLOCK_STACK_TRACING
-        boolean "Keep stack trace of persistent data block lock holders"
-        depends on STACKTRACE_SUPPORT && DM_PERSISTENT_DATA
-        select STACKTRACE
-        ---help---
-          Enable this for messages that may help debug problems with the
-          block manager locking used by thin provisioning and caching.
-
-          If unsure, say N.
-
 config DM_CACHE
        tristate "Cache target (EXPERIMENTAL)"
        depends on BLK_DEV_DM
diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
index 1e018e986610..0e385e40909e 100644
--- a/drivers/md/dm-cache-policy-mq.c
+++ b/drivers/md/dm-cache-policy-mq.c
@@ -872,7 +872,7 @@ static void mq_destroy(struct dm_cache_policy *p)
 {
         struct mq_policy *mq = to_mq_policy(p);
 
-        kfree(mq->table);
+        vfree(mq->table);
         epool_exit(&mq->cache_pool);
         epool_exit(&mq->pre_cache_pool);
         kfree(mq);
@@ -1245,7 +1245,7 @@ static struct dm_cache_policy *mq_create(dm_cblock_t cache_size,
 
         mq->nr_buckets = next_power(from_cblock(cache_size) / 2, 16);
         mq->hash_bits = ffs(mq->nr_buckets) - 1;
-        mq->table = kzalloc(sizeof(*mq->table) * mq->nr_buckets, GFP_KERNEL);
+        mq->table = vzalloc(sizeof(*mq->table) * mq->nr_buckets);
         if (!mq->table)
                 goto bad_alloc_table;
 
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 1af70145fab9..074b9c8e4cf0 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -979,12 +979,13 @@ static void issue_copy_real(struct dm_cache_migration *mg)
         int r;
         struct dm_io_region o_region, c_region;
         struct cache *cache = mg->cache;
+        sector_t cblock = from_cblock(mg->cblock);
 
         o_region.bdev = cache->origin_dev->bdev;
         o_region.count = cache->sectors_per_block;
 
         c_region.bdev = cache->cache_dev->bdev;
-        c_region.sector = from_cblock(mg->cblock) * cache->sectors_per_block;
+        c_region.sector = cblock * cache->sectors_per_block;
         c_region.count = cache->sectors_per_block;
 
         if (mg->writeback || mg->demote) {
@@ -2464,20 +2465,18 @@ static int cache_map(struct dm_target *ti, struct bio *bio)
         bool discarded_block;
         struct dm_bio_prison_cell *cell;
         struct policy_result lookup_result;
-        struct per_bio_data *pb;
+        struct per_bio_data *pb = init_per_bio_data(bio, pb_data_size);
 
-        if (from_oblock(block) > from_oblock(cache->origin_blocks)) {
+        if (unlikely(from_oblock(block) >= from_oblock(cache->origin_blocks))) {
                 /*
                  * This can only occur if the io goes to a partial block at
                  * the end of the origin device.  We don't cache these.
                  * Just remap to the origin and carry on.
                  */
-                remap_to_origin_clear_discard(cache, bio, block);
+                remap_to_origin(cache, bio);
                 return DM_MAPIO_REMAPPED;
         }
 
-        pb = init_per_bio_data(bio, pb_data_size);
-
         if (bio->bi_rw & (REQ_FLUSH | REQ_FUA | REQ_DISCARD)) {
                 defer_bio(cache, bio);
                 return DM_MAPIO_SUBMITTED;
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index afc3d017de4c..d6e88178d22c 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -546,6 +546,9 @@ static int read_exceptions(struct pstore *ps,
                 r = insert_exceptions(ps, area, callback, callback_context,
                                       &full);
 
+                if (!full)
+                        memcpy(ps->area, area, ps->store->chunk_size << SECTOR_SHIFT);
+
                 dm_bufio_release(bp);
 
                 dm_bufio_forget(client, chunk);
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index baa87ff12816..fb9efc829182 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -76,7 +76,7 @@
 
 #define THIN_SUPERBLOCK_MAGIC 27022010
 #define THIN_SUPERBLOCK_LOCATION 0
-#define THIN_VERSION 1
+#define THIN_VERSION 2
 #define THIN_METADATA_CACHE_SIZE 64
 #define SECTOR_TO_BLOCK_SHIFT 3
 
@@ -1755,3 +1755,38 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
 
         return r;
 }
+
+int dm_pool_metadata_set_needs_check(struct dm_pool_metadata *pmd)
+{
+        int r;
+        struct dm_block *sblock;
+        struct thin_disk_superblock *disk_super;
+
+        down_write(&pmd->root_lock);
+        pmd->flags |= THIN_METADATA_NEEDS_CHECK_FLAG;
+
+        r = superblock_lock(pmd, &sblock);
+        if (r) {
+                DMERR("couldn't read superblock");
+                goto out;
+        }
+
+        disk_super = dm_block_data(sblock);
+        disk_super->flags = cpu_to_le32(pmd->flags);
+
+        dm_bm_unlock(sblock);
+out:
+        up_write(&pmd->root_lock);
+        return r;
+}
+
+bool dm_pool_metadata_needs_check(struct dm_pool_metadata *pmd)
+{
+        bool needs_check;
+
+        down_read(&pmd->root_lock);
+        needs_check = pmd->flags & THIN_METADATA_NEEDS_CHECK_FLAG;
+        up_read(&pmd->root_lock);
+
+        return needs_check;
+}
diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h
index 82ea384d36ff..e3c857db195a 100644
--- a/drivers/md/dm-thin-metadata.h
+++ b/drivers/md/dm-thin-metadata.h
@@ -25,6 +25,11 @@
 
 /*----------------------------------------------------------------*/
 
+/*
+ * Thin metadata superblock flags.
+ */
+#define THIN_METADATA_NEEDS_CHECK_FLAG (1 << 0)
+
 struct dm_pool_metadata;
 struct dm_thin_device;
 
@@ -202,6 +207,12 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
                                         dm_sm_threshold_fn fn,
                                         void *context);
 
+/*
+ * Updates the superblock immediately.
+ */
+int dm_pool_metadata_set_needs_check(struct dm_pool_metadata *pmd);
+bool dm_pool_metadata_needs_check(struct dm_pool_metadata *pmd);
+
 /*----------------------------------------------------------------*/
 
 #endif
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 7e84baccf0ad..be70d38745f7 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -130,10 +130,11 @@ static void build_virtual_key(struct dm_thin_device *td, dm_block_t b,
 struct dm_thin_new_mapping;
 
 /*
- * The pool runs in 3 modes.  Ordered in degraded order for comparisons.
+ * The pool runs in 4 modes.  Ordered in degraded order for comparisons.
  */
 enum pool_mode {
         PM_WRITE,               /* metadata may be changed */
+        PM_OUT_OF_DATA_SPACE,   /* metadata may be changed, though data may not be allocated */
         PM_READ_ONLY,           /* metadata may not be changed */
         PM_FAIL,                /* all I/O fails */
 };
@@ -198,7 +199,6 @@ struct pool {
 };
 
 static enum pool_mode get_pool_mode(struct pool *pool);
-static void out_of_data_space(struct pool *pool);
 static void metadata_operation_failed(struct pool *pool, const char *op, int r);
 
 /*
@@ -226,6 +226,7 @@ struct thin_c {
 
         struct pool *pool;
         struct dm_thin_device *td;
+        bool requeue_mode:1;
 };
 
 /*----------------------------------------------------------------*/
@@ -369,14 +370,18 @@ struct dm_thin_endio_hook {
         struct dm_thin_new_mapping *overwrite_mapping;
 };
 
-static void __requeue_bio_list(struct thin_c *tc, struct bio_list *master)
+static void requeue_bio_list(struct thin_c *tc, struct bio_list *master)
 {
         struct bio *bio;
         struct bio_list bios;
+        unsigned long flags;
 
         bio_list_init(&bios);
+
+        spin_lock_irqsave(&tc->pool->lock, flags);
         bio_list_merge(&bios, master);
         bio_list_init(master);
+        spin_unlock_irqrestore(&tc->pool->lock, flags);
 
         while ((bio = bio_list_pop(&bios))) {
                 struct dm_thin_endio_hook *h = dm_per_bio_data(bio, sizeof(struct dm_thin_endio_hook));
@@ -391,12 +396,26 @@ static void __requeue_bio_list(struct thin_c *tc, struct bio_list *master)
 static void requeue_io(struct thin_c *tc)
 {
         struct pool *pool = tc->pool;
+
+        requeue_bio_list(tc, &pool->deferred_bios);
+        requeue_bio_list(tc, &pool->retry_on_resume_list);
+}
+
+static void error_retry_list(struct pool *pool)
+{
+        struct bio *bio;
         unsigned long flags;
+        struct bio_list bios;
+
+        bio_list_init(&bios);
 
         spin_lock_irqsave(&pool->lock, flags);
-        __requeue_bio_list(tc, &pool->deferred_bios);
-        __requeue_bio_list(tc, &pool->retry_on_resume_list);
+        bio_list_merge(&bios, &pool->retry_on_resume_list);
+        bio_list_init(&pool->retry_on_resume_list);
         spin_unlock_irqrestore(&pool->lock, flags);
+
+        while ((bio = bio_list_pop(&bios)))
+                bio_io_error(bio);
 }
 
 /*
@@ -925,13 +944,15 @@ static void check_low_water_mark(struct pool *pool, dm_block_t free_blocks)
         }
 }
 
+static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
+
 static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
 {
         int r;
         dm_block_t free_blocks;
         struct pool *pool = tc->pool;
 
-        if (get_pool_mode(pool) != PM_WRITE)
+        if (WARN_ON(get_pool_mode(pool) != PM_WRITE))
                 return -EINVAL;
 
         r = dm_pool_get_free_block_count(pool->pmd, &free_blocks);
@@ -958,7 +979,7 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
                 }
 
                 if (!free_blocks) {
-                        out_of_data_space(pool);
+                        set_pool_mode(pool, PM_OUT_OF_DATA_SPACE);
                         return -ENOSPC;
                 }
         }
@@ -988,15 +1009,32 @@ static void retry_on_resume(struct bio *bio)
         spin_unlock_irqrestore(&pool->lock, flags);
 }
 
-static void handle_unserviceable_bio(struct pool *pool, struct bio *bio)
+static bool should_error_unserviceable_bio(struct pool *pool)
 {
-        /*
-         * When pool is read-only, no cell locking is needed because
-         * nothing is changing.
-         */
-        WARN_ON_ONCE(get_pool_mode(pool) != PM_READ_ONLY);
+        enum pool_mode m = get_pool_mode(pool);
+
+        switch (m) {
+        case PM_WRITE:
+                /* Shouldn't get here */
+                DMERR_LIMIT("bio unserviceable, yet pool is in PM_WRITE mode");
+                return true;
+
+        case PM_OUT_OF_DATA_SPACE:
+                return pool->pf.error_if_no_space;
 
-        if (pool->pf.error_if_no_space)
+        case PM_READ_ONLY:
+        case PM_FAIL:
+                return true;
+        default:
+                /* Shouldn't get here */
+                DMERR_LIMIT("bio unserviceable, yet pool has an unknown mode");
+                return true;
+        }
+}
+
+static void handle_unserviceable_bio(struct pool *pool, struct bio *bio)
+{
+        if (should_error_unserviceable_bio(pool))
                 bio_io_error(bio);
         else
                 retry_on_resume(bio);
@@ -1007,11 +1045,20 @@ static void retry_bios_on_resume(struct pool *pool, struct dm_bio_prison_cell *c
         struct bio *bio;
         struct bio_list bios;
 
+        if (should_error_unserviceable_bio(pool)) {
+                cell_error(pool, cell);
+                return;
+        }
+
         bio_list_init(&bios);
         cell_release(pool, cell, &bios);
 
-        while ((bio = bio_list_pop(&bios)))
-                handle_unserviceable_bio(pool, bio);
+        if (should_error_unserviceable_bio(pool))
+                while ((bio = bio_list_pop(&bios)))
+                        bio_io_error(bio);
+        else
+                while ((bio = bio_list_pop(&bios)))
+                        retry_on_resume(bio);
 }
 
 static void process_discard(struct thin_c *tc, struct bio *bio)
@@ -1296,6 +1343,11 @@ static void process_bio_read_only(struct thin_c *tc, struct bio *bio)
         }
 }
 
+static void process_bio_success(struct thin_c *tc, struct bio *bio)
+{
+        bio_endio(bio, 0);
+}
+
 static void process_bio_fail(struct thin_c *tc, struct bio *bio)
 {
         bio_io_error(bio);
@@ -1328,6 +1380,11 @@ static void process_deferred_bios(struct pool *pool)
                 struct dm_thin_endio_hook *h = dm_per_bio_data(bio, sizeof(struct dm_thin_endio_hook));
                 struct thin_c *tc = h->tc;
 
+                if (tc->requeue_mode) {
+                        bio_endio(bio, DM_ENDIO_REQUEUE);
+                        continue;
+                }
+
                 /*
                  * If we've got no free new_mapping structs, and processing
                  * this bio might require one, we pause until there are some
@@ -1394,51 +1451,134 @@ static void do_waker(struct work_struct *ws)
 
 /*----------------------------------------------------------------*/
 
+struct noflush_work {
+        struct work_struct worker;
+        struct thin_c *tc;
+
+        atomic_t complete;
+        wait_queue_head_t wait;
+};
+
+static void complete_noflush_work(struct noflush_work *w)
+{
+        atomic_set(&w->complete, 1);
+        wake_up(&w->wait);
+}
+
+static void do_noflush_start(struct work_struct *ws)
+{
+        struct noflush_work *w = container_of(ws, struct noflush_work, worker);
+        w->tc->requeue_mode = true;
+        requeue_io(w->tc);
+        complete_noflush_work(w);
+}
+
+static void do_noflush_stop(struct work_struct *ws)
+{
+        struct noflush_work *w = container_of(ws, struct noflush_work, worker);
+        w->tc->requeue_mode = false;
+        complete_noflush_work(w);
+}
+
+static void noflush_work(struct thin_c *tc, void (*fn)(struct work_struct *))
+{
+        struct noflush_work w;
+
+        INIT_WORK(&w.worker, fn);
+        w.tc = tc;
+        atomic_set(&w.complete, 0);
+        init_waitqueue_head(&w.wait);
+
+        queue_work(tc->pool->wq, &w.worker);
+
+        wait_event(w.wait, atomic_read(&w.complete));
+}
+
+/*----------------------------------------------------------------*/
+
 static enum pool_mode get_pool_mode(struct pool *pool)
 {
         return pool->pf.mode;
 }
 
+static void notify_of_pool_mode_change(struct pool *pool, const char *new_mode)
+{
+        dm_table_event(pool->ti->table);
+        DMINFO("%s: switching pool to %s mode",
+               dm_device_name(pool->pool_md), new_mode);
+}
+
 static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
 {
-        int r;
-        enum pool_mode old_mode = pool->pf.mode;
+        struct pool_c *pt = pool->ti->private;
+        bool needs_check = dm_pool_metadata_needs_check(pool->pmd);
+        enum pool_mode old_mode = get_pool_mode(pool);
+
+        /*
+         * Never allow the pool to transition to PM_WRITE mode if user
+         * intervention is required to verify metadata and data consistency.
+         */
+        if (new_mode == PM_WRITE && needs_check) {
+                DMERR("%s: unable to switch pool to write mode until repaired.",
+                      dm_device_name(pool->pool_md));
+                if (old_mode != new_mode)
+                        new_mode = old_mode;
+                else
+                        new_mode = PM_READ_ONLY;
+        }
+        /*
+         * If we were in PM_FAIL mode, rollback of metadata failed.  We're
+         * not going to recover without a thin_repair.  So we never let the
+         * pool move out of the old mode.
+         */
+        if (old_mode == PM_FAIL)
+                new_mode = old_mode;
 
         switch (new_mode) {
         case PM_FAIL:
                 if (old_mode != new_mode)
-                        DMERR("%s: switching pool to failure mode",
-                              dm_device_name(pool->pool_md));
+                        notify_of_pool_mode_change(pool, "failure");
                 dm_pool_metadata_read_only(pool->pmd);
                 pool->process_bio = process_bio_fail;
                 pool->process_discard = process_bio_fail;
                 pool->process_prepared_mapping = process_prepared_mapping_fail;
                 pool->process_prepared_discard = process_prepared_discard_fail;
+
+                error_retry_list(pool);
                 break;
 
         case PM_READ_ONLY:
                 if (old_mode != new_mode)
-                        DMERR("%s: switching pool to read-only mode",
-                              dm_device_name(pool->pool_md));
-                r = dm_pool_abort_metadata(pool->pmd);
-                if (r) {
-                        DMERR("%s: aborting transaction failed",
-                              dm_device_name(pool->pool_md));
-                        new_mode = PM_FAIL;
-                        set_pool_mode(pool, new_mode);
-                } else {
-                        dm_pool_metadata_read_only(pool->pmd);
-                        pool->process_bio = process_bio_read_only;
-                        pool->process_discard = process_discard;
-                        pool->process_prepared_mapping = process_prepared_mapping_fail;
-                        pool->process_prepared_discard = process_prepared_discard_passdown;
-                }
+                        notify_of_pool_mode_change(pool, "read-only");
+                dm_pool_metadata_read_only(pool->pmd);
+                pool->process_bio = process_bio_read_only;
+                pool->process_discard = process_bio_success;
+                pool->process_prepared_mapping = process_prepared_mapping_fail;
+                pool->process_prepared_discard = process_prepared_discard_passdown;
+
+                error_retry_list(pool);
+                break;
+
+        case PM_OUT_OF_DATA_SPACE:
+                /*
+                 * Ideally we'd never hit this state; the low water mark
+                 * would trigger userland to extend the pool before we
+                 * completely run out of data space.  However, many small
+                 * IOs to unprovisioned space can consume data space at an
+                 * alarming rate.  Adjust your low water mark if you're
+                 * frequently seeing this mode.
+                 */
+                if (old_mode != new_mode)
+                        notify_of_pool_mode_change(pool, "out-of-data-space");
+                pool->process_bio = process_bio_read_only;
+                pool->process_discard = process_discard;
+                pool->process_prepared_mapping = process_prepared_mapping;
+                pool->process_prepared_discard = process_prepared_discard_passdown;
                 break;
 
         case PM_WRITE:
                 if (old_mode != new_mode)
-                        DMINFO("%s: switching pool to write mode",
-                               dm_device_name(pool->pool_md));
+                        notify_of_pool_mode_change(pool, "write");
                 dm_pool_metadata_read_write(pool->pmd);
                 pool->process_bio = process_bio;
                 pool->process_discard = process_discard;
@@ -1448,32 +1588,35 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
         }
 
         pool->pf.mode = new_mode;
+        /*
+         * The pool mode may have changed, sync it so bind_control_target()
+         * doesn't cause an unexpected mode transition on resume.
+         */
+        pt->adjusted_pf.mode = new_mode;
 }
 
-/*
- * Rather than calling set_pool_mode directly, use these which describe the
- * reason for mode degradation.
- */
-static void out_of_data_space(struct pool *pool)
+static void abort_transaction(struct pool *pool)
 {
-        DMERR_LIMIT("%s: no free data space available.",
-                    dm_device_name(pool->pool_md));
-        set_pool_mode(pool, PM_READ_ONLY);
+        const char *dev_name = dm_device_name(pool->pool_md);
+
+        DMERR_LIMIT("%s: aborting current metadata transaction", dev_name);
+        if (dm_pool_abort_metadata(pool->pmd)) {
+                DMERR("%s: failed to abort metadata transaction", dev_name);
+                set_pool_mode(pool, PM_FAIL);
+        }
+
+        if (dm_pool_metadata_set_needs_check(pool->pmd)) {
+                DMERR("%s: failed to set 'needs_check' flag in metadata", dev_name);
+                set_pool_mode(pool, PM_FAIL);
+        }
 }
 
 static void metadata_operation_failed(struct pool *pool, const char *op, int r)
 {
-        dm_block_t free_blocks;
-
         DMERR_LIMIT("%s: metadata operation '%s' failed: error = %d",
                     dm_device_name(pool->pool_md), op, r);
 
-        if (r == -ENOSPC &&
-            !dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks) &&
-            !free_blocks)
-                DMERR_LIMIT("%s: no free metadata space available.",
-                            dm_device_name(pool->pool_md));
-
+        abort_transaction(pool);
         set_pool_mode(pool, PM_READ_ONLY);
 }
 
@@ -1524,6 +1667,11 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
 
         thin_hook_bio(tc, bio);
 
+        if (tc->requeue_mode) {
+                bio_endio(bio, DM_ENDIO_REQUEUE);
+                return DM_MAPIO_SUBMITTED;
+        }
+
         if (get_pool_mode(tc->pool) == PM_FAIL) {
                 bio_io_error(bio);
                 return DM_MAPIO_SUBMITTED;
@@ -1687,7 +1835,7 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
         /*
          * We want to make sure that a pool in PM_FAIL mode is never upgraded.
          */
-        enum pool_mode old_mode = pool->pf.mode;
+        enum pool_mode old_mode = get_pool_mode(pool);
         enum pool_mode new_mode = pt->adjusted_pf.mode;
 
         /*
@@ -1701,16 +1849,6 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
         pool->pf = pt->adjusted_pf;
         pool->low_water_blocks = pt->low_water_blocks;
 
-        /*
-         * If we were in PM_FAIL mode, rollback of metadata failed.  We're
-         * not going to recover without a thin_repair.  So we never let the
-         * pool move out of the old mode.  On the other hand a PM_READ_ONLY
-         * may have been due to a lack of metadata or data space, and may
-         * now work (ie. if the underlying devices have been resized).
-         */
-        if (old_mode == PM_FAIL)
-                new_mode = old_mode;
-
         set_pool_mode(pool, new_mode);
 
         return 0;
@@ -2253,6 +2391,12 @@ static int maybe_resize_data_dev(struct dm_target *ti, bool *need_commit)
                 return -EINVAL;
 
         } else if (data_size > sb_data_size) {
+                if (dm_pool_metadata_needs_check(pool->pmd)) {
+                        DMERR("%s: unable to grow the data device until repaired.",
+                              dm_device_name(pool->pool_md));
+                        return 0;
+                }
+
                 if (sb_data_size)
                         DMINFO("%s: growing the data device from %llu to %llu blocks",
                                dm_device_name(pool->pool_md),
@@ -2294,6 +2438,12 @@ static int maybe_resize_metadata_dev(struct dm_target *ti, bool *need_commit)
                 return -EINVAL;
 
         } else if (metadata_dev_size > sb_metadata_dev_size) {
+                if (dm_pool_metadata_needs_check(pool->pmd)) {
+                        DMERR("%s: unable to grow the metadata device until repaired.",
+                              dm_device_name(pool->pool_md));
+                        return 0;
+                }
+
                 warn_if_metadata_device_too_big(pool->md_dev);
                 DMINFO("%s: growing the metadata device from %llu to %llu blocks",
                        dm_device_name(pool->pool_md),
@@ -2681,7 +2831,9 @@ static void pool_status(struct dm_target *ti, status_type_t type,
                 else
                         DMEMIT("- ");
 
-                if (pool->pf.mode == PM_READ_ONLY)
+                if (pool->pf.mode == PM_OUT_OF_DATA_SPACE)
+                        DMEMIT("out_of_data_space ");
+                else if (pool->pf.mode == PM_READ_ONLY)
                         DMEMIT("ro ");
                 else
                         DMEMIT("rw ");
@@ -2795,7 +2947,7 @@ static struct target_type pool_target = {
         .name = "thin-pool",
         .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
                     DM_TARGET_IMMUTABLE,
-        .version = {1, 10, 0},
+        .version = {1, 11, 0},
         .module = THIS_MODULE,
         .ctr = pool_ctr,
         .dtr = pool_dtr,
@@ -2997,10 +3149,23 @@ static int thin_endio(struct dm_target *ti, struct bio *bio, int err)
         return 0;
 }
 
-static void thin_postsuspend(struct dm_target *ti)
+static void thin_presuspend(struct dm_target *ti)
 {
+        struct thin_c *tc = ti->private;
+
         if (dm_noflush_suspending(ti))
-                requeue_io((struct thin_c *)ti->private);
+                noflush_work(tc, do_noflush_start);
+}
+
+static void thin_postsuspend(struct dm_target *ti)
+{
+        struct thin_c *tc = ti->private;
+
+        /*
+         * The dm_noflush_suspending flag has been cleared by now, so
+         * unfortunately we must always run this.
+         */
+        noflush_work(tc, do_noflush_stop);
 }
 
 /*
@@ -3085,12 +3250,13 @@ static int thin_iterate_devices(struct dm_target *ti,
 
 static struct target_type thin_target = {
         .name = "thin",
-        .version = {1, 10, 0},
+        .version = {1, 11, 0},
         .module = THIS_MODULE,
         .ctr = thin_ctr,
         .dtr = thin_dtr,
         .map = thin_map,
         .end_io = thin_endio,
+        .presuspend = thin_presuspend,
         .postsuspend = thin_postsuspend,
         .status = thin_status,
         .iterate_devices = thin_iterate_devices,
diff --git a/drivers/md/persistent-data/Kconfig b/drivers/md/persistent-data/Kconfig
index 19b268795415..0c2dec7aec20 100644
--- a/drivers/md/persistent-data/Kconfig
+++ b/drivers/md/persistent-data/Kconfig
@@ -6,3 +6,13 @@ config DM_PERSISTENT_DATA
        ---help---
          Library providing immutable on-disk data structure support for
          device-mapper targets such as the thin provisioning target.
+
+config DM_DEBUG_BLOCK_STACK_TRACING
+       boolean "Keep stack trace of persistent data block lock holders"
+       depends on STACKTRACE_SUPPORT && DM_PERSISTENT_DATA
+       select STACKTRACE
+       ---help---
+         Enable this for messages that may help debug problems with the
+         block manager locking used by thin provisioning and caching.
+
+         If unsure, say N.
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index e9bdd462f4f5..786b689bdfc7 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -91,6 +91,69 @@ struct block_op {
         dm_block_t block;
 };
 
+struct bop_ring_buffer {
+        unsigned begin;
+        unsigned end;
+        struct block_op bops[MAX_RECURSIVE_ALLOCATIONS + 1];
+};
+
+static void brb_init(struct bop_ring_buffer *brb)
+{
+        brb->begin = 0;
+        brb->end = 0;
+}
+
+static bool brb_empty(struct bop_ring_buffer *brb)
+{
+        return brb->begin == brb->end;
+}
+
+static unsigned brb_next(struct bop_ring_buffer *brb, unsigned old)
+{
+        unsigned r = old + 1;
+        return (r >= (sizeof(brb->bops) / sizeof(*brb->bops))) ? 0 : r;
+}
+
+static int brb_push(struct bop_ring_buffer *brb,
+                    enum block_op_type type, dm_block_t b)
+{
+        struct block_op *bop;
+        unsigned next = brb_next(brb, brb->end);
+
+        /*
+         * We don't allow the last bop to be filled, this way we can
+         * differentiate between full and empty.
+         */
+        if (next == brb->begin)
+                return -ENOMEM;
+
+        bop = brb->bops + brb->end;
+        bop->type = type;
+        bop->block = b;
+
+        brb->end = next;
+
+        return 0;
+}
+
+static int brb_pop(struct bop_ring_buffer *brb, struct block_op *result)
+{
+        struct block_op *bop;
+
+        if (brb_empty(brb))
+                return -ENODATA;
+
+        bop = brb->bops + brb->begin;
+        result->type = bop->type;
+        result->block = bop->block;
+
+        brb->begin = brb_next(brb, brb->begin);
+
+        return 0;
+}
+
+/*----------------------------------------------------------------*/
+
 struct sm_metadata {
         struct dm_space_map sm;
 
@@ -101,25 +164,20 @@ struct sm_metadata {
 
         unsigned recursion_count;
         unsigned allocated_this_transaction;
-        unsigned nr_uncommitted;
-        struct block_op uncommitted[MAX_RECURSIVE_ALLOCATIONS];
+        struct bop_ring_buffer uncommitted;
 
         struct threshold threshold;
 };
 
 static int add_bop(struct sm_metadata *smm, enum block_op_type type, dm_block_t b)
 {
-        struct block_op *op;
+        int r = brb_push(&smm->uncommitted, type, b);
 
-        if (smm->nr_uncommitted == MAX_RECURSIVE_ALLOCATIONS) {
+        if (r) {
                 DMERR("too many recursive allocations");
                 return -ENOMEM;
         }
 
-        op = smm->uncommitted + smm->nr_uncommitted++;
-        op->type = type;
-        op->block = b;
-
         return 0;
 }
 
@@ -158,11 +216,17 @@ static int out(struct sm_metadata *smm)
                 return -ENOMEM;
         }
 
-        if (smm->recursion_count == 1 && smm->nr_uncommitted) {
-                while (smm->nr_uncommitted && !r) {
-                        smm->nr_uncommitted--;
-                        r = commit_bop(smm, smm->uncommitted +
-                                       smm->nr_uncommitted);
+        if (smm->recursion_count == 1) {
+                while (!brb_empty(&smm->uncommitted)) {
+                        struct block_op bop;
+
+                        r = brb_pop(&smm->uncommitted, &bop);
+                        if (r) {
+                                DMERR("bug in bop ring buffer");
+                                break;
+                        }
+
+                        r = commit_bop(smm, &bop);
                         if (r)
                                 break;
                 }
@@ -217,7 +281,8 @@ static int sm_metadata_get_nr_free(struct dm_space_map *sm, dm_block_t *count)
 static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
                                  uint32_t *result)
 {
-        int r, i;
+        int r;
+        unsigned i;
         struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
         unsigned adjustment = 0;
 
@@ -225,8 +290,10 @@ static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
          * We may have some uncommitted adjustments to add.  This list
          * should always be really short.
          */
-        for (i = 0; i < smm->nr_uncommitted; i++) {
-                struct block_op *op = smm->uncommitted + i;
+        for (i = smm->uncommitted.begin;
+             i != smm->uncommitted.end;
+             i = brb_next(&smm->uncommitted, i)) {
+                struct block_op *op = smm->uncommitted.bops + i;
 
                 if (op->block != b)
                         continue;
@@ -254,7 +321,8 @@ static int sm_metadata_get_count(struct dm_space_map *sm, dm_block_t b,
 static int sm_metadata_count_is_more_than_one(struct dm_space_map *sm,
                                               dm_block_t b, int *result)
 {
-        int r, i, adjustment = 0;
+        int r, adjustment = 0;
+        unsigned i;
         struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
         uint32_t rc;
 
@@ -262,8 +330,11 @@ static int sm_metadata_count_is_more_than_one(struct dm_space_map *sm,
          * We may have some uncommitted adjustments to add.  This list
          * should always be really short.
          */
-        for (i = 0; i < smm->nr_uncommitted; i++) {
-                struct block_op *op = smm->uncommitted + i;
+        for (i = smm->uncommitted.begin;
+             i != smm->uncommitted.end;
+             i = brb_next(&smm->uncommitted, i)) {
+
+                struct block_op *op = smm->uncommitted.bops + i;
 
                 if (op->block != b)
                         continue;
@@ -671,7 +742,7 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
         smm->begin = superblock + 1;
         smm->recursion_count = 0;
         smm->allocated_this_transaction = 0;
-        smm->nr_uncommitted = 0;
+        brb_init(&smm->uncommitted);
         threshold_init(&smm->threshold);
 
         memcpy(&smm->sm, &bootstrap_ops, sizeof(smm->sm));
@@ -715,7 +786,7 @@ int dm_sm_metadata_open(struct dm_space_map *sm,
         smm->begin = 0;
         smm->recursion_count = 0;
         smm->allocated_this_transaction = 0;
-        smm->nr_uncommitted = 0;
+        brb_init(&smm->uncommitted);
         threshold_init(&smm->threshold);
 
         memcpy(&smm->old_ll, &smm->ll, sizeof(smm->old_ll));
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index b9e2000969f0..95c894482fdd 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -240,7 +240,7 @@ xpc_create_gru_mq_uv(unsigned int mq_size, int cpu, char *irq_name,
 
         nid = cpu_to_node(cpu);
         page = alloc_pages_exact_node(nid,
-                                      GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                      GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                       pg_order);
         if (page == NULL) {
                 dev_err(xpc_part, "xpc_create_gru_mq_uv() failed to alloc %d "
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 6d20fbde8d43..dcde56057fe1 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -181,7 +181,7 @@ static inline int __agg_has_partner(struct aggregator *agg)
  */
 static inline void __disable_port(struct port *port)
 {
-        bond_set_slave_inactive_flags(port->slave);
+        bond_set_slave_inactive_flags(port->slave, BOND_SLAVE_NOTIFY_LATER);
 }
 
 /**
@@ -193,7 +193,7 @@ static inline void __enable_port(struct port *port)
         struct slave *slave = port->slave;
 
         if ((slave->link == BOND_LINK_UP) && IS_UP(slave->dev))
-                bond_set_slave_active_flags(slave);
+                bond_set_slave_active_flags(slave, BOND_SLAVE_NOTIFY_LATER);
 }
 
 /**
@@ -2062,6 +2062,7 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
         struct list_head *iter;
         struct slave *slave;
         struct port *port;
+        bool should_notify_rtnl = BOND_SLAVE_NOTIFY_LATER;
 
         read_lock(&bond->lock);
         rcu_read_lock();
@@ -2119,8 +2120,19 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
         }
 
 re_arm:
+        bond_for_each_slave_rcu(bond, slave, iter) {
+                if (slave->should_notify) {
+                        should_notify_rtnl = BOND_SLAVE_NOTIFY_NOW;
+                        break;
+                }
+        }
         rcu_read_unlock();
         read_unlock(&bond->lock);
+
+        if (should_notify_rtnl && rtnl_trylock()) {
+                bond_slave_state_notify(bond);
+                rtnl_unlock();
+        }
         queue_delayed_work(bond->wq, &bond->ad_work, ad_delta_in_ticks);
 }
 
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index a2c47476804d..e8f133e926aa 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -730,7 +730,7 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bon
                         client_info->ntt = 0;
                 }
 
-                if (!vlan_get_tag(skb, &client_info->vlan_id))
+                if (vlan_get_tag(skb, &client_info->vlan_id))
                         client_info->vlan_id = 0;
 
                 if (!client_info->assigned) {
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 1c6104d3501d..e5628fc725c3 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -829,21 +829,25 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active)
         if (bond_is_lb(bond)) {
                 bond_alb_handle_active_change(bond, new_active);
                 if (old_active)
-                        bond_set_slave_inactive_flags(old_active);
+                        bond_set_slave_inactive_flags(old_active,
+                                                      BOND_SLAVE_NOTIFY_NOW);
                 if (new_active)
-                        bond_set_slave_active_flags(new_active);
+                        bond_set_slave_active_flags(new_active,
+                                                    BOND_SLAVE_NOTIFY_NOW);
         } else {
                 rcu_assign_pointer(bond->curr_active_slave, new_active);
         }
 
         if (bond->params.mode == BOND_MODE_ACTIVEBACKUP) {
                 if (old_active)
-                        bond_set_slave_inactive_flags(old_active);
+                        bond_set_slave_inactive_flags(old_active,
+                                                      BOND_SLAVE_NOTIFY_NOW);
 
                 if (new_active) {
                         bool should_notify_peers = false;
 
-                        bond_set_slave_active_flags(new_active);
+                        bond_set_slave_active_flags(new_active,
+                                                    BOND_SLAVE_NOTIFY_NOW);
 
                         if (bond->params.fail_over_mac)
                                 bond_do_fail_over_mac(bond, new_active,
@@ -1193,6 +1197,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                 return -EBUSY;
         }
 
+        if (bond_dev == slave_dev) {
+                pr_err("%s: cannot enslave bond to itself.\n", bond_dev->name);
+                return -EPERM;
+        }
+
         /* vlan challenged mutual exclusion */
         /* no need to lock since we're protected by rtnl_lock */
         if (slave_dev->features & NETIF_F_VLAN_CHALLENGED) {
@@ -1463,14 +1472,15 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 
         switch (bond->params.mode) {
         case BOND_MODE_ACTIVEBACKUP:
-                bond_set_slave_inactive_flags(new_slave);
+                bond_set_slave_inactive_flags(new_slave,
+                                              BOND_SLAVE_NOTIFY_NOW);
                 break;
         case BOND_MODE_8023AD:
                 /* in 802.3ad mode, the internal mechanism
                  * will activate the slaves in the selected
                  * aggregator
                  */
-                bond_set_slave_inactive_flags(new_slave);
+                bond_set_slave_inactive_flags(new_slave, BOND_SLAVE_NOTIFY_NOW);
                 /* if this is the first slave */
                 if (!prev_slave) {
                         SLAVE_AD_INFO(new_slave).id = 1;
@@ -1488,7 +1498,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         case BOND_MODE_TLB:
         case BOND_MODE_ALB:
                 bond_set_active_slave(new_slave);
-                bond_set_slave_inactive_flags(new_slave);
+                bond_set_slave_inactive_flags(new_slave, BOND_SLAVE_NOTIFY_NOW);
                 break;
         default:
                 pr_debug("This slave is always active in trunk mode\n");
@@ -1654,9 +1664,6 @@ static int __bond_release_one(struct net_device *bond_dev,
                 return -EINVAL;
         }
 
-        /* release the slave from its bond */
-        bond->slave_cnt--;
-
         bond_sysfs_slave_del(slave);
 
         bond_upper_dev_unlink(bond_dev, slave_dev);
@@ -1738,6 +1745,7 @@ static int __bond_release_one(struct net_device *bond_dev,
 
         unblock_netpoll_tx();
         synchronize_rcu();
+        bond->slave_cnt--;
 
         if (!bond_has_slaves(bond)) {
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, bond->dev);
@@ -2015,7 +2023,8 @@ static void bond_miimon_commit(struct bonding *bond)
 
                         if (bond->params.mode == BOND_MODE_ACTIVEBACKUP ||
                             bond->params.mode == BOND_MODE_8023AD)
-                                bond_set_slave_inactive_flags(slave);
+                                bond_set_slave_inactive_flags(slave,
+                                                              BOND_SLAVE_NOTIFY_NOW);
 
                         pr_info("%s: link status definitely down for interface %s, disabling it\n",
                                 bond->dev->name, slave->dev->name);
@@ -2562,7 +2571,8 @@ static void bond_ab_arp_commit(struct bonding *bond)
                                 slave->link = BOND_LINK_UP;
                                 if (bond->current_arp_slave) {
                                         bond_set_slave_inactive_flags(
-                                                bond->current_arp_slave);
+                                                bond->current_arp_slave,
+                                                BOND_SLAVE_NOTIFY_NOW);
                                         bond->current_arp_slave = NULL;
                                 }
 
@@ -2582,7 +2592,8 @@ static void bond_ab_arp_commit(struct bonding *bond)
                                 slave->link_failure_count++;
 
                         slave->link = BOND_LINK_DOWN;
-                        bond_set_slave_inactive_flags(slave);
+                        bond_set_slave_inactive_flags(slave,
+                                                      BOND_SLAVE_NOTIFY_NOW);
 
                         pr_info("%s: link status definitely down for interface %s, disabling it\n",
                                 bond->dev->name, slave->dev->name);
@@ -2615,17 +2626,17 @@ do_failover:
 
 /*
  * Send ARP probes for active-backup mode ARP monitor.
+ *
+ * Called with rcu_read_lock hold.
  */
 static bool bond_ab_arp_probe(struct bonding *bond)
 {
         struct slave *slave, *before = NULL, *new_slave = NULL,
-                     *curr_arp_slave, *curr_active_slave;
+                     *curr_arp_slave = rcu_dereference(bond->current_arp_slave),
+                     *curr_active_slave = rcu_dereference(bond->curr_active_slave);
         struct list_head *iter;
         bool found = false;
-
-        rcu_read_lock();
-        curr_arp_slave = rcu_dereference(bond->current_arp_slave);
-        curr_active_slave = rcu_dereference(bond->curr_active_slave);
+        bool should_notify_rtnl = BOND_SLAVE_NOTIFY_LATER;
 
         if (curr_arp_slave && curr_active_slave)
                 pr_info("PROBE: c_arp %s && cas %s BAD\n",
@@ -2634,32 +2645,23 @@ static bool bond_ab_arp_probe(struct bonding *bond)
 
         if (curr_active_slave) {
                 bond_arp_send_all(bond, curr_active_slave);
-                rcu_read_unlock();
-                return true;
+                return should_notify_rtnl;
         }
-        rcu_read_unlock();
 
         /* if we don't have a curr_active_slave, search for the next available
          * backup slave from the current_arp_slave and make it the candidate
          * for becoming the curr_active_slave
          */
 
-        if (!rtnl_trylock())
-                return false;
-        /* curr_arp_slave might have gone away */
-        curr_arp_slave = ACCESS_ONCE(bond->current_arp_slave);
-
         if (!curr_arp_slave) {
-                curr_arp_slave = bond_first_slave(bond);
-                if (!curr_arp_slave) {
-                        rtnl_unlock();
-                        return true;
-                }
+                curr_arp_slave = bond_first_slave_rcu(bond);
+                if (!curr_arp_slave)
+                        return should_notify_rtnl;
         }
 
-        bond_set_slave_inactive_flags(curr_arp_slave);
+        bond_set_slave_inactive_flags(curr_arp_slave, BOND_SLAVE_NOTIFY_LATER);
 
-        bond_for_each_slave(bond, slave, iter) {
+        bond_for_each_slave_rcu(bond, slave, iter) {
                 if (!found && !before && IS_UP(slave->dev))
                         before = slave;
 
@@ -2677,7 +2679,8 @@ static bool bond_ab_arp_probe(struct bonding *bond)
                         if (slave->link_failure_count < UINT_MAX)
                                 slave->link_failure_count++;
 
-                        bond_set_slave_inactive_flags(slave);
+                        bond_set_slave_inactive_flags(slave,
+                                                      BOND_SLAVE_NOTIFY_LATER);
 
                         pr_info("%s: backup interface %s is now down.\n",
                                 bond->dev->name, slave->dev->name);
@@ -2689,26 +2692,31 @@ static bool bond_ab_arp_probe(struct bonding *bond)
         if (!new_slave && before)
                 new_slave = before;
 
-        if (!new_slave) {
-                rtnl_unlock();
-                return true;
-        }
+        if (!new_slave)
+                goto check_state;
 
         new_slave->link = BOND_LINK_BACK;
-        bond_set_slave_active_flags(new_slave);
+        bond_set_slave_active_flags(new_slave, BOND_SLAVE_NOTIFY_LATER);
         bond_arp_send_all(bond, new_slave);
         new_slave->jiffies = jiffies;
         rcu_assign_pointer(bond->current_arp_slave, new_slave);
-        rtnl_unlock();
 
-        return true;
+check_state:
+        bond_for_each_slave_rcu(bond, slave, iter) {
+                if (slave->should_notify) {
+                        should_notify_rtnl = BOND_SLAVE_NOTIFY_NOW;
+                        break;
+                }
+        }
+        return should_notify_rtnl;
 }
 
 static void bond_activebackup_arp_mon(struct work_struct *work)
 {
         struct bonding *bond = container_of(work, struct bonding,
                                             arp_work.work);
-        bool should_notify_peers = false, should_commit = false;
+        bool should_notify_peers = false;
+        bool should_notify_rtnl = false;
         int delta_in_ticks;
 
         delta_in_ticks = msecs_to_jiffies(bond->params.arp_interval);
@@ -2717,11 +2725,12 @@ static void bond_activebackup_arp_mon(struct work_struct *work)
                 goto re_arm;
 
         rcu_read_lock();
+
         should_notify_peers = bond_should_notify_peers(bond);
-        should_commit = bond_ab_arp_inspect(bond);
-        rcu_read_unlock();
 
-        if (should_commit) {
+        if (bond_ab_arp_inspect(bond)) {
+                rcu_read_unlock();
+
                 /* Race avoidance with bond_close flush of workqueue */
                 if (!rtnl_trylock()) {
                         delta_in_ticks = 1;
@@ -2730,23 +2739,28 @@ static void bond_activebackup_arp_mon(struct work_struct *work)
                 }
 
                 bond_ab_arp_commit(bond);
+
                 rtnl_unlock();
+                rcu_read_lock();
         }
 
-        if (!bond_ab_arp_probe(bond)) {
-                /* rtnl locking failed, re-arm */
-                delta_in_ticks = 1;
-                should_notify_peers = false;
-        }
+        should_notify_rtnl = bond_ab_arp_probe(bond);
+        rcu_read_unlock();
 
 re_arm:
         if (bond->params.arp_interval)
                 queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
 
-        if (should_notify_peers) {
+        if (should_notify_peers || should_notify_rtnl) {
                 if (!rtnl_trylock())
                         return;
-                call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, bond->dev);
+
+                if (should_notify_peers)
+                        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS,
+                                                 bond->dev);
+                if (should_notify_rtnl)
+                        bond_slave_state_notify(bond);
+
                 rtnl_unlock();
         }
 }
@@ -3046,9 +3060,11 @@ static int bond_open(struct net_device *bond_dev)
                 bond_for_each_slave(bond, slave, iter) {
                         if ((bond->params.mode == BOND_MODE_ACTIVEBACKUP)
                                 && (slave != bond->curr_active_slave)) {
-                                bond_set_slave_inactive_flags(slave);
+                                bond_set_slave_inactive_flags(slave,
+                                                              BOND_SLAVE_NOTIFY_NOW);
                         } else {
-                                bond_set_slave_active_flags(slave);
+                                bond_set_slave_active_flags(slave,
+                                                            BOND_SLAVE_NOTIFY_NOW);
                         }
                 }
                 read_unlock(&bond->curr_slave_lock);
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index c37878432717..298c26509095 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -121,6 +121,7 @@ static struct bond_opt_value bond_resend_igmp_tbl[] = {
 static struct bond_opt_value bond_lp_interval_tbl[] = {
         { "minval",  1,       BOND_VALFLAG_MIN | BOND_VALFLAG_DEFAULT},
         { "maxval",  INT_MAX, BOND_VALFLAG_MAX},
+        { NULL,      -1,      0},
 };
 
 static struct bond_option bond_opts[] = {
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 86ccfb9f71cc..2b0fdec695f7 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -195,7 +195,8 @@ struct slave {
         s8     new_link;
         u8     backup:1,   /* indicates backup slave. Value corresponds with
                               BOND_STATE_ACTIVE and BOND_STATE_BACKUP */
-               inactive:1; /* indicates inactive slave */
+               inactive:1, /* indicates inactive slave */
+               should_notify:1; /* indicateds whether the state changed */
         u8     duplex;
         u32    original_mtu;
         u32    link_failure_count;
@@ -303,6 +304,24 @@ static inline void bond_set_backup_slave(struct slave *slave)
         }
 }
 
+static inline void bond_set_slave_state(struct slave *slave,
+                                        int slave_state, bool notify)
+{
+        if (slave->backup == slave_state)
+                return;
+
+        slave->backup = slave_state;
+        if (notify) {
+                rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_KERNEL);
+                slave->should_notify = 0;
+        } else {
+                if (slave->should_notify)
+                        slave->should_notify = 0;
+                else
+                        slave->should_notify = 1;
+        }
+}
+
 static inline void bond_slave_state_change(struct bonding *bond)
 {
         struct list_head *iter;
@@ -316,6 +335,19 @@ static inline void bond_slave_state_change(struct bonding *bond)
         }
 }
 
+static inline void bond_slave_state_notify(struct bonding *bond)
+{
+        struct list_head *iter;
+        struct slave *tmp;
+
+        bond_for_each_slave(bond, tmp, iter) {
+                if (tmp->should_notify) {
+                        rtmsg_ifinfo(RTM_NEWLINK, tmp->dev, 0, GFP_KERNEL);
+                        tmp->should_notify = 0;
+                }
+        }
+}
+
 static inline int bond_slave_state(struct slave *slave)
 {
         return slave->backup;
@@ -343,6 +375,9 @@ static inline bool bond_is_active_slave(struct slave *slave)
 #define BOND_ARP_VALIDATE_ALL           (BOND_ARP_VALIDATE_ACTIVE | \
                                          BOND_ARP_VALIDATE_BACKUP)
 
+#define BOND_SLAVE_NOTIFY_NOW           true
+#define BOND_SLAVE_NOTIFY_LATER         false
+
 static inline int slave_do_arp_validate(struct bonding *bond,
                                         struct slave *slave)
 {
@@ -394,17 +429,19 @@ static inline void bond_netpoll_send_skb(const struct slave *slave,
 }
 #endif
 
-static inline void bond_set_slave_inactive_flags(struct slave *slave)
+static inline void bond_set_slave_inactive_flags(struct slave *slave,
+                                                 bool notify)
 {
         if (!bond_is_lb(slave->bond))
-                bond_set_backup_slave(slave);
+                bond_set_slave_state(slave, BOND_STATE_BACKUP, notify);
         if (!slave->bond->params.all_slaves_active)
                 slave->inactive = 1;
 }
 
-static inline void bond_set_slave_active_flags(struct slave *slave)
+static inline void bond_set_slave_active_flags(struct slave *slave,
+                                               bool notify)
 {
-        bond_set_active_slave(slave);
+        bond_set_slave_state(slave, BOND_STATE_ACTIVE, notify);
         slave->inactive = 0;
 }
 
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 320bef2dba42..61376abdab39 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -144,6 +144,8 @@
 
 #define FLEXCAN_MB_CODE_MASK            (0xf0ffffff)
 
+#define FLEXCAN_TIMEOUT_US             (50)
+
 /*
  * FLEXCAN hardware feature flags
  *
@@ -262,6 +264,22 @@ static inline void flexcan_write(u32 val, void __iomem *addr)
 }
 #endif
 
+static inline int flexcan_transceiver_enable(const struct flexcan_priv *priv)
+{
+        if (!priv->reg_xceiver)
+                return 0;
+
+        return regulator_enable(priv->reg_xceiver);
+}
+
+static inline int flexcan_transceiver_disable(const struct flexcan_priv *priv)
+{
+        if (!priv->reg_xceiver)
+                return 0;
+
+        return regulator_disable(priv->reg_xceiver);
+}
+
 static inline int flexcan_has_and_handle_berr(const struct flexcan_priv *priv,
                                               u32 reg_esr)
 {
@@ -269,26 +287,95 @@ static inline int flexcan_has_and_handle_berr(const struct flexcan_priv *priv,
                 (reg_esr & FLEXCAN_ESR_ERR_BUS);
 }
 
-static inline void flexcan_chip_enable(struct flexcan_priv *priv)
+static int flexcan_chip_enable(struct flexcan_priv *priv)
 {
         struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
         u32 reg;
 
         reg = flexcan_read(&regs->mcr);
         reg &= ~FLEXCAN_MCR_MDIS;
         flexcan_write(reg, &regs->mcr);
 
-        udelay(10);
+        while (timeout-- && (flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
+                usleep_range(10, 20);
+
+        if (flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK)
+                return -ETIMEDOUT;
+
+        return 0;
 }
 
-static inline void flexcan_chip_disable(struct flexcan_priv *priv)
+static int flexcan_chip_disable(struct flexcan_priv *priv)
 {
         struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
         u32 reg;
 
         reg = flexcan_read(&regs->mcr);
         reg |= FLEXCAN_MCR_MDIS;
         flexcan_write(reg, &regs->mcr);
+
+        while (timeout-- && !(flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
+                usleep_range(10, 20);
+
+        if (!(flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
+                return -ETIMEDOUT;
+
+        return 0;
+}
+
+static int flexcan_chip_freeze(struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = 1000 * 1000 * 10 / priv->can.bittiming.bitrate;
+        u32 reg;
+
+        reg = flexcan_read(&regs->mcr);
+        reg |= FLEXCAN_MCR_HALT;
+        flexcan_write(reg, &regs->mcr);
+
+        while (timeout-- && !(flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
+                usleep_range(100, 200);
+
+        if (!(flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
+                return -ETIMEDOUT;
+
+        return 0;
+}
+
+static int flexcan_chip_unfreeze(struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
+        u32 reg;
+
+        reg = flexcan_read(&regs->mcr);
+        reg &= ~FLEXCAN_MCR_HALT;
+        flexcan_write(reg, &regs->mcr);
+
+        while (timeout-- && (flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
+                usleep_range(10, 20);
+
+        if (flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK)
+                return -ETIMEDOUT;
+
+        return 0;
+}
+
+static int flexcan_chip_softreset(struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
+
+        flexcan_write(FLEXCAN_MCR_SOFTRST, &regs->mcr);
+        while (timeout-- && (flexcan_read(&regs->mcr) & FLEXCAN_MCR_SOFTRST))
+                usleep_range(10, 20);
+
+        if (flexcan_read(&regs->mcr) & FLEXCAN_MCR_SOFTRST)
+                return -ETIMEDOUT;
+
+        return 0;
 }
 
 static int flexcan_get_berr_counter(const struct net_device *dev,
@@ -709,19 +796,14 @@ static int flexcan_chip_start(struct net_device *dev)
         u32 reg_mcr, reg_ctrl;
 
         /* enable module */
-        flexcan_chip_enable(priv);
+        err = flexcan_chip_enable(priv);
+        if (err)
+                return err;
 
         /* soft reset */
-        flexcan_write(FLEXCAN_MCR_SOFTRST, &regs->mcr);
-        udelay(10);
-
-        reg_mcr = flexcan_read(&regs->mcr);
-        if (reg_mcr & FLEXCAN_MCR_SOFTRST) {
-                netdev_err(dev, "Failed to softreset can module (mcr=0x%08x)\n",
-                           reg_mcr);
-                err = -ENODEV;
-                goto out;
-        }
+        err = flexcan_chip_softreset(priv);
+        if (err)
+                goto out_chip_disable;
 
         flexcan_set_bittiming(dev);
 
@@ -788,16 +870,14 @@ static int flexcan_chip_start(struct net_device *dev)
         if (priv->devtype_data->features & FLEXCAN_HAS_V10_FEATURES)
                 flexcan_write(0x0, &regs->rxfgmask);
 
-        if (priv->reg_xceiver)  {
-                err = regulator_enable(priv->reg_xceiver);
-                if (err)
-                        goto out;
-        }
+        err = flexcan_transceiver_enable(priv);
+        if (err)
+                goto out_chip_disable;
 
         /* synchronize with the can bus */
-        reg_mcr = flexcan_read(&regs->mcr);
-        reg_mcr &= ~FLEXCAN_MCR_HALT;
-        flexcan_write(reg_mcr, &regs->mcr);
+        err = flexcan_chip_unfreeze(priv);
+        if (err)
+                goto out_transceiver_disable;
 
         priv->can.state = CAN_STATE_ERROR_ACTIVE;
 
@@ -810,7 +890,9 @@ static int flexcan_chip_start(struct net_device *dev)
 
         return 0;
 
- out:
+ out_transceiver_disable:
+        flexcan_transceiver_disable(priv);
+ out_chip_disable:
         flexcan_chip_disable(priv);
         return err;
 }
@@ -825,18 +907,17 @@ static void flexcan_chip_stop(struct net_device *dev)
 {
         struct flexcan_priv *priv = netdev_priv(dev);
         struct flexcan_regs __iomem *regs = priv->base;
-        u32 reg;
+
+        /* freeze + disable module */
+        flexcan_chip_freeze(priv);
+        flexcan_chip_disable(priv);
 
         /* Disable all interrupts */
         flexcan_write(0, &regs->imask1);
+        flexcan_write(priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_ALL,
+                      &regs->ctrl);
 
-        /* Disable + halt module */
-        reg = flexcan_read(&regs->mcr);
-        reg |= FLEXCAN_MCR_MDIS | FLEXCAN_MCR_HALT;
-        flexcan_write(reg, &regs->mcr);
-
-        if (priv->reg_xceiver)
-                regulator_disable(priv->reg_xceiver);
+        flexcan_transceiver_disable(priv);
         priv->can.state = CAN_STATE_STOPPED;
 
         return;
@@ -866,7 +947,7 @@ static int flexcan_open(struct net_device *dev)
         /* start chip and queuing */
         err = flexcan_chip_start(dev);
         if (err)
-                goto out_close;
+                goto out_free_irq;
 
         can_led_event(dev, CAN_LED_EVENT_OPEN);
 
@@ -875,6 +956,8 @@ static int flexcan_open(struct net_device *dev)
 
         return 0;
 
+ out_free_irq:
+        free_irq(dev->irq, dev);
  out_close:
         close_candev(dev);
  out_disable_per:
@@ -945,12 +1028,16 @@ static int register_flexcandev(struct net_device *dev)
                 goto out_disable_ipg;
 
         /* select "bus clock", chip must be disabled */
-        flexcan_chip_disable(priv);
+        err = flexcan_chip_disable(priv);
+        if (err)
+                goto out_disable_per;
         reg = flexcan_read(&regs->ctrl);
         reg |= FLEXCAN_CTRL_CLK_SRC;
         flexcan_write(reg, &regs->ctrl);
 
-        flexcan_chip_enable(priv);
+        err = flexcan_chip_enable(priv);
+        if (err)
+                goto out_chip_disable;
 
         /* set freeze, halt and activate FIFO, restrict register access */
         reg = flexcan_read(&regs->mcr);
@@ -967,14 +1054,15 @@ static int register_flexcandev(struct net_device *dev)
         if (!(reg & FLEXCAN_MCR_FEN)) {
                 netdev_err(dev, "Could not enable RX FIFO, unsupported core\n");
                 err = -ENODEV;
-                goto out_disable_per;
+                goto out_chip_disable;
         }
 
         err = register_candev(dev);
 
- out_disable_per:
         /* disable core and turn off clocks */
+ out_chip_disable:
         flexcan_chip_disable(priv);
+ out_disable_per:
         clk_disable_unprepare(priv->clk_per);
  out_disable_ipg:
         clk_disable_unprepare(priv->clk_ipg);
@@ -1104,9 +1192,10 @@ static int flexcan_probe(struct platform_device *pdev)
 static int flexcan_remove(struct platform_device *pdev)
 {
         struct net_device *dev = platform_get_drvdata(pdev);
+        struct flexcan_priv *priv = netdev_priv(dev);
 
         unregister_flexcandev(dev);
-
+        netif_napi_del(&priv->napi);
         free_candev(dev);
 
         return 0;
@@ -1117,8 +1206,11 @@ static int flexcan_suspend(struct device *device)
 {
         struct net_device *dev = dev_get_drvdata(device);
         struct flexcan_priv *priv = netdev_priv(dev);
+        int err;
 
-        flexcan_chip_disable(priv);
+        err = flexcan_chip_disable(priv);
+        if (err)
+                return err;
 
         if (netif_running(dev)) {
                 netif_stop_queue(dev);
@@ -1139,9 +1231,7 @@ static int flexcan_resume(struct device *device)
                 netif_device_attach(dev);
                 netif_start_queue(dev);
         }
-        flexcan_chip_enable(priv);
-
-        return 0;
+        return flexcan_chip_enable(priv);
 }
 #endif /* CONFIG_PM_SLEEP */
 
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 2e45f6ec1bf0..380d24922049 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1248,19 +1248,13 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * shared register for the high 32 bits, so only a single, aligned,
          * 4 GB physical address range can be used for descriptors.
          */
-        if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) &&
-            !dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64))) {
+        if (!dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64))) {
                 dev_dbg(&pdev->dev, "DMA to 64-BIT addresses\n");
         } else {
-                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
+                err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
                 if (err) {
-                        err = dma_set_coherent_mask(&pdev->dev,
-                                                    DMA_BIT_MASK(32));
-                        if (err) {
-                                dev_err(&pdev->dev,
-                                        "No usable DMA config, aborting\n");
-                                goto out_pci_disable;
-                        }
+                        dev_err(&pdev->dev, "No usable DMA config, aborting\n");
+                        goto out_pci_disable;
                 }
         }
 
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
index d5c2d3e912e5..422aab27ea1b 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
@@ -2436,7 +2436,7 @@ err_reset:
 err_register:
 err_sw_init:
 err_eeprom:
-        iounmap(adapter->hw.hw_addr);
+        pci_iounmap(pdev, adapter->hw.hw_addr);
 err_init_netdev:
 err_ioremap:
         free_netdev(netdev);
@@ -2474,7 +2474,7 @@ static void atl1e_remove(struct pci_dev *pdev)
         unregister_netdev(netdev);
         atl1e_free_ring_resources(adapter);
         atl1e_force_ps(&adapter->hw);
-        iounmap(adapter->hw.hw_addr);
+        pci_iounmap(pdev, adapter->hw.hw_addr);
         pci_release_regions(pdev);
         free_netdev(netdev);
         pci_disable_device(pdev);
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 1f7b5aa114fa..8a7bf7dad898 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -1484,6 +1484,10 @@ static int b44_open(struct net_device *dev)
         add_timer(&bp->timer);
 
         b44_enable_ints(bp);
+
+        if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+                phy_start(bp->phydev);
+
         netif_start_queue(dev);
 out:
         return err;
@@ -1646,6 +1650,9 @@ static int b44_close(struct net_device *dev)
 
         netif_stop_queue(dev);
 
+        if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+                phy_stop(bp->phydev);
+
         napi_disable(&bp->napi);
 
         del_timer_sync(&bp->timer);
@@ -2222,7 +2229,12 @@ static void b44_adjust_link(struct net_device *dev)
         }
 
         if (status_changed) {
-                b44_check_phy(bp);
+                u32 val = br32(bp, B44_TX_CTRL);
+                if (bp->flags & B44_FLAG_FULL_DUPLEX)
+                        val |= TX_CTRL_DUPLEX;
+                else
+                        val &= ~TX_CTRL_DUPLEX;
+                bw32(bp, B44_TX_CTRL, val);
                 phy_print_status(phydev);
         }
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index cda25ac45b47..6c9e1c9bdeb8 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -2507,6 +2507,7 @@ bnx2_fw_sync(struct bnx2 *bp, u32 msg_data, int ack, int silent)
 
         bp->fw_wr_seq++;
         msg_data |= bp->fw_wr_seq;
+        bp->fw_last_msg = msg_data;
 
         bnx2_shmem_wr(bp, BNX2_DRV_MB, msg_data);
 
@@ -4000,8 +4001,23 @@ bnx2_setup_wol(struct bnx2 *bp)
                         wol_msg = BNX2_DRV_MSG_CODE_SUSPEND_NO_WOL;
         }
 
-        if (!(bp->flags & BNX2_FLAG_NO_WOL))
-                bnx2_fw_sync(bp, BNX2_DRV_MSG_DATA_WAIT3 | wol_msg, 1, 0);
+        if (!(bp->flags & BNX2_FLAG_NO_WOL)) {
+                u32 val;
+
+                wol_msg |= BNX2_DRV_MSG_DATA_WAIT3;
+                if (bp->fw_last_msg || BNX2_CHIP(bp) != BNX2_CHIP_5709) {
+                        bnx2_fw_sync(bp, wol_msg, 1, 0);
+                        return;
+                }
+                /* Tell firmware not to power down the PHY yet, otherwise
+                 * the chip will take a long time to respond to MMIO reads.
+                 */
+                val = bnx2_shmem_rd(bp, BNX2_PORT_FEATURE);
+                bnx2_shmem_wr(bp, BNX2_PORT_FEATURE,
+                              val | BNX2_PORT_FEATURE_ASF_ENABLED);
+                bnx2_fw_sync(bp, wol_msg, 1, 0);
+                bnx2_shmem_wr(bp, BNX2_PORT_FEATURE, val);
+        }
 
 }
 
@@ -4033,9 +4049,22 @@ bnx2_set_power_state(struct bnx2 *bp, pci_power_t state)
 
                         if (bp->wol)
                                 pci_set_power_state(bp->pdev, PCI_D3hot);
-                } else {
-                        pci_set_power_state(bp->pdev, PCI_D3hot);
+                        break;
+
+                }
+                if (!bp->fw_last_msg && BNX2_CHIP(bp) == BNX2_CHIP_5709) {
+                        u32 val;
+
+                        /* Tell firmware not to power down the PHY yet,
+                         * otherwise the other port may not respond to
+                         * MMIO reads.
+                         */
+                        val = bnx2_shmem_rd(bp, BNX2_BC_STATE_CONDITION);
+                        val &= ~BNX2_CONDITION_PM_STATE_MASK;
+                        val |= BNX2_CONDITION_PM_STATE_UNPREP;
+                        bnx2_shmem_wr(bp, BNX2_BC_STATE_CONDITION, val);
                 }
+                pci_set_power_state(bp->pdev, PCI_D3hot);
 
                 /* No more memory access after this point until
                  * device is brought back to D0.
diff --git a/drivers/net/ethernet/broadcom/bnx2.h b/drivers/net/ethernet/broadcom/bnx2.h
index f1cf2c44e7ed..e341bc366fa5 100644
--- a/drivers/net/ethernet/broadcom/bnx2.h
+++ b/drivers/net/ethernet/broadcom/bnx2.h
@@ -6900,6 +6900,7 @@ struct bnx2 {
 
         u16                     fw_wr_seq;
         u16                     fw_drv_pulse_wr_seq;
+        u32                     fw_last_msg;
 
         int                     rx_max_ring;
         int                     rx_ring_size;
@@ -7406,6 +7407,10 @@ struct bnx2_rv2p_fw_file {
 #define BNX2_CONDITION_MFW_RUN_NCSI              0x00006000
 #define BNX2_CONDITION_MFW_RUN_NONE              0x0000e000
 #define BNX2_CONDITION_MFW_RUN_MASK              0x0000e000
+#define BNX2_CONDITION_PM_STATE_MASK             0x00030000
+#define BNX2_CONDITION_PM_STATE_FULL             0x00030000
+#define BNX2_CONDITION_PM_STATE_PREP             0x00020000
+#define BNX2_CONDITION_PM_STATE_UNPREP           0x00010000
 
 #define BNX2_BC_STATE_DEBUG_CMD                 0x1dc
 #define BNX2_BC_STATE_BC_DBG_CMD_SIGNATURE       0x42440000
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 66c0df78c3ff..dbcff509dc3f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3875,7 +3875,9 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                                      xmit_type);
                 }
 
-                /* Add the macs to the parsing BD this is a vf */
+                /* Add the macs to the parsing BD if this is a vf or if
+                 * Tx Switching is enabled.
+                 */
                 if (IS_VF(bp)) {
                         /* override GRE parameters in BD */
                         bnx2x_set_fw_mac_addr(&pbd_e2->data.mac_addr.src_hi,
@@ -3887,6 +3889,11 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                               &pbd_e2->data.mac_addr.dst_mid,
                                               &pbd_e2->data.mac_addr.dst_lo,
                                               eth->h_dest);
+                } else if (bp->flags & TX_SWITCHING) {
+                        bnx2x_set_fw_mac_addr(&pbd_e2->data.mac_addr.dst_hi,
+                                              &pbd_e2->data.mac_addr.dst_mid,
+                                              &pbd_e2->data.mac_addr.dst_lo,
+                                              eth->h_dest);
                 }
 
                 SET_FLAG(pbd_e2_parsing_data,
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index fcf9105a5476..09f3fefcbf9c 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -1,6 +1,6 @@
 /* cnic.c: Broadcom CNIC core network driver.
  *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -342,7 +342,7 @@ static int cnic_send_nlmsg(struct cnic_local *cp, u32 type,
         while (retry < 3) {
                 rc = 0;
                 rcu_read_lock();
-                ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
+                ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
                 if (ulp_ops)
                         rc = ulp_ops->iscsi_nl_send_msg(
                                 cp->ulp_handle[CNIC_ULP_ISCSI],
@@ -726,7 +726,7 @@ static void cnic_free_dma(struct cnic_dev *dev, struct cnic_dma *dma)
 
         for (i = 0; i < dma->num_pages; i++) {
                 if (dma->pg_arr[i]) {
-                        dma_free_coherent(&dev->pcidev->dev, BNX2_PAGE_SIZE,
+                        dma_free_coherent(&dev->pcidev->dev, CNIC_PAGE_SIZE,
                                           dma->pg_arr[i], dma->pg_map_arr[i]);
                         dma->pg_arr[i] = NULL;
                 }
@@ -785,7 +785,7 @@ static int cnic_alloc_dma(struct cnic_dev *dev, struct cnic_dma *dma,
 
         for (i = 0; i < pages; i++) {
                 dma->pg_arr[i] = dma_alloc_coherent(&dev->pcidev->dev,
-                                                    BNX2_PAGE_SIZE,
+                                                    CNIC_PAGE_SIZE,
                                                     &dma->pg_map_arr[i],
                                                     GFP_ATOMIC);
                 if (dma->pg_arr[i] == NULL)
@@ -794,8 +794,8 @@ static int cnic_alloc_dma(struct cnic_dev *dev, struct cnic_dma *dma,
         if (!use_pg_tbl)
                 return 0;
 
-        dma->pgtbl_size = ((pages * 8) + BNX2_PAGE_SIZE - 1) &
-                          ~(BNX2_PAGE_SIZE - 1);
+        dma->pgtbl_size = ((pages * 8) + CNIC_PAGE_SIZE - 1) &
+                          ~(CNIC_PAGE_SIZE - 1);
         dma->pgtbl = dma_alloc_coherent(&dev->pcidev->dev, dma->pgtbl_size,
                                         &dma->pgtbl_map, GFP_ATOMIC);
         if (dma->pgtbl == NULL)
@@ -900,8 +900,8 @@ static int cnic_alloc_context(struct cnic_dev *dev)
         if (BNX2_CHIP(cp) == BNX2_CHIP_5709) {
                 int i, k, arr_size;
 
-                cp->ctx_blk_size = BNX2_PAGE_SIZE;
-                cp->cids_per_blk = BNX2_PAGE_SIZE / 128;
+                cp->ctx_blk_size = CNIC_PAGE_SIZE;
+                cp->cids_per_blk = CNIC_PAGE_SIZE / 128;
                 arr_size = BNX2_MAX_CID / cp->cids_per_blk *
                            sizeof(struct cnic_ctx);
                 cp->ctx_arr = kzalloc(arr_size, GFP_KERNEL);
@@ -933,7 +933,7 @@ static int cnic_alloc_context(struct cnic_dev *dev)
                 for (i = 0; i < cp->ctx_blks; i++) {
                         cp->ctx_arr[i].ctx =
                                 dma_alloc_coherent(&dev->pcidev->dev,
-                                                   BNX2_PAGE_SIZE,
+                                                   CNIC_PAGE_SIZE,
                                                    &cp->ctx_arr[i].mapping,
                                                    GFP_KERNEL);
                         if (cp->ctx_arr[i].ctx == NULL)
@@ -1013,7 +1013,7 @@ static int __cnic_alloc_uio_rings(struct cnic_uio_dev *udev, int pages)
         if (udev->l2_ring)
                 return 0;
 
-        udev->l2_ring_size = pages * BNX2_PAGE_SIZE;
+        udev->l2_ring_size = pages * CNIC_PAGE_SIZE;
         udev->l2_ring = dma_alloc_coherent(&udev->pdev->dev, udev->l2_ring_size,
                                            &udev->l2_ring_map,
                                            GFP_KERNEL | __GFP_COMP);
@@ -1021,7 +1021,7 @@ static int __cnic_alloc_uio_rings(struct cnic_uio_dev *udev, int pages)
                 return -ENOMEM;
 
         udev->l2_buf_size = (cp->l2_rx_ring_size + 1) * cp->l2_single_buf_size;
-        udev->l2_buf_size = PAGE_ALIGN(udev->l2_buf_size);
+        udev->l2_buf_size = CNIC_PAGE_ALIGN(udev->l2_buf_size);
         udev->l2_buf = dma_alloc_coherent(&udev->pdev->dev, udev->l2_buf_size,
                                           &udev->l2_buf_map,
                                           GFP_KERNEL | __GFP_COMP);
@@ -1102,7 +1102,7 @@ static int cnic_init_uio(struct cnic_dev *dev)
                 uinfo->mem[0].size = MB_GET_CID_ADDR(TX_TSS_CID +
                                                      TX_MAX_TSS_RINGS + 1);
                 uinfo->mem[1].addr = (unsigned long) cp->status_blk.gen &
-                                        PAGE_MASK;
+                                        CNIC_PAGE_MASK;
                 if (cp->ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX)
                         uinfo->mem[1].size = BNX2_SBLK_MSIX_ALIGN_SIZE * 9;
                 else
@@ -1113,7 +1113,7 @@ static int cnic_init_uio(struct cnic_dev *dev)
                 uinfo->mem[0].size = pci_resource_len(dev->pcidev, 0);
 
                 uinfo->mem[1].addr = (unsigned long) cp->bnx2x_def_status_blk &
-                        PAGE_MASK;
+                        CNIC_PAGE_MASK;
                 uinfo->mem[1].size = sizeof(*cp->bnx2x_def_status_blk);
 
                 uinfo->name = "bnx2x_cnic";
@@ -1267,14 +1267,14 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
         for (i = MAX_ISCSI_TBL_SZ; i < cp->max_cid_space; i++)
                 cp->ctx_tbl[i].ulp_proto_id = CNIC_ULP_FCOE;
 
-        pages = PAGE_ALIGN(cp->max_cid_space * CNIC_KWQ16_DATA_SIZE) /
-                PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->max_cid_space * CNIC_KWQ16_DATA_SIZE) /
+                CNIC_PAGE_SIZE;
 
         ret = cnic_alloc_dma(dev, kwq_16_dma, pages, 0);
         if (ret)
                 return -ENOMEM;
 
-        n = PAGE_SIZE / CNIC_KWQ16_DATA_SIZE;
+        n = CNIC_PAGE_SIZE / CNIC_KWQ16_DATA_SIZE;
         for (i = 0, j = 0; i < cp->max_cid_space; i++) {
                 long off = CNIC_KWQ16_DATA_SIZE * (i % n);
 
@@ -1296,7 +1296,7 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
                         goto error;
         }
 
-        pages = PAGE_ALIGN(BNX2X_ISCSI_GLB_BUF_SIZE) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(BNX2X_ISCSI_GLB_BUF_SIZE) / CNIC_PAGE_SIZE;
         ret = cnic_alloc_dma(dev, &cp->gbl_buf_info, pages, 0);
         if (ret)
                 goto error;
@@ -1466,8 +1466,8 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
         cp->r2tq_size = cp->num_iscsi_tasks * BNX2X_ISCSI_MAX_PENDING_R2TS *
                         BNX2X_ISCSI_R2TQE_SIZE;
         cp->hq_size = cp->num_ccells * BNX2X_ISCSI_HQ_BD_SIZE;
-        pages = PAGE_ALIGN(cp->hq_size) / PAGE_SIZE;
-        hq_bds = pages * (PAGE_SIZE / BNX2X_ISCSI_HQ_BD_SIZE);
+        pages = CNIC_PAGE_ALIGN(cp->hq_size) / CNIC_PAGE_SIZE;
+        hq_bds = pages * (CNIC_PAGE_SIZE / BNX2X_ISCSI_HQ_BD_SIZE);
         cp->num_cqs = req1->num_cqs;
 
         if (!dev->max_iscsi_conn)
@@ -1477,9 +1477,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
         CNIC_WR16(dev, BAR_TSTRORM_INTMEM + TSTORM_ISCSI_RQ_SIZE_OFFSET(pfid),
                   req1->rq_num_wqes);
         CNIC_WR16(dev, BAR_TSTRORM_INTMEM + TSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
         CNIC_WR8(dev, BAR_TSTRORM_INTMEM +
-                 TSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 TSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
         CNIC_WR16(dev, BAR_TSTRORM_INTMEM +
                   TSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                   req1->num_tasks_per_conn);
@@ -1489,9 +1489,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
                   USTORM_ISCSI_RQ_BUFFER_SIZE_OFFSET(pfid),
                   req1->rq_buffer_size);
         CNIC_WR16(dev, BAR_USTRORM_INTMEM + USTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
         CNIC_WR8(dev, BAR_USTRORM_INTMEM +
-                 USTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 USTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
         CNIC_WR16(dev, BAR_USTRORM_INTMEM +
                   USTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                   req1->num_tasks_per_conn);
@@ -1504,9 +1504,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
 
         /* init Xstorm RAM */
         CNIC_WR16(dev, BAR_XSTRORM_INTMEM + XSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 XSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
         CNIC_WR16(dev, BAR_XSTRORM_INTMEM +
                   XSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                   req1->num_tasks_per_conn);
@@ -1519,9 +1519,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
 
         /* init Cstorm RAM */
         CNIC_WR16(dev, BAR_CSTRORM_INTMEM + CSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
         CNIC_WR8(dev, BAR_CSTRORM_INTMEM +
-                 CSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 CSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
         CNIC_WR16(dev, BAR_CSTRORM_INTMEM +
                   CSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                   req1->num_tasks_per_conn);
@@ -1623,18 +1623,18 @@ static int cnic_alloc_bnx2x_conn_resc(struct cnic_dev *dev, u32 l5_cid)
         }
 
         ctx->cid = cid;
-        pages = PAGE_ALIGN(cp->task_array_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->task_array_size) / CNIC_PAGE_SIZE;
 
         ret = cnic_alloc_dma(dev, &iscsi->task_array_info, pages, 1);
         if (ret)
                 goto error;
 
-        pages = PAGE_ALIGN(cp->r2tq_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->r2tq_size) / CNIC_PAGE_SIZE;
         ret = cnic_alloc_dma(dev, &iscsi->r2tq_info, pages, 1);
         if (ret)
                 goto error;
 
-        pages = PAGE_ALIGN(cp->hq_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->hq_size) / CNIC_PAGE_SIZE;
         ret = cnic_alloc_dma(dev, &iscsi->hq_info, pages, 1);
         if (ret)
                 goto error;
@@ -1760,7 +1760,7 @@ static int cnic_setup_bnx2x_ctx(struct cnic_dev *dev, struct kwqe *wqes[],
         ictx->tstorm_st_context.iscsi.hdr_bytes_2_fetch = ISCSI_HEADER_SIZE;
         /* TSTORM requires the base address of RQ DB & not PTE */
         ictx->tstorm_st_context.iscsi.rq_db_phy_addr.lo =
-                req2->rq_page_table_addr_lo & PAGE_MASK;
+                req2->rq_page_table_addr_lo & CNIC_PAGE_MASK;
         ictx->tstorm_st_context.iscsi.rq_db_phy_addr.hi =
                 req2->rq_page_table_addr_hi;
         ictx->tstorm_st_context.iscsi.iscsi_conn_id = req1->iscsi_conn_id;
@@ -1842,7 +1842,7 @@ static int cnic_setup_bnx2x_ctx(struct cnic_dev *dev, struct kwqe *wqes[],
         /* CSTORM and USTORM initialization is different, CSTORM requires
          * CQ DB base & not PTE addr */
         ictx->cstorm_st_context.cq_db_base.lo =
-                req1->cq_page_table_addr_lo & PAGE_MASK;
+                req1->cq_page_table_addr_lo & CNIC_PAGE_MASK;
         ictx->cstorm_st_context.cq_db_base.hi = req1->cq_page_table_addr_hi;
         ictx->cstorm_st_context.iscsi_conn_id = req1->iscsi_conn_id;
         ictx->cstorm_st_context.cq_proc_en_bit_map = (1 << cp->num_cqs) - 1;
@@ -2911,7 +2911,7 @@ static int cnic_l2_completion(struct cnic_local *cp)
         u16 hw_cons, sw_cons;
         struct cnic_uio_dev *udev = cp->udev;
         union eth_rx_cqe *cqe, *cqe_ring = (union eth_rx_cqe *)
-                                        (udev->l2_ring + (2 * BNX2_PAGE_SIZE));
+                                        (udev->l2_ring + (2 * CNIC_PAGE_SIZE));
         u32 cmd;
         int comp = 0;
 
@@ -3244,7 +3244,8 @@ static int cnic_copy_ulp_stats(struct cnic_dev *dev, int ulp_type)
         int rc;
 
         mutex_lock(&cnic_lock);
-        ulp_ops = cnic_ulp_tbl_prot(ulp_type);
+        ulp_ops = rcu_dereference_protected(cp->ulp_ops[ulp_type],
+                                            lockdep_is_held(&cnic_lock));
         if (ulp_ops && ulp_ops->cnic_get_stats)
                 rc = ulp_ops->cnic_get_stats(cp->ulp_handle[ulp_type]);
         else
@@ -4384,7 +4385,7 @@ static int cnic_setup_5709_context(struct cnic_dev *dev, int valid)
                 u32 idx = cp->ctx_arr[i].cid / cp->cids_per_blk;
                 u32 val;
 
-                memset(cp->ctx_arr[i].ctx, 0, BNX2_PAGE_SIZE);
+                memset(cp->ctx_arr[i].ctx, 0, CNIC_PAGE_SIZE);
 
                 CNIC_WR(dev, BNX2_CTX_HOST_PAGE_TBL_DATA0,
                         (cp->ctx_arr[i].mapping & 0xffffffff) | valid_bit);
@@ -4628,7 +4629,7 @@ static void cnic_init_bnx2_rx_ring(struct cnic_dev *dev)
                 val = BNX2_L2CTX_L2_STATUSB_NUM(sb_id);
         cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_HOST_BDIDX, val);
 
-        rxbd = udev->l2_ring + BNX2_PAGE_SIZE;
+        rxbd = udev->l2_ring + CNIC_PAGE_SIZE;
         for (i = 0; i < BNX2_MAX_RX_DESC_CNT; i++, rxbd++) {
                 dma_addr_t buf_map;
                 int n = (i % cp->l2_rx_ring_size) + 1;
@@ -4639,11 +4640,11 @@ static void cnic_init_bnx2_rx_ring(struct cnic_dev *dev)
                 rxbd->rx_bd_haddr_hi = (u64) buf_map >> 32;
                 rxbd->rx_bd_haddr_lo = (u64) buf_map & 0xffffffff;
         }
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) >> 32;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) >> 32;
         cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_NX_BDHADDR_HI, val);
         rxbd->rx_bd_haddr_hi = val;
 
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) & 0xffffffff;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) & 0xffffffff;
         cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_NX_BDHADDR_LO, val);
         rxbd->rx_bd_haddr_lo = val;
 
@@ -4709,10 +4710,10 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
 
         val = CNIC_RD(dev, BNX2_MQ_CONFIG);
         val &= ~BNX2_MQ_CONFIG_KNL_BYP_BLK_SIZE;
-        if (BNX2_PAGE_BITS > 12)
+        if (CNIC_PAGE_BITS > 12)
                 val |= (12 - 8)  << 4;
         else
-                val |= (BNX2_PAGE_BITS - 8)  << 4;
+                val |= (CNIC_PAGE_BITS - 8)  << 4;
 
         CNIC_WR(dev, BNX2_MQ_CONFIG, val);
 
@@ -4742,13 +4743,13 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
 
         /* Initialize the kernel work queue context. */
         val = KRNLQ_TYPE_TYPE_KRNLQ | KRNLQ_SIZE_TYPE_SIZE |
-              (BNX2_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
+              (CNIC_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
         cnic_ctx_wr(dev, kwq_cid_addr, L5_KRNLQ_TYPE, val);
 
-        val = (BNX2_PAGE_SIZE / sizeof(struct kwqe) - 1) << 16;
+        val = (CNIC_PAGE_SIZE / sizeof(struct kwqe) - 1) << 16;
         cnic_ctx_wr(dev, kwq_cid_addr, L5_KRNLQ_QE_SELF_SEQ_MAX, val);
 
-        val = ((BNX2_PAGE_SIZE / sizeof(struct kwqe)) << 16) | KWQ_PAGE_CNT;
+        val = ((CNIC_PAGE_SIZE / sizeof(struct kwqe)) << 16) | KWQ_PAGE_CNT;
         cnic_ctx_wr(dev, kwq_cid_addr, L5_KRNLQ_PGTBL_NPAGES, val);
 
         val = (u32) ((u64) cp->kwq_info.pgtbl_map >> 32);
@@ -4768,13 +4769,13 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
 
         /* Initialize the kernel complete queue context. */
         val = KRNLQ_TYPE_TYPE_KRNLQ | KRNLQ_SIZE_TYPE_SIZE |
-              (BNX2_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
+              (CNIC_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
         cnic_ctx_wr(dev, kcq_cid_addr, L5_KRNLQ_TYPE, val);
 
-        val = (BNX2_PAGE_SIZE / sizeof(struct kcqe) - 1) << 16;
+        val = (CNIC_PAGE_SIZE / sizeof(struct kcqe) - 1) << 16;
         cnic_ctx_wr(dev, kcq_cid_addr, L5_KRNLQ_QE_SELF_SEQ_MAX, val);
 
-        val = ((BNX2_PAGE_SIZE / sizeof(struct kcqe)) << 16) | KCQ_PAGE_CNT;
+        val = ((CNIC_PAGE_SIZE / sizeof(struct kcqe)) << 16) | KCQ_PAGE_CNT;
         cnic_ctx_wr(dev, kcq_cid_addr, L5_KRNLQ_PGTBL_NPAGES, val);
 
         val = (u32) ((u64) cp->kcq1.dma.pgtbl_map >> 32);
@@ -4918,7 +4919,7 @@ static void cnic_init_bnx2x_tx_ring(struct cnic_dev *dev,
         u32 cli = cp->ethdev->iscsi_l2_client_id;
         u32 val;
 
-        memset(txbd, 0, BNX2_PAGE_SIZE);
+        memset(txbd, 0, CNIC_PAGE_SIZE);
 
         buf_map = udev->l2_buf_map;
         for (i = 0; i < BNX2_MAX_TX_DESC_CNT; i += 3, txbd += 3) {
@@ -4978,9 +4979,9 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev,
         struct bnx2x *bp = netdev_priv(dev->netdev);
         struct cnic_uio_dev *udev = cp->udev;
         struct eth_rx_bd *rxbd = (struct eth_rx_bd *) (udev->l2_ring +
-                                BNX2_PAGE_SIZE);
+                                CNIC_PAGE_SIZE);
         struct eth_rx_cqe_next_page *rxcqe = (struct eth_rx_cqe_next_page *)
-                                (udev->l2_ring + (2 * BNX2_PAGE_SIZE));
+                                (udev->l2_ring + (2 * CNIC_PAGE_SIZE));
         struct host_sp_status_block *sb = cp->bnx2x_def_status_blk;
         int i;
         u32 cli = cp->ethdev->iscsi_l2_client_id;
@@ -5004,20 +5005,20 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev,
                 rxbd->addr_lo = cpu_to_le32(buf_map & 0xffffffff);
         }
 
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) >> 32;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) >> 32;
         rxbd->addr_hi = cpu_to_le32(val);
         data->rx.bd_page_base.hi = cpu_to_le32(val);
 
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) & 0xffffffff;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) & 0xffffffff;
         rxbd->addr_lo = cpu_to_le32(val);
         data->rx.bd_page_base.lo = cpu_to_le32(val);
 
         rxcqe += BNX2X_MAX_RCQ_DESC_CNT;
-        val = (u64) (ring_map + (2 * BNX2_PAGE_SIZE)) >> 32;
+        val = (u64) (ring_map + (2 * CNIC_PAGE_SIZE)) >> 32;
         rxcqe->addr_hi = cpu_to_le32(val);
         data->rx.cqe_page_base.hi = cpu_to_le32(val);
 
-        val = (u64) (ring_map + (2 * BNX2_PAGE_SIZE)) & 0xffffffff;
+        val = (u64) (ring_map + (2 * CNIC_PAGE_SIZE)) & 0xffffffff;
         rxcqe->addr_lo = cpu_to_le32(val);
         data->rx.cqe_page_base.lo = cpu_to_le32(val);
 
@@ -5265,8 +5266,8 @@ static void cnic_shutdown_rings(struct cnic_dev *dev)
                 msleep(10);
         }
         clear_bit(CNIC_LCL_FL_RINGS_INITED, &cp->cnic_local_flags);
-        rx_ring = udev->l2_ring + BNX2_PAGE_SIZE;
-        memset(rx_ring, 0, BNX2_PAGE_SIZE);
+        rx_ring = udev->l2_ring + CNIC_PAGE_SIZE;
+        memset(rx_ring, 0, CNIC_PAGE_SIZE);
 }
 
 static int cnic_register_netdev(struct cnic_dev *dev)
diff --git a/drivers/net/ethernet/broadcom/cnic.h b/drivers/net/ethernet/broadcom/cnic.h
index 0d6b13f854d9..d535ae4228b4 100644
--- a/drivers/net/ethernet/broadcom/cnic.h
+++ b/drivers/net/ethernet/broadcom/cnic.h
@@ -1,6 +1,6 @@
 /* cnic.h: Broadcom CNIC core network driver.
  *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff --git a/drivers/net/ethernet/broadcom/cnic_defs.h b/drivers/net/ethernet/broadcom/cnic_defs.h
index 95a8e4b11c9f..dcbca6997e8f 100644
--- a/drivers/net/ethernet/broadcom/cnic_defs.h
+++ b/drivers/net/ethernet/broadcom/cnic_defs.h
@@ -1,7 +1,7 @@
 
 /* cnic.c: Broadcom CNIC core network driver.
  *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff --git a/drivers/net/ethernet/broadcom/cnic_if.h b/drivers/net/ethernet/broadcom/cnic_if.h
index 8cf6b1926069..5f4d5573a73d 100644
--- a/drivers/net/ethernet/broadcom/cnic_if.h
+++ b/drivers/net/ethernet/broadcom/cnic_if.h
@@ -1,6 +1,6 @@
 /* cnic_if.h: Broadcom CNIC core network driver.
  *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -14,8 +14,8 @@
 
 #include "bnx2x/bnx2x_mfw_req.h"
 
-#define CNIC_MODULE_VERSION     "2.5.19"
-#define CNIC_MODULE_RELDATE     "December 19, 2013"
+#define CNIC_MODULE_VERSION     "2.5.20"
+#define CNIC_MODULE_RELDATE     "March 14, 2014"
 
 #define CNIC_ULP_RDMA           0
 #define CNIC_ULP_ISCSI          1
@@ -24,6 +24,16 @@
 #define MAX_CNIC_ULP_TYPE_EXT   3
 #define MAX_CNIC_ULP_TYPE       4
 
+/* Use CPU native page size up to 16K for cnic ring sizes.  */
+#if (PAGE_SHIFT > 14)
+#define CNIC_PAGE_BITS  14
+#else
+#define CNIC_PAGE_BITS  PAGE_SHIFT
+#endif
+#define CNIC_PAGE_SIZE  (1 << (CNIC_PAGE_BITS))
+#define CNIC_PAGE_ALIGN(addr) ALIGN(addr, CNIC_PAGE_SIZE)
+#define CNIC_PAGE_MASK  (~((CNIC_PAGE_SIZE) - 1))
+
 struct kwqe {
         u32 kwqe_op_flag;
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 3167ed6593b0..3b6d0ba86c71 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -6843,8 +6843,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
 
                 work_mask |= opaque_key;
 
-                if ((desc->err_vlan & RXD_ERR_MASK) != 0 &&
-                    (desc->err_vlan != RXD_ERR_ODD_NIBBLE_RCVD_MII)) {
+                if (desc->err_vlan & RXD_ERR_MASK) {
                 drop_it:
                         tg3_recycle_rx(tnapi, tpr, opaque_key,
                                        desc_idx, *post_ptr);
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index ef472385bce4..04321e5a356e 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -2608,7 +2608,11 @@ struct tg3_rx_buffer_desc {
 #define RXD_ERR_TOO_SMALL               0x00400000
 #define RXD_ERR_NO_RESOURCES            0x00800000
 #define RXD_ERR_HUGE_FRAME              0x01000000
-#define RXD_ERR_MASK                    0xffff0000
+
+#define RXD_ERR_MASK    (RXD_ERR_BAD_CRC | RXD_ERR_COLLISION |          \
+                         RXD_ERR_LINK_LOST | RXD_ERR_PHY_DECODE |       \
+                         RXD_ERR_MAC_ABRT | RXD_ERR_TOO_SMALL |         \
+                         RXD_ERR_NO_RESOURCES | RXD_ERR_HUGE_FRAME)
 
         u32                             reserved;
         u32                             opaque;
diff --git a/drivers/net/ethernet/brocade/bna/bfa_ioc.c b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
index 1803c3959044..354ae9792bad 100644
--- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c
+++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
@@ -1704,7 +1704,7 @@ bfa_flash_sem_get(void __iomem *bar)
         while (!bfa_raw_sem_get(bar)) {
                 if (--n <= 0)
                         return BFA_STATUS_BADFLASH;
-                udelay(10000);
+                mdelay(10);
         }
         return BFA_STATUS_OK;
 }
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index cf64f3d0b60d..4ad1187e82fb 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -707,7 +707,8 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget)
                 else
                         skb_checksum_none_assert(skb);
 
-                if (flags & BNA_CQ_EF_VLAN)
+                if ((flags & BNA_CQ_EF_VLAN) &&
+                    (bnad->netdev->features & NETIF_F_HW_VLAN_CTAG_RX))
                         __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), ntohs(cmpl->vlan_tag));
 
                 if (BNAD_RXBUF_IS_SK_BUFF(unmap_q->type))
@@ -2094,7 +2095,9 @@ bnad_init_rx_config(struct bnad *bnad, struct bna_rx_config *rx_config)
                 rx_config->q1_buf_size = BFI_SMALL_RXBUF_SIZE;
         }
 
-        rx_config->vlan_strip_status = BNA_STATUS_T_ENABLED;
+        rx_config->vlan_strip_status =
+                (bnad->netdev->features & NETIF_F_HW_VLAN_CTAG_RX) ?
+                BNA_STATUS_T_ENABLED : BNA_STATUS_T_DISABLED;
 }
 
 static void
@@ -3245,11 +3248,6 @@ bnad_set_rx_mode(struct net_device *netdev)
                         BNA_RXMODE_ALLMULTI;
         bna_rx_mode_set(bnad->rx_info[0].rx, new_mode, mode_mask, NULL);
 
-        if (bnad->cfg_flags & BNAD_CF_PROMISC)
-                bna_rx_vlan_strip_disable(bnad->rx_info[0].rx);
-        else
-                bna_rx_vlan_strip_enable(bnad->rx_info[0].rx);
-
         spin_unlock_irqrestore(&bnad->bna_lock, flags);
 }
 
@@ -3374,6 +3372,27 @@ bnad_vlan_rx_kill_vid(struct net_device *netdev, __be16 proto, u16 vid)
         return 0;
 }
 
+static int bnad_set_features(struct net_device *dev, netdev_features_t features)
+{
+        struct bnad *bnad = netdev_priv(dev);
+        netdev_features_t changed = features ^ dev->features;
+
+        if ((changed & NETIF_F_HW_VLAN_CTAG_RX) && netif_running(dev)) {
+                unsigned long flags;
+
+                spin_lock_irqsave(&bnad->bna_lock, flags);
+
+                if (features & NETIF_F_HW_VLAN_CTAG_RX)
+                        bna_rx_vlan_strip_enable(bnad->rx_info[0].rx);
+                else
+                        bna_rx_vlan_strip_disable(bnad->rx_info[0].rx);
+
+                spin_unlock_irqrestore(&bnad->bna_lock, flags);
+        }
+
+        return 0;
+}
+
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void
 bnad_netpoll(struct net_device *netdev)
@@ -3421,6 +3440,7 @@ static const struct net_device_ops bnad_netdev_ops = {
         .ndo_change_mtu         = bnad_change_mtu,
         .ndo_vlan_rx_add_vid    = bnad_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = bnad_vlan_rx_kill_vid,
+        .ndo_set_features       = bnad_set_features,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = bnad_netpoll
 #endif
@@ -3433,14 +3453,14 @@ bnad_netdev_init(struct bnad *bnad, bool using_dac)
 
         netdev->hw_features = NETIF_F_SG | NETIF_F_RXCSUM |
                 NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_HW_VLAN_CTAG_TX;
+                NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_HW_VLAN_CTAG_TX |
+                NETIF_F_HW_VLAN_CTAG_RX;
 
         netdev->vlan_features = NETIF_F_SG | NETIF_F_HIGHDMA |
                 NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                 NETIF_F_TSO | NETIF_F_TSO6;
 
-        netdev->features |= netdev->hw_features |
-                NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_CTAG_FILTER;
+        netdev->features |= netdev->hw_features | NETIF_F_HW_VLAN_CTAG_FILTER;
 
         if (using_dac)
                 netdev->features |= NETIF_F_HIGHDMA;
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index 3190d38e16fb..d0c38e01e99f 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -632,11 +632,16 @@ static void gem_rx_refill(struct macb *bp)
                                            "Unable to allocate sk_buff\n");
                                 break;
                         }
-                        bp->rx_skbuff[entry] = skb;
 
                         /* now fill corresponding descriptor entry */
                         paddr = dma_map_single(&bp->pdev->dev, skb->data,
                                                bp->rx_buffer_size, DMA_FROM_DEVICE);
+                        if (dma_mapping_error(&bp->pdev->dev, paddr)) {
+                                dev_kfree_skb(skb);
+                                break;
+                        }
+
+                        bp->rx_skbuff[entry] = skb;
 
                         if (entry == RX_RING_SIZE - 1)
                                 paddr |= MACB_BIT(RX_WRAP);
@@ -725,7 +730,7 @@ static int gem_rx(struct macb *bp, int budget)
                 skb_put(skb, len);
                 addr = MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, addr));
                 dma_unmap_single(&bp->pdev->dev, addr,
-                                 len, DMA_FROM_DEVICE);
+                                 bp->rx_buffer_size, DMA_FROM_DEVICE);
 
                 skb->protocol = eth_type_trans(skb, bp->dev);
                 skb_checksum_none_assert(skb);
@@ -1036,11 +1041,15 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         entry = macb_tx_ring_wrap(bp->tx_head);
-        bp->tx_head++;
         netdev_vdbg(bp->dev, "Allocated ring entry %u\n", entry);
         mapping = dma_map_single(&bp->pdev->dev, skb->data,
                                  len, DMA_TO_DEVICE);
+        if (dma_mapping_error(&bp->pdev->dev, mapping)) {
+                kfree_skb(skb);
+                goto unlock;
+        }
 
+        bp->tx_head++;
         tx_skb = &bp->tx_skb[entry];
         tx_skb->skb = skb;
         tx_skb->mapping = mapping;
@@ -1066,6 +1075,7 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (CIRC_SPACE(bp->tx_head, bp->tx_tail, TX_RING_SIZE) < 1)
                 netif_stop_queue(dev);
 
+unlock:
         spin_unlock_irqrestore(&bp->lock, flags);
 
         return NETDEV_TX_OK;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 43ab35fea48d..34e2488767d9 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -6179,6 +6179,7 @@ static struct pci_driver cxgb4_driver = {
         .id_table = cxgb4_pci_tbl,
         .probe    = init_one,
         .remove   = remove_one,
+        .shutdown = remove_one,
         .err_handler = &cxgb4_eeh,
 };
 
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 8d09615da585..05529e273050 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -350,11 +350,13 @@ struct be_drv_stats {
         u32 roce_drops_crc;
 };
 
+/* A vlan-id of 0xFFFF must be used to clear transparent vlan-tagging */
+#define BE_RESET_VLAN_TAG_ID    0xFFFF
+
 struct be_vf_cfg {
         unsigned char mac_addr[ETH_ALEN];
         int if_handle;
         int pmac_id;
-        u16 def_vid;
         u16 vlan_tag;
         u32 tx_rate;
 };
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 04ac9c6a0d39..36c80612e21a 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -913,24 +913,14 @@ static int be_ipv6_tx_stall_chk(struct be_adapter *adapter,
         return BE3_chip(adapter) && be_ipv6_exthdr_check(skb);
 }
 
-static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
-                                           struct sk_buff *skb,
-                                           bool *skip_hw_vlan)
+static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter,
+                                                  struct sk_buff *skb,
+                                                  bool *skip_hw_vlan)
 {
         struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
         unsigned int eth_hdr_len;
         struct iphdr *ip;
 
-        /* Lancer, SH-R ASICs have a bug wherein Packets that are 32 bytes or less
-         * may cause a transmit stall on that port. So the work-around is to
-         * pad short packets (<= 32 bytes) to a 36-byte length.
-         */
-        if (unlikely(!BEx_chip(adapter) && skb->len <= 32)) {
-                if (skb_padto(skb, 36))
-                        goto tx_drop;
-                skb->len = 36;
-        }
-
         /* For padded packets, BE HW modifies tot_len field in IP header
          * incorrecly when VLAN tag is inserted by HW.
          * For padded packets, Lancer computes incorrect checksum.
@@ -959,7 +949,7 @@ static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
             vlan_tx_tag_present(skb)) {
                 skb = be_insert_vlan_in_pkt(adapter, skb, skip_hw_vlan);
                 if (unlikely(!skb))
-                        goto tx_drop;
+                        goto err;
         }
 
         /* HW may lockup when VLAN HW tagging is requested on
@@ -981,15 +971,39 @@ static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
             be_vlan_tag_tx_chk(adapter, skb)) {
                 skb = be_insert_vlan_in_pkt(adapter, skb, skip_hw_vlan);
                 if (unlikely(!skb))
-                        goto tx_drop;
+                        goto err;
         }
 
         return skb;
 tx_drop:
         dev_kfree_skb_any(skb);
+err:
         return NULL;
 }
 
+static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
+                                           struct sk_buff *skb,
+                                           bool *skip_hw_vlan)
+{
+        /* Lancer, SH-R ASICs have a bug wherein Packets that are 32 bytes or
+         * less may cause a transmit stall on that port. So the work-around is
+         * to pad short packets (<= 32 bytes) to a 36-byte length.
+         */
+        if (unlikely(!BEx_chip(adapter) && skb->len <= 32)) {
+                if (skb_padto(skb, 36))
+                        return NULL;
+                skb->len = 36;
+        }
+
+        if (BEx_chip(adapter) || lancer_chip(adapter)) {
+                skb = be_lancer_xmit_workarounds(adapter, skb, skip_hw_vlan);
+                if (!skb)
+                        return NULL;
+        }
+
+        return skb;
+}
+
 static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
@@ -1157,6 +1171,14 @@ ret:
         return status;
 }
 
+static void be_clear_promisc(struct be_adapter *adapter)
+{
+        adapter->promiscuous = false;
+        adapter->flags &= ~BE_FLAGS_VLAN_PROMISC;
+
+        be_cmd_rx_filter(adapter, IFF_PROMISC, OFF);
+}
+
 static void be_set_rx_mode(struct net_device *netdev)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
@@ -1170,9 +1192,7 @@ static void be_set_rx_mode(struct net_device *netdev)
 
         /* BE was previously in promiscuous mode; disable it */
         if (adapter->promiscuous) {
-                adapter->promiscuous = false;
-                be_cmd_rx_filter(adapter, IFF_PROMISC, OFF);
-
+                be_clear_promisc(adapter);
                 if (adapter->vlans_added)
                         be_vid_config(adapter);
         }
@@ -1287,24 +1307,20 @@ static int be_set_vf_vlan(struct net_device *netdev,
 
         if (vlan || qos) {
                 vlan |= qos << VLAN_PRIO_SHIFT;
-                if (vf_cfg->vlan_tag != vlan) {
-                        /* If this is new value, program it. Else skip. */
-                        vf_cfg->vlan_tag = vlan;
+                if (vf_cfg->vlan_tag != vlan)
                         status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
                                                        vf_cfg->if_handle, 0);
-                }
         } else {
                 /* Reset Transparent Vlan Tagging. */
-                vf_cfg->vlan_tag = 0;
-                vlan = vf_cfg->def_vid;
-                status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                                               vf_cfg->if_handle, 0);
+                status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID,
+                                               vf + 1, vf_cfg->if_handle, 0);
         }
 
-
-        if (status)
+        if (!status)
+                vf_cfg->vlan_tag = vlan;
+        else
                 dev_info(&adapter->pdev->dev,
-                                "VLAN %d config on VF %d failed\n", vlan, vf);
+                         "VLAN %d config on VF %d failed\n", vlan, vf);
         return status;
 }
 
@@ -3013,11 +3029,11 @@ static int be_vf_setup_init(struct be_adapter *adapter)
 
 static int be_vf_setup(struct be_adapter *adapter)
 {
+        struct device *dev = &adapter->pdev->dev;
         struct be_vf_cfg *vf_cfg;
-        u16 def_vlan, lnk_speed;
         int status, old_vfs, vf;
-        struct device *dev = &adapter->pdev->dev;
         u32 privileges;
+        u16 lnk_speed;
 
         old_vfs = pci_num_vf(adapter->pdev);
         if (old_vfs) {
@@ -3084,12 +3100,6 @@ static int be_vf_setup(struct be_adapter *adapter)
                 if (!status)
                         vf_cfg->tx_rate = lnk_speed;
 
-                status = be_cmd_get_hsw_config(adapter, &def_vlan,
-                                               vf + 1, vf_cfg->if_handle, NULL);
-                if (status)
-                        goto err;
-                vf_cfg->def_vid = def_vlan;
-
                 if (!old_vfs)
                         be_cmd_enable_vf(adapter, vf + 1);
         }
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 903362a7b584..03a351300013 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -389,12 +389,6 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                         netdev_err(ndev, "Tx DMA memory map failed\n");
                 return NETDEV_TX_OK;
         }
-        /* Send it on its way.  Tell FEC it's ready, interrupt when done,
-         * it's the last BD of the frame, and to put the CRC on the end.
-         */
-        status |= (BD_ENET_TX_READY | BD_ENET_TX_INTR
-                        | BD_ENET_TX_LAST | BD_ENET_TX_TC);
-        bdp->cbd_sc = status;
 
         if (fep->bufdesc_ex) {
 
@@ -416,6 +410,13 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 }
         }
 
+        /* Send it on its way.  Tell FEC it's ready, interrupt when done,
+         * it's the last BD of the frame, and to put the CRC on the end.
+         */
+        status |= (BD_ENET_TX_READY | BD_ENET_TX_INTR
+                        | BD_ENET_TX_LAST | BD_ENET_TX_TC);
+        bdp->cbd_sc = status;
+
         bdp_pre = fec_enet_get_prevdesc(bdp, fep);
         if ((id_entry->driver_data & FEC_QUIRK_ERR006358) &&
             !(bdp_pre->cbd_sc & BD_ENET_TX_READY)) {
@@ -527,13 +528,6 @@ fec_restart(struct net_device *ndev, int duplex)
         /* Clear any outstanding interrupt. */
         writel(0xffc00000, fep->hwp + FEC_IEVENT);
 
-        /* Setup multicast filter. */
-        set_multicast_list(ndev);
-#ifndef CONFIG_M5272
-        writel(0, fep->hwp + FEC_HASH_TABLE_HIGH);
-        writel(0, fep->hwp + FEC_HASH_TABLE_LOW);
-#endif
-
         /* Set maximum receive buffer size. */
         writel(PKT_MAXBLR_SIZE, fep->hwp + FEC_R_BUFF_SIZE);
 
@@ -654,6 +648,13 @@ fec_restart(struct net_device *ndev, int duplex)
 
         writel(rcntl, fep->hwp + FEC_R_CNTRL);
 
+        /* Setup multicast filter. */
+        set_multicast_list(ndev);
+#ifndef CONFIG_M5272
+        writel(0, fep->hwp + FEC_HASH_TABLE_HIGH);
+        writel(0, fep->hwp + FEC_HASH_TABLE_LOW);
+#endif
+
         if (id_entry->driver_data & FEC_QUIRK_ENET_MAC) {
                 /* enable ENET endian swap */
                 ecntl |= (1 << 8);
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 4be971590461..1fc8334fc181 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -522,10 +522,21 @@ retry:
         return rc;
 }
 
+static u64 ibmveth_encode_mac_addr(u8 *mac)
+{
+        int i;
+        u64 encoded = 0;
+
+        for (i = 0; i < ETH_ALEN; i++)
+                encoded = (encoded << 8) | mac[i];
+
+        return encoded;
+}
+
 static int ibmveth_open(struct net_device *netdev)
 {
         struct ibmveth_adapter *adapter = netdev_priv(netdev);
-        u64 mac_address = 0;
+        u64 mac_address;
         int rxq_entries = 1;
         unsigned long lpar_rc;
         int rc;
@@ -579,8 +590,7 @@ static int ibmveth_open(struct net_device *netdev)
         adapter->rx_queue.num_slots = rxq_entries;
         adapter->rx_queue.toggle = 1;
 
-        memcpy(&mac_address, netdev->dev_addr, netdev->addr_len);
-        mac_address = mac_address >> 16;
+        mac_address = ibmveth_encode_mac_addr(netdev->dev_addr);
 
         rxq_desc.fields.flags_len = IBMVETH_BUF_VALID |
                                         adapter->rx_queue.queue_len;
@@ -1183,8 +1193,8 @@ static void ibmveth_set_multicast_list(struct net_device *netdev)
                 /* add the addresses to the filter table */
                 netdev_for_each_mc_addr(ha, netdev) {
                         /* add the multicast address to the filter table */
-                        unsigned long mcast_addr = 0;
-                        memcpy(((char *)&mcast_addr)+2, ha->addr, ETH_ALEN);
+                        u64 mcast_addr;
+                        mcast_addr = ibmveth_encode_mac_addr(ha->addr);
                         lpar_rc = h_multicast_ctrl(adapter->vdev->unit_address,
                                                    IbmVethMcastAddFilter,
                                                    mcast_addr);
@@ -1372,9 +1382,6 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
 
         netif_napi_add(netdev, &adapter->napi, ibmveth_poll, 16);
 
-        adapter->mac_addr = 0;
-        memcpy(&adapter->mac_addr, mac_addr_p, ETH_ALEN);
-
         netdev->irq = dev->irq;
         netdev->netdev_ops = &ibmveth_netdev_ops;
         netdev->ethtool_ops = &netdev_ethtool_ops;
@@ -1383,7 +1390,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
                 NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
         netdev->features |= netdev->hw_features;
 
-        memcpy(netdev->dev_addr, &adapter->mac_addr, netdev->addr_len);
+        memcpy(netdev->dev_addr, mac_addr_p, ETH_ALEN);
 
         for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) {
                 struct kobject *kobj = &adapter->rx_buff_pool[i].kobj;
diff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h
index 451ba7949e15..1f37499d4398 100644
--- a/drivers/net/ethernet/ibm/ibmveth.h
+++ b/drivers/net/ethernet/ibm/ibmveth.h
@@ -138,7 +138,6 @@ struct ibmveth_adapter {
     struct napi_struct napi;
     struct net_device_stats stats;
     unsigned int mcastFilterSize;
-    unsigned long mac_addr;
     void * buffer_list_addr;
     void * filter_list_addr;
     dma_addr_t buffer_list_dma;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index fad45316200a..84a96f70dfb5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -742,6 +742,14 @@ static int mlx4_en_replace_mac(struct mlx4_en_priv *priv, int qpn,
                                 err = mlx4_en_uc_steer_add(priv, new_mac,
                                                            &qpn,
                                                            &entry->reg_id);
+                                if (err)
+                                        return err;
+                                if (priv->tunnel_reg_id) {
+                                        mlx4_flow_detach(priv->mdev->dev, priv->tunnel_reg_id);
+                                        priv->tunnel_reg_id = 0;
+                                }
+                                err = mlx4_en_tunnel_steer_add(priv, new_mac, qpn,
+                                                               &priv->tunnel_reg_id);
                                 return err;
                         }
                 }
@@ -1792,6 +1800,8 @@ void mlx4_en_stop_port(struct net_device *dev, int detach)
                 mc_list[5] = priv->port;
                 mlx4_multicast_detach(mdev->dev, &priv->rss_map.indir_qp,
                                       mc_list, MLX4_PROT_ETH, mclist->reg_id);
+                if (mclist->tunnel_reg_id)
+                        mlx4_flow_detach(mdev->dev, mclist->tunnel_reg_id);
         }
         mlx4_en_clear_list(dev);
         list_for_each_entry_safe(mclist, tmp, &priv->curr_list, list) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 91b69ff4b4a2..7e2995ecea6f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -129,13 +129,14 @@ static void dump_dev_cap_flags2(struct mlx4_dev *dev, u64 flags)
                 [0] = "RSS support",
                 [1] = "RSS Toeplitz Hash Function support",
                 [2] = "RSS XOR Hash Function support",
-                [3] = "Device manage flow steering support",
+                [3] = "Device managed flow steering support",
                 [4] = "Automatic MAC reassignment support",
                 [5] = "Time stamping support",
                 [6] = "VST (control vlan insertion/stripping) support",
                 [7] = "FSM (MAC anti-spoofing) support",
                 [8] = "Dynamic QP updates support",
-                [9] = "TCP/IP offloads/flow-steering for VXLAN support"
+                [9] = "Device managed flow steering IPoIB support",
+                [10] = "TCP/IP offloads/flow-steering for VXLAN support"
         };
         int i;
 
@@ -859,7 +860,7 @@ int mlx4_QUERY_DEV_CAP_wrapper(struct mlx4_dev *dev, int slave,
         MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_CQ_TS_SUPPORT_OFFSET);
 
         /* For guests, disable vxlan tunneling */
-        MLX4_GET(field, outbox, QUERY_DEV_CAP_VXLAN);
+        MLX4_GET(field, outbox->buf, QUERY_DEV_CAP_VXLAN);
         field &= 0xf7;
         MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_VXLAN);
 
@@ -869,7 +870,7 @@ int mlx4_QUERY_DEV_CAP_wrapper(struct mlx4_dev *dev, int slave,
         MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_BF_OFFSET);
 
         /* For guests, disable mw type 2 */
-        MLX4_GET(bmme_flags, outbox, QUERY_DEV_CAP_BMME_FLAGS_OFFSET);
+        MLX4_GET(bmme_flags, outbox->buf, QUERY_DEV_CAP_BMME_FLAGS_OFFSET);
         bmme_flags &= ~MLX4_BMME_FLAG_TYPE_2_WIN;
         MLX4_PUT(outbox->buf, bmme_flags, QUERY_DEV_CAP_BMME_FLAGS_OFFSET);
 
@@ -883,7 +884,7 @@ int mlx4_QUERY_DEV_CAP_wrapper(struct mlx4_dev *dev, int slave,
         }
 
         /* turn off ipoib managed steering for guests */
-        MLX4_GET(field, outbox, QUERY_DEV_CAP_FLOW_STEERING_IPOIB_OFFSET);
+        MLX4_GET(field, outbox->buf, QUERY_DEV_CAP_FLOW_STEERING_IPOIB_OFFSET);
         field &= ~0x80;
         MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_FLOW_STEERING_IPOIB_OFFSET);
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index d711158b0d4b..936c15364739 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -150,6 +150,8 @@ struct mlx4_port_config {
         struct pci_dev *pdev;
 };
 
+static atomic_t pf_loading = ATOMIC_INIT(0);
+
 int mlx4_check_port_params(struct mlx4_dev *dev,
                            enum mlx4_port_type *port_type)
 {
@@ -749,7 +751,7 @@ static void mlx4_request_modules(struct mlx4_dev *dev)
                         has_eth_port = true;
         }
 
-        if (has_ib_port)
+        if (has_ib_port || (dev->caps.flags & MLX4_DEV_CAP_FLAG_IBOE))
                 request_module_nowait(IB_DRV_NAME);
         if (has_eth_port)
                 request_module_nowait(EN_DRV_NAME);
@@ -1407,6 +1409,11 @@ static int mlx4_init_slave(struct mlx4_dev *dev)
         u32 slave_read;
         u32 cmd_channel_ver;
 
+        if (atomic_read(&pf_loading)) {
+                mlx4_warn(dev, "PF is not ready. Deferring probe\n");
+                return -EPROBE_DEFER;
+        }
+
         mutex_lock(&priv->cmd.slave_cmd_mutex);
         priv->cmd.max_cmds = 1;
         mlx4_warn(dev, "Sending reset\n");
@@ -2319,7 +2326,11 @@ static int __mlx4_init_one(struct pci_dev *pdev, int pci_dev_data)
 
                 if (num_vfs) {
                         mlx4_warn(dev, "Enabling SR-IOV with %d VFs\n", num_vfs);
+
+                        atomic_inc(&pf_loading);
                         err = pci_enable_sriov(pdev, num_vfs);
+                        atomic_dec(&pf_loading);
+
                         if (err) {
                                 mlx4_err(dev, "Failed to enable SR-IOV, continuing without SR-IOV (err = %d).\n",
                                          err);
@@ -2684,6 +2695,7 @@ static struct pci_driver mlx4_driver = {
         .name           = DRV_NAME,
         .id_table       = mlx4_pci_table,
         .probe          = mlx4_init_one,
+        .shutdown       = mlx4_remove_one,
         .remove         = mlx4_remove_one,
         .err_handler    = &mlx4_err_handler,
 };
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index 6b65f7795215..7aec6c833973 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -51,8 +51,8 @@
 
 #define DRV_NAME        "mlx4_core"
 #define PFX             DRV_NAME ": "
-#define DRV_VERSION     "1.1"
-#define DRV_RELDATE     "Dec, 2011"
+#define DRV_VERSION     "2.2-1"
+#define DRV_RELDATE     "Feb, 2014"
 
 #define MLX4_FS_UDP_UC_EN               (1 << 1)
 #define MLX4_FS_TCP_UC_EN               (1 << 2)
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 9ca223bc90fc..b57e8c87a34e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -57,8 +57,8 @@
 #include "en_port.h"
 
 #define DRV_NAME        "mlx4_en"
-#define DRV_VERSION     "2.0"
-#define DRV_RELDATE     "Dec 2011"
+#define DRV_VERSION     "2.2-1"
+#define DRV_RELDATE     "Feb 2014"
 
 #define MLX4_EN_MSG_LEVEL       (NETIF_MSG_LINK | NETIF_MSG_IFDOWN)
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index a064f06e0cb8..23b7e2d35a93 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -46,8 +46,8 @@
 #include "mlx5_core.h"
 
 #define DRIVER_NAME "mlx5_core"
-#define DRIVER_VERSION "1.0"
-#define DRIVER_RELDATE  "June 2013"
+#define DRIVER_VERSION "2.2-1"
+#define DRIVER_RELDATE  "Feb 2014"
 
 MODULE_AUTHOR("Eli Cohen <eli@mellanox.com>");
 MODULE_DESCRIPTION("Mellanox ConnectX-IB HCA core library");
diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c
index 727b546a9eb8..e0c92e0e5e1d 100644
--- a/drivers/net/ethernet/micrel/ks8851.c
+++ b/drivers/net/ethernet/micrel/ks8851.c
@@ -23,6 +23,7 @@
 #include <linux/crc32.h>
 #include <linux/mii.h>
 #include <linux/eeprom_93cx6.h>
+#include <linux/regulator/consumer.h>
 
 #include <linux/spi/spi.h>
 
@@ -83,6 +84,7 @@ union ks8851_tx_hdr {
  * @rc_rxqcr: Cached copy of KS_RXQCR.
  * @eeprom_size: Companion eeprom size in Bytes, 0 if no eeprom
  * @eeprom: 93CX6 EEPROM state for accessing on-board EEPROM.
+ * @vdd_reg:    Optional regulator supplying the chip
  *
  * The @lock ensures that the chip is protected when certain operations are
  * in progress. When the read or write packet transfer is in progress, most
@@ -130,6 +132,7 @@ struct ks8851_net {
         struct spi_transfer     spi_xfer2[2];
 
         struct eeprom_93cx6     eeprom;
+        struct regulator        *vdd_reg;
 };
 
 static int msg_enable;
@@ -1414,6 +1417,21 @@ static int ks8851_probe(struct spi_device *spi)
         ks->spidev = spi;
         ks->tx_space = 6144;
 
+        ks->vdd_reg = regulator_get_optional(&spi->dev, "vdd");
+        if (IS_ERR(ks->vdd_reg)) {
+                ret = PTR_ERR(ks->vdd_reg);
+                if (ret == -EPROBE_DEFER)
+                        goto err_reg;
+        } else {
+                ret = regulator_enable(ks->vdd_reg);
+                if (ret) {
+                        dev_err(&spi->dev, "regulator enable fail: %d\n",
+                                ret);
+                        goto err_reg_en;
+                }
+        }
+
+
         mutex_init(&ks->lock);
         spin_lock_init(&ks->statelock);
 
@@ -1508,8 +1526,14 @@ static int ks8851_probe(struct spi_device *spi)
 err_netdev:
         free_irq(ndev->irq, ks);
 
-err_id:
 err_irq:
+err_id:
+        if (!IS_ERR(ks->vdd_reg))
+                regulator_disable(ks->vdd_reg);
+err_reg_en:
+        if (!IS_ERR(ks->vdd_reg))
+                regulator_put(ks->vdd_reg);
+err_reg:
         free_netdev(ndev);
         return ret;
 }
@@ -1523,6 +1547,10 @@ static int ks8851_remove(struct spi_device *spi)
 
         unregister_netdev(priv->netdev);
         free_irq(spi->irq, priv);
+        if (!IS_ERR(priv->vdd_reg)) {
+                regulator_disable(priv->vdd_reg);
+                regulator_put(priv->vdd_reg);
+        }
         free_netdev(priv->netdev);
 
         return 0;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 4146664d4d6a..27c4f131863b 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -340,6 +340,7 @@ int qlcnic_83xx_setup_intr(struct qlcnic_adapter *adapter)
                         if (qlcnic_sriov_vf_check(adapter))
                                 return -EINVAL;
                         num_msix = 1;
+                        adapter->drv_sds_rings = QLCNIC_SINGLE_RING;
                         adapter->drv_tx_rings = QLCNIC_SINGLE_RING;
                 }
         }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
index 77f1bce432d2..7d4f54912bad 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
@@ -807,7 +807,7 @@ qlcnic_dcb_get_pg_tc_cfg_tx(struct net_device *netdev, int tc, u8 *prio,
             !type->tc_param_valid)
                 return;
 
-        if (tc < 0 || (tc > QLC_DCB_MAX_TC))
+        if (tc < 0 || (tc >= QLC_DCB_MAX_TC))
                 return;
 
         tc_cfg = &type->tc_cfg[tc];
@@ -843,7 +843,7 @@ static void qlcnic_dcb_get_pg_bwg_cfg_tx(struct net_device *netdev, int pgid,
             !type->tc_param_valid)
                 return;
 
-        if (pgid < 0 || pgid > QLC_DCB_MAX_PG)
+        if (pgid < 0 || pgid >= QLC_DCB_MAX_PG)
                 return;
 
         pgcfg = &type->pg_cfg[pgid];
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index ba78c7481fa3..1222865cfb73 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -816,9 +816,10 @@ static int qlcnic_82xx_setup_intr(struct qlcnic_adapter *adapter)
 
                 if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
                         qlcnic_disable_multi_tx(adapter);
+                        adapter->drv_sds_rings = QLCNIC_SINGLE_RING;
 
                         err = qlcnic_enable_msi_legacy(adapter);
-                        if (!err)
+                        if (err)
                                 return err;
                 }
         }
@@ -3863,7 +3864,7 @@ int qlcnic_validate_rings(struct qlcnic_adapter *adapter, __u32 ring_cnt,
                 strcpy(buf, "Tx");
         }
 
-        if (!qlcnic_use_msi_x && !qlcnic_use_msi) {
+        if (!QLCNIC_IS_MSI_FAMILY(adapter)) {
                 netdev_err(netdev, "No RSS/TSS support in INT-x mode\n");
                 return -EINVAL;
         }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index 09acf15c3a56..e5277a632671 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -13,8 +13,6 @@
 #define QLC_VF_MIN_TX_RATE      100
 #define QLC_VF_MAX_TX_RATE      9999
 #define QLC_MAC_OPCODE_MASK     0x7
-#define QLC_MAC_STAR_ADD        6
-#define QLC_MAC_STAR_DEL        7
 #define QLC_VF_FLOOD_BIT        BIT_16
 #define QLC_FLOOD_MODE          0x5
 
@@ -1206,13 +1204,6 @@ static int qlcnic_sriov_validate_cfg_macvlan(struct qlcnic_adapter *adapter,
         struct qlcnic_vport *vp = vf->vp;
         u8 op, new_op;
 
-        if (((cmd->req.arg[1] & QLC_MAC_OPCODE_MASK) == QLC_MAC_STAR_ADD) ||
-            ((cmd->req.arg[1] & QLC_MAC_OPCODE_MASK) == QLC_MAC_STAR_DEL)) {
-                netdev_err(adapter->netdev, "MAC + any VLAN filter not allowed from VF %d\n",
-                           vf->pci_func);
-                return -EINVAL;
-        }
-
         if (!(cmd->req.arg[1] & BIT_8))
                 return -EINVAL;
 
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 91a67ae8f17b..3ff7bc3e7a23 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -209,7 +209,7 @@ static const struct {
         [RTL_GIGA_MAC_VER_16] =
                 _R("RTL8101e",          RTL_TD_0, NULL, JUMBO_1K, true),
         [RTL_GIGA_MAC_VER_17] =
-                _R("RTL8168b/8111b",    RTL_TD_1, NULL, JUMBO_4K, false),
+                _R("RTL8168b/8111b",    RTL_TD_0, NULL, JUMBO_4K, false),
         [RTL_GIGA_MAC_VER_18] =
                 _R("RTL8168cp/8111cp",  RTL_TD_1, NULL, JUMBO_6K, false),
         [RTL_GIGA_MAC_VER_19] =
@@ -7118,6 +7118,8 @@ rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         mutex_init(&tp->wk.mutex);
+        u64_stats_init(&tp->rx_stats.syncp);
+        u64_stats_init(&tp->tx_stats.syncp);
 
         /* Get MAC address */
         for (i = 0; i < ETH_ALEN; i++)
diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
index eb75fbd11a01..d7a36829649a 100644
--- a/drivers/net/ethernet/sfc/ptp.c
+++ b/drivers/net/ethernet/sfc/ptp.c
@@ -1668,6 +1668,13 @@ void efx_ptp_event(struct efx_nic *efx, efx_qword_t *ev)
         struct efx_ptp_data *ptp = efx->ptp_data;
         int code = EFX_QWORD_FIELD(*ev, MCDI_EVENT_CODE);
 
+        if (!ptp) {
+                if (net_ratelimit())
+                        netif_warn(efx, drv, efx->net_dev,
+                                   "Received PTP event but PTP not set up\n");
+                return;
+        }
+
         if (!ptp->enabled)
                 return;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
index 72d282bf33a5..c553f6b5a913 100644
--- a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
@@ -151,7 +151,7 @@ static void stmmac_clean_desc3(void *priv_ptr, struct dma_desc *p)
                                           sizeof(struct dma_desc)));
 }
 
-const struct stmmac_chain_mode_ops chain_mode_ops = {
+const struct stmmac_mode_ops chain_mode_ops = {
         .init = stmmac_init_dma_chain,
         .is_jumbo_frm = stmmac_is_jumbo_frm,
         .jumbo_frm = stmmac_jumbo_frm,
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index 7834a3993946..74610f3aca9e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -419,20 +419,13 @@ struct mii_regs {
         unsigned int data;      /* MII Data */
 };
 
-struct stmmac_ring_mode_ops {
-        unsigned int (*is_jumbo_frm) (int len, int ehn_desc);
-        unsigned int (*jumbo_frm) (void *priv, struct sk_buff *skb, int csum);
-        void (*refill_desc3) (void *priv, struct dma_desc *p);
-        void (*init_desc3) (struct dma_desc *p);
-        void (*clean_desc3) (void *priv, struct dma_desc *p);
-        int (*set_16kib_bfsize) (int mtu);
-};
-
-struct stmmac_chain_mode_ops {
+struct stmmac_mode_ops {
         void (*init) (void *des, dma_addr_t phy_addr, unsigned int size,
                       unsigned int extend_desc);
         unsigned int (*is_jumbo_frm) (int len, int ehn_desc);
         unsigned int (*jumbo_frm) (void *priv, struct sk_buff *skb, int csum);
+        int (*set_16kib_bfsize)(int mtu);
+        void (*init_desc3)(struct dma_desc *p);
         void (*refill_desc3) (void *priv, struct dma_desc *p);
         void (*clean_desc3) (void *priv, struct dma_desc *p);
 };
@@ -441,8 +434,7 @@ struct mac_device_info {
         const struct stmmac_ops *mac;
         const struct stmmac_desc_ops *desc;
         const struct stmmac_dma_ops *dma;
-        const struct stmmac_ring_mode_ops *ring;
-        const struct stmmac_chain_mode_ops *chain;
+        const struct stmmac_mode_ops *mode;
         const struct stmmac_hwtimestamp *ptp;
         struct mii_regs mii;    /* MII register Addresses */
         struct mac_link link;
@@ -460,7 +452,7 @@ void stmmac_get_mac_addr(void __iomem *ioaddr, unsigned char *addr,
 void stmmac_set_mac(void __iomem *ioaddr, bool enable);
 
 void dwmac_dma_flush_tx_fifo(void __iomem *ioaddr);
-extern const struct stmmac_ring_mode_ops ring_mode_ops;
-extern const struct stmmac_chain_mode_ops chain_mode_ops;
+extern const struct stmmac_mode_ops ring_mode_ops;
+extern const struct stmmac_mode_ops chain_mode_ops;
 
 #endif /* __COMMON_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index a96c7c2f5f3f..650a4be6bce5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -100,10 +100,9 @@ static void stmmac_refill_desc3(void *priv_ptr, struct dma_desc *p)
 {
         struct stmmac_priv *priv = (struct stmmac_priv *)priv_ptr;
 
-        if (unlikely(priv->plat->has_gmac))
-                /* Fill DES3 in case of RING mode */
-                if (priv->dma_buf_sz >= BUF_SIZE_8KiB)
-                        p->des3 = p->des2 + BUF_SIZE_8KiB;
+        /* Fill DES3 in case of RING mode */
+        if (priv->dma_buf_sz >= BUF_SIZE_8KiB)
+                p->des3 = p->des2 + BUF_SIZE_8KiB;
 }
 
 /* In ring mode we need to fill the desc3 because it is used as buffer */
@@ -126,7 +125,7 @@ static int stmmac_set_16kib_bfsize(int mtu)
         return ret;
 }
 
-const struct stmmac_ring_mode_ops ring_mode_ops = {
+const struct stmmac_mode_ops ring_mode_ops = {
         .is_jumbo_frm = stmmac_is_jumbo_frm,
         .jumbo_frm = stmmac_jumbo_frm,
         .refill_desc3 = stmmac_refill_desc3,
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index a2e7d2c96e36..8543e1cfd55e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -92,8 +92,8 @@ static int tc = TC_DEFAULT;
 module_param(tc, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(tc, "DMA threshold control value");
 
-#define DMA_BUFFER_SIZE BUF_SIZE_4KiB
-static int buf_sz = DMA_BUFFER_SIZE;
+#define DEFAULT_BUFSIZE 1536
+static int buf_sz = DEFAULT_BUFSIZE;
 module_param(buf_sz, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(buf_sz, "DMA buffer size");
 
@@ -136,8 +136,8 @@ static void stmmac_verify_args(void)
                 dma_rxsize = DMA_RX_SIZE;
         if (unlikely(dma_txsize < 0))
                 dma_txsize = DMA_TX_SIZE;
-        if (unlikely((buf_sz < DMA_BUFFER_SIZE) || (buf_sz > BUF_SIZE_16KiB)))
-                buf_sz = DMA_BUFFER_SIZE;
+        if (unlikely((buf_sz < DEFAULT_BUFSIZE) || (buf_sz > BUF_SIZE_16KiB)))
+                buf_sz = DEFAULT_BUFSIZE;
         if (unlikely(flow_ctrl > 1))
                 flow_ctrl = FLOW_AUTO;
         else if (likely(flow_ctrl < 0))
@@ -286,10 +286,25 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
 
         /* MAC core supports the EEE feature. */
         if (priv->dma_cap.eee) {
+                int tx_lpi_timer = priv->tx_lpi_timer;
+
                 /* Check if the PHY supports EEE */
-                if (phy_init_eee(priv->phydev, 1))
+                if (phy_init_eee(priv->phydev, 1)) {
+                        /* To manage at run-time if the EEE cannot be supported
+                         * anymore (for example because the lp caps have been
+                         * changed).
+                         * In that case the driver disable own timers.
+                         */
+                        if (priv->eee_active) {
+                                pr_debug("stmmac: disable EEE\n");
+                                del_timer_sync(&priv->eee_ctrl_timer);
+                                priv->hw->mac->set_eee_timer(priv->ioaddr, 0,
+                                                             tx_lpi_timer);
+                        }
+                        priv->eee_active = 0;
                         goto out;
-
+                }
+                /* Activate the EEE and start timers */
                 if (!priv->eee_active) {
                         priv->eee_active = 1;
                         init_timer(&priv->eee_ctrl_timer);
@@ -300,13 +315,13 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
 
                         priv->hw->mac->set_eee_timer(priv->ioaddr,
                                                      STMMAC_DEFAULT_LIT_LS,
-                                                     priv->tx_lpi_timer);
+                                                     tx_lpi_timer);
                 } else
                         /* Set HW EEE according to the speed */
                         priv->hw->mac->set_eee_pls(priv->ioaddr,
                                                    priv->phydev->link);
 
-                pr_info("stmmac: Energy-Efficient Ethernet initialized\n");
+                pr_debug("stmmac: Energy-Efficient Ethernet initialized\n");
 
                 ret = true;
         }
@@ -886,10 +901,10 @@ static int stmmac_set_bfsize(int mtu, int bufsize)
                 ret = BUF_SIZE_8KiB;
         else if (mtu >= BUF_SIZE_2KiB)
                 ret = BUF_SIZE_4KiB;
-        else if (mtu >= DMA_BUFFER_SIZE)
+        else if (mtu > DEFAULT_BUFSIZE)
                 ret = BUF_SIZE_2KiB;
         else
-                ret = DMA_BUFFER_SIZE;
+                ret = DEFAULT_BUFSIZE;
 
         return ret;
 }
@@ -951,9 +966,9 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
 
         p->des2 = priv->rx_skbuff_dma[i];
 
-        if ((priv->mode == STMMAC_RING_MODE) &&
+        if ((priv->hw->mode->init_desc3) &&
             (priv->dma_buf_sz == BUF_SIZE_16KiB))
-                priv->hw->ring->init_desc3(p);
+                priv->hw->mode->init_desc3(p);
 
         return 0;
 }
@@ -984,11 +999,8 @@ static int init_dma_desc_rings(struct net_device *dev)
         unsigned int bfsize = 0;
         int ret = -ENOMEM;
 
-        /* Set the max buffer size according to the DESC mode
-         * and the MTU. Note that RING mode allows 16KiB bsize.
-         */
-        if (priv->mode == STMMAC_RING_MODE)
-                bfsize = priv->hw->ring->set_16kib_bfsize(dev->mtu);
+        if (priv->hw->mode->set_16kib_bfsize)
+                bfsize = priv->hw->mode->set_16kib_bfsize(dev->mtu);
 
         if (bfsize < BUF_SIZE_16KiB)
                 bfsize = stmmac_set_bfsize(dev->mtu, priv->dma_buf_sz);
@@ -1029,15 +1041,15 @@ static int init_dma_desc_rings(struct net_device *dev)
         /* Setup the chained descriptor addresses */
         if (priv->mode == STMMAC_CHAIN_MODE) {
                 if (priv->extend_desc) {
-                        priv->hw->chain->init(priv->dma_erx, priv->dma_rx_phy,
-                                              rxsize, 1);
-                        priv->hw->chain->init(priv->dma_etx, priv->dma_tx_phy,
-                                              txsize, 1);
+                        priv->hw->mode->init(priv->dma_erx, priv->dma_rx_phy,
+                                             rxsize, 1);
+                        priv->hw->mode->init(priv->dma_etx, priv->dma_tx_phy,
+                                             txsize, 1);
                 } else {
-                        priv->hw->chain->init(priv->dma_rx, priv->dma_rx_phy,
-                                              rxsize, 0);
-                        priv->hw->chain->init(priv->dma_tx, priv->dma_tx_phy,
-                                              txsize, 0);
+                        priv->hw->mode->init(priv->dma_rx, priv->dma_rx_phy,
+                                             rxsize, 0);
+                        priv->hw->mode->init(priv->dma_tx, priv->dma_tx_phy,
+                                             txsize, 0);
                 }
         }
 
@@ -1288,7 +1300,7 @@ static void stmmac_tx_clean(struct stmmac_priv *priv)
                                          DMA_TO_DEVICE);
                         priv->tx_skbuff_dma[entry] = 0;
                 }
-                priv->hw->ring->clean_desc3(priv, p);
+                priv->hw->mode->clean_desc3(priv, p);
 
                 if (likely(skb != NULL)) {
                         dev_kfree_skb(skb);
@@ -1705,7 +1717,7 @@ static int stmmac_open(struct net_device *dev)
         priv->dma_rx_size = STMMAC_ALIGN(dma_rxsize);
         priv->dma_buf_sz = STMMAC_ALIGN(buf_sz);
 
-        alloc_dma_desc_resources(priv);
+        ret = alloc_dma_desc_resources(priv);
         if (ret < 0) {
                 pr_err("%s: DMA descriptors allocation failed\n", __func__);
                 goto dma_desc_error;
@@ -1844,6 +1856,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         int nfrags = skb_shinfo(skb)->nr_frags;
         struct dma_desc *desc, *first;
         unsigned int nopaged_len = skb_headlen(skb);
+        unsigned int enh_desc = priv->plat->enh_desc;
 
         if (unlikely(stmmac_tx_avail(priv) < nfrags + 1)) {
                 if (!netif_queue_stopped(dev)) {
@@ -1871,27 +1884,19 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         first = desc;
 
         /* To program the descriptors according to the size of the frame */
-        if (priv->mode == STMMAC_RING_MODE) {
-                is_jumbo = priv->hw->ring->is_jumbo_frm(skb->len,
-                                                        priv->plat->enh_desc);
-                if (unlikely(is_jumbo))
-                        entry = priv->hw->ring->jumbo_frm(priv, skb,
-                                                          csum_insertion);
-        } else {
-                is_jumbo = priv->hw->chain->is_jumbo_frm(skb->len,
-                                                         priv->plat->enh_desc);
-                if (unlikely(is_jumbo))
-                        entry = priv->hw->chain->jumbo_frm(priv, skb,
-                                                           csum_insertion);
-        }
+        if (enh_desc)
+                is_jumbo = priv->hw->mode->is_jumbo_frm(skb->len, enh_desc);
+
         if (likely(!is_jumbo)) {
                 desc->des2 = dma_map_single(priv->device, skb->data,
                                             nopaged_len, DMA_TO_DEVICE);
                 priv->tx_skbuff_dma[entry] = desc->des2;
                 priv->hw->desc->prepare_tx_desc(desc, 1, nopaged_len,
                                                 csum_insertion, priv->mode);
-        } else
+        } else {
                 desc = first;
+                entry = priv->hw->mode->jumbo_frm(priv, skb, csum_insertion);
+        }
 
         for (i = 0; i < nfrags; i++) {
                 const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
@@ -2029,7 +2034,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv)
 
                         p->des2 = priv->rx_skbuff_dma[entry];
 
-                        priv->hw->ring->refill_desc3(priv, p);
+                        priv->hw->mode->refill_desc3(priv, p);
 
                         if (netif_msg_rx_status(priv))
                                 pr_debug("\trefill entry #%d\n", entry);
@@ -2633,11 +2638,11 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
 
         /* To use the chained or ring mode */
         if (chain_mode) {
-                priv->hw->chain = &chain_mode_ops;
+                priv->hw->mode = &chain_mode_ops;
                 pr_info(" Chain mode enabled\n");
                 priv->mode = STMMAC_CHAIN_MODE;
         } else {
-                priv->hw->ring = &ring_mode_ops;
+                priv->hw->mode = &ring_mode_ops;
                 pr_info(" Ring mode enabled\n");
                 priv->mode = STMMAC_RING_MODE;
         }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index c61bc72b8e90..8fb32a80f1c1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -36,7 +36,7 @@ static const struct of_device_id stmmac_dt_ids[] = {
 #ifdef CONFIG_DWMAC_STI
         { .compatible = "st,stih415-dwmac", .data = &sti_gmac_data},
         { .compatible = "st,stih416-dwmac", .data = &sti_gmac_data},
-        { .compatible = "st,stih127-dwmac", .data = &sti_gmac_data},
+        { .compatible = "st,stid127-dwmac", .data = &sti_gmac_data},
 #endif
         /* SoC specific glue layers should come before generic bindings */
         { .compatible = "st,spear600-gmac"},
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 651087b5c8da..7d6d8ec676c8 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1164,11 +1164,17 @@ static void cpsw_init_host_port(struct cpsw_priv *priv)
 
 static void cpsw_slave_stop(struct cpsw_slave *slave, struct cpsw_priv *priv)
 {
+        u32 slave_port;
+
+        slave_port = cpsw_get_slave_port(priv, slave->slave_num);
+
         if (!slave->phy)
                 return;
         phy_stop(slave->phy);
         phy_disconnect(slave->phy);
         slave->phy = NULL;
+        cpsw_ale_control_set(priv->ale, slave_port,
+                             ALE_PORT_STATE, ALE_PORT_STATE_DISABLE);
 }
 
 static int cpsw_ndo_open(struct net_device *ndev)
@@ -2223,10 +2229,6 @@ static int cpsw_probe(struct platform_device *pdev)
                 goto clean_ale_ret;
         }
 
-        if (cpts_register(&pdev->dev, priv->cpts,
-                          data->cpts_clock_mult, data->cpts_clock_shift))
-                dev_err(priv->dev, "error registering cpts device\n");
-
         cpsw_notice(priv, probe, "initialized device (regs %pa, irq %d)\n",
                     &ss_res->start, ndev->irq);
 
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index 364d0c7952c0..88ef27067bf2 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -355,7 +355,7 @@ int cpdma_ctlr_stop(struct cpdma_ctlr *ctlr)
         int i;
 
         spin_lock_irqsave(&ctlr->lock, flags);
-        if (ctlr->state != CPDMA_STATE_ACTIVE) {
+        if (ctlr->state == CPDMA_STATE_TEARDOWN) {
                 spin_unlock_irqrestore(&ctlr->lock, flags);
                 return -EINVAL;
         }
@@ -891,7 +891,7 @@ int cpdma_chan_stop(struct cpdma_chan *chan)
         unsigned                timeout;
 
         spin_lock_irqsave(&chan->lock, flags);
-        if (chan->state != CPDMA_STATE_ACTIVE) {
+        if (chan->state == CPDMA_STATE_TEARDOWN) {
                 spin_unlock_irqrestore(&chan->lock, flags);
                 return -EINVAL;
         }
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index cd9b164a0434..8f0e69ce07ca 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1532,9 +1532,9 @@ static int emac_dev_open(struct net_device *ndev)
         struct device *emac_dev = &ndev->dev;
         u32 cnt;
         struct resource *res;
-        int ret;
+        int q, m, ret;
+        int res_num = 0, irq_num = 0;
         int i = 0;
-        int k = 0;
         struct emac_priv *priv = netdev_priv(ndev);
 
         pm_runtime_get(&priv->pdev->dev);
@@ -1564,15 +1564,24 @@ static int emac_dev_open(struct net_device *ndev)
         }
 
         /* Request IRQ */
+        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ,
+                                            res_num))) {
+                for (irq_num = res->start; irq_num <= res->end; irq_num++) {
+                        dev_err(emac_dev, "Request IRQ %d\n", irq_num);
+                        if (request_irq(irq_num, emac_irq, 0, ndev->name,
+                                        ndev)) {
+                                dev_err(emac_dev,
+                                        "DaVinci EMAC: request_irq() failed\n");
+                                ret = -EBUSY;
 
-        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
-                for (i = res->start; i <= res->end; i++) {
-                        if (devm_request_irq(&priv->pdev->dev, i, emac_irq,
-                                             0, ndev->name, ndev))
                                 goto rollback;
+                        }
                 }
-                k++;
+                res_num++;
         }
+        /* prepare counters for rollback in case of an error */
+        res_num--;
+        irq_num--;
 
         /* Start/Enable EMAC hardware */
         emac_hw_enable(priv);
@@ -1639,11 +1648,23 @@ static int emac_dev_open(struct net_device *ndev)
 
         return 0;
 
-rollback:
-
-        dev_err(emac_dev, "DaVinci EMAC: devm_request_irq() failed");
-        ret = -EBUSY;
 err:
+        emac_int_disable(priv);
+        napi_disable(&priv->napi);
+
+rollback:
+        for (q = res_num; q >= 0; q--) {
+                res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, q);
+                /* at the first iteration, irq_num is already set to the
+                 * right value
+                 */
+                if (q != res_num)
+                        irq_num = res->end;
+
+                for (m = irq_num; m >= res->start; m--)
+                        free_irq(m, ndev);
+        }
+        cpdma_ctlr_stop(priv->dma);
         pm_runtime_put(&priv->pdev->dev);
         return ret;
 }
@@ -1659,6 +1680,9 @@ err:
  */
 static int emac_dev_stop(struct net_device *ndev)
 {
+        struct resource *res;
+        int i = 0;
+        int irq_num;
         struct emac_priv *priv = netdev_priv(ndev);
         struct device *emac_dev = &ndev->dev;
 
@@ -1674,6 +1698,13 @@ static int emac_dev_stop(struct net_device *ndev)
         if (priv->phydev)
                 phy_disconnect(priv->phydev);
 
+        /* Free IRQ */
+        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, i))) {
+                for (irq_num = res->start; irq_num <= res->end; irq_num++)
+                        free_irq(irq_num, priv->ndev);
+                i++;
+        }
+
         if (netif_msg_drv(priv))
                 dev_notice(emac_dev, "DaVinci EMAC: %s stopped\n", ndev->name);
 
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index ef312bc6b865..6ac20a6738f4 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -923,7 +923,7 @@ static int rhine_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc) {
                 dev_err(&pdev->dev,
                         "32-bit PCI DMA addresses not supported by the card!?\n");
-                goto err_out;
+                goto err_out_pci_disable;
         }
 
         /* sanity check */
@@ -931,7 +931,7 @@ static int rhine_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
             (pci_resource_len(pdev, 1) < io_size)) {
                 rc = -EIO;
                 dev_err(&pdev->dev, "Insufficient PCI resources, aborting\n");
-                goto err_out;
+                goto err_out_pci_disable;
         }
 
         pioaddr = pci_resource_start(pdev, 0);
@@ -942,7 +942,7 @@ static int rhine_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         dev = alloc_etherdev(sizeof(struct rhine_private));
         if (!dev) {
                 rc = -ENOMEM;
-                goto err_out;
+                goto err_out_pci_disable;
         }
         SET_NETDEV_DEV(dev, &pdev->dev);
 
@@ -1084,6 +1084,8 @@ err_out_free_res:
         pci_release_regions(pdev);
 err_out_free_netdev:
         free_netdev(dev);
+err_out_pci_disable:
+        pci_disable_device(pdev);
 err_out:
         return rc;
 }
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 7141a1937360..d6fce9750b95 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -442,6 +442,8 @@ static int netvsc_probe(struct hv_device *dev,
         if (!net)
                 return -ENOMEM;
 
+        netif_carrier_off(net);
+
         net_device_ctx = netdev_priv(net);
         net_device_ctx->device_ctx = dev;
         hv_set_drvdata(dev, net);
@@ -473,6 +475,8 @@ static int netvsc_probe(struct hv_device *dev,
                 pr_err("Unable to register netdev.\n");
                 rndis_filter_device_remove(dev);
                 free_netdev(net);
+        } else {
+                schedule_delayed_work(&net_device_ctx->dwork, 0);
         }
 
         return ret;
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 1084e5de3ceb..b54fd257652b 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -243,6 +243,22 @@ static int rndis_filter_send_request(struct rndis_device *dev,
         return ret;
 }
 
+static void rndis_set_link_state(struct rndis_device *rdev,
+                                 struct rndis_request *request)
+{
+        u32 link_status;
+        struct rndis_query_complete *query_complete;
+
+        query_complete = &request->response_msg.msg.query_complete;
+
+        if (query_complete->status == RNDIS_STATUS_SUCCESS &&
+            query_complete->info_buflen == sizeof(u32)) {
+                memcpy(&link_status, (void *)((unsigned long)query_complete +
+                       query_complete->info_buf_offset), sizeof(u32));
+                rdev->link_state = link_status != 0;
+        }
+}
+
 static void rndis_filter_receive_response(struct rndis_device *dev,
                                        struct rndis_message *resp)
 {
@@ -272,6 +288,10 @@ static void rndis_filter_receive_response(struct rndis_device *dev,
                     sizeof(struct rndis_message) + RNDIS_EXT_LEN) {
                         memcpy(&request->response_msg, resp,
                                resp->msg_len);
+                        if (request->request_msg.ndis_msg_type ==
+                            RNDIS_MSG_QUERY && request->request_msg.msg.
+                            query_req.oid == RNDIS_OID_GEN_MEDIA_CONNECT_STATUS)
+                                rndis_set_link_state(dev, request);
                 } else {
                         netdev_err(ndev,
                                 "rndis response buffer overflow "
@@ -620,7 +640,6 @@ static int rndis_filter_query_device_link_status(struct rndis_device *dev)
         ret = rndis_filter_query_device(dev,
                                       RNDIS_OID_GEN_MEDIA_CONNECT_STATUS,
                                       &link_status, &size);
-        dev->link_state = (link_status != 0) ? true : false;
 
         return ret;
 }
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index ab31544bc254..a30258aad139 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -546,12 +546,12 @@ at86rf230_xmit(struct ieee802154_dev *dev, struct sk_buff *skb)
         int rc;
         unsigned long flags;
 
-        spin_lock(&lp->lock);
+        spin_lock_irqsave(&lp->lock, flags);
         if  (lp->irq_busy) {
-                spin_unlock(&lp->lock);
+                spin_unlock_irqrestore(&lp->lock, flags);
                 return -EBUSY;
         }
-        spin_unlock(&lp->lock);
+        spin_unlock_irqrestore(&lp->lock, flags);
 
         might_sleep();
 
@@ -725,10 +725,11 @@ static void at86rf230_irqwork_level(struct work_struct *work)
 static irqreturn_t at86rf230_isr(int irq, void *data)
 {
         struct at86rf230_local *lp = data;
+        unsigned long flags;
 
-        spin_lock(&lp->lock);
+        spin_lock_irqsave(&lp->lock, flags);
         lp->irq_busy = 1;
-        spin_unlock(&lp->lock);
+        spin_unlock_irqrestore(&lp->lock, flags);
 
         schedule_work(&lp->irqwork);
 
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index a5d21893670d..1831fb7cd017 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -506,6 +506,9 @@ static int macvlan_change_mtu(struct net_device *dev, int new_mtu)
 static struct lock_class_key macvlan_netdev_xmit_lock_key;
 static struct lock_class_key macvlan_netdev_addr_lock_key;
 
+#define ALWAYS_ON_FEATURES \
+        (NETIF_F_SG | NETIF_F_GEN_CSUM | NETIF_F_GSO_SOFTWARE | NETIF_F_LLTX)
+
 #define MACVLAN_FEATURES \
         (NETIF_F_SG | NETIF_F_ALL_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
          NETIF_F_GSO | NETIF_F_TSO | NETIF_F_UFO | NETIF_F_GSO_ROBUST | \
@@ -539,7 +542,7 @@ static int macvlan_init(struct net_device *dev)
         dev->state              = (dev->state & ~MACVLAN_STATE_MASK) |
                                   (lowerdev->state & MACVLAN_STATE_MASK);
         dev->features           = lowerdev->features & MACVLAN_FEATURES;
-        dev->features           |= NETIF_F_LLTX;
+        dev->features           |= ALWAYS_ON_FEATURES;
         dev->gso_max_size       = lowerdev->gso_max_size;
         dev->iflink             = lowerdev->ifindex;
         dev->hard_header_len    = lowerdev->hard_header_len;
@@ -699,7 +702,7 @@ static netdev_features_t macvlan_fix_features(struct net_device *dev,
         features = netdev_increment_features(vlan->lowerdev->features,
                                              features,
                                              mask);
-        features |= NETIF_F_LLTX;
+        features |= ALWAYS_ON_FEATURES;
 
         return features;
 }
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 19c9eca0ef26..76d96b9ebcdb 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -164,9 +164,9 @@ static const struct phy_setting settings[] = {
  *   of that setting.  Returns the index of the last setting if
  *   none of the others match.
  */
-static inline int phy_find_setting(int speed, int duplex)
+static inline unsigned int phy_find_setting(int speed, int duplex)
 {
-        int idx = 0;
+        unsigned int idx = 0;
 
         while (idx < ARRAY_SIZE(settings) &&
                (settings[idx].speed != speed || settings[idx].duplex != duplex))
@@ -185,7 +185,7 @@ static inline int phy_find_setting(int speed, int duplex)
  *   the mask in features.  Returns the index of the last setting
  *   if nothing else matches.
  */
-static inline int phy_find_valid(int idx, u32 features)
+static inline unsigned int phy_find_valid(unsigned int idx, u32 features)
 {
         while (idx < MAX_NUM_SETTINGS && !(settings[idx].setting & features))
                 idx++;
@@ -204,7 +204,7 @@ static inline int phy_find_valid(int idx, u32 features)
 static void phy_sanitize_settings(struct phy_device *phydev)
 {
         u32 features = phydev->supported;
-        int idx;
+        unsigned int idx;
 
         /* Sanitize settings based on PHY capabilities */
         if ((features & SUPPORTED_Autoneg) == 0)
@@ -954,7 +954,8 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
             (phydev->interface == PHY_INTERFACE_MODE_RGMII))) {
                 int eee_lp, eee_cap, eee_adv;
                 u32 lp, cap, adv;
-                int idx, status;
+                int status;
+                unsigned int idx;
 
                 /* Read phy status to properly get the right settings */
                 status = phy_read_status(phydev);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 82514e72b3d8..2f6989b1e0dc 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -683,10 +683,9 @@ EXPORT_SYMBOL(phy_detach);
 int phy_suspend(struct phy_device *phydev)
 {
         struct phy_driver *phydrv = to_phy_driver(phydev->dev.driver);
-        struct ethtool_wolinfo wol;
+        struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL };
 
         /* If the device has WOL enabled, we cannot suspend the PHY */
-        wol.cmd = ETHTOOL_GWOL;
         phy_ethtool_get_wol(phydev, &wol);
         if (wol.wolopts)
                 return -EBUSY;
@@ -916,6 +915,8 @@ int genphy_read_status(struct phy_device *phydev)
         int err;
         int lpa;
         int lpagb = 0;
+        int common_adv;
+        int common_adv_gb = 0;
 
         /* Update the link, but return if there was an error */
         err = genphy_update_link(phydev);
@@ -937,7 +938,7 @@ int genphy_read_status(struct phy_device *phydev)
 
                         phydev->lp_advertising =
                                 mii_stat1000_to_ethtool_lpa_t(lpagb);
-                        lpagb &= adv << 2;
+                        common_adv_gb = lpagb & adv << 2;
                 }
 
                 lpa = phy_read(phydev, MII_LPA);
@@ -950,25 +951,25 @@ int genphy_read_status(struct phy_device *phydev)
                 if (adv < 0)
                         return adv;
 
-                lpa &= adv;
+                common_adv = lpa & adv;
 
                 phydev->speed = SPEED_10;
                 phydev->duplex = DUPLEX_HALF;
                 phydev->pause = 0;
                 phydev->asym_pause = 0;
 
-                if (lpagb & (LPA_1000FULL | LPA_1000HALF)) {
+                if (common_adv_gb & (LPA_1000FULL | LPA_1000HALF)) {
                         phydev->speed = SPEED_1000;
 
-                        if (lpagb & LPA_1000FULL)
+                        if (common_adv_gb & LPA_1000FULL)
                                 phydev->duplex = DUPLEX_FULL;
-                } else if (lpa & (LPA_100FULL | LPA_100HALF)) {
+                } else if (common_adv & (LPA_100FULL | LPA_100HALF)) {
                         phydev->speed = SPEED_100;
 
-                        if (lpa & LPA_100FULL)
+                        if (common_adv & LPA_100FULL)
                                 phydev->duplex = DUPLEX_FULL;
                 } else
-                        if (lpa & LPA_10FULL)
+                        if (common_adv & LPA_10FULL)
                                 phydev->duplex = DUPLEX_FULL;
 
                 if (phydev->duplex == DUPLEX_FULL) {
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 8fe9cb7d0f72..26f8635b027d 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1686,7 +1686,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                                    TUN_USER_FEATURES | NETIF_F_HW_VLAN_CTAG_TX |
                                    NETIF_F_HW_VLAN_STAG_TX;
                 dev->features = dev->hw_features;
-                dev->vlan_features = dev->features;
+                dev->vlan_features = dev->features &
+                                     ~(NETIF_F_HW_VLAN_CTAG_TX |
+                                       NETIF_F_HW_VLAN_STAG_TX);
 
                 INIT_LIST_HEAD(&tun->disabled);
                 err = tun_attach(tun, file, false);
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 433f0a00c683..e2797f1e1b31 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -11,7 +11,7 @@ obj-$(CONFIG_USB_HSO)		+= hso.o
 obj-$(CONFIG_USB_NET_AX8817X)   += asix.o
 asix-y := asix_devices.o asix_common.o ax88172a.o
 obj-$(CONFIG_USB_NET_AX88179_178A)      += ax88179_178a.o
-obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o r815x.o
+obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o
 obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
 obj-$(CONFIG_USB_NET_SR9700)    += sr9700.o
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 955df81a4358..054e59ca6946 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1029,20 +1029,12 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->mii.phy_id = 0x03;
         dev->mii.supports_gmii = 1;
 
-        if (usb_device_no_sg_constraint(dev->udev))
-                dev->can_dma_sg = 1;
-
         dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                               NETIF_F_RXCSUM;
 
         dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                                  NETIF_F_RXCSUM;
 
-        if (dev->can_dma_sg) {
-                dev->net->features |= NETIF_F_SG | NETIF_F_TSO;
-                dev->net->hw_features |= NETIF_F_SG | NETIF_F_TSO;
-        }
-
         /* Enable checksum offload */
         *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
                AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
@@ -1395,6 +1387,19 @@ static const struct driver_info ax88178a_info = {
         .tx_fixup = ax88179_tx_fixup,
 };
 
+static const struct driver_info dlink_dub1312_info = {
+        .description = "D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
 static const struct driver_info sitecom_info = {
         .description = "Sitecom USB 3.0 to Gigabit Adapter",
         .bind = ax88179_bind,
@@ -1421,6 +1426,19 @@ static const struct driver_info samsung_info = {
         .tx_fixup = ax88179_tx_fixup,
 };
 
+static const struct driver_info lenovo_info = {
+        .description = "Lenovo OneLinkDock Gigabit LAN",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
 static const struct usb_device_id products[] = {
 {
         /* ASIX AX88179 10/100/1000 */
@@ -1431,6 +1449,10 @@ static const struct usb_device_id products[] = {
         USB_DEVICE(0x0b95, 0x178a),
         .driver_info = (unsigned long)&ax88178a_info,
 }, {
+        /* D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter */
+        USB_DEVICE(0x2001, 0x4a00),
+        .driver_info = (unsigned long)&dlink_dub1312_info,
+}, {
         /* Sitecom USB 3.0 to Gigabit Adapter */
         USB_DEVICE(0x0df6, 0x0072),
         .driver_info = (unsigned long)&sitecom_info,
@@ -1438,6 +1460,10 @@ static const struct usb_device_id products[] = {
         /* Samsung USB Ethernet Adapter */
         USB_DEVICE(0x04e8, 0xa100),
         .driver_info = (unsigned long)&samsung_info,
+}, {
+        /* Lenovo OneLinkDock Gigabit LAN */
+        USB_DEVICE(0x17ef, 0x304b),
+        .driver_info = (unsigned long)&lenovo_info,
 },
         { },
 };
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 42e176912c8e..bd363b27e854 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -652,6 +652,13 @@ static const struct usb_device_id	products[] = {
         .driver_info = 0,
 },
 
+/* Samsung USB Ethernet Adapters */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, 0xa101, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+
 /* WHITELIST!!!
  *
  * CDC Ether uses two interfaces, not necessarily consecutive.
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index dbff290ed0e4..d350d2795e10 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -68,7 +68,6 @@ static struct usb_driver cdc_ncm_driver;
 static int cdc_ncm_setup(struct usbnet *dev)
 {
         struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
-        struct usb_cdc_ncm_ntb_parameters ncm_parm;
         u32 val;
         u8 flags;
         u8 iface_no;
@@ -82,22 +81,22 @@ static int cdc_ncm_setup(struct usbnet *dev)
         err = usbnet_read_cmd(dev, USB_CDC_GET_NTB_PARAMETERS,
                               USB_TYPE_CLASS | USB_DIR_IN
                               |USB_RECIP_INTERFACE,
-                              0, iface_no, &ncm_parm,
-                              sizeof(ncm_parm));
+                              0, iface_no, &ctx->ncm_parm,
+                              sizeof(ctx->ncm_parm));
         if (err < 0) {
                 dev_err(&dev->intf->dev, "failed GET_NTB_PARAMETERS\n");
                 return err; /* GET_NTB_PARAMETERS is required */
         }
 
         /* read correct set of parameters according to device mode */
-        ctx->rx_max = le32_to_cpu(ncm_parm.dwNtbInMaxSize);
-        ctx->tx_max = le32_to_cpu(ncm_parm.dwNtbOutMaxSize);
-        ctx->tx_remainder = le16_to_cpu(ncm_parm.wNdpOutPayloadRemainder);
-        ctx->tx_modulus = le16_to_cpu(ncm_parm.wNdpOutDivisor);
-        ctx->tx_ndp_modulus = le16_to_cpu(ncm_parm.wNdpOutAlignment);
+        ctx->rx_max = le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize);
+        ctx->tx_max = le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize);
+        ctx->tx_remainder = le16_to_cpu(ctx->ncm_parm.wNdpOutPayloadRemainder);
+        ctx->tx_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutDivisor);
+        ctx->tx_ndp_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutAlignment);
         /* devices prior to NCM Errata shall set this field to zero */
-        ctx->tx_max_datagrams = le16_to_cpu(ncm_parm.wNtbOutMaxDatagrams);
-        ntb_fmt_supported = le16_to_cpu(ncm_parm.bmNtbFormatsSupported);
+        ctx->tx_max_datagrams = le16_to_cpu(ctx->ncm_parm.wNtbOutMaxDatagrams);
+        ntb_fmt_supported = le16_to_cpu(ctx->ncm_parm.bmNtbFormatsSupported);
 
         /* there are some minor differences in NCM and MBIM defaults */
         if (cdc_ncm_comm_intf_is_mbim(ctx->control->cur_altsetting)) {
@@ -146,7 +145,7 @@ static int cdc_ncm_setup(struct usbnet *dev)
         }
 
         /* inform device about NTB input size changes */
-        if (ctx->rx_max != le32_to_cpu(ncm_parm.dwNtbInMaxSize)) {
+        if (ctx->rx_max != le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize)) {
                 __le32 dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
 
                 err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_INPUT_SIZE,
@@ -162,14 +161,6 @@ static int cdc_ncm_setup(struct usbnet *dev)
                 dev_dbg(&dev->intf->dev, "Using default maximum transmit length=%d\n",
                         CDC_NCM_NTB_MAX_SIZE_TX);
                 ctx->tx_max = CDC_NCM_NTB_MAX_SIZE_TX;
-
-                /* Adding a pad byte here simplifies the handling in
-                 * cdc_ncm_fill_tx_frame, by making tx_max always
-                 * represent the real skb max size.
-                 */
-                if (ctx->tx_max % usb_maxpacket(dev->udev, dev->out, 1) == 0)
-                        ctx->tx_max++;
-
         }
 
         /*
@@ -439,6 +430,10 @@ advance:
                 goto error2;
         }
 
+        /* initialize data interface */
+        if (cdc_ncm_setup(dev))
+                goto error2;
+
         /* configure data interface */
         temp = usb_set_interface(dev->udev, iface_no, data_altsetting);
         if (temp) {
@@ -453,12 +448,6 @@ advance:
                 goto error2;
         }
 
-        /* initialize data interface */
-        if (cdc_ncm_setup(dev)) {
-                dev_dbg(&intf->dev, "cdc_ncm_setup() failed\n");
-                goto error2;
-        }
-
         usb_set_intfdata(ctx->data, dev);
         usb_set_intfdata(ctx->control, dev);
 
@@ -475,6 +464,15 @@ advance:
         dev->hard_mtu = ctx->tx_max;
         dev->rx_urb_size = ctx->rx_max;
 
+        /* cdc_ncm_setup will override dwNtbOutMaxSize if it is
+         * outside the sane range. Adding a pad byte here if necessary
+         * simplifies the handling in cdc_ncm_fill_tx_frame, making
+         * tx_max always represent the real skb max size.
+         */
+        if (ctx->tx_max != le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) &&
+            ctx->tx_max % usb_maxpacket(dev->udev, dev->out, 1) == 0)
+                ctx->tx_max++;
+
         return 0;
 
 error2:
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index d89dbe395ad2..adb12f349a61 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -449,9 +449,6 @@ enum rtl8152_flags {
 #define MCU_TYPE_PLA                    0x0100
 #define MCU_TYPE_USB                    0x0000
 
-#define REALTEK_USB_DEVICE(vend, prod)  \
-        USB_DEVICE_INTERFACE_CLASS(vend, prod, USB_CLASS_VENDOR_SPEC)
-
 struct rx_desc {
         __le32 opts1;
 #define RX_LEN_MASK                     0x7fff
@@ -2739,6 +2736,12 @@ static int rtl8152_probe(struct usb_interface *intf,
         struct net_device *netdev;
         int ret;
 
+        if (udev->actconfig->desc.bConfigurationValue != 1) {
+                usb_driver_set_configuration(udev, 1);
+                return -ENODEV;
+        }
+
+        usb_reset_device(udev);
         netdev = alloc_etherdev(sizeof(struct r8152));
         if (!netdev) {
                 dev_err(&intf->dev, "Out of memory\n");
@@ -2819,9 +2822,9 @@ static void rtl8152_disconnect(struct usb_interface *intf)
 
 /* table of devices that work with this driver */
 static struct usb_device_id rtl8152_table[] = {
-        {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8152)},
-        {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8153)},
-        {REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, PRODUCT_ID_SAMSUNG)},
+        {USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8152)},
+        {USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8153)},
+        {USB_DEVICE(VENDOR_ID_SAMSUNG, PRODUCT_ID_SAMSUNG)},
         {}
 };
 
diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c
deleted file mode 100644
index f0a8791b7636..000000000000
--- a/drivers/net/usb/r815x.c
+++ /dev/null
@@ -1,248 +0,0 @@
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <linux/mii.h>
-#include <linux/usb.h>
-#include <linux/usb/cdc.h>
-#include <linux/usb/usbnet.h>
-
-#define RTL815x_REQT_READ       0xc0
-#define RTL815x_REQT_WRITE      0x40
-#define RTL815x_REQ_GET_REGS    0x05
-#define RTL815x_REQ_SET_REGS    0x05
-
-#define MCU_TYPE_PLA            0x0100
-#define OCP_BASE                0xe86c
-#define BASE_MII                0xa400
-
-#define BYTE_EN_DWORD           0xff
-#define BYTE_EN_WORD            0x33
-#define BYTE_EN_BYTE            0x11
-
-#define R815x_PHY_ID            32
-#define REALTEK_VENDOR_ID       0x0bda
-
-
-static int pla_read_word(struct usb_device *udev, u16 index)
-{
-        int ret;
-        u8 shift = index & 2;
-        __le32 *tmp;
-
-        tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
-        if (!tmp)
-                return -ENOMEM;
-
-        index &= ~3;
-
-        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
-                              RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-                              index, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500);
-        if (ret < 0)
-                goto out2;
-
-        ret = __le32_to_cpu(*tmp);
-        ret >>= (shift * 8);
-        ret &= 0xffff;
-
-out2:
-        kfree(tmp);
-        return ret;
-}
-
-static int pla_write_word(struct usb_device *udev, u16 index, u32 data)
-{
-        __le32 *tmp;
-        u32 mask = 0xffff;
-        u16 byen = BYTE_EN_WORD;
-        u8 shift = index & 2;
-        int ret;
-
-        tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
-        if (!tmp)
-                return -ENOMEM;
-
-        data &= mask;
-
-        if (shift) {
-                byen <<= shift;
-                mask <<= (shift * 8);
-                data <<= (shift * 8);
-                index &= ~3;
-        }
-
-        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
-                              RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-                              index, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500);
-        if (ret < 0)
-                goto out3;
-
-        data |= __le32_to_cpu(*tmp) & ~mask;
-        *tmp = __cpu_to_le32(data);
-
-        ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
-                              RTL815x_REQ_SET_REGS, RTL815x_REQT_WRITE,
-                              index, MCU_TYPE_PLA | byen, tmp, sizeof(*tmp),
-                              500);
-
-out3:
-        kfree(tmp);
-        return ret;
-}
-
-static int ocp_reg_read(struct usbnet *dev, u16 addr)
-{
-        u16 ocp_base, ocp_index;
-        int ret;
-
-        ocp_base = addr & 0xf000;
-        ret = pla_write_word(dev->udev, OCP_BASE, ocp_base);
-        if (ret < 0)
-                goto out;
-
-        ocp_index = (addr & 0x0fff) | 0xb000;
-        ret = pla_read_word(dev->udev, ocp_index);
-
-out:
-        return ret;
-}
-
-static int ocp_reg_write(struct usbnet *dev, u16 addr, u16 data)
-{
-        u16 ocp_base, ocp_index;
-        int ret;
-
-        ocp_base = addr & 0xf000;
-        ret = pla_write_word(dev->udev, OCP_BASE, ocp_base);
-        if (ret < 0)
-                goto out1;
-
-        ocp_index = (addr & 0x0fff) | 0xb000;
-        ret = pla_write_word(dev->udev, ocp_index, data);
-
-out1:
-        return ret;
-}
-
-static int r815x_mdio_read(struct net_device *netdev, int phy_id, int reg)
-{
-        struct usbnet *dev = netdev_priv(netdev);
-        int ret;
-
-        if (phy_id != R815x_PHY_ID)
-                return -EINVAL;
-
-        if (usb_autopm_get_interface(dev->intf) < 0)
-                return -ENODEV;
-
-        ret = ocp_reg_read(dev, BASE_MII + reg * 2);
-
-        usb_autopm_put_interface(dev->intf);
-        return ret;
-}
-
-static
-void r815x_mdio_write(struct net_device *netdev, int phy_id, int reg, int val)
-{
-        struct usbnet *dev = netdev_priv(netdev);
-
-        if (phy_id != R815x_PHY_ID)
-                return;
-
-        if (usb_autopm_get_interface(dev->intf) < 0)
-                return;
-
-        ocp_reg_write(dev, BASE_MII + reg * 2, val);
-
-        usb_autopm_put_interface(dev->intf);
-}
-
-static int r8153_bind(struct usbnet *dev, struct usb_interface *intf)
-{
-        int status;
-
-        status = usbnet_cdc_bind(dev, intf);
-        if (status < 0)
-                return status;
-
-        dev->mii.dev = dev->net;
-        dev->mii.mdio_read = r815x_mdio_read;
-        dev->mii.mdio_write = r815x_mdio_write;
-        dev->mii.phy_id_mask = 0x3f;
-        dev->mii.reg_num_mask = 0x1f;
-        dev->mii.phy_id = R815x_PHY_ID;
-        dev->mii.supports_gmii = 1;
-
-        return status;
-}
-
-static int r8152_bind(struct usbnet *dev, struct usb_interface *intf)
-{
-        int status;
-
-        status = usbnet_cdc_bind(dev, intf);
-        if (status < 0)
-                return status;
-
-        dev->mii.dev = dev->net;
-        dev->mii.mdio_read = r815x_mdio_read;
-        dev->mii.mdio_write = r815x_mdio_write;
-        dev->mii.phy_id_mask = 0x3f;
-        dev->mii.reg_num_mask = 0x1f;
-        dev->mii.phy_id = R815x_PHY_ID;
-        dev->mii.supports_gmii = 0;
-
-        return status;
-}
-
-static const struct driver_info r8152_info = {
-        .description =  "RTL8152 ECM Device",
-        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
-        .bind =         r8152_bind,
-        .unbind =       usbnet_cdc_unbind,
-        .status =       usbnet_cdc_status,
-        .manage_power = usbnet_manage_power,
-};
-
-static const struct driver_info r8153_info = {
-        .description =  "RTL8153 ECM Device",
-        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
-        .bind =         r8153_bind,
-        .unbind =       usbnet_cdc_unbind,
-        .status =       usbnet_cdc_status,
-        .manage_power = usbnet_manage_power,
-};
-
-static const struct usb_device_id products[] = {
-{
-        USB_DEVICE_AND_INTERFACE_INFO(REALTEK_VENDOR_ID, 0x8152, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &r8152_info,
-},
-
-{
-        USB_DEVICE_AND_INTERFACE_INFO(REALTEK_VENDOR_ID, 0x8153, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &r8153_info,
-},
-
-        { },            /* END */
-};
-MODULE_DEVICE_TABLE(usb, products);
-
-static struct usb_driver r815x_driver = {
-        .name =         "r815x",
-        .id_table =     products,
-        .probe =        usbnet_probe,
-        .disconnect =   usbnet_disconnect,
-        .suspend =      usbnet_suspend,
-        .resume =       usbnet_resume,
-        .reset_resume = usbnet_resume,
-        .supports_autosuspend = 1,
-        .disable_hub_initiated_lpm = 1,
-};
-
-module_usb_driver(r815x_driver);
-
-MODULE_AUTHOR("Hayes Wang");
-MODULE_DESCRIPTION("Realtek USB ECM device");
-MODULE_LICENSE("GPL");
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 2ec2041b62d4..5b374370f71c 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -285,7 +285,8 @@ static void veth_setup(struct net_device *dev)
         dev->ethtool_ops = &veth_ethtool_ops;
         dev->features |= NETIF_F_LLTX;
         dev->features |= VETH_FEATURES;
-        dev->vlan_features = dev->features;
+        dev->vlan_features = dev->features &
+                             ~(NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX);
         dev->destructor = veth_dev_free;
 
         dev->hw_features = VETH_FEATURES;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d75f8edf4fb3..5632a99cbbd2 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1711,7 +1711,8 @@ static int virtnet_probe(struct virtio_device *vdev)
         /* If we can receive ANY GSO packets, we must allocate large ones. */
         if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
             virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) ||
-            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) ||
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO))
                 vi->big_packets = true;
 
         if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF))
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 3be786faaaec..0fa3b44f7342 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1762,11 +1762,20 @@ vmxnet3_netpoll(struct net_device *netdev)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
 
-        if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
-                vmxnet3_disable_all_intrs(adapter);
-
-        vmxnet3_do_poll(adapter, adapter->rx_queue[0].rx_ring[0].size);
-        vmxnet3_enable_all_intrs(adapter);
+        switch (adapter->intr.type) {
+#ifdef CONFIG_PCI_MSI
+        case VMXNET3_IT_MSIX: {
+                int i;
+                for (i = 0; i < adapter->num_rx_queues; i++)
+                        vmxnet3_msix_rx(0, &adapter->rx_queue[i]);
+                break;
+        }
+#endif
+        case VMXNET3_IT_MSI:
+        default:
+                vmxnet3_intr(0, adapter->netdev);
+                break;
+        }
 
 }
 #endif  /* CONFIG_NET_POLL_CONTROLLER */
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index b0f705c2378f..1236812c7be6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1318,6 +1318,9 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb)
 
                 neigh_release(n);
 
+                if (reply == NULL)
+                        goto out;
+
                 skb_reset_mac_header(reply);
                 __skb_pull(reply, skb_network_offset(reply));
                 reply->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1339,15 +1342,103 @@ out:
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
+
+static struct sk_buff *vxlan_na_create(struct sk_buff *request,
+        struct neighbour *n, bool isrouter)
+{
+        struct net_device *dev = request->dev;
+        struct sk_buff *reply;
+        struct nd_msg *ns, *na;
+        struct ipv6hdr *pip6;
+        u8 *daddr;
+        int na_olen = 8; /* opt hdr + ETH_ALEN for target */
+        int ns_olen;
+        int i, len;
+
+        if (dev == NULL)
+                return NULL;
+
+        len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
+                sizeof(*na) + na_olen + dev->needed_tailroom;
+        reply = alloc_skb(len, GFP_ATOMIC);
+        if (reply == NULL)
+                return NULL;
+
+        reply->protocol = htons(ETH_P_IPV6);
+        reply->dev = dev;
+        skb_reserve(reply, LL_RESERVED_SPACE(request->dev));
+        skb_push(reply, sizeof(struct ethhdr));
+        skb_set_mac_header(reply, 0);
+
+        ns = (struct nd_msg *)skb_transport_header(request);
+
+        daddr = eth_hdr(request)->h_source;
+        ns_olen = request->len - skb_transport_offset(request) - sizeof(*ns);
+        for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) {
+                if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
+                        daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
+                        break;
+                }
+        }
+
+        /* Ethernet header */
+        ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
+        ether_addr_copy(eth_hdr(reply)->h_source, n->ha);
+        eth_hdr(reply)->h_proto = htons(ETH_P_IPV6);
+        reply->protocol = htons(ETH_P_IPV6);
+
+        skb_pull(reply, sizeof(struct ethhdr));
+        skb_set_network_header(reply, 0);
+        skb_put(reply, sizeof(struct ipv6hdr));
+
+        /* IPv6 header */
+
+        pip6 = ipv6_hdr(reply);
+        memset(pip6, 0, sizeof(struct ipv6hdr));
+        pip6->version = 6;
+        pip6->priority = ipv6_hdr(request)->priority;
+        pip6->nexthdr = IPPROTO_ICMPV6;
+        pip6->hop_limit = 255;
+        pip6->daddr = ipv6_hdr(request)->saddr;
+        pip6->saddr = *(struct in6_addr *)n->primary_key;
+
+        skb_pull(reply, sizeof(struct ipv6hdr));
+        skb_set_transport_header(reply, 0);
+
+        na = (struct nd_msg *)skb_put(reply, sizeof(*na) + na_olen);
+
+        /* Neighbor Advertisement */
+        memset(na, 0, sizeof(*na)+na_olen);
+        na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
+        na->icmph.icmp6_router = isrouter;
+        na->icmph.icmp6_override = 1;
+        na->icmph.icmp6_solicited = 1;
+        na->target = ns->target;
+        ether_addr_copy(&na->opt[2], n->ha);
+        na->opt[0] = ND_OPT_TARGET_LL_ADDR;
+        na->opt[1] = na_olen >> 3;
+
+        na->icmph.icmp6_cksum = csum_ipv6_magic(&pip6->saddr,
+                &pip6->daddr, sizeof(*na)+na_olen, IPPROTO_ICMPV6,
+                csum_partial(na, sizeof(*na)+na_olen, 0));
+
+        pip6->payload_len = htons(sizeof(*na)+na_olen);
+
+        skb_push(reply, sizeof(struct ipv6hdr));
+
+        reply->ip_summed = CHECKSUM_UNNECESSARY;
+
+        return reply;
+}
+
 static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
 {
         struct vxlan_dev *vxlan = netdev_priv(dev);
-        struct neighbour *n;
-        union vxlan_addr ipa;
+        struct nd_msg *msg;
         const struct ipv6hdr *iphdr;
         const struct in6_addr *saddr, *daddr;
-        struct nd_msg *msg;
-        struct inet6_dev *in6_dev = NULL;
+        struct neighbour *n;
+        struct inet6_dev *in6_dev;
 
         in6_dev = __in6_dev_get(dev);
         if (!in6_dev)
@@ -1360,19 +1451,20 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
         saddr = &iphdr->saddr;
         daddr = &iphdr->daddr;
 
-        if (ipv6_addr_loopback(daddr) ||
-            ipv6_addr_is_multicast(daddr))
-                goto out;
-
         msg = (struct nd_msg *)skb_transport_header(skb);
         if (msg->icmph.icmp6_code != 0 ||
             msg->icmph.icmp6_type != NDISC_NEIGHBOUR_SOLICITATION)
                 goto out;
 
-        n = neigh_lookup(ipv6_stub->nd_tbl, daddr, dev);
+        if (ipv6_addr_loopback(daddr) ||
+            ipv6_addr_is_multicast(&msg->target))
+                goto out;
+
+        n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, dev);
 
         if (n) {
                 struct vxlan_fdb *f;
+                struct sk_buff *reply;
 
                 if (!(n->nud_state & NUD_CONNECTED)) {
                         neigh_release(n);
@@ -1386,13 +1478,23 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
                         goto out;
                 }
 
-                ipv6_stub->ndisc_send_na(dev, n, saddr, &msg->target,
-                                         !!in6_dev->cnf.forwarding,
-                                         true, false, false);
+                reply = vxlan_na_create(skb, n,
+                                        !!(f ? f->flags & NTF_ROUTER : 0));
+
                 neigh_release(n);
+
+                if (reply == NULL)
+                        goto out;
+
+                if (netif_rx_ni(reply) == NET_RX_DROP)
+                        dev->stats.rx_dropped++;
+
         } else if (vxlan->flags & VXLAN_F_L3MISS) {
-                ipa.sin6.sin6_addr = *daddr;
-                ipa.sa.sa_family = AF_INET6;
+                union vxlan_addr ipa = {
+                        .sin6.sin6_addr = msg->target,
+                        .sa.sa_family = AF_INET6,
+                };
+
                 vxlan_ip_miss(dev, &ipa);
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
index 1cc13569b17b..1b6b4d0cfa97 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
@@ -57,7 +57,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
         {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32365a5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
-        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e20, 0x000003a5, 0x000003a5, 0x000003a5, 0x000003a5},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
         {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
         {0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
@@ -96,7 +96,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
         {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000},
         {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000ae20, 0x000001a6, 0x000001a6, 0x000001aa, 0x000001aa},
         {0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 11eab9f01fd8..9078a6c5a74e 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1534,7 +1534,7 @@ EXPORT_SYMBOL(ath9k_hw_check_nav);
 bool ath9k_hw_check_alive(struct ath_hw *ah)
 {
         int count = 50;
-        u32 reg;
+        u32 reg, last_val;
 
         if (AR_SREV_9300(ah))
                 return !ath9k_hw_detect_mac_hang(ah);
@@ -1542,9 +1542,14 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
         if (AR_SREV_9285_12_OR_LATER(ah))
                 return true;
 
+        last_val = REG_READ(ah, AR_OBS_BUS_1);
         do {
                 reg = REG_READ(ah, AR_OBS_BUS_1);
+                if (reg != last_val)
+                        return true;
 
+                udelay(1);
+                last_val = reg;
                 if ((reg & 0x7E7FFFEF) == 0x00702400)
                         continue;
 
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index a0ebdd000fc2..82e340d3ec60 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -732,11 +732,18 @@ static struct ath_rxbuf *ath_get_next_rx_buf(struct ath_softc *sc,
                         return NULL;
 
                 /*
-                 * mark descriptor as zero-length and set the 'more'
-                 * flag to ensure that both buffers get discarded
+                 * Re-check previous descriptor, in case it has been filled
+                 * in the mean time.
                  */
-                rs->rs_datalen = 0;
-                rs->rs_more = true;
+                ret = ath9k_hw_rxprocdesc(ah, ds, rs);
+                if (ret == -EINPROGRESS) {
+                        /*
+                         * mark descriptor as zero-length and set the 'more'
+                         * flag to ensure that both buffers get discarded
+                         */
+                        rs->rs_datalen = 0;
+                        rs->rs_more = true;
+                }
         }
 
         list_del(&bf->list);
@@ -985,32 +992,32 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
         struct ath_common *common = ath9k_hw_common(ah);
         struct ieee80211_hdr *hdr;
         bool discard_current = sc->rx.discard_next;
-        int ret = 0;
 
         /*
          * Discard corrupt descriptors which are marked in
          * ath_get_next_rx_buf().
          */
-        sc->rx.discard_next = rx_stats->rs_more;
         if (discard_current)
-                return -EINVAL;
+                goto corrupt;
+
+        sc->rx.discard_next = false;
 
         /*
          * Discard zero-length packets.
          */
         if (!rx_stats->rs_datalen) {
                 RX_STAT_INC(rx_len_err);
-                return -EINVAL;
+                goto corrupt;
         }
 
-        /*
-         * rs_status follows rs_datalen so if rs_datalen is too large
-         * we can take a hint that hardware corrupted it, so ignore
-         * those frames.
-         */
+        /*
+         * rs_status follows rs_datalen so if rs_datalen is too large
+         * we can take a hint that hardware corrupted it, so ignore
+         * those frames.
+         */
         if (rx_stats->rs_datalen > (common->rx_bufsize - ah->caps.rx_status_len)) {
                 RX_STAT_INC(rx_len_err);
-                return -EINVAL;
+                goto corrupt;
         }
 
         /* Only use status info from the last fragment */
@@ -1024,10 +1031,8 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
          * This is different from the other corrupt descriptor
          * condition handled above.
          */
-        if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC) {
-                ret = -EINVAL;
-                goto exit;
-        }
+        if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC)
+                goto corrupt;
 
         hdr = (struct ieee80211_hdr *) (skb->data + ah->caps.rx_status_len);
 
@@ -1043,18 +1048,15 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
                 if (ath_process_fft(sc, hdr, rx_stats, rx_status->mactime))
                         RX_STAT_INC(rx_spectral);
 
-                ret = -EINVAL;
-                goto exit;
+                return -EINVAL;
         }
 
         /*
          * everything but the rate is checked here, the rate check is done
          * separately to avoid doing two lookups for a rate for each frame.
          */
-        if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error)) {
-                ret = -EINVAL;
-                goto exit;
-        }
+        if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error))
+                return -EINVAL;
 
         if (ath_is_mybeacon(common, hdr)) {
                 RX_STAT_INC(rx_beacons);
@@ -1064,15 +1066,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
         /*
          * This shouldn't happen, but have a safety check anyway.
          */
-        if (WARN_ON(!ah->curchan)) {
-                ret = -EINVAL;
-                goto exit;
-        }
+        if (WARN_ON(!ah->curchan))
+                return -EINVAL;
 
-        if (ath9k_process_rate(common, hw, rx_stats, rx_status)) {
-                ret =-EINVAL;
-                goto exit;
-        }
+        if (ath9k_process_rate(common, hw, rx_stats, rx_status))
+                return -EINVAL;
 
         ath9k_process_rssi(common, hw, rx_stats, rx_status);
 
@@ -1087,9 +1085,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
                 sc->rx.num_pkts++;
 #endif
 
-exit:
-        sc->rx.discard_next = false;
-        return ret;
+        return 0;
+
+corrupt:
+        sc->rx.discard_next = rx_stats->rs_more;
+        return -EINVAL;
 }
 
 static void ath9k_rx_skb_postprocess(struct ath_common *common,
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 0a75e2f68c9d..55897d508a76 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1444,14 +1444,16 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
         for (tidno = 0, tid = &an->tid[tidno];
              tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
 
-                if (!tid->sched)
-                        continue;
-
                 ac = tid->ac;
                 txq = ac->txq;
 
                 ath_txq_lock(sc, txq);
 
+                if (!tid->sched) {
+                        ath_txq_unlock(sc, txq);
+                        continue;
+                }
+
                 buffered = ath_tid_has_buffered(tid);
 
                 tid->sched = false;
@@ -2061,7 +2063,7 @@ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
 
         ATH_TXBUF_RESET(bf);
 
-        if (tid) {
+        if (tid && ieee80211_is_data_present(hdr->frame_control)) {
                 fragno = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
                 seqno = tid->seq_next;
                 hdr->seq_ctrl = cpu_to_le16(tid->seq_next << IEEE80211_SEQ_SEQ_SHIFT);
@@ -2184,14 +2186,15 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                 txq->stopped = true;
         }
 
+        if (txctl->an && ieee80211_is_data_present(hdr->frame_control))
+                tid = ath_get_skb_tid(sc, txctl->an, skb);
+
         if (info->flags & IEEE80211_TX_CTL_PS_RESPONSE) {
                 ath_txq_unlock(sc, txq);
                 txq = sc->tx.uapsdq;
                 ath_txq_lock(sc, txq);
         } else if (txctl->an &&
                    ieee80211_is_data_present(hdr->frame_control)) {
-                tid = ath_get_skb_tid(sc, txctl->an, skb);
-
                 WARN_ON(tid->ac->txq != txctl->txq);
 
                 if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 3e991897d7ca..ddaa9efd053d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -457,7 +457,6 @@ struct brcmf_sdio {
 
         u8 tx_hdrlen;           /* sdio bus header length for tx packet */
         bool txglom;            /* host tx glomming enable flag */
-        struct sk_buff *txglom_sgpad;   /* scatter-gather padding buffer */
         u16 head_align;         /* buffer pointer alignment */
         u16 sgentry_align;      /* scatter-gather buffer alignment */
 };
@@ -1944,19 +1943,21 @@ static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus,
         if (lastfrm && chain_pad)
                 tail_pad += blksize - chain_pad;
         if (skb_tailroom(pkt) < tail_pad && pkt->len > blksize) {
-                pkt_pad = bus->txglom_sgpad;
-                if (pkt_pad == NULL)
-                          brcmu_pkt_buf_get_skb(tail_pad + tail_chop);
+                pkt_pad = brcmu_pkt_buf_get_skb(tail_pad + tail_chop +
+                                                bus->head_align);
                 if (pkt_pad == NULL)
                         return -ENOMEM;
                 ret = brcmf_sdio_txpkt_hdalign(bus, pkt_pad);
-                if (unlikely(ret < 0))
+                if (unlikely(ret < 0)) {
+                        kfree_skb(pkt_pad);
                         return ret;
+                }
                 memcpy(pkt_pad->data,
                        pkt->data + pkt->len - tail_chop,
                        tail_chop);
                 *(u32 *)(pkt_pad->cb) = ALIGN_SKB_FLAG + tail_chop;
                 skb_trim(pkt, pkt->len - tail_chop);
+                skb_trim(pkt_pad, tail_pad + tail_chop);
                 __skb_queue_after(pktq, pkt, pkt_pad);
         } else {
                 ntail = pkt->data_len + tail_pad -
@@ -2011,7 +2012,7 @@ brcmf_sdio_txpkt_prep(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
                         return ret;
                 head_pad = (u16)ret;
                 if (head_pad)
-                        memset(pkt_next->data, 0, head_pad + bus->tx_hdrlen);
+                        memset(pkt_next->data + bus->tx_hdrlen, 0, head_pad);
 
                 total_len += pkt_next->len;
 
@@ -3486,10 +3487,6 @@ static int brcmf_sdio_bus_preinit(struct device *dev)
                 bus->txglom = false;
                 value = 1;
                 pad_size = bus->sdiodev->func[2]->cur_blksize << 1;
-                bus->txglom_sgpad = brcmu_pkt_buf_get_skb(pad_size);
-                if (!bus->txglom_sgpad)
-                        brcmf_err("allocating txglom padding skb failed, reduced performance\n");
-
                 err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",
                                            &value, sizeof(u32));
                 if (err < 0) {
@@ -4053,7 +4050,6 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
                         brcmf_sdio_chip_detach(&bus->ci);
                 }
 
-                brcmu_pkt_buf_free_skb(bus->txglom_sgpad);
                 kfree(bus->rxbuf);
                 kfree(bus->hdrbuf);
                 kfree(bus);
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index d36e252d2ccb..596525528f50 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -147,7 +147,7 @@ static void ap_free_sta(struct ap_data *ap, struct sta_info *sta)
 
         if (!sta->ap && sta->u.sta.challenge)
                 kfree(sta->u.sta.challenge);
-        del_timer(&sta->timer);
+        del_timer_sync(&sta->timer);
 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
 
         kfree(sta);
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index c0d070c5df5e..9cdd91cdf661 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -590,6 +590,7 @@ void iwl_deactivate_station(struct iwl_priv *priv, const u8 sta_id,
                         sizeof(priv->tid_data[sta_id][tid]));
 
         priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
+        priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
 
         priv->num_stations--;
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index a6839dfcb82d..398dd096674c 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1291,8 +1291,6 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
         struct iwl_compressed_ba_resp *ba_resp = (void *)pkt->data;
         struct iwl_ht_agg *agg;
         struct sk_buff_head reclaimed_skbs;
-        struct ieee80211_tx_info *info;
-        struct ieee80211_hdr *hdr;
         struct sk_buff *skb;
         int sta_id;
         int tid;
@@ -1379,22 +1377,28 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
         freed = 0;
 
         skb_queue_walk(&reclaimed_skbs, skb) {
-                hdr = (struct ieee80211_hdr *)skb->data;
+                struct ieee80211_hdr *hdr = (void *)skb->data;
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
                 if (ieee80211_is_data_qos(hdr->frame_control))
                         freed++;
                 else
                         WARN_ON_ONCE(1);
 
-                info = IEEE80211_SKB_CB(skb);
                 iwl_trans_free_tx_cmd(priv->trans, info->driver_data[1]);
 
+                memset(&info->status, 0, sizeof(info->status));
+                /* Packet was transmitted successfully, failures come as single
+                 * frames because before failing a frame the firmware transmits
+                 * it without aggregation at least once.
+                 */
+                info->flags |= IEEE80211_TX_STAT_ACK;
+
                 if (freed == 1) {
                         /* this is the first skb we deliver in this batch */
                         /* put the rate scaling data there */
                         info = IEEE80211_SKB_CB(skb);
                         memset(&info->status, 0, sizeof(info->status));
-                        info->flags |= IEEE80211_TX_STAT_ACK;
                         info->flags |= IEEE80211_TX_STAT_AMPDU;
                         info->status.ampdu_ack_len = ba_resp->txed_2_done;
                         info->status.ampdu_len = ba_resp->txed;
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
index 76cde6ce6551..18a895a949d4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -872,8 +872,11 @@ void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         lockdep_assert_held(&mvm->mutex);
 
-        /* Rssi update while not associated ?! */
-        if (WARN_ON_ONCE(mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT))
+        /*
+         * Rssi update while not associated - can happen since the statistics
+         * are handled asynchronously
+         */
+        if (mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT)
                 return;
 
         /* No BT - reports should be disabled */
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index e4ead86f06d6..2b0ba1fc3c82 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -152,7 +152,7 @@ enum iwl_power_scheme {
         IWL_POWER_SCHEME_LP
 };
 
-#define IWL_CONN_MAX_LISTEN_INTERVAL    70
+#define IWL_CONN_MAX_LISTEN_INTERVAL    10
 #define IWL_UAPSD_AC_INFO               (IEEE80211_WMM_IE_STA_QOSINFO_AC_VO |\
                                          IEEE80211_WMM_IE_STA_QOSINFO_AC_VI |\
                                          IEEE80211_WMM_IE_STA_QOSINFO_AC_BK |\
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 4df12fa9d336..76ee486039d7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -822,16 +822,12 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         struct iwl_mvm_ba_notif *ba_notif = (void *)pkt->data;
         struct sk_buff_head reclaimed_skbs;
         struct iwl_mvm_tid_data *tid_data;
-        struct ieee80211_tx_info *info;
         struct ieee80211_sta *sta;
         struct iwl_mvm_sta *mvmsta;
-        struct ieee80211_hdr *hdr;
         struct sk_buff *skb;
         int sta_id, tid, freed;
-
         /* "flow" corresponds to Tx queue */
         u16 scd_flow = le16_to_cpu(ba_notif->scd_flow);
-
         /* "ssn" is start of block-ack Tx window, corresponds to index
          * (in Tx queue's circular buffer) of first TFD/frame in window */
         u16 ba_resp_scd_ssn = le16_to_cpu(ba_notif->scd_ssn);
@@ -888,22 +884,26 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         freed = 0;
 
         skb_queue_walk(&reclaimed_skbs, skb) {
-                hdr = (struct ieee80211_hdr *)skb->data;
+                struct ieee80211_hdr *hdr = (void *)skb->data;
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
                 if (ieee80211_is_data_qos(hdr->frame_control))
                         freed++;
                 else
                         WARN_ON_ONCE(1);
 
-                info = IEEE80211_SKB_CB(skb);
                 iwl_trans_free_tx_cmd(mvm->trans, info->driver_data[1]);
 
+                memset(&info->status, 0, sizeof(info->status));
+                /* Packet was transmitted successfully, failures come as single
+                 * frames because before failing a frame the firmware transmits
+                 * it without aggregation at least once.
+                 */
+                info->flags |= IEEE80211_TX_STAT_ACK;
+
                 if (freed == 1) {
                         /* this is the first skb we deliver in this batch */
                         /* put the rate scaling data there */
-                        info = IEEE80211_SKB_CB(skb);
-                        memset(&info->status, 0, sizeof(info->status));
-                        info->flags |= IEEE80211_TX_STAT_ACK;
                         info->flags |= IEEE80211_TX_STAT_AMPDU;
                         info->status.ampdu_ack_len = ba_notif->txed_2_done;
                         info->status.ampdu_len = ba_notif->txed;
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index f47bcbe2945a..3872ead75488 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -359,13 +359,12 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 /* 7265 Series */
         {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5110, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095A, 0x5112, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5100, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095A, 0x510A, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_n_cfg)},
         {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5412, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5400, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 32f75007a825..cb6d189bc3e6 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -621,7 +621,7 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                         id = *pos++;
                         elen = *pos++;
                         left -= 2;
-                        if (elen > left || elen == 0) {
+                        if (elen > left) {
                                 lbs_deb_scan("scan response: invalid IE fmt\n");
                                 goto done;
                         }
diff --git a/drivers/net/wireless/mwifiex/11ac.c b/drivers/net/wireless/mwifiex/11ac.c
index 5e0eec4d71c7..5d9a8084665d 100644
--- a/drivers/net/wireless/mwifiex/11ac.c
+++ b/drivers/net/wireless/mwifiex/11ac.c
@@ -189,8 +189,7 @@ int mwifiex_cmd_append_11ac_tlv(struct mwifiex_private *priv,
                 vht_cap->header.len  =
                                 cpu_to_le16(sizeof(struct ieee80211_vht_cap));
                 memcpy((u8 *)vht_cap + sizeof(struct mwifiex_ie_types_header),
-                       (u8 *)bss_desc->bcn_vht_cap +
-                       sizeof(struct ieee_types_header),
+                       (u8 *)bss_desc->bcn_vht_cap,
                        le16_to_cpu(vht_cap->header.len));
 
                 mwifiex_fill_vht_cap_tlv(priv, vht_cap, bss_desc->bss_band);
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 6261f8c53d44..7db1a89fdd95 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -308,8 +308,7 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
                 ht_cap->header.len =
                                 cpu_to_le16(sizeof(struct ieee80211_ht_cap));
                 memcpy((u8 *) ht_cap + sizeof(struct mwifiex_ie_types_header),
-                       (u8 *) bss_desc->bcn_ht_cap +
-                       sizeof(struct ieee_types_header),
+                       (u8 *)bss_desc->bcn_ht_cap,
                        le16_to_cpu(ht_cap->header.len));
 
                 mwifiex_fill_cap_info(priv, radio_type, ht_cap);
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 03688aa14e8a..7fe7b53fb17a 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -1211,6 +1211,12 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
                 rd_index = card->rxbd_rdptr & reg->rx_mask;
                 skb_data = card->rx_buf_list[rd_index];
 
+                /* If skb allocation was failed earlier for Rx packet,
+                 * rx_buf_list[rd_index] would have been left with a NULL.
+                 */
+                if (!skb_data)
+                        return -ENOMEM;
+
                 MWIFIEX_SKB_PACB(skb_data, &buf_pa);
                 pci_unmap_single(card->dev, buf_pa, MWIFIEX_RX_DATA_BUF_SIZE,
                                  PCI_DMA_FROMDEVICE);
@@ -1525,6 +1531,14 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
                 if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
                         mwifiex_process_sleep_confirm_resp(adapter, skb->data,
                                                            skb->len);
+                        mwifiex_pcie_enable_host_int(adapter);
+                        if (mwifiex_write_reg(adapter,
+                                              PCIE_CPU_INT_EVENT,
+                                              CPU_INTR_SLEEP_CFM_DONE)) {
+                                dev_warn(adapter->dev,
+                                         "Write register failed\n");
+                                return -1;
+                        }
                         while (reg->sleep_cookie && (count++ < 10) &&
                                mwifiex_pcie_ok_to_access_hw(adapter))
                                 usleep_range(50, 60);
@@ -1993,23 +2007,9 @@ static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter)
                 adapter->int_status |= pcie_ireg;
                 spin_unlock_irqrestore(&adapter->int_lock, flags);
 
-                if (pcie_ireg & HOST_INTR_CMD_DONE) {
-                        if ((adapter->ps_state == PS_STATE_SLEEP_CFM) ||
-                            (adapter->ps_state == PS_STATE_SLEEP)) {
-                                mwifiex_pcie_enable_host_int(adapter);
-                                if (mwifiex_write_reg(adapter,
-                                                      PCIE_CPU_INT_EVENT,
-                                                      CPU_INTR_SLEEP_CFM_DONE)
-                                                      ) {
-                                        dev_warn(adapter->dev,
-                                                 "Write register failed\n");
-                                        return;
-
-                                }
-                        }
-                } else if (!adapter->pps_uapsd_mode &&
-                           adapter->ps_state == PS_STATE_SLEEP &&
-                           mwifiex_pcie_ok_to_access_hw(adapter)) {
+                if (!adapter->pps_uapsd_mode &&
+                    adapter->ps_state == PS_STATE_SLEEP &&
+                    mwifiex_pcie_ok_to_access_hw(adapter)) {
                                 /* Potentially for PCIe we could get other
                                  * interrupts like shared. Don't change power
                                  * state until cookie is set */
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 0a8a26e10f01..668547c2de84 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -2101,12 +2101,12 @@ mwifiex_save_curr_bcn(struct mwifiex_private *priv)
                          curr_bss->ht_info_offset);
 
         if (curr_bss->bcn_vht_cap)
-                curr_bss->bcn_ht_cap = (void *)(curr_bss->beacon_buf +
-                                                curr_bss->vht_cap_offset);
+                curr_bss->bcn_vht_cap = (void *)(curr_bss->beacon_buf +
+                                                 curr_bss->vht_cap_offset);
 
         if (curr_bss->bcn_vht_oper)
-                curr_bss->bcn_ht_oper = (void *)(curr_bss->beacon_buf +
-                                                 curr_bss->vht_info_offset);
+                curr_bss->bcn_vht_oper = (void *)(curr_bss->beacon_buf +
+                                                  curr_bss->vht_info_offset);
 
         if (curr_bss->bcn_bss_co_2040)
                 curr_bss->bcn_bss_co_2040 =
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index e8ebbd4bc3cd..208748804a55 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -22,8 +22,6 @@
 
 #define USB_VERSION     "1.0"
 
-static const char usbdriver_name[] = "usb8xxx";
-
 static struct mwifiex_if_ops usb_ops;
 static struct semaphore add_remove_card_sem;
 static struct usb_card_rec *usb_card;
@@ -527,13 +525,6 @@ static int mwifiex_usb_resume(struct usb_interface *intf)
                                                    MWIFIEX_BSS_ROLE_ANY),
                                   MWIFIEX_ASYNC_CMD);
 
-#ifdef CONFIG_PM
-        /* Resume handler may be called due to remote wakeup,
-         * force to exit suspend anyway
-         */
-        usb_disable_autosuspend(card->udev);
-#endif /* CONFIG_PM */
-
         return 0;
 }
 
@@ -567,13 +558,12 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf)
 }
 
 static struct usb_driver mwifiex_usb_driver = {
-        .name = usbdriver_name,
+        .name = "mwifiex_usb",
         .probe = mwifiex_usb_probe,
         .disconnect = mwifiex_usb_disconnect,
         .id_table = mwifiex_usb_table,
         .suspend = mwifiex_usb_suspend,
         .resume = mwifiex_usb_resume,
-        .supports_autosuspend = 1,
 };
 
 static int mwifiex_usb_tx_init(struct mwifiex_adapter *adapter)
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 13eaeed03898..981cf6e7c73b 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -559,7 +559,8 @@ mwifiex_clean_txrx(struct mwifiex_private *priv)
         mwifiex_wmm_delete_all_ralist(priv);
         memcpy(tos_to_tid, ac_to_tid, sizeof(tos_to_tid));
 
-        if (priv->adapter->if_ops.clean_pcie_ring)
+        if (priv->adapter->if_ops.clean_pcie_ring &&
+            !priv->adapter->surprise_removed)
                 priv->adapter->if_ops.clean_pcie_ring(priv->adapter);
         spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, flags);
 }
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 7f8b5d156c8c..41d4a8167dc3 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -5460,14 +5460,15 @@ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
 
         rt2800_bbp_write(rt2x00dev, 68, 0x0b);
 
-        rt2800_bbp_write(rt2x00dev, 69, 0x0d);
-        rt2800_bbp_write(rt2x00dev, 70, 0x06);
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
         rt2800_bbp_write(rt2x00dev, 73, 0x13);
         rt2800_bbp_write(rt2x00dev, 75, 0x46);
         rt2800_bbp_write(rt2x00dev, 76, 0x28);
 
         rt2800_bbp_write(rt2x00dev, 77, 0x59);
 
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
+
         rt2800_bbp_write(rt2x00dev, 79, 0x13);
         rt2800_bbp_write(rt2x00dev, 80, 0x05);
         rt2800_bbp_write(rt2x00dev, 81, 0x33);
@@ -5510,7 +5511,6 @@ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
         if (rt2x00_rt(rt2x00dev, RT5392)) {
                 rt2800_bbp_write(rt2x00dev, 134, 0xd0);
                 rt2800_bbp_write(rt2x00dev, 135, 0xf6);
-                rt2800_bbp_write(rt2x00dev, 148, 0x84);
         }
 
         rt2800_disable_unused_dac_adc(rt2x00dev);
diff --git a/drivers/net/wireless/ti/wl1251/rx.c b/drivers/net/wireless/ti/wl1251/rx.c
index 123c4bb50e0a..cde0eaf99714 100644
--- a/drivers/net/wireless/ti/wl1251/rx.c
+++ b/drivers/net/wireless/ti/wl1251/rx.c
@@ -180,7 +180,7 @@ static void wl1251_rx_body(struct wl1251 *wl,
         wl1251_mem_read(wl, rx_packet_ring_addr, rx_buffer, length);
 
         /* The actual length doesn't include the target's alignment */
-        skb->len = desc->length  - PLCP_HEADER_LENGTH;
+        skb_trim(skb, desc->length - PLCP_HEADER_LENGTH);
 
         fc = (u16 *)skb->data;
 
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 7669d49a67e2..301cc037fda8 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -132,8 +132,7 @@ static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
         /* If the skb is GSO then we'll also need an extra slot for the
          * metadata.
          */
-        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 ||
-            skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+        if (skb_is_gso(skb))
                 min_slots_needed++;
 
         /* If the skb can't possibly fit in the remaining slots
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index e5284bca2d90..438d0c09b7e6 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -240,7 +240,7 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
         struct gnttab_copy *copy_gop;
         struct xenvif_rx_meta *meta;
         unsigned long bytes;
-        int gso_type;
+        int gso_type = XEN_NETIF_GSO_TYPE_NONE;
 
         /* Data must not cross a page boundary. */
         BUG_ON(size + offset > PAGE_SIZE<<compound_order(page));
@@ -299,12 +299,12 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
                 }
 
                 /* Leave a gap for the GSO descriptor. */
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
-                        gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
-                else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
-                        gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
-                else
-                        gso_type = XEN_NETIF_GSO_TYPE_NONE;
+                if (skb_is_gso(skb)) {
+                        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
+                                gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
+                        else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                                gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
+                }
 
                 if (*head && ((1 << gso_type) & vif->gso_mask))
                         vif->rx.req_cons++;
@@ -338,19 +338,15 @@ static int xenvif_gop_skb(struct sk_buff *skb,
         int head = 1;
         int old_meta_prod;
         int gso_type;
-        int gso_size;
 
         old_meta_prod = npo->meta_prod;
 
-        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) {
-                gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
-                gso_size = skb_shinfo(skb)->gso_size;
-        } else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
-                gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
-                gso_size = skb_shinfo(skb)->gso_size;
-        } else {
-                gso_type = XEN_NETIF_GSO_TYPE_NONE;
-                gso_size = 0;
+        gso_type = XEN_NETIF_GSO_TYPE_NONE;
+        if (skb_is_gso(skb)) {
+                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
+                        gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
+                else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                        gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
         }
 
         /* Set up a GSO prefix descriptor, if necessary */
@@ -358,7 +354,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
                 req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
                 meta = npo->meta + npo->meta_prod++;
                 meta->gso_type = gso_type;
-                meta->gso_size = gso_size;
+                meta->gso_size = skb_shinfo(skb)->gso_size;
                 meta->size = 0;
                 meta->id = req->id;
         }
@@ -368,7 +364,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
 
         if ((1 << gso_type) & vif->gso_mask) {
                 meta->gso_type = gso_type;
-                meta->gso_size = gso_size;
+                meta->gso_size = skb_shinfo(skb)->gso_size;
         } else {
                 meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
                 meta->gso_size = 0;
@@ -500,8 +496,9 @@ static void xenvif_rx_action(struct xenvif *vif)
                         size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
                         max_slots_needed += DIV_ROUND_UP(size, PAGE_SIZE);
                 }
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 ||
-                    skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                if (skb_is_gso(skb) &&
+                   (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 ||
+                    skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6))
                         max_slots_needed++;
 
                 /* If the skb may not fit then bail out now */
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index f9daa9e183f2..e30d80033cbc 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -907,6 +907,7 @@ static int handle_incoming_queue(struct net_device *dev,
 
                 /* Ethernet work: Delayed to here as it peeks the header. */
                 skb->protocol = eth_type_trans(skb, dev);
+                skb_reset_network_header(skb);
 
                 if (checksum_setup(dev, skb)) {
                         kfree_skb(skb);
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 00660cc502c5..38901665c770 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -162,8 +162,6 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
 
                 avail = *r;
                 pci_clip_resource_to_region(bus, &avail, region);
-                if (!resource_size(&avail))
-                        continue;
 
                 /*
                  * "min" is typically PCIBIOS_MIN_IO or PCIBIOS_MIN_MEM to
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 6b05f6134b68..fdbc294821e6 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1192,6 +1192,9 @@ static int do_pci_enable_device(struct pci_dev *dev, int bars)
                 return err;
         pci_fixup_device(pci_fixup_enable, dev);
 
+        if (dev->msi_enabled || dev->msix_enabled)
+                return 0;
+
         pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
         if (pin) {
                 pci_read_config_word(dev, PCI_COMMAND, &cmd);
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index be361b7cd30f..1e4e69384baa 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -217,7 +217,7 @@ config PINCTRL_IMX28
         select PINCTRL_MXS
 
 config PINCTRL_MSM
-        tristate
+        bool
         select PINMUX
         select PINCONF
         select GENERIC_PINCONF
diff --git a/drivers/pinctrl/pinctrl-capri.c b/drivers/pinctrl/pinctrl-capri.c
index 4669c53f99b0..eb2500212147 100644
--- a/drivers/pinctrl/pinctrl-capri.c
+++ b/drivers/pinctrl/pinctrl-capri.c
@@ -1435,7 +1435,7 @@ int __init capri_pinctrl_probe(struct platform_device *pdev)
 }
 
 static struct of_device_id capri_pinctrl_of_match[] = {
-        { .compatible = "brcm,capri-pinctrl", },
+        { .compatible = "brcm,bcm11351-pinctrl", },
         { },
 };
 
diff --git a/drivers/pinctrl/pinctrl-sunxi.c b/drivers/pinctrl/pinctrl-sunxi.c
index 9ccf681dad2f..f9fabe9bf47d 100644
--- a/drivers/pinctrl/pinctrl-sunxi.c
+++ b/drivers/pinctrl/pinctrl-sunxi.c
@@ -14,6 +14,7 @@
 #include <linux/clk.h>
 #include <linux/gpio.h>
 #include <linux/irqdomain.h>
+#include <linux/irqchip/chained_irq.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
@@ -584,7 +585,7 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d,
         spin_lock_irqsave(&pctl->lock, flags);
 
         regval = readl(pctl->membase + reg);
-        regval &= ~IRQ_CFG_IRQ_MASK;
+        regval &= ~(IRQ_CFG_IRQ_MASK << index);
         writel(regval | (mode << index), pctl->membase + reg);
 
         spin_unlock_irqrestore(&pctl->lock, flags);
@@ -665,6 +666,7 @@ static struct irq_chip sunxi_pinctrl_irq_chip = {
 
 static void sunxi_pinctrl_irq_handler(unsigned irq, struct irq_desc *desc)
 {
+        struct irq_chip *chip = irq_get_chip(irq);
         struct sunxi_pinctrl *pctl = irq_get_handler_data(irq);
         const unsigned long reg = readl(pctl->membase + IRQ_STATUS_REG);
 
@@ -674,10 +676,12 @@ static void sunxi_pinctrl_irq_handler(unsigned irq, struct irq_desc *desc)
         if (reg) {
                 int irqoffset;
 
+                chained_irq_enter(chip, desc);
                 for_each_set_bit(irqoffset, &reg, SUNXI_IRQ_NUMBER) {
                         int pin_irq = irq_find_mapping(pctl->domain, irqoffset);
                         generic_handle_irq(pin_irq);
                 }
+                chained_irq_exit(chip, desc);
         }
 }
 
diff --git a/drivers/pinctrl/pinctrl-sunxi.h b/drivers/pinctrl/pinctrl-sunxi.h
index 01c494f8a14f..552b0e97077a 100644
--- a/drivers/pinctrl/pinctrl-sunxi.h
+++ b/drivers/pinctrl/pinctrl-sunxi.h
@@ -511,7 +511,7 @@ static inline u32 sunxi_pull_offset(u16 pin)
 
 static inline u32 sunxi_irq_cfg_reg(u16 irq)
 {
-        u8 reg = irq / IRQ_CFG_IRQ_PER_REG;
+        u8 reg = irq / IRQ_CFG_IRQ_PER_REG * 0x04;
         return reg + IRQ_CFG_REG;
 }
 
@@ -523,7 +523,7 @@ static inline u32 sunxi_irq_cfg_offset(u16 irq)
 
 static inline u32 sunxi_irq_ctrl_reg(u16 irq)
 {
-        u8 reg = irq / IRQ_CTRL_IRQ_PER_REG;
+        u8 reg = irq / IRQ_CTRL_IRQ_PER_REG * 0x04;
         return reg + IRQ_CTRL_REG;
 }
 
@@ -535,7 +535,7 @@ static inline u32 sunxi_irq_ctrl_offset(u16 irq)
 
 static inline u32 sunxi_irq_status_reg(u16 irq)
 {
-        u8 reg = irq / IRQ_STATUS_IRQ_PER_REG;
+        u8 reg = irq / IRQ_STATUS_IRQ_PER_REG * 0x04;
         return reg + IRQ_STATUS_REG;
 }
 
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index 77d103fe39d9..567d6918d50b 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -89,7 +89,8 @@ enum {
 
         /* GPSR6 */
         FN_IP13_10, FN_IP13_11, FN_IP13_12, FN_IP13_13, FN_IP13_14,
-        FN_IP13_15, FN_IP13_18_16, FN_IP13_21_19, FN_IP13_22, FN_IP13_24_23,
+        FN_IP13_15, FN_IP13_18_16, FN_IP13_21_19,
+        FN_IP13_22, FN_IP13_24_23, FN_SD1_CLK,
         FN_IP13_25, FN_IP13_26, FN_IP13_27, FN_IP13_30_28, FN_IP14_1_0,
         FN_IP14_2, FN_IP14_3, FN_IP14_4, FN_IP14_5, FN_IP14_6, FN_IP14_7,
         FN_IP14_10_8, FN_IP14_13_11, FN_IP14_16_14, FN_IP14_19_17,
@@ -788,6 +789,7 @@ static const u16 pinmux_data[] = {
         PINMUX_DATA(USB1_PWEN_MARK, FN_USB1_PWEN),
         PINMUX_DATA(USB1_OVC_MARK, FN_USB1_OVC),
         PINMUX_DATA(DU0_DOTCLKIN_MARK, FN_DU0_DOTCLKIN),
+        PINMUX_DATA(SD1_CLK_MARK, FN_SD1_CLK),
 
         /* IPSR0 */
         PINMUX_IPSR_DATA(IP0_0, D0),
@@ -3825,7 +3827,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
                 GP_6_11_FN, FN_IP13_25,
                 GP_6_10_FN, FN_IP13_24_23,
                 GP_6_9_FN, FN_IP13_22,
-                0, 0,
+                GP_6_8_FN, FN_SD1_CLK,
                 GP_6_7_FN, FN_IP13_21_19,
                 GP_6_6_FN, FN_IP13_18_16,
                 GP_6_5_FN, FN_IP13_15,
diff --git a/drivers/pinctrl/sirf/pinctrl-sirf.c b/drivers/pinctrl/sirf/pinctrl-sirf.c
index a0d6152701cd..617a4916b50f 100644
--- a/drivers/pinctrl/sirf/pinctrl-sirf.c
+++ b/drivers/pinctrl/sirf/pinctrl-sirf.c
@@ -598,7 +598,7 @@ static unsigned int sirfsoc_gpio_irq_startup(struct irq_data *d)
 {
         struct sirfsoc_gpio_bank *bank = irq_data_get_irq_chip_data(d);
 
-        if (gpio_lock_as_irq(&bank->chip.gc, d->hwirq))
+        if (gpio_lock_as_irq(&bank->chip.gc, d->hwirq % SIRFSOC_GPIO_BANK_SIZE))
                 dev_err(bank->chip.gc.dev,
                         "unable to lock HW IRQ %lu for IRQ\n",
                         d->hwirq);
@@ -611,7 +611,7 @@ static void sirfsoc_gpio_irq_shutdown(struct irq_data *d)
         struct sirfsoc_gpio_bank *bank = irq_data_get_irq_chip_data(d);
 
         sirfsoc_gpio_irq_mask(d);
-        gpio_unlock_as_irq(&bank->chip.gc, d->hwirq);
+        gpio_unlock_as_irq(&bank->chip.gc, d->hwirq % SIRFSOC_GPIO_BANK_SIZE);
 }
 
 static struct irq_chip sirfsoc_irq_chip = {
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 167f3d00c916..66977ebf13b3 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -183,9 +183,7 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
         struct resource r = {0};
         int i, flags;
 
-        if (acpi_dev_resource_memory(res, &r)
-            || acpi_dev_resource_io(res, &r)
-            || acpi_dev_resource_address_space(res, &r)
+        if (acpi_dev_resource_address_space(res, &r)
             || acpi_dev_resource_ext_address_space(res, &r)) {
                 pnp_add_resource(dev, &r);
                 return AE_OK;
@@ -217,6 +215,17 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
         }
 
         switch (res->type) {
+        case ACPI_RESOURCE_TYPE_MEMORY24:
+        case ACPI_RESOURCE_TYPE_MEMORY32:
+        case ACPI_RESOURCE_TYPE_FIXED_MEMORY32:
+                if (acpi_dev_resource_memory(res, &r))
+                        pnp_add_resource(dev, &r);
+                break;
+        case ACPI_RESOURCE_TYPE_IO:
+        case ACPI_RESOURCE_TYPE_FIXED_IO:
+                if (acpi_dev_resource_io(res, &r))
+                        pnp_add_resource(dev, &r);
+                break;
         case ACPI_RESOURCE_TYPE_DMA:
                 dma = &res->data.dma;
                 if (dma->channel_count > 0 && dma->channels[0] != (u8) -1)
diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h
index b4b0d83f9ef6..7061ac0ad428 100644
--- a/drivers/rapidio/devices/tsi721.h
+++ b/drivers/rapidio/devices/tsi721.h
@@ -678,6 +678,7 @@ struct tsi721_bdma_chan {
         struct list_head        free_list;
         dma_cookie_t            completed_cookie;
         struct tasklet_struct   tasklet;
+        bool                    active;
 };
 
 #endif /* CONFIG_RAPIDIO_DMA_ENGINE */
diff --git a/drivers/rapidio/devices/tsi721_dma.c b/drivers/rapidio/devices/tsi721_dma.c
index 502663f5f7c6..91245f5dbe81 100644
--- a/drivers/rapidio/devices/tsi721_dma.c
+++ b/drivers/rapidio/devices/tsi721_dma.c
@@ -206,8 +206,8 @@ void tsi721_bdma_handler(struct tsi721_bdma_chan *bdma_chan)
 {
         /* Disable BDMA channel interrupts */
         iowrite32(0, bdma_chan->regs + TSI721_DMAC_INTE);
-
-        tasklet_schedule(&bdma_chan->tasklet);
+        if (bdma_chan->active)
+                tasklet_schedule(&bdma_chan->tasklet);
 }
 
 #ifdef CONFIG_PCI_MSI
@@ -562,7 +562,7 @@ static int tsi721_alloc_chan_resources(struct dma_chan *dchan)
         }
 #endif /* CONFIG_PCI_MSI */
 
-        tasklet_enable(&bdma_chan->tasklet);
+        bdma_chan->active = true;
         tsi721_bdma_interrupt_enable(bdma_chan, 1);
 
         return bdma_chan->bd_num - 1;
@@ -576,9 +576,7 @@ err_out:
 static void tsi721_free_chan_resources(struct dma_chan *dchan)
 {
         struct tsi721_bdma_chan *bdma_chan = to_tsi721_chan(dchan);
-#ifdef CONFIG_PCI_MSI
         struct tsi721_device *priv = to_tsi721(dchan->device);
-#endif
         LIST_HEAD(list);
 
         dev_dbg(dchan->device->dev, "%s: Entry\n", __func__);
@@ -589,14 +587,25 @@ static void tsi721_free_chan_resources(struct dma_chan *dchan)
         BUG_ON(!list_empty(&bdma_chan->active_list));
         BUG_ON(!list_empty(&bdma_chan->queue));
 
-        tasklet_disable(&bdma_chan->tasklet);
+        tsi721_bdma_interrupt_enable(bdma_chan, 0);
+        bdma_chan->active = false;
+
+#ifdef CONFIG_PCI_MSI
+        if (priv->flags & TSI721_USING_MSIX) {
+                synchronize_irq(priv->msix[TSI721_VECT_DMA0_DONE +
+                                           bdma_chan->id].vector);
+                synchronize_irq(priv->msix[TSI721_VECT_DMA0_INT +
+                                           bdma_chan->id].vector);
+        } else
+#endif
+        synchronize_irq(priv->pdev->irq);
+
+        tasklet_kill(&bdma_chan->tasklet);
 
         spin_lock_bh(&bdma_chan->lock);
         list_splice_init(&bdma_chan->free_list, &list);
         spin_unlock_bh(&bdma_chan->lock);
 
-        tsi721_bdma_interrupt_enable(bdma_chan, 0);
-
 #ifdef CONFIG_PCI_MSI
         if (priv->flags & TSI721_USING_MSIX) {
                 free_irq(priv->msix[TSI721_VECT_DMA0_DONE +
@@ -790,6 +799,7 @@ int tsi721_register_dma(struct tsi721_device *priv)
                 bdma_chan->dchan.cookie = 1;
                 bdma_chan->dchan.chan_id = i;
                 bdma_chan->id = i;
+                bdma_chan->active = false;
 
                 spin_lock_init(&bdma_chan->lock);
 
@@ -799,7 +809,6 @@ int tsi721_register_dma(struct tsi721_device *priv)
 
                 tasklet_init(&bdma_chan->tasklet, tsi721_dma_tasklet,
                              (unsigned long)bdma_chan);
-                tasklet_disable(&bdma_chan->tasklet);
                 list_add_tail(&bdma_chan->dchan.device_node,
                               &mport->dma.channels);
         }
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index d1ac4caaf1b0..afca1bc24f26 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -953,6 +953,8 @@ static int machine_constraints_current(struct regulator_dev *rdev,
         return 0;
 }
 
+static int _regulator_do_enable(struct regulator_dev *rdev);
+
 /**
  * set_machine_constraints - sets regulator constraints
  * @rdev: regulator source
@@ -1013,10 +1015,9 @@ static int set_machine_constraints(struct regulator_dev *rdev,
         /* If the constraints say the regulator should be on at this point
          * and we have control then make sure it is enabled.
          */
-        if ((rdev->constraints->always_on || rdev->constraints->boot_on) &&
-            ops->enable) {
-                ret = ops->enable(rdev);
-                if (ret < 0) {
+        if (rdev->constraints->always_on || rdev->constraints->boot_on) {
+                ret = _regulator_do_enable(rdev);
+                if (ret < 0 && ret != -EINVAL) {
                         rdev_err(rdev, "failed to enable\n");
                         goto out;
                 }
@@ -1907,8 +1908,6 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
 
         trace_regulator_disable_complete(rdev_get_name(rdev));
 
-        _notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE,
-                             NULL);
         return 0;
 }
 
@@ -1932,6 +1931,8 @@ static int _regulator_disable(struct regulator_dev *rdev)
                                 rdev_err(rdev, "failed to disable\n");
                                 return ret;
                         }
+                        _notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE,
+                                        NULL);
                 }
 
                 rdev->use_count = 0;
@@ -1984,20 +1985,16 @@ static int _regulator_force_disable(struct regulator_dev *rdev)
 {
         int ret = 0;
 
-        /* force disable */
-        if (rdev->desc->ops->disable) {
-                /* ah well, who wants to live forever... */
-                ret = rdev->desc->ops->disable(rdev);
-                if (ret < 0) {
-                        rdev_err(rdev, "failed to force disable\n");
-                        return ret;
-                }
-                /* notify other consumers that power has been forced off */
-                _notifier_call_chain(rdev, REGULATOR_EVENT_FORCE_DISABLE |
-                        REGULATOR_EVENT_DISABLE, NULL);
+        ret = _regulator_do_disable(rdev);
+        if (ret < 0) {
+                rdev_err(rdev, "failed to force disable\n");
+                return ret;
         }
 
-        return ret;
+        _notifier_call_chain(rdev, REGULATOR_EVENT_FORCE_DISABLE |
+                        REGULATOR_EVENT_DISABLE, NULL);
+
+        return 0;
 }
 
 /**
@@ -3630,23 +3627,18 @@ int regulator_suspend_finish(void)
 
         mutex_lock(&regulator_list_mutex);
         list_for_each_entry(rdev, &regulator_list, list) {
-                struct regulator_ops *ops = rdev->desc->ops;
-
                 mutex_lock(&rdev->mutex);
-                if ((rdev->use_count > 0  || rdev->constraints->always_on) &&
-                                ops->enable) {
-                        error = ops->enable(rdev);
+                if (rdev->use_count > 0  || rdev->constraints->always_on) {
+                        error = _regulator_do_enable(rdev);
                         if (error)
                                 ret = error;
                 } else {
                         if (!have_full_constraints())
                                 goto unlock;
-                        if (!ops->disable)
-                                goto unlock;
                         if (!_regulator_is_enabled(rdev))
                                 goto unlock;
 
-                        error = ops->disable(rdev);
+                        error = _regulator_do_disable(rdev);
                         if (error)
                                 ret = error;
                 }
@@ -3820,7 +3812,7 @@ static int __init regulator_init_complete(void)
                 ops = rdev->desc->ops;
                 c = rdev->constraints;
 
-                if (!ops->disable || (c && c->always_on))
+                if (c && c->always_on)
                         continue;
 
                 mutex_lock(&rdev->mutex);
@@ -3841,7 +3833,7 @@ static int __init regulator_init_complete(void)
                         /* We log since this may kill the system if it
                          * goes wrong. */
                         rdev_info(rdev, "disabling\n");
-                        ret = ops->disable(rdev);
+                        ret = _regulator_do_disable(rdev);
                         if (ret != 0)
                                 rdev_err(rdev, "couldn't disable: %d\n", ret);
                 } else {
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 7afd373b9595..c4cde9c08f1f 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -580,10 +580,12 @@ static int s3c_rtc_suspend(struct device *dev)
 
         clk_enable(rtc_clk);
         /* save TICNT for anyone using periodic interrupts */
-        ticnt_save = readb(s3c_rtc_base + S3C2410_TICNT);
         if (s3c_rtc_cpu_type == TYPE_S3C64XX) {
                 ticnt_en_save = readw(s3c_rtc_base + S3C2410_RTCCON);
                 ticnt_en_save &= S3C64XX_RTCCON_TICEN;
+                ticnt_save = readl(s3c_rtc_base + S3C2410_TICNT);
+        } else {
+                ticnt_save = readb(s3c_rtc_base + S3C2410_TICNT);
         }
         s3c_rtc_enable(pdev, 0);
 
@@ -605,10 +607,15 @@ static int s3c_rtc_resume(struct device *dev)
 
         clk_enable(rtc_clk);
         s3c_rtc_enable(pdev, 1);
-        writeb(ticnt_save, s3c_rtc_base + S3C2410_TICNT);
-        if (s3c_rtc_cpu_type == TYPE_S3C64XX && ticnt_en_save) {
-                tmp = readw(s3c_rtc_base + S3C2410_RTCCON);
-                writew(tmp | ticnt_en_save, s3c_rtc_base + S3C2410_RTCCON);
+        if (s3c_rtc_cpu_type == TYPE_S3C64XX) {
+                writel(ticnt_save, s3c_rtc_base + S3C2410_TICNT);
+                if (ticnt_en_save) {
+                        tmp = readw(s3c_rtc_base + S3C2410_RTCCON);
+                        writew(tmp | ticnt_en_save,
+                                        s3c_rtc_base + S3C2410_RTCCON);
+                }
+        } else {
+                writeb(ticnt_save, s3c_rtc_base + S3C2410_TICNT);
         }
 
         if (device_may_wakeup(dev) && wake_en) {
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index c3a83df07894..795ed61a5496 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -1660,7 +1660,6 @@ int qeth_qdio_clear_card(struct qeth_card *card, int use_halt)
                                 QDIO_FLAG_CLEANUP_USING_CLEAR);
                 if (rc)
                         QETH_CARD_TEXT_(card, 3, "1err%d", rc);
-                qdio_free(CARD_DDEV(card));
                 atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
                 break;
         case QETH_QDIO_CLEANING:
@@ -2605,6 +2604,7 @@ static int qeth_mpc_initialize(struct qeth_card *card)
         return 0;
 out_qdio:
         qeth_qdio_clear_card(card, card->info.type != QETH_CARD_TYPE_IQD);
+        qdio_free(CARD_DDEV(card));
         return rc;
 }
 
@@ -4906,9 +4906,11 @@ retry:
         if (retries < 3)
                 QETH_DBF_MESSAGE(2, "%s Retrying to do IDX activates.\n",
                         dev_name(&card->gdev->dev));
+        rc = qeth_qdio_clear_card(card, card->info.type != QETH_CARD_TYPE_IQD);
         ccw_device_set_offline(CARD_DDEV(card));
         ccw_device_set_offline(CARD_WDEV(card));
         ccw_device_set_offline(CARD_RDEV(card));
+        qdio_free(CARD_DDEV(card));
         rc = ccw_device_set_online(CARD_RDEV(card));
         if (rc)
                 goto retriable;
@@ -4918,7 +4920,6 @@ retry:
         rc = ccw_device_set_online(CARD_DDEV(card));
         if (rc)
                 goto retriable;
-        rc = qeth_qdio_clear_card(card, card->info.type != QETH_CARD_TYPE_IQD);
 retriable:
         if (rc == -ERESTARTSYS) {
                 QETH_DBF_TEXT(SETUP, 2, "break1");
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 0710550093ce..908d82529ee9 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1091,6 +1091,7 @@ out_remove:
         ccw_device_set_offline(CARD_DDEV(card));
         ccw_device_set_offline(CARD_WDEV(card));
         ccw_device_set_offline(CARD_RDEV(card));
+        qdio_free(CARD_DDEV(card));
         if (recover_flag == CARD_STATE_RECOVER)
                 card->state = CARD_STATE_RECOVER;
         else
@@ -1132,6 +1133,7 @@ static int __qeth_l2_set_offline(struct ccwgroup_device *cgdev,
                 rc = (rc2) ? rc2 : rc3;
         if (rc)
                 QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
+        qdio_free(CARD_DDEV(card));
         if (recover_flag == CARD_STATE_UP)
                 card->state = CARD_STATE_RECOVER;
         /* let user_space know that device is offline */
@@ -1194,6 +1196,7 @@ static void qeth_l2_shutdown(struct ccwgroup_device *gdev)
                 qeth_hw_trap(card, QETH_DIAGS_TRAP_DISARM);
         qeth_qdio_clear_card(card, 0);
         qeth_clear_qdio_buffers(card);
+        qdio_free(CARD_DDEV(card));
 }
 
 static int qeth_l2_pm_suspend(struct ccwgroup_device *gdev)
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 0f430424c3b8..3524d34ff694 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3447,6 +3447,7 @@ out_remove:
         ccw_device_set_offline(CARD_DDEV(card));
         ccw_device_set_offline(CARD_WDEV(card));
         ccw_device_set_offline(CARD_RDEV(card));
+        qdio_free(CARD_DDEV(card));
         if (recover_flag == CARD_STATE_RECOVER)
                 card->state = CARD_STATE_RECOVER;
         else
@@ -3493,6 +3494,7 @@ static int __qeth_l3_set_offline(struct ccwgroup_device *cgdev,
                 rc = (rc2) ? rc2 : rc3;
         if (rc)
                 QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
+        qdio_free(CARD_DDEV(card));
         if (recover_flag == CARD_STATE_UP)
                 card->state = CARD_STATE_RECOVER;
         /* let user_space know that device is offline */
@@ -3545,6 +3547,7 @@ static void qeth_l3_shutdown(struct ccwgroup_device *gdev)
                 qeth_hw_trap(card, QETH_DIAGS_TRAP_DISARM);
         qeth_qdio_clear_card(card, 0);
         qeth_clear_qdio_buffers(card);
+        qdio_free(CARD_DDEV(card));
 }
 
 static int qeth_l3_pm_suspend(struct ccwgroup_device *gdev)
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 1f375051483a..5642a9b250c2 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -325,7 +325,7 @@ static int beiscsi_eh_device_reset(struct scsi_cmnd *sc)
                 if (!abrt_task->sc || abrt_task->state == ISCSI_TASK_FREE)
                         continue;
 
-                if (abrt_task->sc->device->lun != abrt_task->sc->device->lun)
+                if (sc->device->lun != abrt_task->sc->device->lun)
                         continue;
 
                 /* Invalidate WRB Posted for this Task */
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index ed880891cb7c..e9279a8c1e1c 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -594,13 +594,13 @@ static void bnx2fc_free_mp_resc(struct bnx2fc_cmd *io_req)
                 mp_req->mp_resp_bd = NULL;
         }
         if (mp_req->req_buf) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                      mp_req->req_buf,
                                      mp_req->req_buf_dma);
                 mp_req->req_buf = NULL;
         }
         if (mp_req->resp_buf) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                      mp_req->resp_buf,
                                      mp_req->resp_buf_dma);
                 mp_req->resp_buf = NULL;
@@ -622,7 +622,7 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
 
         mp_req->req_len = sizeof(struct fcp_cmnd);
         io_req->data_xfer_len = mp_req->req_len;
-        mp_req->req_buf = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        mp_req->req_buf = dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                              &mp_req->req_buf_dma,
                                              GFP_ATOMIC);
         if (!mp_req->req_buf) {
@@ -631,7 +631,7 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
                 return FAILED;
         }
 
-        mp_req->resp_buf = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        mp_req->resp_buf = dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                               &mp_req->resp_buf_dma,
                                               GFP_ATOMIC);
         if (!mp_req->resp_buf) {
@@ -639,8 +639,8 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
                 bnx2fc_free_mp_resc(io_req);
                 return FAILED;
         }
-        memset(mp_req->req_buf, 0, PAGE_SIZE);
-        memset(mp_req->resp_buf, 0, PAGE_SIZE);
+        memset(mp_req->req_buf, 0, CNIC_PAGE_SIZE);
+        memset(mp_req->resp_buf, 0, CNIC_PAGE_SIZE);
 
         /* Allocate and map mp_req_bd and mp_resp_bd */
         sz = sizeof(struct fcoe_bd_ctx);
@@ -665,7 +665,7 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
         mp_req_bd = mp_req->mp_req_bd;
         mp_req_bd->buf_addr_lo = (u32)addr & 0xffffffff;
         mp_req_bd->buf_addr_hi = (u32)((u64)addr >> 32);
-        mp_req_bd->buf_len = PAGE_SIZE;
+        mp_req_bd->buf_len = CNIC_PAGE_SIZE;
         mp_req_bd->flags = 0;
 
         /*
@@ -677,7 +677,7 @@ int bnx2fc_init_mp_req(struct bnx2fc_cmd *io_req)
         addr = mp_req->resp_buf_dma;
         mp_resp_bd->buf_addr_lo = (u32)addr & 0xffffffff;
         mp_resp_bd->buf_addr_hi = (u32)((u64)addr >> 32);
-        mp_resp_bd->buf_len = PAGE_SIZE;
+        mp_resp_bd->buf_len = CNIC_PAGE_SIZE;
         mp_resp_bd->flags = 0;
 
         return SUCCESS;
diff --git a/drivers/scsi/bnx2fc/bnx2fc_tgt.c b/drivers/scsi/bnx2fc/bnx2fc_tgt.c
index 4d93177dfb53..d9bae5672273 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_tgt.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_tgt.c
@@ -673,7 +673,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
 
         /* Allocate and map SQ */
         tgt->sq_mem_size = tgt->max_sqes * BNX2FC_SQ_WQE_SIZE;
-        tgt->sq_mem_size = (tgt->sq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+        tgt->sq_mem_size = (tgt->sq_mem_size + (CNIC_PAGE_SIZE - 1)) &
+                           CNIC_PAGE_MASK;
 
         tgt->sq = dma_alloc_coherent(&hba->pcidev->dev, tgt->sq_mem_size,
                                      &tgt->sq_dma, GFP_KERNEL);
@@ -686,7 +687,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
 
         /* Allocate and map CQ */
         tgt->cq_mem_size = tgt->max_cqes * BNX2FC_CQ_WQE_SIZE;
-        tgt->cq_mem_size = (tgt->cq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+        tgt->cq_mem_size = (tgt->cq_mem_size + (CNIC_PAGE_SIZE - 1)) &
+                           CNIC_PAGE_MASK;
 
         tgt->cq = dma_alloc_coherent(&hba->pcidev->dev, tgt->cq_mem_size,
                                      &tgt->cq_dma, GFP_KERNEL);
@@ -699,7 +701,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
 
         /* Allocate and map RQ and RQ PBL */
         tgt->rq_mem_size = tgt->max_rqes * BNX2FC_RQ_WQE_SIZE;
-        tgt->rq_mem_size = (tgt->rq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+        tgt->rq_mem_size = (tgt->rq_mem_size + (CNIC_PAGE_SIZE - 1)) &
+                           CNIC_PAGE_MASK;
 
         tgt->rq = dma_alloc_coherent(&hba->pcidev->dev, tgt->rq_mem_size,
                                         &tgt->rq_dma, GFP_KERNEL);
@@ -710,8 +713,9 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
         }
         memset(tgt->rq, 0, tgt->rq_mem_size);
 
-        tgt->rq_pbl_size = (tgt->rq_mem_size / PAGE_SIZE) * sizeof(void *);
-        tgt->rq_pbl_size = (tgt->rq_pbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+        tgt->rq_pbl_size = (tgt->rq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
+        tgt->rq_pbl_size = (tgt->rq_pbl_size + (CNIC_PAGE_SIZE - 1)) &
+                           CNIC_PAGE_MASK;
 
         tgt->rq_pbl = dma_alloc_coherent(&hba->pcidev->dev, tgt->rq_pbl_size,
                                          &tgt->rq_pbl_dma, GFP_KERNEL);
@@ -722,7 +726,7 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
         }
 
         memset(tgt->rq_pbl, 0, tgt->rq_pbl_size);
-        num_pages = tgt->rq_mem_size / PAGE_SIZE;
+        num_pages = tgt->rq_mem_size / CNIC_PAGE_SIZE;
         page = tgt->rq_dma;
         pbl = (u32 *)tgt->rq_pbl;
 
@@ -731,13 +735,13 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
                 pbl++;
                 *pbl = (u32)((u64)page >> 32);
                 pbl++;
-                page += PAGE_SIZE;
+                page += CNIC_PAGE_SIZE;
         }
 
         /* Allocate and map XFERQ */
         tgt->xferq_mem_size = tgt->max_sqes * BNX2FC_XFERQ_WQE_SIZE;
-        tgt->xferq_mem_size = (tgt->xferq_mem_size + (PAGE_SIZE - 1)) &
-                               PAGE_MASK;
+        tgt->xferq_mem_size = (tgt->xferq_mem_size + (CNIC_PAGE_SIZE - 1)) &
+                               CNIC_PAGE_MASK;
 
         tgt->xferq = dma_alloc_coherent(&hba->pcidev->dev, tgt->xferq_mem_size,
                                         &tgt->xferq_dma, GFP_KERNEL);
@@ -750,8 +754,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
 
         /* Allocate and map CONFQ & CONFQ PBL */
         tgt->confq_mem_size = tgt->max_sqes * BNX2FC_CONFQ_WQE_SIZE;
-        tgt->confq_mem_size = (tgt->confq_mem_size + (PAGE_SIZE - 1)) &
-                               PAGE_MASK;
+        tgt->confq_mem_size = (tgt->confq_mem_size + (CNIC_PAGE_SIZE - 1)) &
+                               CNIC_PAGE_MASK;
 
         tgt->confq = dma_alloc_coherent(&hba->pcidev->dev, tgt->confq_mem_size,
                                         &tgt->confq_dma, GFP_KERNEL);
@@ -763,9 +767,9 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
         memset(tgt->confq, 0, tgt->confq_mem_size);
 
         tgt->confq_pbl_size =
-                (tgt->confq_mem_size / PAGE_SIZE) * sizeof(void *);
+                (tgt->confq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
         tgt->confq_pbl_size =
-                (tgt->confq_pbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (tgt->confq_pbl_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
 
         tgt->confq_pbl = dma_alloc_coherent(&hba->pcidev->dev,
                                             tgt->confq_pbl_size,
@@ -777,7 +781,7 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
         }
 
         memset(tgt->confq_pbl, 0, tgt->confq_pbl_size);
-        num_pages = tgt->confq_mem_size / PAGE_SIZE;
+        num_pages = tgt->confq_mem_size / CNIC_PAGE_SIZE;
         page = tgt->confq_dma;
         pbl = (u32 *)tgt->confq_pbl;
 
@@ -786,7 +790,7 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
                 pbl++;
                 *pbl = (u32)((u64)page >> 32);
                 pbl++;
-                page += PAGE_SIZE;
+                page += CNIC_PAGE_SIZE;
         }
 
         /* Allocate and map ConnDB */
@@ -805,8 +809,8 @@ static int bnx2fc_alloc_session_resc(struct bnx2fc_hba *hba,
 
         /* Allocate and map LCQ */
         tgt->lcq_mem_size = (tgt->max_sqes + 8) * BNX2FC_SQ_WQE_SIZE;
-        tgt->lcq_mem_size = (tgt->lcq_mem_size + (PAGE_SIZE - 1)) &
-                             PAGE_MASK;
+        tgt->lcq_mem_size = (tgt->lcq_mem_size + (CNIC_PAGE_SIZE - 1)) &
+                             CNIC_PAGE_MASK;
 
         tgt->lcq = dma_alloc_coherent(&hba->pcidev->dev, tgt->lcq_mem_size,
                                       &tgt->lcq_dma, GFP_KERNEL);
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
index e4cf23df4b4f..b87a1933f880 100644
--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -61,7 +61,7 @@ static void bnx2i_adjust_qp_size(struct bnx2i_hba *hba)
          * yield integral num of page buffers
          */
         /* adjust SQ */
-        num_elements_per_pg = PAGE_SIZE / BNX2I_SQ_WQE_SIZE;
+        num_elements_per_pg = CNIC_PAGE_SIZE / BNX2I_SQ_WQE_SIZE;
         if (hba->max_sqes < num_elements_per_pg)
                 hba->max_sqes = num_elements_per_pg;
         else if (hba->max_sqes % num_elements_per_pg)
@@ -69,7 +69,7 @@ static void bnx2i_adjust_qp_size(struct bnx2i_hba *hba)
                                  ~(num_elements_per_pg - 1);
 
         /* adjust CQ */
-        num_elements_per_pg = PAGE_SIZE / BNX2I_CQE_SIZE;
+        num_elements_per_pg = CNIC_PAGE_SIZE / BNX2I_CQE_SIZE;
         if (hba->max_cqes < num_elements_per_pg)
                 hba->max_cqes = num_elements_per_pg;
         else if (hba->max_cqes % num_elements_per_pg)
@@ -77,7 +77,7 @@ static void bnx2i_adjust_qp_size(struct bnx2i_hba *hba)
                                  ~(num_elements_per_pg - 1);
 
         /* adjust RQ */
-        num_elements_per_pg = PAGE_SIZE / BNX2I_RQ_WQE_SIZE;
+        num_elements_per_pg = CNIC_PAGE_SIZE / BNX2I_RQ_WQE_SIZE;
         if (hba->max_rqes < num_elements_per_pg)
                 hba->max_rqes = num_elements_per_pg;
         else if (hba->max_rqes % num_elements_per_pg)
@@ -959,7 +959,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
 
         /* SQ page table */
         memset(ep->qp.sq_pgtbl_virt, 0, ep->qp.sq_pgtbl_size);
-        num_pages = ep->qp.sq_mem_size / PAGE_SIZE;
+        num_pages = ep->qp.sq_mem_size / CNIC_PAGE_SIZE;
         page = ep->qp.sq_phys;
 
         if (cnic_dev_10g)
@@ -973,7 +973,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                         ptbl++;
                         *ptbl = (u32) ((u64) page >> 32);
                         ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                 } else {
                         /* PTE is written in big endian format for
                          * 5706/5708/5709 devices */
@@ -981,13 +981,13 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                         ptbl++;
                         *ptbl = (u32) page;
                         ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                 }
         }
 
         /* RQ page table */
         memset(ep->qp.rq_pgtbl_virt, 0, ep->qp.rq_pgtbl_size);
-        num_pages = ep->qp.rq_mem_size / PAGE_SIZE;
+        num_pages = ep->qp.rq_mem_size / CNIC_PAGE_SIZE;
         page = ep->qp.rq_phys;
 
         if (cnic_dev_10g)
@@ -1001,7 +1001,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                         ptbl++;
                         *ptbl = (u32) ((u64) page >> 32);
                         ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                 } else {
                         /* PTE is written in big endian format for
                          * 5706/5708/5709 devices */
@@ -1009,13 +1009,13 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                         ptbl++;
                         *ptbl = (u32) page;
                         ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                 }
         }
 
         /* CQ page table */
         memset(ep->qp.cq_pgtbl_virt, 0, ep->qp.cq_pgtbl_size);
-        num_pages = ep->qp.cq_mem_size / PAGE_SIZE;
+        num_pages = ep->qp.cq_mem_size / CNIC_PAGE_SIZE;
         page = ep->qp.cq_phys;
 
         if (cnic_dev_10g)
@@ -1029,7 +1029,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                         ptbl++;
                         *ptbl = (u32) ((u64) page >> 32);
                         ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                 } else {
                         /* PTE is written in big endian format for
                          * 5706/5708/5709 devices */
@@ -1037,7 +1037,7 @@ static void setup_qp_page_tables(struct bnx2i_endpoint *ep)
                         ptbl++;
                         *ptbl = (u32) page;
                         ptbl++;
-                        page += PAGE_SIZE;
+                        page += CNIC_PAGE_SIZE;
                 }
         }
 }
@@ -1064,11 +1064,11 @@ int bnx2i_alloc_qp_resc(struct bnx2i_hba *hba, struct bnx2i_endpoint *ep)
         /* Allocate page table memory for SQ which is page aligned */
         ep->qp.sq_mem_size = hba->max_sqes * BNX2I_SQ_WQE_SIZE;
         ep->qp.sq_mem_size =
-                (ep->qp.sq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.sq_mem_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
         ep->qp.sq_pgtbl_size =
-                (ep->qp.sq_mem_size / PAGE_SIZE) * sizeof(void *);
+                (ep->qp.sq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
         ep->qp.sq_pgtbl_size =
-                (ep->qp.sq_pgtbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.sq_pgtbl_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
 
         ep->qp.sq_pgtbl_virt =
                 dma_alloc_coherent(&hba->pcidev->dev, ep->qp.sq_pgtbl_size,
@@ -1101,11 +1101,11 @@ int bnx2i_alloc_qp_resc(struct bnx2i_hba *hba, struct bnx2i_endpoint *ep)
         /* Allocate page table memory for CQ which is page aligned */
         ep->qp.cq_mem_size = hba->max_cqes * BNX2I_CQE_SIZE;
         ep->qp.cq_mem_size =
-                (ep->qp.cq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.cq_mem_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
         ep->qp.cq_pgtbl_size =
-                (ep->qp.cq_mem_size / PAGE_SIZE) * sizeof(void *);
+                (ep->qp.cq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
         ep->qp.cq_pgtbl_size =
-                (ep->qp.cq_pgtbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.cq_pgtbl_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
 
         ep->qp.cq_pgtbl_virt =
                 dma_alloc_coherent(&hba->pcidev->dev, ep->qp.cq_pgtbl_size,
@@ -1144,11 +1144,11 @@ int bnx2i_alloc_qp_resc(struct bnx2i_hba *hba, struct bnx2i_endpoint *ep)
         /* Allocate page table memory for RQ which is page aligned */
         ep->qp.rq_mem_size = hba->max_rqes * BNX2I_RQ_WQE_SIZE;
         ep->qp.rq_mem_size =
-                (ep->qp.rq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.rq_mem_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
         ep->qp.rq_pgtbl_size =
-                (ep->qp.rq_mem_size / PAGE_SIZE) * sizeof(void *);
+                (ep->qp.rq_mem_size / CNIC_PAGE_SIZE) * sizeof(void *);
         ep->qp.rq_pgtbl_size =
-                (ep->qp.rq_pgtbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+                (ep->qp.rq_pgtbl_size + (CNIC_PAGE_SIZE - 1)) & CNIC_PAGE_MASK;
 
         ep->qp.rq_pgtbl_virt =
                 dma_alloc_coherent(&hba->pcidev->dev, ep->qp.rq_pgtbl_size,
@@ -1270,7 +1270,7 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
         bnx2i_adjust_qp_size(hba);
 
         iscsi_init.flags =
-                ISCSI_PAGE_SIZE_4K << ISCSI_KWQE_INIT1_PAGE_SIZE_SHIFT;
+                (CNIC_PAGE_BITS - 8) << ISCSI_KWQE_INIT1_PAGE_SIZE_SHIFT;
         if (en_tcp_dack)
                 iscsi_init.flags |= ISCSI_KWQE_INIT1_DELAYED_ACK_ENABLE;
         iscsi_init.reserved0 = 0;
@@ -1288,15 +1288,15 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
                         ((hba->num_ccell & 0xFFFF) | (hba->max_sqes << 16));
         iscsi_init.num_ccells_per_conn = hba->num_ccell;
         iscsi_init.num_tasks_per_conn = hba->max_sqes;
-        iscsi_init.sq_wqes_per_page = PAGE_SIZE / BNX2I_SQ_WQE_SIZE;
+        iscsi_init.sq_wqes_per_page = CNIC_PAGE_SIZE / BNX2I_SQ_WQE_SIZE;
         iscsi_init.sq_num_wqes = hba->max_sqes;
         iscsi_init.cq_log_wqes_per_page =
-                (u8) bnx2i_power_of2(PAGE_SIZE / BNX2I_CQE_SIZE);
+                (u8) bnx2i_power_of2(CNIC_PAGE_SIZE / BNX2I_CQE_SIZE);
         iscsi_init.cq_num_wqes = hba->max_cqes;
         iscsi_init.cq_num_pages = (hba->max_cqes * BNX2I_CQE_SIZE +
-                                   (PAGE_SIZE - 1)) / PAGE_SIZE;
+                                   (CNIC_PAGE_SIZE - 1)) / CNIC_PAGE_SIZE;
         iscsi_init.sq_num_pages = (hba->max_sqes * BNX2I_SQ_WQE_SIZE +
-                                   (PAGE_SIZE - 1)) / PAGE_SIZE;
+                                   (CNIC_PAGE_SIZE - 1)) / CNIC_PAGE_SIZE;
         iscsi_init.rq_buffer_size = BNX2I_RQ_WQE_SIZE;
         iscsi_init.rq_num_wqes = hba->max_rqes;
 
diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c
index 854dad7d5b03..c8b0aff5bbd4 100644
--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
+++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
@@ -525,7 +525,7 @@ static int bnx2i_setup_mp_bdt(struct bnx2i_hba *hba)
         struct iscsi_bd *mp_bdt;
         u64 addr;
 
-        hba->mp_bd_tbl = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        hba->mp_bd_tbl = dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                             &hba->mp_bd_dma, GFP_KERNEL);
         if (!hba->mp_bd_tbl) {
                 printk(KERN_ERR "unable to allocate Middle Path BDT\n");
@@ -533,11 +533,12 @@ static int bnx2i_setup_mp_bdt(struct bnx2i_hba *hba)
                 goto out;
         }
 
-        hba->dummy_buffer = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        hba->dummy_buffer = dma_alloc_coherent(&hba->pcidev->dev,
+                                               CNIC_PAGE_SIZE,
                                                &hba->dummy_buf_dma, GFP_KERNEL);
         if (!hba->dummy_buffer) {
                 printk(KERN_ERR "unable to alloc Middle Path Dummy Buffer\n");
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                   hba->mp_bd_tbl, hba->mp_bd_dma);
                 hba->mp_bd_tbl = NULL;
                 rc = -1;
@@ -548,7 +549,7 @@ static int bnx2i_setup_mp_bdt(struct bnx2i_hba *hba)
         addr = (unsigned long) hba->dummy_buf_dma;
         mp_bdt->buffer_addr_lo = addr & 0xffffffff;
         mp_bdt->buffer_addr_hi = addr >> 32;
-        mp_bdt->buffer_length = PAGE_SIZE;
+        mp_bdt->buffer_length = CNIC_PAGE_SIZE;
         mp_bdt->flags = ISCSI_BD_LAST_IN_BD_CHAIN |
                         ISCSI_BD_FIRST_IN_BD_CHAIN;
 out:
@@ -565,12 +566,12 @@ out:
 static void bnx2i_free_mp_bdt(struct bnx2i_hba *hba)
 {
         if (hba->mp_bd_tbl) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                   hba->mp_bd_tbl, hba->mp_bd_dma);
                 hba->mp_bd_tbl = NULL;
         }
         if (hba->dummy_buffer) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                   hba->dummy_buffer, hba->dummy_buf_dma);
                 hba->dummy_buffer = NULL;
         }
@@ -934,14 +935,14 @@ static void bnx2i_conn_free_login_resources(struct bnx2i_hba *hba,
                                             struct bnx2i_conn *bnx2i_conn)
 {
         if (bnx2i_conn->gen_pdu.resp_bd_tbl) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                   bnx2i_conn->gen_pdu.resp_bd_tbl,
                                   bnx2i_conn->gen_pdu.resp_bd_dma);
                 bnx2i_conn->gen_pdu.resp_bd_tbl = NULL;
         }
 
         if (bnx2i_conn->gen_pdu.req_bd_tbl) {
-                dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                   bnx2i_conn->gen_pdu.req_bd_tbl,
                                   bnx2i_conn->gen_pdu.req_bd_dma);
                 bnx2i_conn->gen_pdu.req_bd_tbl = NULL;
@@ -998,13 +999,13 @@ static int bnx2i_conn_alloc_login_resources(struct bnx2i_hba *hba,
         bnx2i_conn->gen_pdu.resp_wr_ptr = bnx2i_conn->gen_pdu.resp_buf;
 
         bnx2i_conn->gen_pdu.req_bd_tbl =
-                dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                    &bnx2i_conn->gen_pdu.req_bd_dma, GFP_KERNEL);
         if (bnx2i_conn->gen_pdu.req_bd_tbl == NULL)
                 goto login_req_bd_tbl_failure;
 
         bnx2i_conn->gen_pdu.resp_bd_tbl =
-                dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+                dma_alloc_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                                    &bnx2i_conn->gen_pdu.resp_bd_dma,
                                    GFP_KERNEL);
         if (bnx2i_conn->gen_pdu.resp_bd_tbl == NULL)
@@ -1013,7 +1014,7 @@ static int bnx2i_conn_alloc_login_resources(struct bnx2i_hba *hba,
         return 0;
 
 login_resp_bd_tbl_failure:
-        dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+        dma_free_coherent(&hba->pcidev->dev, CNIC_PAGE_SIZE,
                           bnx2i_conn->gen_pdu.req_bd_tbl,
                           bnx2i_conn->gen_pdu.req_bd_dma);
         bnx2i_conn->gen_pdu.req_bd_tbl = NULL;
diff --git a/drivers/scsi/isci/host.h b/drivers/scsi/isci/host.h
index 4911310a38f5..22a9bb1abae1 100644
--- a/drivers/scsi/isci/host.h
+++ b/drivers/scsi/isci/host.h
@@ -311,9 +311,8 @@ static inline struct Scsi_Host *to_shost(struct isci_host *ihost)
 }
 
 #define for_each_isci_host(id, ihost, pdev) \
-        for (id = 0, ihost = to_pci_info(pdev)->hosts[id]; \
-             id < ARRAY_SIZE(to_pci_info(pdev)->hosts) && ihost; \
-             ihost = to_pci_info(pdev)->hosts[++id])
+        for (id = 0; id < SCI_MAX_CONTROLLERS && \
+             (ihost = to_pci_info(pdev)->hosts[id]); id++)
 
 static inline void wait_for_start(struct isci_host *ihost)
 {
diff --git a/drivers/scsi/isci/port_config.c b/drivers/scsi/isci/port_config.c
index 85c77f6b802b..ac879745ef80 100644
--- a/drivers/scsi/isci/port_config.c
+++ b/drivers/scsi/isci/port_config.c
@@ -615,13 +615,6 @@ static void sci_apc_agent_link_up(struct isci_host *ihost,
                                           SCIC_SDS_APC_WAIT_LINK_UP_NOTIFICATION);
         } else {
                 /* the phy is already the part of the port */
-                u32 port_state = iport->sm.current_state_id;
-
-                /* if the PORT'S state is resetting then the link up is from
-                 * port hard reset in this case, we need to tell the port
-                 * that link up is recieved
-                 */
-                BUG_ON(port_state != SCI_PORT_RESETTING);
                 port_agent->phy_ready_mask |= 1 << phy_index;
                 sci_port_link_up(iport, iphy);
         }
diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
index 0d30ca849e8f..5d6fda72d659 100644
--- a/drivers/scsi/isci/task.c
+++ b/drivers/scsi/isci/task.c
@@ -801,7 +801,7 @@ int isci_task_I_T_nexus_reset(struct domain_device *dev)
                 /* XXX: need to cleanup any ireqs targeting this
                  * domain_device
                  */
-                ret = TMF_RESP_FUNC_COMPLETE;
+                ret = -ENODEV;
                 goto out;
         }
 
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index e1fe95ef23e1..266724b6b899 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -2996,8 +2996,7 @@ struct qla_hw_data {
                                 IS_QLA82XX(ha) || IS_QLA83XX(ha) || \
                                 IS_QLA8044(ha))
 #define IS_MSIX_NACK_CAPABLE(ha) (IS_QLA81XX(ha) || IS_QLA83XX(ha))
-#define IS_NOPOLLING_TYPE(ha)   ((IS_QLA25XX(ha) || IS_QLA81XX(ha) || \
-                        IS_QLA83XX(ha)) && (ha)->flags.msix_enabled)
+#define IS_NOPOLLING_TYPE(ha)   (IS_QLA81XX(ha) && (ha)->flags.msix_enabled)
 #define IS_FAC_REQUIRED(ha)     (IS_QLA81XX(ha) || IS_QLA83XX(ha))
 #define IS_NOCACHE_VPD_TYPE(ha) (IS_QLA81XX(ha) || IS_QLA83XX(ha))
 #define IS_ALOGIO_CAPABLE(ha)   (IS_QLA23XX(ha) || IS_FWI2_CAPABLE(ha))
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 9bc86b9e86b1..0a1dcb43d18b 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -2880,6 +2880,7 @@ static int
 qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
 {
 #define MIN_MSIX_COUNT  2
+#define ATIO_VECTOR     2
         int i, ret;
         struct msix_entry *entries;
         struct qla_msix_entry *qentry;
@@ -2936,34 +2937,47 @@ msix_failed:
         }
 
         /* Enable MSI-X vectors for the base queue */
-        for (i = 0; i < ha->msix_count; i++) {
+        for (i = 0; i < 2; i++) {
                 qentry = &ha->msix_entries[i];
-                if (QLA_TGT_MODE_ENABLED() && IS_ATIO_MSIX_CAPABLE(ha)) {
-                        ret = request_irq(qentry->vector,
-                                qla83xx_msix_entries[i].handler,
-                                0, qla83xx_msix_entries[i].name, rsp);
-                } else if (IS_P3P_TYPE(ha)) {
+                if (IS_P3P_TYPE(ha))
                         ret = request_irq(qentry->vector,
                                 qla82xx_msix_entries[i].handler,
                                 0, qla82xx_msix_entries[i].name, rsp);
-                } else {
+                else
                         ret = request_irq(qentry->vector,
                                 msix_entries[i].handler,
                                 0, msix_entries[i].name, rsp);
-                }
-                if (ret) {
-                        ql_log(ql_log_fatal, vha, 0x00cb,
-                            "MSI-X: unable to register handler -- %x/%d.\n",
-                            qentry->vector, ret);
-                        qla24xx_disable_msix(ha);
-                        ha->mqenable = 0;
-                        goto msix_out;
-                }
+                if (ret)
+                        goto msix_register_fail;
                 qentry->have_irq = 1;
                 qentry->rsp = rsp;
                 rsp->msix = qentry;
         }
 
+        /*
+         * If target mode is enable, also request the vector for the ATIO
+         * queue.
+         */
+        if (QLA_TGT_MODE_ENABLED() && IS_ATIO_MSIX_CAPABLE(ha)) {
+                qentry = &ha->msix_entries[ATIO_VECTOR];
+                ret = request_irq(qentry->vector,
+                        qla83xx_msix_entries[ATIO_VECTOR].handler,
+                        0, qla83xx_msix_entries[ATIO_VECTOR].name, rsp);
+                qentry->have_irq = 1;
+                qentry->rsp = rsp;
+                rsp->msix = qentry;
+        }
+
+msix_register_fail:
+        if (ret) {
+                ql_log(ql_log_fatal, vha, 0x00cb,
+                    "MSI-X: unable to register handler -- %x/%d.\n",
+                    qentry->vector, ret);
+                qla24xx_disable_msix(ha);
+                ha->mqenable = 0;
+                goto msix_out;
+        }
+
         /* Enable MSI-X vector for response queue update for queue 0 */
         if (IS_QLA83XX(ha)) {
                 if (ha->msixbase && ha->mqiobase &&
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 17d740427240..9969fa1ef7c4 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1419,6 +1419,9 @@ static void storvsc_device_destroy(struct scsi_device *sdevice)
 {
         struct stor_mem_pools *memp = sdevice->hostdata;
 
+        if (!memp)
+                return;
+
         mempool_destroy(memp->request_mempool);
         kmem_cache_destroy(memp->request_pool);
         kfree(memp);
diff --git a/drivers/spi/spi-ath79.c b/drivers/spi/spi-ath79.c
index 31534b51715a..c3b2fb9b6713 100644
--- a/drivers/spi/spi-ath79.c
+++ b/drivers/spi/spi-ath79.c
@@ -132,9 +132,9 @@ static int ath79_spi_setup_cs(struct spi_device *spi)
 
                 flags = GPIOF_DIR_OUT;
                 if (spi->mode & SPI_CS_HIGH)
-                        flags |= GPIOF_INIT_HIGH;
-                else
                         flags |= GPIOF_INIT_LOW;
+                else
+                        flags |= GPIOF_INIT_HIGH;
 
                 status = gpio_request_one(cdata->gpio, flags,
                                           dev_name(&spi->dev));
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index b0842f751016..5d7b07f08326 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1455,6 +1455,14 @@ static int atmel_spi_suspend(struct device *dev)
 {
         struct spi_master       *master = dev_get_drvdata(dev);
         struct atmel_spi        *as = spi_master_get_devdata(master);
+        int ret;
+
+        /* Stop the queue running */
+        ret = spi_master_suspend(master);
+        if (ret) {
+                dev_warn(dev, "cannot suspend master\n");
+                return ret;
+        }
 
         clk_disable_unprepare(as->clk);
         return 0;
@@ -1464,9 +1472,16 @@ static int atmel_spi_resume(struct device *dev)
 {
         struct spi_master       *master = dev_get_drvdata(dev);
         struct atmel_spi        *as = spi_master_get_devdata(master);
+        int ret;
 
         clk_prepare_enable(as->clk);
-        return 0;
+
+        /* Start the queue running */
+        ret = spi_master_resume(master);
+        if (ret)
+                dev_err(dev, "problem starting queue (%d)\n", ret);
+
+        return ret;
 }
 
 static SIMPLE_DEV_PM_OPS(atmel_spi_pm_ops, atmel_spi_suspend, atmel_spi_resume);
diff --git a/drivers/spi/spi-coldfire-qspi.c b/drivers/spi/spi-coldfire-qspi.c
index cabed8f9119e..28ae470397a9 100644
--- a/drivers/spi/spi-coldfire-qspi.c
+++ b/drivers/spi/spi-coldfire-qspi.c
@@ -514,7 +514,8 @@ static int mcfqspi_resume(struct device *dev)
 #ifdef CONFIG_PM_RUNTIME
 static int mcfqspi_runtime_suspend(struct device *dev)
 {
-        struct mcfqspi *mcfqspi = dev_get_drvdata(dev);
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct mcfqspi *mcfqspi = spi_master_get_devdata(master);
 
         clk_disable(mcfqspi->clk);
 
@@ -523,7 +524,8 @@ static int mcfqspi_runtime_suspend(struct device *dev)
 
 static int mcfqspi_runtime_resume(struct device *dev)
 {
-        struct mcfqspi *mcfqspi = dev_get_drvdata(dev);
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct mcfqspi *mcfqspi = spi_master_get_devdata(master);
 
         clk_enable(mcfqspi->clk);
 
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index ec79f726672a..a25392065d9b 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -420,7 +420,6 @@ static int dspi_suspend(struct device *dev)
 
 static int dspi_resume(struct device *dev)
 {
-
         struct spi_master *master = dev_get_drvdata(dev);
         struct fsl_dspi *dspi = spi_master_get_devdata(master);
 
@@ -504,7 +503,7 @@ static int dspi_probe(struct platform_device *pdev)
         clk_prepare_enable(dspi->clk);
 
         init_waitqueue_head(&dspi->waitq);
-        platform_set_drvdata(pdev, dspi);
+        platform_set_drvdata(pdev, master);
 
         ret = spi_bitbang_start(&dspi->bitbang);
         if (ret != 0) {
@@ -525,7 +524,8 @@ out_master_put:
 
 static int dspi_remove(struct platform_device *pdev)
 {
-        struct fsl_dspi *dspi = platform_get_drvdata(pdev);
+        struct spi_master *master = platform_get_drvdata(pdev);
+        struct fsl_dspi *dspi = spi_master_get_devdata(master);
 
         /* Disconnect from the SPI framework */
         spi_bitbang_stop(&dspi->bitbang);
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index a5474ef9d2a0..47f15d97e7fa 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -948,8 +948,8 @@ static int spi_imx_remove(struct platform_device *pdev)
         spi_bitbang_stop(&spi_imx->bitbang);
 
         writel(0, spi_imx->base + MXC_CSPICTRL);
-        clk_disable_unprepare(spi_imx->clk_ipg);
-        clk_disable_unprepare(spi_imx->clk_per);
+        clk_unprepare(spi_imx->clk_ipg);
+        clk_unprepare(spi_imx->clk_per);
         spi_master_put(master);
 
         return 0;
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index 2e7f38c7a961..88eb57e858b3 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -915,7 +915,7 @@ static void pch_spi_request_dma(struct pch_spi_data *data, int bpw)
         /* Set Tx DMA */
         param = &dma->param_tx;
         param->dma_dev = &dma_dev->dev;
-        param->chan_id = data->master->bus_num * 2; /* Tx = 0, 2 */
+        param->chan_id = data->ch * 2; /* Tx = 0, 2 */;
         param->tx_reg = data->io_base_addr + PCH_SPDWR;
         param->width = width;
         chan = dma_request_channel(mask, pch_spi_filter, param);
@@ -930,7 +930,7 @@ static void pch_spi_request_dma(struct pch_spi_data *data, int bpw)
         /* Set Rx DMA */
         param = &dma->param_rx;
         param->dma_dev = &dma_dev->dev;
-        param->chan_id = data->master->bus_num * 2 + 1; /* Rx = Tx + 1 */
+        param->chan_id = data->ch * 2 + 1; /* Rx = Tx + 1 */;
         param->rx_reg = data->io_base_addr + PCH_SPDRR;
         param->width = width;
         chan = dma_request_channel(mask, pch_spi_filter, param);
@@ -1452,6 +1452,11 @@ static int pch_spi_pd_probe(struct platform_device *plat_dev)
 
         pch_spi_set_master_mode(master);
 
+        if (use_dma) {
+                dev_info(&plat_dev->dev, "Use DMA for data transfers\n");
+                pch_alloc_dma_buf(board_dat, data);
+        }
+
         ret = spi_register_master(master);
         if (ret != 0) {
                 dev_err(&plat_dev->dev,
@@ -1459,14 +1464,10 @@ static int pch_spi_pd_probe(struct platform_device *plat_dev)
                 goto err_spi_register_master;
         }
 
-        if (use_dma) {
-                dev_info(&plat_dev->dev, "Use DMA for data transfers\n");
-                pch_alloc_dma_buf(board_dat, data);
-        }
-
         return 0;
 
 err_spi_register_master:
+        pch_free_dma_buf(board_dat, data);
         free_irq(board_dat->pdev->irq, data);
 err_request_irq:
         pch_spi_free_resources(board_dat, data);
diff --git a/drivers/staging/cxt1e1/linux.c b/drivers/staging/cxt1e1/linux.c
index 4a08e16e42f7..79206cb3fb94 100644
--- a/drivers/staging/cxt1e1/linux.c
+++ b/drivers/staging/cxt1e1/linux.c
@@ -866,6 +866,8 @@ c4_ioctl (struct net_device *ndev, struct ifreq *ifr, int cmd)
             _IOC_SIZE (iocmd));
 #endif
     iolen = _IOC_SIZE (iocmd);
+    if (iolen > sizeof(arg))
+        return -EFAULT;
     data = ifr->ifr_data + sizeof (iocmd);
     if (copy_from_user (&arg, data, iolen))
         return -EFAULT;
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 7f1a7ce4b771..b83ec378d04f 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -785,7 +785,7 @@ static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
         spin_unlock_bh(&conn->cmd_lock);
 
         list_for_each_entry_safe(cmd, cmd_p, &ack_list, i_conn_node) {
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                 iscsit_free_cmd(cmd, false);
         }
 }
@@ -3708,7 +3708,7 @@ iscsit_immediate_queue(struct iscsi_conn *conn, struct iscsi_cmd *cmd, int state
                 break;
         case ISTATE_REMOVE:
                 spin_lock_bh(&conn->cmd_lock);
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 iscsit_free_cmd(cmd, false);
@@ -4151,7 +4151,7 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
         spin_lock_bh(&conn->cmd_lock);
         list_for_each_entry_safe(cmd, cmd_tmp, &conn->conn_cmd_list, i_conn_node) {
 
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 iscsit_increment_maxcmdsn(cmd, sess);
@@ -4196,6 +4196,10 @@ int iscsit_close_connection(
         iscsit_stop_timers_for_cmds(conn);
         iscsit_stop_nopin_response_timer(conn);
         iscsit_stop_nopin_timer(conn);
+
+        if (conn->conn_transport->iscsit_wait_conn)
+                conn->conn_transport->iscsit_wait_conn(conn);
+
         iscsit_free_queue_reqs_for_conn(conn);
 
         /*
diff --git a/drivers/target/iscsi/iscsi_target_erl2.c b/drivers/target/iscsi/iscsi_target_erl2.c
index 33be1fb1df32..4ca8fd2a70db 100644
--- a/drivers/target/iscsi/iscsi_target_erl2.c
+++ b/drivers/target/iscsi/iscsi_target_erl2.c
@@ -138,7 +138,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
                 list_for_each_entry_safe(cmd, cmd_tmp,
                                 &cr->conn_recovery_cmd_list, i_conn_node) {
 
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                         cmd->conn = NULL;
                         spin_unlock(&cr->conn_recovery_cmd_lock);
                         iscsit_free_cmd(cmd, true);
@@ -160,7 +160,7 @@ void iscsit_free_connection_recovery_entires(struct iscsi_session *sess)
                 list_for_each_entry_safe(cmd, cmd_tmp,
                                 &cr->conn_recovery_cmd_list, i_conn_node) {
 
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                         cmd->conn = NULL;
                         spin_unlock(&cr->conn_recovery_cmd_lock);
                         iscsit_free_cmd(cmd, true);
@@ -216,7 +216,7 @@ int iscsit_remove_cmd_from_connection_recovery(
         }
         cr = cmd->cr;
 
-        list_del(&cmd->i_conn_node);
+        list_del_init(&cmd->i_conn_node);
         return --cr->cmd_count;
 }
 
@@ -297,7 +297,7 @@ int iscsit_discard_unacknowledged_ooo_cmdsns_for_conn(struct iscsi_conn *conn)
                 if (!(cmd->cmd_flags & ICF_OOO_CMDSN))
                         continue;
 
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
 
                 spin_unlock_bh(&conn->cmd_lock);
                 iscsit_free_cmd(cmd, true);
@@ -335,7 +335,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
         /*
          * Only perform connection recovery on ISCSI_OP_SCSI_CMD or
          * ISCSI_OP_NOOP_OUT opcodes.  For all other opcodes call
-         * list_del(&cmd->i_conn_node); to release the command to the
+         * list_del_init(&cmd->i_conn_node); to release the command to the
          * session pool and remove it from the connection's list.
          *
          * Also stop the DataOUT timer, which will be restarted after
@@ -351,7 +351,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
                                 " CID: %hu\n", cmd->iscsi_opcode,
                                 cmd->init_task_tag, cmd->cmd_sn, conn->cid);
 
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                         spin_unlock_bh(&conn->cmd_lock);
                         iscsit_free_cmd(cmd, true);
                         spin_lock_bh(&conn->cmd_lock);
@@ -371,7 +371,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
                  */
                 if (!(cmd->cmd_flags & ICF_OOO_CMDSN) && !cmd->immediate_cmd &&
                      iscsi_sna_gte(cmd->cmd_sn, conn->sess->exp_cmd_sn)) {
-                        list_del(&cmd->i_conn_node);
+                        list_del_init(&cmd->i_conn_node);
                         spin_unlock_bh(&conn->cmd_lock);
                         iscsit_free_cmd(cmd, true);
                         spin_lock_bh(&conn->cmd_lock);
@@ -393,7 +393,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
 
                 cmd->sess = conn->sess;
 
-                list_del(&cmd->i_conn_node);
+                list_del_init(&cmd->i_conn_node);
                 spin_unlock_bh(&conn->cmd_lock);
 
                 iscsit_free_all_datain_reqs(cmd);
diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
index 39761837608d..44a5471de00f 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.c
+++ b/drivers/target/iscsi/iscsi_target_tpg.c
@@ -137,7 +137,7 @@ struct iscsi_portal_group *iscsit_get_tpg_from_np(
         list_for_each_entry(tpg, &tiqn->tiqn_tpg_list, tpg_list) {
 
                 spin_lock(&tpg->tpg_state_lock);
-                if (tpg->tpg_state == TPG_STATE_FREE) {
+                if (tpg->tpg_state != TPG_STATE_ACTIVE) {
                         spin_unlock(&tpg->tpg_state_lock);
                         continue;
                 }
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 42f18fc1067b..77e6531fb0a1 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -1079,25 +1079,31 @@ sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read,
         left = sectors * dev->prot_length;
 
         for_each_sg(cmd->t_prot_sg, psg, cmd->t_prot_nents, i) {
-
-                len = min(psg->length, left);
-                if (offset >= sg->length) {
-                        sg = sg_next(sg);
-                        offset = 0;
-                }
+                unsigned int psg_len, copied = 0;
 
                 paddr = kmap_atomic(sg_page(psg)) + psg->offset;
-                addr = kmap_atomic(sg_page(sg)) + sg->offset + offset;
-
-                if (read)
-                        memcpy(paddr, addr, len);
-                else
-                        memcpy(addr, paddr, len);
-
-                left -= len;
-                offset += len;
+                psg_len = min(left, psg->length);
+                while (psg_len) {
+                        len = min(psg_len, sg->length - offset);
+                        addr = kmap_atomic(sg_page(sg)) + sg->offset + offset;
+
+                        if (read)
+                                memcpy(paddr + copied, addr, len);
+                        else
+                                memcpy(addr, paddr + copied, len);
+
+                        left -= len;
+                        offset += len;
+                        copied += len;
+                        psg_len -= len;
+
+                        if (offset >= sg->length) {
+                                sg = sg_next(sg);
+                                offset = 0;
+                        }
+                        kunmap_atomic(addr);
+                }
                 kunmap_atomic(paddr);
-                kunmap_atomic(addr);
         }
 }
 
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index 35c066489a19..5f88d767671e 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -136,6 +136,7 @@ config SPEAR_THERMAL
 config RCAR_THERMAL
         tristate "Renesas R-Car thermal driver"
         depends on ARCH_SHMOBILE || COMPILE_TEST
+        depends on HAS_IOMEM
         help
           Enable this to plug the R-Car thermal sensor driver into the Linux
           thermal framework.
@@ -210,8 +211,16 @@ config ACPI_INT3403_THERMAL
         tristate "ACPI INT3403 thermal driver"
         depends on X86 && ACPI
         help
-          This driver uses ACPI INT3403 device objects. If present, it will
-          register each INT3403 thermal sensor as a thermal zone.
+          Newer laptops and tablets that use ACPI may have thermal sensors
+          outside the core CPU/SOC for thermal safety reasons. These
+          temperature sensors are also exposed for the OS to use via the so
+          called INT3403 ACPI object. This driver will, on devices that have
+          such sensors, expose the temperature information from these sensors
+          to userspace via the normal thermal framework. This means that a wide
+          range of applications and GUI widgets can show this information to
+          the user or use this information for making decisions. For example,
+          the Intel Thermal Daemon can use this information to allow the user
+          to select his laptop to run without turning on the fans.
 
 menu "Texas Instruments thermal drivers"
 source "drivers/thermal/ti-soc-thermal/Kconfig"
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 338a88bf6662..71b0ec0c370d 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -56,10 +56,15 @@ static LIST_HEAD(thermal_governor_list);
 static DEFINE_MUTEX(thermal_list_lock);
 static DEFINE_MUTEX(thermal_governor_lock);
 
+static struct thermal_governor *def_governor;
+
 static struct thermal_governor *__find_governor(const char *name)
 {
         struct thermal_governor *pos;
 
+        if (!name || !name[0])
+                return def_governor;
+
         list_for_each_entry(pos, &thermal_governor_list, governor_list)
                 if (!strnicmp(name, pos->name, THERMAL_NAME_LENGTH))
                         return pos;
@@ -82,17 +87,23 @@ int thermal_register_governor(struct thermal_governor *governor)
         if (__find_governor(governor->name) == NULL) {
                 err = 0;
                 list_add(&governor->governor_list, &thermal_governor_list);
+                if (!def_governor && !strncmp(governor->name,
+                        DEFAULT_THERMAL_GOVERNOR, THERMAL_NAME_LENGTH))
+                        def_governor = governor;
         }
 
         mutex_lock(&thermal_list_lock);
 
         list_for_each_entry(pos, &thermal_tz_list, node) {
+                /*
+                 * only thermal zones with specified tz->tzp->governor_name
+                 * may run with tz->govenor unset
+                 */
                 if (pos->governor)
                         continue;
-                if (pos->tzp)
-                        name = pos->tzp->governor_name;
-                else
-                        name = DEFAULT_THERMAL_GOVERNOR;
+
+                name = pos->tzp->governor_name;
+
                 if (!strnicmp(name, governor->name, THERMAL_NAME_LENGTH))
                         pos->governor = governor;
         }
@@ -342,8 +353,8 @@ static void monitor_thermal_zone(struct thermal_zone_device *tz)
 static void handle_non_critical_trips(struct thermal_zone_device *tz,
                         int trip, enum thermal_trip_type trip_type)
 {
-        if (tz->governor)
-                tz->governor->throttle(tz, trip);
+        tz->governor ? tz->governor->throttle(tz, trip) :
+                       def_governor->throttle(tz, trip);
 }
 
 static void handle_critical_trips(struct thermal_zone_device *tz,
@@ -1107,7 +1118,7 @@ __thermal_cooling_device_register(struct device_node *np,
         INIT_LIST_HEAD(&cdev->thermal_instances);
         cdev->np = np;
         cdev->ops = ops;
-        cdev->updated = true;
+        cdev->updated = false;
         cdev->device.class = &thermal_class;
         cdev->devdata = devdata;
         dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
@@ -1533,7 +1544,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
         if (tz->tzp)
                 tz->governor = __find_governor(tz->tzp->governor_name);
         else
-                tz->governor = __find_governor(DEFAULT_THERMAL_GOVERNOR);
+                tz->governor = def_governor;
 
         mutex_unlock(&thermal_governor_lock);
 
diff --git a/drivers/thermal/x86_pkg_temp_thermal.c b/drivers/thermal/x86_pkg_temp_thermal.c
index 972e1c73722a..081fd7e6a9f0 100644
--- a/drivers/thermal/x86_pkg_temp_thermal.c
+++ b/drivers/thermal/x86_pkg_temp_thermal.c
@@ -68,6 +68,10 @@ struct phy_dev_entry {
         struct thermal_zone_device *tzone;
 };
 
+static const struct thermal_zone_params pkg_temp_tz_params = {
+        .no_hwmon       = true,
+};
+
 /* List maintaining number of package instances */
 static LIST_HEAD(phy_dev_list);
 static DEFINE_MUTEX(phy_dev_list_mutex);
@@ -394,7 +398,6 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
         int err;
         u32 tj_max;
         struct phy_dev_entry *phy_dev_entry;
-        char buffer[30];
         int thres_count;
         u32 eax, ebx, ecx, edx;
         u8 *temp;
@@ -440,13 +443,11 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
         phy_dev_entry->first_cpu = cpu;
         phy_dev_entry->tj_max = tj_max;
         phy_dev_entry->ref_cnt = 1;
-        snprintf(buffer, sizeof(buffer), "pkg-temp-%d\n",
-                                        phy_dev_entry->phys_proc_id);
-        phy_dev_entry->tzone = thermal_zone_device_register(buffer,
+        phy_dev_entry->tzone = thermal_zone_device_register("x86_pkg_temp",
                         thres_count,
                         (thres_count == MAX_NUMBER_OF_TRIPS) ?
                                 0x03 : 0x01,
-                        phy_dev_entry, &tzone_ops, NULL, 0, 0);
+                        phy_dev_entry, &tzone_ops, &pkg_temp_tz_params, 0, 0);
         if (IS_ERR(phy_dev_entry->tzone)) {
                 err = PTR_ERR(phy_dev_entry->tzone);
                 goto err_ret_free;
diff --git a/drivers/tty/serial/sunhv.c b/drivers/tty/serial/sunhv.c
index cf86e729532b..dc697cee248a 100644
--- a/drivers/tty/serial/sunhv.c
+++ b/drivers/tty/serial/sunhv.c
@@ -433,13 +433,10 @@ static void sunhv_console_write_paged(struct console *con, const char *s, unsign
         unsigned long flags;
         int locked = 1;
 
-        local_irq_save(flags);
-        if (port->sysrq) {
-                locked = 0;
-        } else if (oops_in_progress) {
-                locked = spin_trylock(&port->lock);
-        } else
-                spin_lock(&port->lock);
+        if (port->sysrq || oops_in_progress)
+                locked = spin_trylock_irqsave(&port->lock, flags);
+        else
+                spin_lock_irqsave(&port->lock, flags);
 
         while (n > 0) {
                 unsigned long ra = __pa(con_write_page);
@@ -470,8 +467,7 @@ static void sunhv_console_write_paged(struct console *con, const char *s, unsign
         }
 
         if (locked)
-                spin_unlock(&port->lock);
-        local_irq_restore(flags);
+                spin_unlock_irqrestore(&port->lock, flags);
 }
 
 static inline void sunhv_console_putchar(struct uart_port *port, char c)
@@ -492,7 +488,10 @@ static void sunhv_console_write_bychar(struct console *con, const char *s, unsig
         unsigned long flags;
         int i, locked = 1;
 
-        local_irq_save(flags);
+        if (port->sysrq || oops_in_progress)
+                locked = spin_trylock_irqsave(&port->lock, flags);
+        else
+                spin_lock_irqsave(&port->lock, flags);
         if (port->sysrq) {
                 locked = 0;
         } else if (oops_in_progress) {
@@ -507,8 +506,7 @@ static void sunhv_console_write_bychar(struct console *con, const char *s, unsig
         }
 
         if (locked)
-                spin_unlock(&port->lock);
-        local_irq_restore(flags);
+                spin_unlock_irqrestore(&port->lock, flags);
 }
 
 static struct console sunhv_console = {
diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c
index 380fb5355cb2..5faa8e905e98 100644
--- a/drivers/tty/serial/sunsab.c
+++ b/drivers/tty/serial/sunsab.c
@@ -844,20 +844,16 @@ static void sunsab_console_write(struct console *con, const char *s, unsigned n)
         unsigned long flags;
         int locked = 1;
 
-        local_irq_save(flags);
-        if (up->port.sysrq) {
-                locked = 0;
-        } else if (oops_in_progress) {
-                locked = spin_trylock(&up->port.lock);
-        } else
-                spin_lock(&up->port.lock);
+        if (up->port.sysrq || oops_in_progress)
+                locked = spin_trylock_irqsave(&up->port.lock, flags);
+        else
+                spin_lock_irqsave(&up->port.lock, flags);
 
         uart_console_write(&up->port, s, n, sunsab_console_putchar);
         sunsab_tec_wait(up);
 
         if (locked)
-                spin_unlock(&up->port.lock);
-        local_irq_restore(flags);
+                spin_unlock_irqrestore(&up->port.lock, flags);
 }
 
 static int sunsab_console_setup(struct console *con, char *options)
diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
index db79b76f5c8e..9a0f24f83720 100644
--- a/drivers/tty/serial/sunsu.c
+++ b/drivers/tty/serial/sunsu.c
@@ -1295,13 +1295,10 @@ static void sunsu_console_write(struct console *co, const char *s,
         unsigned int ier;
         int locked = 1;
 
-        local_irq_save(flags);
-        if (up->port.sysrq) {
-                locked = 0;
-        } else if (oops_in_progress) {
-                locked = spin_trylock(&up->port.lock);
-        } else
-                spin_lock(&up->port.lock);
+        if (up->port.sysrq || oops_in_progress)
+                locked = spin_trylock_irqsave(&up->port.lock, flags);
+        else
+                spin_lock_irqsave(&up->port.lock, flags);
 
         /*
          *      First save the UER then disable the interrupts
@@ -1319,8 +1316,7 @@ static void sunsu_console_write(struct console *co, const char *s,
         serial_out(up, UART_IER, ier);
 
         if (locked)
-                spin_unlock(&up->port.lock);
-        local_irq_restore(flags);
+                spin_unlock_irqrestore(&up->port.lock, flags);
 }
 
 /*
diff --git a/drivers/tty/serial/sunzilog.c b/drivers/tty/serial/sunzilog.c
index 45a8c6aa5837..a2c40ed287d2 100644
--- a/drivers/tty/serial/sunzilog.c
+++ b/drivers/tty/serial/sunzilog.c
@@ -1195,20 +1195,16 @@ sunzilog_console_write(struct console *con, const char *s, unsigned int count)
         unsigned long flags;
         int locked = 1;
 
-        local_irq_save(flags);
-        if (up->port.sysrq) {
-                locked = 0;
-        } else if (oops_in_progress) {
-                locked = spin_trylock(&up->port.lock);
-        } else
-                spin_lock(&up->port.lock);
+        if (up->port.sysrq || oops_in_progress)
+                locked = spin_trylock_irqsave(&up->port.lock, flags);
+        else
+                spin_lock_irqsave(&up->port.lock, flags);
 
         uart_console_write(&up->port, s, count, sunzilog_putchar);
         udelay(2);
 
         if (locked)
-                spin_unlock(&up->port.lock);
-        local_irq_restore(flags);
+                spin_unlock_irqrestore(&up->port.lock, flags);
 }
 
 static int __init sunzilog_console_setup(struct console *con, char *options)
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 8d72f0c65937..062967c90b2a 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -717,6 +717,10 @@ int usb_get_configuration(struct usb_device *dev)
                         result = -ENOMEM;
                         goto err;
                 }
+
+                if (dev->quirks & USB_QUIRK_DELAY_INIT)
+                        msleep(100);
+
                 result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
                     bigbuffer, length);
                 if (result < 0) {
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 8f37063c0a49..739ee8e8bdfd 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -47,6 +47,10 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Microsoft LifeCam-VX700 v2.0 */
         { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Logitech HD Pro Webcams C920 and C930e */
+        { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+        { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+
         /* Logitech Quickcam Fusion */
         { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6fe577d46fa2..924a6ccdb622 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4733,6 +4733,9 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
         /* Accept arbitrarily long scatter-gather lists */
         hcd->self.sg_tablesize = ~0;
 
+        /* support to build packet from discontinuous buffers */
+        hcd->self.no_sg_constraint = 1;
+
         /* XHCI controllers don't stop the ep queue on short packets :| */
         hcd->self.no_stop_on_short = 1;
 
@@ -4757,14 +4760,6 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
                 /* xHCI private pointer was set in xhci_pci_probe for the second
                  * registered roothub.
                  */
-                xhci = hcd_to_xhci(hcd);
-                /*
-                 * Support arbitrarily aligned sg-list entries on hosts without
-                 * TD fragment rules (which are currently unsupported).
-                 */
-                if (xhci->hci_version < 0x100)
-                        hcd->self.no_sg_constraint = 1;
-
                 return 0;
         }
 
@@ -4793,9 +4788,6 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
         if (xhci->hci_version > 0x96)
                 xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
 
-        if (xhci->hci_version < 0x100)
-                hcd->self.no_sg_constraint = 1;
-
         /* Make sure the HC is halted. */
         retval = xhci_halt(xhci);
         if (retval)
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 4fb7a8f83c8a..54af4e933695 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -186,12 +186,12 @@ static bool is_invalid_reserved_pfn(unsigned long pfn)
         if (pfn_valid(pfn)) {
                 bool reserved;
                 struct page *tail = pfn_to_page(pfn);
-                struct page *head = compound_trans_head(tail);
+                struct page *head = compound_head(tail);
                 reserved = !!(PageReserved(head));
                 if (head != tail) {
                         /*
                          * "head" is not a dangling pointer
-                         * (compound_trans_head takes care of that)
+                         * (compound_head takes care of that)
                          * but the hugepage may have been split
                          * from under us (and we may not hold a
                          * reference count on the head page so it can
diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
index 0129b78a6908..4f70f383132c 100644
--- a/fs/bio-integrity.c
+++ b/fs/bio-integrity.c
@@ -458,11 +458,10 @@ static int bio_integrity_verify(struct bio *bio)
         struct blk_integrity_exchg bix;
         struct bio_vec *bv;
         sector_t sector = bio->bi_integrity->bip_iter.bi_sector;
-        unsigned int sectors, total, ret;
+        unsigned int sectors, ret = 0;
         void *prot_buf = bio->bi_integrity->bip_buf;
         int i;
 
-        ret = total = 0;
         bix.disk_name = bio->bi_bdev->bd_disk->disk_name;
         bix.sector_size = bi->sector_size;
 
@@ -484,8 +483,6 @@ static int bio_integrity_verify(struct bio *bio)
                 sectors = bv->bv_len / bi->sector_size;
                 sector += sectors;
                 prot_buf += sectors * bi->tuple_size;
-                total += sectors * bi->tuple_size;
-                BUG_ON(total > bio->bi_integrity->bip_iter.bi_size);
 
                 kunmap_atomic(kaddr);
         }
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index cf32f0393369..c0f3718b77a8 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -513,7 +513,7 @@ struct cifs_mnt_data {
 static inline unsigned int
 get_rfc1002_length(void *buf)
 {
-        return be32_to_cpu(*((__be32 *)buf));
+        return be32_to_cpu(*((__be32 *)buf)) & 0xffffff;
 }
 
 static inline void
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 53c15074bb36..834fce759d80 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2579,31 +2579,19 @@ cifs_writev(struct kiocb *iocb, const struct iovec *iov,
         struct cifsInodeInfo *cinode = CIFS_I(inode);
         struct TCP_Server_Info *server = tlink_tcon(cfile->tlink)->ses->server;
         ssize_t rc = -EACCES;
+        loff_t lock_pos = pos;
 
-        BUG_ON(iocb->ki_pos != pos);
-
+        if (file->f_flags & O_APPEND)
+                lock_pos = i_size_read(inode);
         /*
          * We need to hold the sem to be sure nobody modifies lock list
          * with a brlock that prevents writing.
          */
         down_read(&cinode->lock_sem);
-        if (!cifs_find_lock_conflict(cfile, pos, iov_length(iov, nr_segs),
+        if (!cifs_find_lock_conflict(cfile, lock_pos, iov_length(iov, nr_segs),
                                      server->vals->exclusive_lock_type, NULL,
-                                     CIFS_WRITE_OP)) {
-                mutex_lock(&inode->i_mutex);
-                rc = __generic_file_aio_write(iocb, iov, nr_segs,
-                                               &iocb->ki_pos);
-                mutex_unlock(&inode->i_mutex);
-        }
-
-        if (rc > 0) {
-                ssize_t err;
-
-                err = generic_write_sync(file, iocb->ki_pos - rc, rc);
-                if (err < 0)
-                        rc = err;
-        }
-
+                                     CIFS_WRITE_OP))
+                rc = generic_file_aio_write(iocb, iov, nr_segs, pos);
         up_read(&cinode->lock_sem);
         return rc;
 }
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index b37570952846..18cd5650a5fc 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -270,6 +270,26 @@ cifs_rqst_page_to_kvec(struct smb_rqst *rqst, unsigned int idx,
                 iov->iov_len = rqst->rq_pagesz;
 }
 
+static unsigned long
+rqst_len(struct smb_rqst *rqst)
+{
+        unsigned int i;
+        struct kvec *iov = rqst->rq_iov;
+        unsigned long buflen = 0;
+
+        /* total up iov array first */
+        for (i = 0; i < rqst->rq_nvec; i++)
+                buflen += iov[i].iov_len;
+
+        /* add in the page array if there is one */
+        if (rqst->rq_npages) {
+                buflen += rqst->rq_pagesz * (rqst->rq_npages - 1);
+                buflen += rqst->rq_tailsz;
+        }
+
+        return buflen;
+}
+
 static int
 smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
 {
@@ -277,6 +297,7 @@ smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
         struct kvec *iov = rqst->rq_iov;
         int n_vec = rqst->rq_nvec;
         unsigned int smb_buf_length = get_rfc1002_length(iov[0].iov_base);
+        unsigned long send_length;
         unsigned int i;
         size_t total_len = 0, sent;
         struct socket *ssocket = server->ssocket;
@@ -285,6 +306,14 @@ smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
         if (ssocket == NULL)
                 return -ENOTSOCK;
 
+        /* sanity check send length */
+        send_length = rqst_len(rqst);
+        if (send_length != smb_buf_length + 4) {
+                WARN(1, "Send length mismatch(send_length=%lu smb_buf_length=%u)\n",
+                        send_length, smb_buf_length);
+                return -EIO;
+        }
+
         cifs_dbg(FYI, "Sending smb: smb_len=%u\n", smb_buf_length);
         dump_smb(iov[0].iov_base, iov[0].iov_len);
 
diff --git a/fs/file.c b/fs/file.c
index db25c2bdfe46..60a45e9f5323 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -683,35 +683,65 @@ EXPORT_SYMBOL(fget_raw);
  * The fput_needed flag returned by fget_light should be passed to the
  * corresponding fput_light.
  */
-struct file *__fget_light(unsigned int fd, fmode_t mask, int *fput_needed)
+static unsigned long __fget_light(unsigned int fd, fmode_t mask)
 {
         struct files_struct *files = current->files;
         struct file *file;
 
-        *fput_needed = 0;
         if (atomic_read(&files->count) == 1) {
                 file = __fcheck_files(files, fd);
-                if (file && (file->f_mode & mask))
-                        file = NULL;
+                if (!file || unlikely(file->f_mode & mask))
+                        return 0;
+                return (unsigned long)file;
         } else {
                 file = __fget(fd, mask);
-                if (file)
-                        *fput_needed = 1;
+                if (!file)
+                        return 0;
+                return FDPUT_FPUT | (unsigned long)file;
         }
-
-        return file;
 }
-struct file *fget_light(unsigned int fd, int *fput_needed)
+unsigned long __fdget(unsigned int fd)
 {
-        return __fget_light(fd, FMODE_PATH, fput_needed);
+        return __fget_light(fd, FMODE_PATH);
 }
-EXPORT_SYMBOL(fget_light);
+EXPORT_SYMBOL(__fdget);
 
-struct file *fget_raw_light(unsigned int fd, int *fput_needed)
+unsigned long __fdget_raw(unsigned int fd)
 {
-        return __fget_light(fd, 0, fput_needed);
+        return __fget_light(fd, 0);
+}
+
+unsigned long __fdget_pos(unsigned int fd)
+{
+        struct files_struct *files = current->files;
+        struct file *file;
+        unsigned long v;
+
+        if (atomic_read(&files->count) == 1) {
+                file = __fcheck_files(files, fd);
+                v = 0;
+        } else {
+                file = __fget(fd, 0);
+                v = FDPUT_FPUT;
+        }
+        if (!file)
+                return 0;
+
+        if (file->f_mode & FMODE_ATOMIC_POS) {
+                if (file_count(file) > 1) {
+                        v |= FDPUT_POS_UNLOCK;
+                        mutex_lock(&file->f_pos_lock);
+                }
+        }
+        return v | (unsigned long)file;
 }
 
+/*
+ * We only lock f_pos if we have threads or if the file might be
+ * shared with another process. In both cases we'll have an elevated
+ * file count (done either by fdget() or by fork()).
+ */
+
 void set_close_on_exec(unsigned int fd, int flag)
 {
         struct files_struct *files = current->files;
diff --git a/fs/file_table.c b/fs/file_table.c
index 5fff9030be34..5b24008ea4f6 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -135,6 +135,7 @@ struct file *get_empty_filp(void)
         atomic_long_set(&f->f_count, 1);
         rwlock_init(&f->f_owner.lock);
         spin_lock_init(&f->f_lock);
+        mutex_init(&f->f_pos_lock);
         eventpoll_init_file(f);
         /* f->f_version: 0 */
         return f;
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index 968ce411db53..32602c667b4a 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -103,6 +103,8 @@ static int hfsplus_cat_build_record(hfsplus_cat_entry *entry,
                 folder = &entry->folder;
                 memset(folder, 0, sizeof(*folder));
                 folder->type = cpu_to_be16(HFSPLUS_FOLDER);
+                if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags))
+                        folder->flags |= cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT);
                 folder->id = cpu_to_be32(inode->i_ino);
                 HFSPLUS_I(inode)->create_date =
                         folder->create_date =
@@ -203,6 +205,36 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
         return hfs_brec_find(fd, hfs_find_rec_by_key);
 }
 
+static void hfsplus_subfolders_inc(struct inode *dir)
+{
+        struct hfsplus_sb_info *sbi = HFSPLUS_SB(dir->i_sb);
+
+        if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags)) {
+                /*
+                 * Increment subfolder count. Note, the value is only meaningful
+                 * for folders with HFSPLUS_HAS_FOLDER_COUNT flag set.
+                 */
+                HFSPLUS_I(dir)->subfolders++;
+        }
+}
+
+static void hfsplus_subfolders_dec(struct inode *dir)
+{
+        struct hfsplus_sb_info *sbi = HFSPLUS_SB(dir->i_sb);
+
+        if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags)) {
+                /*
+                 * Decrement subfolder count. Note, the value is only meaningful
+                 * for folders with HFSPLUS_HAS_FOLDER_COUNT flag set.
+                 *
+                 * Check for zero. Some subfolders may have been created
+                 * by an implementation ignorant of this counter.
+                 */
+                if (HFSPLUS_I(dir)->subfolders)
+                        HFSPLUS_I(dir)->subfolders--;
+        }
+}
+
 int hfsplus_create_cat(u32 cnid, struct inode *dir,
                 struct qstr *str, struct inode *inode)
 {
@@ -247,6 +279,8 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
                 goto err1;
 
         dir->i_size++;
+        if (S_ISDIR(inode->i_mode))
+                hfsplus_subfolders_inc(dir);
         dir->i_mtime = dir->i_ctime = CURRENT_TIME_SEC;
         hfsplus_mark_inode_dirty(dir, HFSPLUS_I_CAT_DIRTY);
 
@@ -336,6 +370,8 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
                 goto out;
 
         dir->i_size--;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_dec(dir);
         dir->i_mtime = dir->i_ctime = CURRENT_TIME_SEC;
         hfsplus_mark_inode_dirty(dir, HFSPLUS_I_CAT_DIRTY);
 
@@ -380,6 +416,7 @@ int hfsplus_rename_cat(u32 cnid,
 
         hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
                                 src_fd.entrylength);
+        type = be16_to_cpu(entry.type);
 
         /* create new dir entry with the data from the old entry */
         hfsplus_cat_build_key(sb, dst_fd.search_key, dst_dir->i_ino, dst_name);
@@ -394,6 +431,8 @@ int hfsplus_rename_cat(u32 cnid,
         if (err)
                 goto out;
         dst_dir->i_size++;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_inc(dst_dir);
         dst_dir->i_mtime = dst_dir->i_ctime = CURRENT_TIME_SEC;
 
         /* finally remove the old entry */
@@ -405,6 +444,8 @@ int hfsplus_rename_cat(u32 cnid,
         if (err)
                 goto out;
         src_dir->i_size--;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_dec(src_dir);
         src_dir->i_mtime = src_dir->i_ctime = CURRENT_TIME_SEC;
 
         /* remove old thread entry */
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index 08846425b67f..62d571eb69ba 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -242,6 +242,7 @@ struct hfsplus_inode_info {
          */
         sector_t fs_blocks;
         u8 userflags;           /* BSD user file flags */
+        u32 subfolders;         /* Subfolder count (HFSX only) */
         struct list_head open_dir_list;
         loff_t phys_size;
 
diff --git a/fs/hfsplus/hfsplus_raw.h b/fs/hfsplus/hfsplus_raw.h
index 8ffb3a8ffe75..5a126828d85e 100644
--- a/fs/hfsplus/hfsplus_raw.h
+++ b/fs/hfsplus/hfsplus_raw.h
@@ -261,7 +261,7 @@ struct hfsplus_cat_folder {
         struct DInfo user_info;
         struct DXInfo finder_info;
         __be32 text_encoding;
-        u32 reserved;
+        __be32 subfolders;      /* Subfolder count in HFSX. Reserved in HFS+. */
 } __packed;
 
 /* HFS file info (stolen from hfs.h) */
@@ -301,11 +301,13 @@ struct hfsplus_cat_file {
         struct hfsplus_fork_raw rsrc_fork;
 } __packed;
 
-/* File attribute bits */
+/* File and folder flag bits */
 #define HFSPLUS_FILE_LOCKED             0x0001
 #define HFSPLUS_FILE_THREAD_EXISTS      0x0002
 #define HFSPLUS_XATTR_EXISTS            0x0004
 #define HFSPLUS_ACL_EXISTS              0x0008
+#define HFSPLUS_HAS_FOLDER_COUNT        0x0010  /* Folder has subfolder count
+                                                 * (HFSX only) */
 
 /* HFS+ catalog thread (part of a cat_entry) */
 struct hfsplus_cat_thread {
diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index fa929f325f87..a4f45bd88a63 100644
--- a/fs/hfsplus/inode.c
+++ b/fs/hfsplus/inode.c
@@ -375,6 +375,7 @@ struct inode *hfsplus_new_inode(struct super_block *sb, umode_t mode)
         hip->extent_state = 0;
         hip->flags = 0;
         hip->userflags = 0;
+        hip->subfolders = 0;
         memset(hip->first_extents, 0, sizeof(hfsplus_extent_rec));
         memset(hip->cached_extents, 0, sizeof(hfsplus_extent_rec));
         hip->alloc_blocks = 0;
@@ -494,6 +495,10 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
                 inode->i_ctime = hfsp_mt2ut(folder->attribute_mod_date);
                 HFSPLUS_I(inode)->create_date = folder->create_date;
                 HFSPLUS_I(inode)->fs_blocks = 0;
+                if (folder->flags & cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT)) {
+                        HFSPLUS_I(inode)->subfolders =
+                                be32_to_cpu(folder->subfolders);
+                }
                 inode->i_op = &hfsplus_dir_inode_operations;
                 inode->i_fop = &hfsplus_dir_operations;
         } else if (type == HFSPLUS_FILE) {
@@ -566,6 +571,10 @@ int hfsplus_cat_write_inode(struct inode *inode)
                 folder->content_mod_date = hfsp_ut2mt(inode->i_mtime);
                 folder->attribute_mod_date = hfsp_ut2mt(inode->i_ctime);
                 folder->valence = cpu_to_be32(inode->i_size - 2);
+                if (folder->flags & cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT)) {
+                        folder->subfolders =
+                                cpu_to_be32(HFSPLUS_I(inode)->subfolders);
+                }
                 hfs_bnode_write(fd.bnode, &entry, fd.entryoffset,
                                          sizeof(struct hfsplus_cat_folder));
         } else if (HFSPLUS_IS_RSRC(inode)) {
diff --git a/fs/hfsplus/options.c b/fs/hfsplus/options.c
index 968eab5bc1f5..68537e8b7a09 100644
--- a/fs/hfsplus/options.c
+++ b/fs/hfsplus/options.c
@@ -75,7 +75,7 @@ int hfsplus_parse_options_remount(char *input, int *force)
         int token;
 
         if (!input)
-                return 0;
+                return 1;
 
         while ((p = strsep(&input, ",")) != NULL) {
                 if (!*p)
diff --git a/fs/namei.c b/fs/namei.c
index 385f7817bfcc..2f730ef9b4b3 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1884,7 +1884,7 @@ static int path_init(int dfd, const char *name, unsigned int flags,
 
                 nd->path = f.file->f_path;
                 if (flags & LOOKUP_RCU) {
-                        if (f.need_put)
+                        if (f.flags & FDPUT_FPUT)
                                 *fp = f.file;
                         nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
                         rcu_read_lock();
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index ef792f29f831..5d8ccecf5f5c 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -659,16 +659,19 @@ int nfs_async_inode_return_delegation(struct inode *inode,
 
         rcu_read_lock();
         delegation = rcu_dereference(NFS_I(inode)->delegation);
+        if (delegation == NULL)
+                goto out_enoent;
 
-        if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid)) {
-                rcu_read_unlock();
-                return -ENOENT;
-        }
+        if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid))
+                goto out_enoent;
         nfs_mark_return_delegation(server, delegation);
         rcu_read_unlock();
 
         nfs_delegation_run_state_manager(clp);
         return 0;
+out_enoent:
+        rcu_read_unlock();
+        return -ENOENT;
 }
 
 static struct inode *
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 12c8132ad408..b9a35c05b60f 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -324,8 +324,9 @@ static void filelayout_read_prepare(struct rpc_task *task, void *data)
                         &rdata->res.seq_res,
                         task))
                 return;
-        nfs4_set_rw_stateid(&rdata->args.stateid, rdata->args.context,
-                        rdata->args.lock_context, FMODE_READ);
+        if (nfs4_set_rw_stateid(&rdata->args.stateid, rdata->args.context,
+                        rdata->args.lock_context, FMODE_READ) == -EIO)
+                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
 }
 
 static void filelayout_read_call_done(struct rpc_task *task, void *data)
@@ -435,8 +436,9 @@ static void filelayout_write_prepare(struct rpc_task *task, void *data)
                         &wdata->res.seq_res,
                         task))
                 return;
-        nfs4_set_rw_stateid(&wdata->args.stateid, wdata->args.context,
-                        wdata->args.lock_context, FMODE_WRITE);
+        if (nfs4_set_rw_stateid(&wdata->args.stateid, wdata->args.context,
+                        wdata->args.lock_context, FMODE_WRITE) == -EIO)
+                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
 }
 
 static void filelayout_write_call_done(struct rpc_task *task, void *data)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 2da6a698b8f7..450bfedbe2f4 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2398,13 +2398,16 @@ static int _nfs4_do_setattr(struct inode *inode, struct rpc_cred *cred,
 
         if (nfs4_copy_delegation_stateid(&arg.stateid, inode, fmode)) {
                 /* Use that stateid */
-        } else if (truncate && state != NULL && nfs4_valid_open_stateid(state)) {
+        } else if (truncate && state != NULL) {
                 struct nfs_lockowner lockowner = {
                         .l_owner = current->files,
                         .l_pid = current->tgid,
                 };
-                nfs4_select_rw_stateid(&arg.stateid, state, FMODE_WRITE,
-                                &lockowner);
+                if (!nfs4_valid_open_stateid(state))
+                        return -EBADF;
+                if (nfs4_select_rw_stateid(&arg.stateid, state, FMODE_WRITE,
+                                &lockowner) == -EIO)
+                        return -EBADF;
         } else
                 nfs4_stateid_copy(&arg.stateid, &zero_stateid);
 
@@ -4011,8 +4014,9 @@ static bool nfs4_stateid_is_current(nfs4_stateid *stateid,
 {
         nfs4_stateid current_stateid;
 
-        if (nfs4_set_rw_stateid(&current_stateid, ctx, l_ctx, fmode))
-                return false;
+        /* If the current stateid represents a lost lock, then exit */
+        if (nfs4_set_rw_stateid(&current_stateid, ctx, l_ctx, fmode) == -EIO)
+                return true;
         return nfs4_stateid_match(stateid, &current_stateid);
 }
 
@@ -5828,8 +5832,7 @@ struct nfs_release_lockowner_data {
         struct nfs4_lock_state *lsp;
         struct nfs_server *server;
         struct nfs_release_lockowner_args args;
-        struct nfs4_sequence_args seq_args;
-        struct nfs4_sequence_res seq_res;
+        struct nfs_release_lockowner_res res;
         unsigned long timestamp;
 };
 
@@ -5837,7 +5840,7 @@ static void nfs4_release_lockowner_prepare(struct rpc_task *task, void *calldata
 {
         struct nfs_release_lockowner_data *data = calldata;
         nfs40_setup_sequence(data->server,
-                                &data->seq_args, &data->seq_res, task);
+                                &data->args.seq_args, &data->res.seq_res, task);
         data->timestamp = jiffies;
 }
 
@@ -5846,7 +5849,7 @@ static void nfs4_release_lockowner_done(struct rpc_task *task, void *calldata)
         struct nfs_release_lockowner_data *data = calldata;
         struct nfs_server *server = data->server;
 
-        nfs40_sequence_done(task, &data->seq_res);
+        nfs40_sequence_done(task, &data->res.seq_res);
 
         switch (task->tk_status) {
         case 0:
@@ -5887,7 +5890,6 @@ static int nfs4_release_lockowner(struct nfs_server *server, struct nfs4_lock_st
         data = kmalloc(sizeof(*data), GFP_NOFS);
         if (!data)
                 return -ENOMEM;
-        nfs4_init_sequence(&data->seq_args, &data->seq_res, 0);
         data->lsp = lsp;
         data->server = server;
         data->args.lock_owner.clientid = server->nfs_client->cl_clientid;
@@ -5895,6 +5897,8 @@ static int nfs4_release_lockowner(struct nfs_server *server, struct nfs4_lock_st
         data->args.lock_owner.s_dev = server->s_dev;
 
         msg.rpc_argp = &data->args;
+        msg.rpc_resp = &data->res;
+        nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 0);
         rpc_call_async(server->client, &msg, 0, &nfs4_release_lockowner_ops, data);
         return 0;
 }
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index e1a47217c05e..0deb32105ccf 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -974,9 +974,6 @@ static int nfs4_copy_lock_stateid(nfs4_stateid *dst,
         else if (lsp != NULL && test_bit(NFS_LOCK_INITIALIZED, &lsp->ls_flags) != 0) {
                 nfs4_stateid_copy(dst, &lsp->ls_stateid);
                 ret = 0;
-                smp_rmb();
-                if (!list_empty(&lsp->ls_seqid.list))
-                        ret = -EWOULDBLOCK;
         }
         spin_unlock(&state->state_lock);
         nfs4_put_lock_state(lsp);
@@ -984,10 +981,9 @@ out:
         return ret;
 }
 
-static int nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
+static void nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
 {
         const nfs4_stateid *src;
-        int ret;
         int seq;
 
         do {
@@ -996,12 +992,7 @@ static int nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
                 if (test_bit(NFS_OPEN_STATE, &state->flags))
                         src = &state->open_stateid;
                 nfs4_stateid_copy(dst, src);
-                ret = 0;
-                smp_rmb();
-                if (!list_empty(&state->owner->so_seqid.list))
-                        ret = -EWOULDBLOCK;
         } while (read_seqretry(&state->seqlock, seq));
-        return ret;
 }
 
 /*
@@ -1026,7 +1017,8 @@ int nfs4_select_rw_stateid(nfs4_stateid *dst, struct nfs4_state *state,
                  * choose to use.
                  */
                 goto out;
-        ret = nfs4_copy_open_stateid(dst, state);
+        nfs4_copy_open_stateid(dst, state);
+        ret = 0;
 out:
         if (nfs_server_capable(state->inode, NFS_CAP_STATEID_NFSV41))
                 dst->seqid = 0;
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 8450262bcf2a..51632c40e896 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -2393,8 +2393,8 @@ out_dio:
 
         if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
             ((file->f_flags & O_DIRECT) && !direct_io)) {
-                ret = filemap_fdatawrite_range(file->f_mapping, pos,
-                                               pos + count - 1);
+                ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
+                                               *ppos + count - 1);
                 if (ret < 0)
                         written = ret;
 
@@ -2407,8 +2407,8 @@ out_dio:
                 }
 
                 if (!ret)
-                        ret = filemap_fdatawait_range(file->f_mapping, pos,
-                                                      pos + count - 1);
+                        ret = filemap_fdatawait_range(file->f_mapping, *ppos,
+                                                      *ppos + count - 1);
         }
 
         /*
diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
index aaa50611ec66..d7b5108789e2 100644
--- a/fs/ocfs2/quota_global.c
+++ b/fs/ocfs2/quota_global.c
@@ -717,6 +717,12 @@ static int ocfs2_release_dquot(struct dquot *dquot)
          */
         if (status < 0)
                 mlog_errno(status);
+        /*
+         * Clear dq_off so that we search for the structure in quota file next
+         * time we acquire it. The structure might be deleted and reallocated
+         * elsewhere by another node while our dquot structure is on freelist.
+         */
+        dquot->dq_off = 0;
         clear_bit(DQ_ACTIVE_B, &dquot->dq_flags);
 out_trans:
         ocfs2_commit_trans(osb, handle);
@@ -756,16 +762,17 @@ static int ocfs2_acquire_dquot(struct dquot *dquot)
         status = ocfs2_lock_global_qf(info, 1);
         if (status < 0)
                 goto out;
-        if (!test_bit(DQ_READ_B, &dquot->dq_flags)) {
-                status = ocfs2_qinfo_lock(info, 0);
-                if (status < 0)
-                        goto out_dq;
-                status = qtree_read_dquot(&info->dqi_gi, dquot);
-                ocfs2_qinfo_unlock(info, 0);
-                if (status < 0)
-                        goto out_dq;
-        }
-        set_bit(DQ_READ_B, &dquot->dq_flags);
+        status = ocfs2_qinfo_lock(info, 0);
+        if (status < 0)
+                goto out_dq;
+        /*
+         * We always want to read dquot structure from disk because we don't
+         * know what happened with it while it was on freelist.
+         */
+        status = qtree_read_dquot(&info->dqi_gi, dquot);
+        ocfs2_qinfo_unlock(info, 0);
+        if (status < 0)
+                goto out_dq;
 
         OCFS2_DQUOT(dquot)->dq_use_count++;
         OCFS2_DQUOT(dquot)->dq_origspace = dquot->dq_dqb.dqb_curspace;
diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index 2e4344be3b96..2001862bf2b1 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -1303,10 +1303,6 @@ int ocfs2_local_release_dquot(handle_t *handle, struct dquot *dquot)
         ocfs2_journal_dirty(handle, od->dq_chunk->qc_headerbh);
 
 out:
-        /* Clear the read bit so that next time someone uses this
-         * dquot he reads fresh info from disk and allocates local
-         * dquot structure */
-        clear_bit(DQ_READ_B, &dquot->dq_flags);
         return status;
 }
 
diff --git a/fs/open.c b/fs/open.c
index 4b3e1edf2fe4..b9ed8b25c108 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -705,6 +705,10 @@ static int do_dentry_open(struct file *f,
                 return 0;
         }
 
+        /* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */
+        if (S_ISREG(inode->i_mode))
+                f->f_mode |= FMODE_ATOMIC_POS;
+
         f->f_op = fops_get(inode->i_fop);
         if (unlikely(WARN_ON(!f->f_op))) {
                 error = -ENODEV;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 51507065263b..b9760628e1fd 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1824,6 +1824,7 @@ static int proc_map_files_get_link(struct dentry *dentry, struct path *path)
         if (rc)
                 goto out_mmput;
 
+        rc = -ENOENT;
         down_read(&mm->mmap_sem);
         vma = find_exact_vma(mm, vm_start, vm_end);
         if (vma && vma->vm_file) {
diff --git a/fs/proc/page.c b/fs/proc/page.c
index 02174a610315..e647c55275d9 100644
--- a/fs/proc/page.c
+++ b/fs/proc/page.c
@@ -121,9 +121,8 @@ u64 stable_page_flags(struct page *page)
          * just checks PG_head/PG_tail, so we need to check PageLRU/PageAnon
          * to make sure a given page is a thp, not a non-huge compound page.
          */
-        else if (PageTransCompound(page) &&
-                 (PageLRU(compound_trans_head(page)) ||
-                  PageAnon(compound_trans_head(page))))
+        else if (PageTransCompound(page) && (PageLRU(compound_head(page)) ||
+                                             PageAnon(compound_head(page))))
                 u |= 1 << KPF_THP;
 
         /*
diff --git a/fs/read_write.c b/fs/read_write.c
index edc5746a902a..54e19b9392dc 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -264,10 +264,22 @@ loff_t vfs_llseek(struct file *file, loff_t offset, int whence)
 }
 EXPORT_SYMBOL(vfs_llseek);
 
+static inline struct fd fdget_pos(int fd)
+{
+        return __to_fd(__fdget_pos(fd));
+}
+
+static inline void fdput_pos(struct fd f)
+{
+        if (f.flags & FDPUT_POS_UNLOCK)
+                mutex_unlock(&f.file->f_pos_lock);
+        fdput(f);
+}
+
 SYSCALL_DEFINE3(lseek, unsigned int, fd, off_t, offset, unsigned int, whence)
 {
         off_t retval;
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         if (!f.file)
                 return -EBADF;
 
@@ -278,7 +290,7 @@ SYSCALL_DEFINE3(lseek, unsigned int, fd, off_t, offset, unsigned int, whence)
                 if (res != (loff_t)retval)
                         retval = -EOVERFLOW;    /* LFS: should only happen on 32 bit platforms */
         }
-        fdput(f);
+        fdput_pos(f);
         return retval;
 }
 
@@ -498,7 +510,7 @@ static inline void file_pos_write(struct file *file, loff_t pos)
 
 SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         ssize_t ret = -EBADF;
 
         if (f.file) {
@@ -506,7 +518,7 @@ SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
                 ret = vfs_read(f.file, buf, count, &pos);
                 if (ret >= 0)
                         file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
         }
         return ret;
 }
@@ -514,7 +526,7 @@ SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
 SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf,
                 size_t, count)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         ssize_t ret = -EBADF;
 
         if (f.file) {
@@ -522,7 +534,7 @@ SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf,
                 ret = vfs_write(f.file, buf, count, &pos);
                 if (ret >= 0)
                         file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
         }
 
         return ret;
@@ -797,7 +809,7 @@ EXPORT_SYMBOL(vfs_writev);
 SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
                 unsigned long, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         ssize_t ret = -EBADF;
 
         if (f.file) {
@@ -805,7 +817,7 @@ SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
                 ret = vfs_readv(f.file, vec, vlen, &pos);
                 if (ret >= 0)
                         file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
         }
 
         if (ret > 0)
@@ -817,7 +829,7 @@ SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
 SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
                 unsigned long, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         ssize_t ret = -EBADF;
 
         if (f.file) {
@@ -825,7 +837,7 @@ SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
                 ret = vfs_writev(f.file, vec, vlen, &pos);
                 if (ret >= 0)
                         file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
         }
 
         if (ret > 0)
@@ -968,7 +980,7 @@ COMPAT_SYSCALL_DEFINE3(readv, compat_ulong_t, fd,
                 const struct compat_iovec __user *,vec,
                 compat_ulong_t, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         ssize_t ret;
         loff_t pos;
 
@@ -978,7 +990,7 @@ COMPAT_SYSCALL_DEFINE3(readv, compat_ulong_t, fd,
         ret = compat_readv(f.file, vec, vlen, &pos);
         if (ret >= 0)
                 f.file->f_pos = pos;
-        fdput(f);
+        fdput_pos(f);
         return ret;
 }
 
@@ -1035,7 +1047,7 @@ COMPAT_SYSCALL_DEFINE3(writev, compat_ulong_t, fd,
                 const struct compat_iovec __user *, vec,
                 compat_ulong_t, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
         ssize_t ret;
         loff_t pos;
 
@@ -1045,7 +1057,7 @@ COMPAT_SYSCALL_DEFINE3(writev, compat_ulong_t, fd,
         ret = compat_writev(f.file, vec, vlen, &pos);
         if (ret >= 0)
                 f.file->f_pos = pos;
-        fdput(f);
+        fdput_pos(f);
         return ret;
 }
 
diff --git a/include/dt-bindings/clock/tegra124-car.h b/include/dt-bindings/clock/tegra124-car.h
index a1116a3b54ef..8c1603b10665 100644
--- a/include/dt-bindings/clock/tegra124-car.h
+++ b/include/dt-bindings/clock/tegra124-car.h
@@ -36,10 +36,10 @@
 #define TEGRA124_CLK_PWM 17
 #define TEGRA124_CLK_I2S2 18
 /* 20 (register bit affects vi and vi_sensor) */
-#define TEGRA124_CLK_GR_2D 21
+/* 21 */
 #define TEGRA124_CLK_USBD 22
 #define TEGRA124_CLK_ISP 23
-#define TEGRA124_CLK_GR_3D 24
+/* 26 */
 /* 25 */
 #define TEGRA124_CLK_DISP2 26
 #define TEGRA124_CLK_DISP1 27
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index be85127bfed3..f27000f55a83 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -171,6 +171,11 @@ static inline int kvm_vgic_set_addr(struct kvm *kvm, unsigned long type, u64 add
         return 0;
 }
 
+static inline int kvm_vgic_addr(struct kvm *kvm, unsigned long type, u64 *addr, bool write)
+{
+        return -ENXIO;
+}
+
 static inline int kvm_vgic_init(struct kvm *kvm)
 {
         return 0;
diff --git a/include/linux/audit.h b/include/linux/audit.h
index aa865a9a4c4f..ec1464df4c60 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -43,6 +43,7 @@ struct mq_attr;
 struct mqstat;
 struct audit_watch;
 struct audit_tree;
+struct sk_buff;
 
 struct audit_krule {
         int                     vers_ops;
@@ -463,7 +464,7 @@ extern int audit_filter_user(int type);
 extern int audit_filter_type(int type);
 extern int audit_rule_change(int type, __u32 portid, int seq,
                                 void *data, size_t datasz);
-extern int audit_list_rules_send(__u32 portid, int seq);
+extern int audit_list_rules_send(struct sk_buff *request_skb, int seq);
 
 extern u32 audit_enabled;
 #else /* CONFIG_AUDIT */
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index 18ba8a627f46..2ff2e8d982be 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -121,8 +121,7 @@ void blk_mq_init_commands(struct request_queue *, void (*init)(void *data, struc
 
 void blk_mq_flush_plug_list(struct blk_plug *plug, bool from_schedule);
 
-void blk_mq_insert_request(struct request_queue *, struct request *,
-                bool, bool);
+void blk_mq_insert_request(struct request *, bool, bool, bool);
 void blk_mq_run_queues(struct request_queue *q, bool async);
 void blk_mq_free_request(struct request *rq);
 bool blk_mq_can_queue(struct blk_mq_hw_ctx *);
@@ -134,7 +133,13 @@ struct blk_mq_hw_ctx *blk_mq_map_queue(struct request_queue *, const int ctx_ind
 struct blk_mq_hw_ctx *blk_mq_alloc_single_hw_queue(struct blk_mq_reg *, unsigned int);
 void blk_mq_free_single_hw_queue(struct blk_mq_hw_ctx *, unsigned int);
 
-void blk_mq_end_io(struct request *rq, int error);
+bool blk_mq_end_io_partial(struct request *rq, int error,
+                unsigned int nr_bytes);
+static inline void blk_mq_end_io(struct request *rq, int error)
+{
+        bool done = !blk_mq_end_io_partial(rq, error, blk_rq_bytes(rq));
+        BUG_ON(!done);
+}
 
 void blk_mq_complete_request(struct request *rq);
 
diff --git a/include/linux/clk/ti.h b/include/linux/clk/ti.h
index 092b64168d7f..4a21a872dbbd 100644
--- a/include/linux/clk/ti.h
+++ b/include/linux/clk/ti.h
@@ -245,6 +245,10 @@ long omap2_dpll_round_rate(struct clk_hw *hw, unsigned long target_rate,
 void omap2_init_clk_clkdm(struct clk_hw *clk);
 unsigned long omap3_clkoutx2_recalc(struct clk_hw *hw,
                                     unsigned long parent_rate);
+int omap3_clkoutx2_set_rate(struct clk_hw *hw, unsigned long rate,
+                                        unsigned long parent_rate);
+long omap3_clkoutx2_round_rate(struct clk_hw *hw, unsigned long rate,
+                unsigned long *prate);
 int omap2_clkops_enable_clkdm(struct clk_hw *hw);
 void omap2_clkops_disable_clkdm(struct clk_hw *hw);
 int omap2_clk_disable_autoidle_all(void);
diff --git a/include/linux/file.h b/include/linux/file.h
index cbacf4faf447..4d69123377a2 100644
--- a/include/linux/file.h
+++ b/include/linux/file.h
@@ -28,33 +28,36 @@ static inline void fput_light(struct file *file, int fput_needed)
 
 struct fd {
         struct file *file;
-        int need_put;
+        unsigned int flags;
 };
+#define FDPUT_FPUT       1
+#define FDPUT_POS_UNLOCK 2
 
 static inline void fdput(struct fd fd)
 {
-        if (fd.need_put)
+        if (fd.flags & FDPUT_FPUT)
                 fput(fd.file);
 }
 
 extern struct file *fget(unsigned int fd);
-extern struct file *fget_light(unsigned int fd, int *fput_needed);
+extern struct file *fget_raw(unsigned int fd);
+extern unsigned long __fdget(unsigned int fd);
+extern unsigned long __fdget_raw(unsigned int fd);
+extern unsigned long __fdget_pos(unsigned int fd);
 
-static inline struct fd fdget(unsigned int fd)
+static inline struct fd __to_fd(unsigned long v)
 {
-        int b;
-        struct file *f = fget_light(fd, &b);
-        return (struct fd){f,b};
+        return (struct fd){(struct file *)(v & ~3),v & 3};
 }
 
-extern struct file *fget_raw(unsigned int fd);
-extern struct file *fget_raw_light(unsigned int fd, int *fput_needed);
+static inline struct fd fdget(unsigned int fd)
+{
+        return __to_fd(__fdget(fd));
+}
 
 static inline struct fd fdget_raw(unsigned int fd)
 {
-        int b;
-        struct file *f = fget_raw_light(fd, &b);
-        return (struct fd){f,b};
+        return __to_fd(__fdget_raw(fd));
 }
 
 extern int f_dupfd(unsigned int from, struct file *file, unsigned flags);
diff --git a/include/linux/firewire.h b/include/linux/firewire.h
index 5d7782e42b8f..c3683bdf28fe 100644
--- a/include/linux/firewire.h
+++ b/include/linux/firewire.h
@@ -200,6 +200,7 @@ struct fw_device {
         unsigned irmc:1;
         unsigned bc_implemented:2;
 
+        work_func_t workfn;
         struct delayed_work work;
         struct fw_attribute_group attribute_group;
 };
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 60829565e552..23b2a35d712e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -123,6 +123,9 @@ typedef void (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
 /* File is opened with O_PATH; almost nothing can be done with it */
 #define FMODE_PATH              ((__force fmode_t)0x4000)
 
+/* File needs atomic accesses to f_pos */
+#define FMODE_ATOMIC_POS        ((__force fmode_t)0x8000)
+
 /* File was opened by fanotify and shouldn't generate fanotify events */
 #define FMODE_NONOTIFY          ((__force fmode_t)0x1000000)
 
@@ -780,13 +783,14 @@ struct file {
         const struct file_operations    *f_op;
 
         /*
-         * Protects f_ep_links, f_flags, f_pos vs i_size in lseek SEEK_CUR.
+         * Protects f_ep_links, f_flags.
          * Must not be taken from IRQ context.
          */
         spinlock_t              f_lock;
         atomic_long_t           f_count;
         unsigned int            f_flags;
         fmode_t                 f_mode;
+        struct mutex            f_pos_lock;
         loff_t                  f_pos;
         struct fown_struct      f_owner;
         const struct cred       *f_cred;
@@ -808,7 +812,7 @@ struct file {
 #ifdef CONFIG_DEBUG_WRITECOUNT
         unsigned long f_mnt_write_state;
 #endif
-};
+} __attribute__((aligned(4)));  /* lest something weird decides that 2 is OK */
 
 struct file_handle {
         __u32 handle_bytes;
diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
index 4e4cc28623ad..4cdb3a17bcb5 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
@@ -495,10 +495,6 @@ enum {
         FILTER_TRACE_FN,
 };
 
-#define EVENT_STORAGE_SIZE 128
-extern struct mutex event_storage_mutex;
-extern char event_storage[EVENT_STORAGE_SIZE];
-
 extern int trace_event_raw_init(struct ftrace_event_call *call);
 extern int trace_define_field(struct ftrace_event_call *call, const char *type,
                               const char *name, int offset, int size,
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 0437439bc047..39b81dc7d01a 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -123,6 +123,10 @@ struct vm_area_struct;
                          __GFP_NOMEMALLOC | __GFP_NORETRY | __GFP_NOWARN | \
                          __GFP_NO_KSWAPD)
 
+/*
+ * GFP_THISNODE does not perform any reclaim, you most likely want to
+ * use __GFP_THISNODE to allocate from a given node without fallback!
+ */
 #ifdef CONFIG_NUMA
 #define GFP_THISNODE    (__GFP_THISNODE | __GFP_NOWARN | __GFP_NORETRY)
 #else
diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
index db512014e061..b826239bdce0 100644
--- a/include/linux/huge_mm.h
+++ b/include/linux/huge_mm.h
@@ -157,46 +157,6 @@ static inline int hpage_nr_pages(struct page *page)
                 return HPAGE_PMD_NR;
         return 1;
 }
-/*
- * compound_trans_head() should be used instead of compound_head(),
- * whenever the "page" passed as parameter could be the tail of a
- * transparent hugepage that could be undergoing a
- * __split_huge_page_refcount(). The page structure layout often
- * changes across releases and it makes extensive use of unions. So if
- * the page structure layout will change in a way that
- * page->first_page gets clobbered by __split_huge_page_refcount, the
- * implementation making use of smp_rmb() will be required.
- *
- * Currently we define compound_trans_head as compound_head, because
- * page->private is in the same union with page->first_page, and
- * page->private isn't clobbered. However this also means we're
- * currently leaving dirt into the page->private field of anonymous
- * pages resulting from a THP split, instead of setting page->private
- * to zero like for every other page that has PG_private not set. But
- * anonymous pages don't use page->private so this is not a problem.
- */
-#if 0
-/* This will be needed if page->private will be clobbered in split_huge_page */
-static inline struct page *compound_trans_head(struct page *page)
-{
-        if (PageTail(page)) {
-                struct page *head;
-                head = page->first_page;
-                smp_rmb();
-                /*
-                 * head may be a dangling pointer.
-                 * __split_huge_page_refcount clears PageTail before
-                 * overwriting first_page, so if PageTail is still
-                 * there it means the head pointer isn't dangling.
-                 */
-                if (PageTail(page))
-                        return head;
-        }
-        return page;
-}
-#else
-#define compound_trans_head(page) compound_head(page)
-#endif
 
 extern int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
                                 unsigned long addr, pmd_t pmd, pmd_t *pmdp);
@@ -226,7 +186,6 @@ static inline int split_huge_page(struct page *page)
         do { } while (0)
 #define split_huge_page_pmd_mm(__mm, __address, __pmd)  \
         do { } while (0)
-#define compound_trans_head(page) compound_head(page)
 static inline int hugepage_madvise(struct vm_area_struct *vma,
                                    unsigned long *vm_flags, int advice)
 {
diff --git a/include/linux/mm.h b/include/linux/mm.h
index f28f46eade6a..c1b7414c7bef 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -175,7 +175,7 @@ extern unsigned int kobjsize(const void *objp);
  * Special vmas that are non-mergable, non-mlock()able.
  * Note: mm/huge_memory.c VM_NO_THP depends on this definition.
  */
-#define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_PFNMAP)
+#define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_PFNMAP | VM_MIXEDMAP)
 
 /*
  * mapping from the currently active vm_flags protection bits (the
@@ -399,8 +399,18 @@ static inline void compound_unlock_irqrestore(struct page *page,
 
 static inline struct page *compound_head(struct page *page)
 {
-        if (unlikely(PageTail(page)))
-                return page->first_page;
+        if (unlikely(PageTail(page))) {
+                struct page *head = page->first_page;
+
+                /*
+                 * page->first_page may be a dangling pointer to an old
+                 * compound page, so recheck that it is still a tail
+                 * page before returning.
+                 */
+                smp_rmb();
+                if (likely(PageTail(page)))
+                        return head;
+        }
         return page;
 }
 
@@ -757,7 +767,7 @@ static inline bool __cpupid_match_pid(pid_t task_pid, int cpupid)
 #ifdef LAST_CPUPID_NOT_IN_PAGE_FLAGS
 static inline int page_cpupid_xchg_last(struct page *page, int cpupid)
 {
-        return xchg(&page->_last_cpupid, cpupid);
+        return xchg(&page->_last_cpupid, cpupid & LAST_CPUPID_MASK);
 }
 
 static inline int page_cpupid_last(struct page *page)
@@ -766,7 +776,7 @@ static inline int page_cpupid_last(struct page *page)
 }
 static inline void page_cpupid_reset_last(struct page *page)
 {
-        page->_last_cpupid = -1;
+        page->_last_cpupid = -1 & LAST_CPUPID_MASK;
 }
 #else
 static inline int page_cpupid_last(struct page *page)
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 5f2052c83154..9b61b9bf81ac 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -590,10 +590,10 @@ static inline bool zone_is_empty(struct zone *zone)
 
 /*
  * The NUMA zonelists are doubled because we need zonelists that restrict the
- * allocations to a single node for GFP_THISNODE.
+ * allocations to a single node for __GFP_THISNODE.
  *
  * [0]  : Zonelist with fallback
- * [1]  : No fallback (GFP_THISNODE)
+ * [1]  : No fallback (__GFP_THISNODE)
  */
 #define MAX_ZONELISTS 2
 
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index b2fb167b2e6d..5624e4e2763c 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -467,9 +467,14 @@ struct nfs_lockt_res {
 };
 
 struct nfs_release_lockowner_args {
+        struct nfs4_sequence_args       seq_args;
         struct nfs_lowner       lock_owner;
 };
 
+struct nfs_release_lockowner_res {
+        struct nfs4_sequence_res        seq_res;
+};
+
 struct nfs4_delegreturnargs {
         struct nfs4_sequence_args       seq_args;
         const struct nfs_fh *fhandle;
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index 1da693d51255..b66c2110cb1f 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -250,8 +250,7 @@ struct rmap_walk_control {
         int (*rmap_one)(struct page *page, struct vm_area_struct *vma,
                                         unsigned long addr, void *arg);
         int (*done)(struct page *page);
-        int (*file_nonlinear)(struct page *, struct address_space *,
-                                        struct vm_area_struct *vma);
+        int (*file_nonlinear)(struct page *, struct address_space *, void *arg);
         struct anon_vma *(*anon_lock)(struct page *page);
         bool (*invalid_vma)(struct vm_area_struct *vma, void *arg);
 };
diff --git a/include/linux/security.h b/include/linux/security.h
index 5623a7f965b7..2fc42d191f79 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1040,6 +1040,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      Allocate a security structure to the xp->security field; the security
  *      field is initialized to NULL when the xfrm_policy is allocated.
  *      Return 0 if operation was successful (memory to allocate, legal context)
+ *      @gfp is to specify the context for the allocation
  * @xfrm_policy_clone_security:
  *      @old_ctx contains an existing xfrm_sec_ctx.
  *      @new_ctxp contains a new xfrm_sec_ctx being cloned from old.
@@ -1683,7 +1684,7 @@ struct security_operations {
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
         int (*xfrm_policy_alloc_security) (struct xfrm_sec_ctx **ctxp,
-                        struct xfrm_user_sec_ctx *sec_ctx);
+                        struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);
         int (*xfrm_policy_clone_security) (struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctx);
         void (*xfrm_policy_free_security) (struct xfrm_sec_ctx *ctx);
         int (*xfrm_policy_delete_security) (struct xfrm_sec_ctx *ctx);
@@ -2859,7 +2860,8 @@ static inline void security_skb_owned_by(struct sk_buff *skb, struct sock *sk)
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 
-int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx);
+int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
+                               struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);
 int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp);
 void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
 int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
@@ -2877,7 +2879,9 @@ void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl);
 
 #else   /* CONFIG_SECURITY_NETWORK_XFRM */
 
-static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx)
+static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
+                                             struct xfrm_user_sec_ctx *sec_ctx,
+                                             gfp_t gfp)
 {
         return 0;
 }
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 3ebbbe7b6d05..5e1e6f2d98c2 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2725,7 +2725,7 @@ static inline void nf_reset(struct sk_buff *skb)
 
 static inline void nf_reset_trace(struct sk_buff *skb)
 {
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
+#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE) || defined(CONFIG_NF_TABLES)
         skb->nf_trace = 0;
 #endif
 }
@@ -2742,6 +2742,9 @@ static inline void __nf_copy(struct sk_buff *dst, const struct sk_buff *src)
         dst->nf_bridge  = src->nf_bridge;
         nf_bridge_get(src->nf_bridge);
 #endif
+#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE) || defined(CONFIG_NF_TABLES)
+        dst->nf_trace = src->nf_trace;
+#endif
 }
 
 static inline void nf_copy(struct sk_buff *dst, const struct sk_buff *src)
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 9260abdd67df..b5b2df60299e 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -410,7 +410,7 @@ static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
  *
  * %GFP_NOWAIT - Allocation will not sleep.
  *
- * %GFP_THISNODE - Allocate node-local memory only.
+ * %__GFP_THISNODE - Allocate node-local memory only.
  *
  * %GFP_DMA - Allocation suitable for DMA.
  *   Should only be used for kmalloc() caches. Otherwise, use a
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index accc497f8d72..7159a0a933df 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -60,6 +60,12 @@ struct tp_module {
         unsigned int num_tracepoints;
         struct tracepoint * const *tracepoints_ptrs;
 };
+bool trace_module_has_bad_taint(struct module *mod);
+#else
+static inline bool trace_module_has_bad_taint(struct module *mod)
+{
+        return false;
+}
 #endif /* CONFIG_MODULES */
 
 struct tracepoint_iter {
diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
index c3fa80745996..2c14d9cdd57a 100644
--- a/include/linux/usb/cdc_ncm.h
+++ b/include/linux/usb/cdc_ncm.h
@@ -88,6 +88,7 @@
 #define cdc_ncm_data_intf_is_mbim(x)  ((x)->desc.bInterfaceProtocol == USB_CDC_MBIM_PROTO_NTB)
 
 struct cdc_ncm_ctx {
+        struct usb_cdc_ncm_ntb_parameters ncm_parm;
         struct hrtimer tx_timer;
         struct tasklet_struct bh;
 
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 48ed75c21260..e77c10405d51 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -129,6 +129,7 @@ int ip_tunnel_changelink(struct net_device *dev, struct nlattr *tb[],
 int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
                       struct ip_tunnel_parm *p);
 void ip_tunnel_setup(struct net_device *dev, int net_id);
+void ip_tunnel_dst_reset_all(struct ip_tunnel *t);
 
 /* Extract dsfield from inner protocol */
 static inline u8 ip_tunnel_get_dsfield(const struct iphdr *iph,
diff --git a/include/net/sock.h b/include/net/sock.h
index 5c3f7c3624aa..b9586a137cad 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1488,6 +1488,11 @@ static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb)
  */
 #define sock_owned_by_user(sk)  ((sk)->sk_lock.owned)
 
+static inline void sock_release_ownership(struct sock *sk)
+{
+        sk->sk_lock.owned = 0;
+}
+
 /*
  * Macro so as to not evaluate some arguments when
  * lockdep is not enabled.
@@ -2186,7 +2191,6 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
 {
 #define FLAGS_TS_OR_DROPS ((1UL << SOCK_RXQ_OVFL)                       | \
                            (1UL << SOCK_RCVTSTAMP)                      | \
-                           (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE)       | \
                            (1UL << SOCK_TIMESTAMPING_SOFTWARE)          | \
                            (1UL << SOCK_TIMESTAMPING_RAW_HARDWARE)      | \
                            (1UL << SOCK_TIMESTAMPING_SYS_HARDWARE))
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 56fc366da6d5..743accec6c76 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -480,20 +480,21 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 #ifdef CONFIG_SYN_COOKIES
 #include <linux/ktime.h>
 
-/* Syncookies use a monotonic timer which increments every 64 seconds.
+/* Syncookies use a monotonic timer which increments every 60 seconds.
  * This counter is used both as a hash input and partially encoded into
  * the cookie value.  A cookie is only validated further if the delta
  * between the current counter value and the encoded one is less than this,
- * i.e. a sent cookie is valid only at most for 128 seconds (or less if
+ * i.e. a sent cookie is valid only at most for 2*60 seconds (or less if
  * the counter advances immediately after a cookie is generated).
  */
 #define MAX_SYNCOOKIE_AGE 2
 
 static inline u32 tcp_cookie_time(void)
 {
-        struct timespec now;
-        getnstimeofday(&now);
-        return now.tv_sec >> 6; /* 64 seconds granularity */
+        u64 val = get_jiffies_64();
+
+        do_div(val, 60 * HZ);
+        return val;
 }
 
 u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,
@@ -1303,7 +1304,8 @@ struct tcp_fastopen_request {
         /* Fast Open cookie. Size 0 means a cookie request */
         struct tcp_fastopen_cookie      cookie;
         struct msghdr                   *data;  /* data in MSG_FASTOPEN */
-        u16                             copied; /* queued in tcp_connect() */
+        size_t                          size;
+        int                             copied; /* queued in tcp_connect() */
 };
 void tcp_free_fastopen_req(struct tcp_sock *tp);
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index afa5730fb3bd..fb5654a8ca3c 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1648,6 +1648,11 @@ static inline int xfrm_aevent_is_on(struct net *net)
 }
 #endif
 
+static inline int aead_len(struct xfrm_algo_aead *alg)
+{
+        return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
+}
+
 static inline int xfrm_alg_len(const struct xfrm_algo *alg)
 {
         return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
@@ -1686,6 +1691,12 @@ static inline int xfrm_replay_clone(struct xfrm_state *x,
         return 0;
 }
 
+static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
+{
+        return kmemdup(orig, aead_len(orig), GFP_KERNEL);
+}
+
+
 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
 {
         return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
diff --git a/include/target/iscsi/iscsi_transport.h b/include/target/iscsi/iscsi_transport.h
index ae5a17111968..4483fadfa68d 100644
--- a/include/target/iscsi/iscsi_transport.h
+++ b/include/target/iscsi/iscsi_transport.h
@@ -12,6 +12,7 @@ struct iscsit_transport {
         int (*iscsit_setup_np)(struct iscsi_np *, struct __kernel_sockaddr_storage *);
         int (*iscsit_accept_np)(struct iscsi_np *, struct iscsi_conn *);
         void (*iscsit_free_np)(struct iscsi_np *);
+        void (*iscsit_wait_conn)(struct iscsi_conn *);
         void (*iscsit_free_conn)(struct iscsi_conn *);
         int (*iscsit_get_login_rx)(struct iscsi_conn *, struct iscsi_login *);
         int (*iscsit_put_login_tx)(struct iscsi_conn *, struct iscsi_login *, u32);
diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
index ddc179b7a105..1fef3e6e9436 100644
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -83,7 +83,7 @@ DECLARE_EVENT_CLASS(rpc_task_running,
                 ),
 
         TP_fast_assign(
-                __entry->client_id = clnt->cl_clid;
+                __entry->client_id = clnt ? clnt->cl_clid : -1;
                 __entry->task_id = task->tk_pid;
                 __entry->action = action;
                 __entry->runstate = task->tk_runstate;
@@ -91,7 +91,7 @@ DECLARE_EVENT_CLASS(rpc_task_running,
                 __entry->flags = task->tk_flags;
                 ),
 
-        TP_printk("task:%u@%u flags=%4.4x state=%4.4lx status=%d action=%pf",
+        TP_printk("task:%u@%d flags=%4.4x state=%4.4lx status=%d action=%pf",
                 __entry->task_id, __entry->client_id,
                 __entry->flags,
                 __entry->runstate,
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index 1a8b28db3775..1ee19a24cc5f 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -310,15 +310,12 @@ static struct trace_event_functions ftrace_event_type_funcs_##call = {	\
 #undef __array
 #define __array(type, item, len)                                        \
         do {                                                            \
-                mutex_lock(&event_storage_mutex);                       \
+                char *type_str = #type"["__stringify(len)"]";           \
                 BUILD_BUG_ON(len > MAX_FILTER_STR_VAL);                 \
-                snprintf(event_storage, sizeof(event_storage),          \
-                         "%s[%d]", #type, len);                         \
-                ret = trace_define_field(event_call, event_storage, #item, \
+                ret = trace_define_field(event_call, type_str, #item,   \
                                  offsetof(typeof(field), item),         \
                                  sizeof(field.item),                    \
                                  is_signed_type(type), FILTER_OTHER);   \
-                mutex_unlock(&event_storage_mutex);                     \
                 if (ret)                                                \
                         return ret;                                     \
         } while (0);
diff --git a/init/main.c b/init/main.c
index eb03090cdced..9c7fd4c9249f 100644
--- a/init/main.c
+++ b/init/main.c
@@ -561,7 +561,6 @@ asmlinkage void __init start_kernel(void)
         init_timers();
         hrtimers_init();
         softirq_init();
-        acpi_early_init();
         timekeeping_init();
         time_init();
         sched_clock_postinit();
@@ -613,6 +612,7 @@ asmlinkage void __init start_kernel(void)
         calibrate_delay();
         pidmap_init();
         anon_vma_init();
+        acpi_early_init();
 #ifdef CONFIG_X86
         if (efi_enabled(EFI_RUNTIME_SERVICES))
                 efi_enter_virtual_mode();
diff --git a/ipc/msg.c b/ipc/msg.c
index 245db1140ad6..649853105a5d 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -901,6 +901,8 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgfl
                 return -EINVAL;
 
         if (msgflg & MSG_COPY) {
+                if ((msgflg & MSG_EXCEPT) || !(msgflg & IPC_NOWAIT))
+                        return -EINVAL;
                 copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax));
                 if (IS_ERR(copy))
                         return PTR_ERR(copy);
diff --git a/kernel/audit.c b/kernel/audit.c
index 34c5a2310fbf..3392d3e0254a 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -182,7 +182,7 @@ struct audit_buffer {
 
 struct audit_reply {
         __u32 portid;
-        pid_t pid;
+        struct net *net;        
         struct sk_buff *skb;
 };
 
@@ -500,7 +500,7 @@ int audit_send_list(void *_dest)
 {
         struct audit_netlink_list *dest = _dest;
         struct sk_buff *skb;
-        struct net *net = get_net_ns_by_pid(dest->pid);
+        struct net *net = dest->net;
         struct audit_net *aunet = net_generic(net, audit_net_id);
 
         /* wait for parent to finish and send an ACK */
@@ -510,6 +510,7 @@ int audit_send_list(void *_dest)
         while ((skb = __skb_dequeue(&dest->q)) != NULL)
                 netlink_unicast(aunet->nlsk, skb, dest->portid, 0);
 
+        put_net(net);
         kfree(dest);
 
         return 0;
@@ -543,7 +544,7 @@ out_kfree_skb:
 static int audit_send_reply_thread(void *arg)
 {
         struct audit_reply *reply = (struct audit_reply *)arg;
-        struct net *net = get_net_ns_by_pid(reply->pid);
+        struct net *net = reply->net;
         struct audit_net *aunet = net_generic(net, audit_net_id);
 
         mutex_lock(&audit_cmd_mutex);
@@ -552,12 +553,13 @@ static int audit_send_reply_thread(void *arg)
         /* Ignore failure. It'll only happen if the sender goes away,
            because our timeout is set to infinite. */
         netlink_unicast(aunet->nlsk , reply->skb, reply->portid, 0);
+        put_net(net);
         kfree(reply);
         return 0;
 }
 /**
  * audit_send_reply - send an audit reply message via netlink
- * @portid: netlink port to which to send reply
+ * @request_skb: skb of request we are replying to (used to target the reply)
  * @seq: sequence number
  * @type: audit message type
  * @done: done (last) flag
@@ -568,9 +570,11 @@ static int audit_send_reply_thread(void *arg)
  * Allocates an skb, builds the netlink message, and sends it to the port id.
  * No failure notifications.
  */
-static void audit_send_reply(__u32 portid, int seq, int type, int done,
+static void audit_send_reply(struct sk_buff *request_skb, int seq, int type, int done,
                              int multi, const void *payload, int size)
 {
+        u32 portid = NETLINK_CB(request_skb).portid;
+        struct net *net = sock_net(NETLINK_CB(request_skb).sk);
         struct sk_buff *skb;
         struct task_struct *tsk;
         struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),
@@ -583,8 +587,8 @@ static void audit_send_reply(__u32 portid, int seq, int type, int done,
         if (!skb)
                 goto out;
 
+        reply->net = get_net(net);
         reply->portid = portid;
-        reply->pid = task_pid_vnr(current);
         reply->skb = skb;
 
         tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
@@ -673,8 +677,7 @@ static int audit_get_feature(struct sk_buff *skb)
 
         seq = nlmsg_hdr(skb)->nlmsg_seq;
 
-        audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
-                         &af, sizeof(af));
+        audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &af, sizeof(af));
 
         return 0;
 }
@@ -794,8 +797,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 s.backlog               = skb_queue_len(&audit_skb_queue);
                 s.version               = AUDIT_VERSION_LATEST;
                 s.backlog_wait_time     = audit_backlog_wait_time;
-                audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_GET, 0, 0,
-                                 &s, sizeof(s));
+                audit_send_reply(skb, seq, AUDIT_GET, 0, 0, &s, sizeof(s));
                 break;
         }
         case AUDIT_SET: {
@@ -905,7 +907,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                            seq, data, nlmsg_len(nlh));
                 break;
         case AUDIT_LIST_RULES:
-                err = audit_list_rules_send(NETLINK_CB(skb).portid, seq);
+                err = audit_list_rules_send(skb, seq);
                 break;
         case AUDIT_TRIM:
                 audit_trim_trees();
@@ -970,8 +972,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                         memcpy(sig_data->ctx, ctx, len);
                         security_release_secctx(ctx, len);
                 }
-                audit_send_reply(NETLINK_CB(skb).portid, seq, AUDIT_SIGNAL_INFO,
-                                0, 0, sig_data, sizeof(*sig_data) + len);
+                audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0,
+                                 sig_data, sizeof(*sig_data) + len);
                 kfree(sig_data);
                 break;
         case AUDIT_TTY_GET: {
@@ -983,8 +985,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 s.log_passwd = tsk->signal->audit_tty_log_passwd;
                 spin_unlock(&tsk->sighand->siglock);
 
-                audit_send_reply(NETLINK_CB(skb).portid, seq,
-                                 AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
+                audit_send_reply(skb, seq, AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
                 break;
         }
         case AUDIT_TTY_SET: {
diff --git a/kernel/audit.h b/kernel/audit.h
index 57cc64d67718..8df132214606 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -247,7 +247,7 @@ extern void		    audit_panic(const char *message);
 
 struct audit_netlink_list {
         __u32 portid;
-        pid_t pid;
+        struct net *net;
         struct sk_buff_head q;
 };
 
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 14a78cca384e..92062fd6cc8c 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -29,6 +29,8 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/security.h>
+#include <net/net_namespace.h>
+#include <net/sock.h>
 #include "audit.h"
 
 /*
@@ -1065,11 +1067,13 @@ int audit_rule_change(int type, __u32 portid, int seq, void *data,
 
 /**
  * audit_list_rules_send - list the audit rules
- * @portid: target portid for netlink audit messages
+ * @request_skb: skb of request we are replying to (used to target the reply)
  * @seq: netlink audit message sequence (serial) number
  */
-int audit_list_rules_send(__u32 portid, int seq)
+int audit_list_rules_send(struct sk_buff *request_skb, int seq)
 {
+        u32 portid = NETLINK_CB(request_skb).portid;
+        struct net *net = sock_net(NETLINK_CB(request_skb).sk);
         struct task_struct *tsk;
         struct audit_netlink_list *dest;
         int err = 0;
@@ -1083,8 +1087,8 @@ int audit_list_rules_send(__u32 portid, int seq)
         dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL);
         if (!dest)
                 return -ENOMEM;
+        dest->net = get_net(net);
         dest->portid = portid;
-        dest->pid = task_pid_vnr(current);
         skb_queue_head_init(&dest->q);
 
         mutex_lock(&audit_filter_mutex);
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 105f273b6f86..0c753ddd223b 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -4112,17 +4112,17 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
 
         err = percpu_ref_init(&css->refcnt, css_release);
         if (err)
-                goto err_free;
+                goto err_free_css;
 
         init_css(css, ss, cgrp);
 
         err = cgroup_populate_dir(cgrp, 1 << ss->subsys_id);
         if (err)
-                goto err_free;
+                goto err_free_percpu_ref;
 
         err = online_css(css);
         if (err)
-                goto err_free;
+                goto err_clear_dir;
 
         dget(cgrp->dentry);
         css_get(css->parent);
@@ -4138,8 +4138,11 @@ static int create_css(struct cgroup *cgrp, struct cgroup_subsys *ss)
 
         return 0;
 
-err_free:
+err_clear_dir:
+        cgroup_clear_dir(css->cgroup, 1 << css->ss->subsys_id);
+err_free_percpu_ref:
         percpu_ref_cancel_init(&css->refcnt);
+err_free_css:
         ss->css_free(css);
         return err;
 }
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 4410ac6a55f1..e6b1b66afe52 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -974,12 +974,6 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
  *    Temporarilly set tasks mems_allowed to target nodes of migration,
  *    so that the migration code can allocate pages on these nodes.
  *
- *    Call holding cpuset_mutex, so current's cpuset won't change
- *    during this call, as manage_mutex holds off any cpuset_attach()
- *    calls.  Therefore we don't need to take task_lock around the
- *    call to guarantee_online_mems(), as we know no one is changing
- *    our task's cpuset.
- *
  *    While the mm_struct we are migrating is typically from some
  *    other task, the task_struct mems_allowed that we are hacking
  *    is for our current task, which must allocate new pages for that
@@ -996,8 +990,10 @@ static void cpuset_migrate_mm(struct mm_struct *mm, const nodemask_t *from,
 
         do_migrate_pages(mm, from, to, MPOL_MF_MOVE_ALL);
 
+        rcu_read_lock();
         mems_cs = effective_nodemask_cpuset(task_cs(tsk));
         guarantee_online_mems(mems_cs, &tsk->mems_allowed);
+        rcu_read_unlock();
 }
 
 /*
@@ -2486,9 +2482,9 @@ int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask)
 
         task_lock(current);
         cs = nearest_hardwall_ancestor(task_cs(current));
+        allowed = node_isset(node, cs->mems_allowed);
         task_unlock(current);
 
-        allowed = node_isset(node, cs->mems_allowed);
         mutex_unlock(&callback_mutex);
         return allowed;
 }
diff --git a/kernel/futex.c b/kernel/futex.c
index 44a1261cb9ff..08ec814ad9d2 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -234,6 +234,7 @@ static const struct futex_q futex_q_init = {
  * waiting on a futex.
  */
 struct futex_hash_bucket {
+        atomic_t waiters;
         spinlock_t lock;
         struct plist_head chain;
 } ____cacheline_aligned_in_smp;
@@ -253,22 +254,37 @@ static inline void futex_get_mm(union futex_key *key)
         smp_mb__after_atomic_inc();
 }
 
-static inline bool hb_waiters_pending(struct futex_hash_bucket *hb)
+/*
+ * Reflects a new waiter being added to the waitqueue.
+ */
+static inline void hb_waiters_inc(struct futex_hash_bucket *hb)
 {
 #ifdef CONFIG_SMP
+        atomic_inc(&hb->waiters);
         /*
-         * Tasks trying to enter the critical region are most likely
-         * potential waiters that will be added to the plist. Ensure
-         * that wakers won't miss to-be-slept tasks in the window between
-         * the wait call and the actual plist_add.
+         * Full barrier (A), see the ordering comment above.
          */
-        if (spin_is_locked(&hb->lock))
-                return true;
-        smp_rmb(); /* Make sure we check the lock state first */
+        smp_mb__after_atomic_inc();
+#endif
+}
+
+/*
+ * Reflects a waiter being removed from the waitqueue by wakeup
+ * paths.
+ */
+static inline void hb_waiters_dec(struct futex_hash_bucket *hb)
+{
+#ifdef CONFIG_SMP
+        atomic_dec(&hb->waiters);
+#endif
+}
 
-        return !plist_head_empty(&hb->chain);
+static inline int hb_waiters_pending(struct futex_hash_bucket *hb)
+{
+#ifdef CONFIG_SMP
+        return atomic_read(&hb->waiters);
 #else
-        return true;
+        return 1;
 #endif
 }
 
@@ -954,6 +970,7 @@ static void __unqueue_futex(struct futex_q *q)
 
         hb = container_of(q->lock_ptr, struct futex_hash_bucket, lock);
         plist_del(&q->list, &hb->chain);
+        hb_waiters_dec(hb);
 }
 
 /*
@@ -1257,7 +1274,9 @@ void requeue_futex(struct futex_q *q, struct futex_hash_bucket *hb1,
          */
         if (likely(&hb1->chain != &hb2->chain)) {
                 plist_del(&q->list, &hb1->chain);
+                hb_waiters_dec(hb1);
                 plist_add(&q->list, &hb2->chain);
+                hb_waiters_inc(hb2);
                 q->lock_ptr = &hb2->lock;
         }
         get_futex_key_refs(key2);
@@ -1600,6 +1619,17 @@ static inline struct futex_hash_bucket *queue_lock(struct futex_q *q)
         struct futex_hash_bucket *hb;
 
         hb = hash_futex(&q->key);
+
+        /*
+         * Increment the counter before taking the lock so that
+         * a potential waker won't miss a to-be-slept task that is
+         * waiting for the spinlock. This is safe as all queue_lock()
+         * users end up calling queue_me(). Similarly, for housekeeping,
+         * decrement the counter at queue_unlock() when some error has
+         * occurred and we don't end up adding the task to the list.
+         */
+        hb_waiters_inc(hb);
+
         q->lock_ptr = &hb->lock;
 
         spin_lock(&hb->lock); /* implies MB (A) */
@@ -1611,6 +1641,7 @@ queue_unlock(struct futex_hash_bucket *hb)
         __releases(&hb->lock)
 {
         spin_unlock(&hb->lock);
+        hb_waiters_dec(hb);
 }
 
 /**
@@ -2342,6 +2373,7 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
                  * Unqueue the futex_q and determine which it was.
                  */
                 plist_del(&q->list, &hb->chain);
+                hb_waiters_dec(hb);
 
                 /* Handle spurious wakeups gracefully */
                 ret = -EWOULDBLOCK;
@@ -2875,6 +2907,7 @@ static int __init futex_init(void)
                 futex_cmpxchg_enabled = 1;
 
         for (i = 0; i < futex_hashsize; i++) {
+                atomic_set(&futex_queues[i].waiters, 0);
                 plist_head_init(&futex_queues[i].chain);
                 spin_lock_init(&futex_queues[i].lock);
         }
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index cf68bb36fe58..f14033700c25 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -10,6 +10,7 @@
 #include <linux/mutex.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
+#include <linux/of_irq.h>
 #include <linux/topology.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 481a13c43b17..d3bf660cb57f 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -802,8 +802,7 @@ static irqreturn_t irq_thread_fn(struct irq_desc *desc,
 
 static void wake_threads_waitq(struct irq_desc *desc)
 {
-        if (atomic_dec_and_test(&desc->threads_active) &&
-            waitqueue_active(&desc->wait_for_threads))
+        if (atomic_dec_and_test(&desc->threads_active))
                 wake_up(&desc->wait_for_threads);
 }
 
diff --git a/kernel/profile.c b/kernel/profile.c
index 6631e1ef55ab..ebdd9c1a86b4 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -549,14 +549,14 @@ static int create_hash_tables(void)
                 struct page *page;
 
                 page = alloc_pages_exact_node(node,
-                                GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                 0);
                 if (!page)
                         goto out_cleanup;
                 per_cpu(cpu_profile_hits, cpu)[1]
                                 = (struct profile_hit *)page_address(page);
                 page = alloc_pages_exact_node(node,
-                                GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+                                GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
                                 0);
                 if (!page)
                         goto out_cleanup;
diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
index 43c2bcc35761..b30a2924ef14 100644
--- a/kernel/sched/clock.c
+++ b/kernel/sched/clock.c
@@ -301,14 +301,14 @@ u64 sched_clock_cpu(int cpu)
         if (unlikely(!sched_clock_running))
                 return 0ull;
 
-        preempt_disable();
+        preempt_disable_notrace();
         scd = cpu_sdc(cpu);
 
         if (cpu != smp_processor_id())
                 clock = sched_clock_remote(scd);
         else
                 clock = sched_clock_local(scd);
-        preempt_enable();
+        preempt_enable_notrace();
 
         return clock;
 }
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 6edbef296ece..f5c6635b806c 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3338,6 +3338,15 @@ recheck:
                                 return -EPERM;
                 }
 
+                 /*
+                  * Can't set/change SCHED_DEADLINE policy at all for now
+                  * (safest behavior); in the future we would like to allow
+                  * unprivileged DL tasks to increase their relative deadline
+                  * or reduce their runtime (both ways reducing utilization)
+                  */
+                if (dl_policy(policy))
+                        return -EPERM;
+
                 /*
                  * Treat SCHED_IDLE as nice 20. Only allow a switch to
                  * SCHED_NORMAL if the RLIMIT_NICE would normally permit it.
diff --git a/kernel/sched/cpudeadline.c b/kernel/sched/cpudeadline.c
index 5b8838b56d1c..5b9bb42b2d47 100644
--- a/kernel/sched/cpudeadline.c
+++ b/kernel/sched/cpudeadline.c
@@ -70,7 +70,7 @@ static void cpudl_heapify(struct cpudl *cp, int idx)
 
 static void cpudl_change_key(struct cpudl *cp, int idx, u64 new_dl)
 {
-        WARN_ON(!cpu_present(idx) || idx == IDX_INVALID);
+        WARN_ON(idx == IDX_INVALID || !cpu_present(idx));
 
         if (dl_time_before(new_dl, cp->elements[idx].dl)) {
                 cp->elements[idx].dl = new_dl;
@@ -117,7 +117,7 @@ int cpudl_find(struct cpudl *cp, struct task_struct *p,
         }
 
 out:
-        WARN_ON(!cpu_present(best_cpu) && best_cpu != -1);
+        WARN_ON(best_cpu != -1 && !cpu_present(best_cpu));
 
         return best_cpu;
 }
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 15cbc17fbf84..6e79b3faa4cd 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -135,7 +135,6 @@ static void update_dl_migration(struct dl_rq *dl_rq)
 static void inc_dl_migration(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
 {
         struct task_struct *p = dl_task_of(dl_se);
-        dl_rq = &rq_of_dl_rq(dl_rq)->dl;
 
         if (p->nr_cpus_allowed > 1)
                 dl_rq->dl_nr_migratory++;
@@ -146,7 +145,6 @@ static void inc_dl_migration(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
 static void dec_dl_migration(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
 {
         struct task_struct *p = dl_task_of(dl_se);
-        dl_rq = &rq_of_dl_rq(dl_rq)->dl;
 
         if (p->nr_cpus_allowed > 1)
                 dl_rq->dl_nr_migratory--;
@@ -564,6 +562,8 @@ int dl_runtime_exceeded(struct rq *rq, struct sched_dl_entity *dl_se)
         return 1;
 }
 
+extern bool sched_rt_bandwidth_account(struct rt_rq *rt_rq);
+
 /*
  * Update the current task's runtime statistics (provided it is still
  * a -deadline task and has not been removed from the dl_rq).
@@ -627,11 +627,13 @@ static void update_curr_dl(struct rq *rq)
                 struct rt_rq *rt_rq = &rq->rt;
 
                 raw_spin_lock(&rt_rq->rt_runtime_lock);
-                rt_rq->rt_time += delta_exec;
                 /*
                  * We'll let actual RT tasks worry about the overflow here, we
-                 * have our own CBS to keep us inline -- see above.
+                 * have our own CBS to keep us inline; only account when RT
+                 * bandwidth is relevant.
                  */
+                if (sched_rt_bandwidth_account(rt_rq))
+                        rt_rq->rt_time += delta_exec;
                 raw_spin_unlock(&rt_rq->rt_runtime_lock);
         }
 }
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 78157099b167..9b4c4f320130 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -7001,15 +7001,15 @@ static void switched_from_fair(struct rq *rq, struct task_struct *p)
         struct cfs_rq *cfs_rq = cfs_rq_of(se);
 
         /*
-         * Ensure the task's vruntime is normalized, so that when its
+         * Ensure the task's vruntime is normalized, so that when it's
          * switched back to the fair class the enqueue_entity(.flags=0) will
          * do the right thing.
          *
-         * If it was on_rq, then the dequeue_entity(.flags=0) will already
-         * have normalized the vruntime, if it was !on_rq, then only when
+         * If it's on_rq, then the dequeue_entity(.flags=0) will already
+         * have normalized the vruntime, if it's !on_rq, then only when
          * the task is sleeping will it still have non-normalized vruntime.
          */
-        if (!se->on_rq && p->state != TASK_RUNNING) {
+        if (!p->on_rq && p->state != TASK_RUNNING) {
                 /*
                  * Fix up our vruntime so that the current sleep doesn't
                  * cause 'unlimited' sleep bonus.
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index a2740b775b45..1999021042c7 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -538,6 +538,14 @@ static inline struct rt_bandwidth *sched_rt_bandwidth(struct rt_rq *rt_rq)
 
 #endif /* CONFIG_RT_GROUP_SCHED */
 
+bool sched_rt_bandwidth_account(struct rt_rq *rt_rq)
+{
+        struct rt_bandwidth *rt_b = sched_rt_bandwidth(rt_rq);
+
+        return (hrtimer_active(&rt_b->rt_period_timer) ||
+                rt_rq->rt_time < rt_b->rt_runtime);
+}
+
 #ifdef CONFIG_SMP
 /*
  * We ran out of runtime, see if we can borrow some from our neighbours.
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 84571e09c907..01fbae5b97b7 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -293,7 +293,7 @@ int stop_two_cpus(unsigned int cpu1, unsigned int cpu2, cpu_stop_fn_t fn, void *
          */
         smp_call_function_single(min(cpu1, cpu2),
                                  &irq_cpu_stop_queue_work,
-                                 &call_args, 0);
+                                 &call_args, 1);
         lg_local_unlock(&stop_cpus_lock);
         preempt_enable();
 
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index e71ffd4eccb5..7b16d40bd64d 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -27,12 +27,6 @@
 
 DEFINE_MUTEX(event_mutex);
 
-DEFINE_MUTEX(event_storage_mutex);
-EXPORT_SYMBOL_GPL(event_storage_mutex);
-
-char event_storage[EVENT_STORAGE_SIZE];
-EXPORT_SYMBOL_GPL(event_storage);
-
 LIST_HEAD(ftrace_events);
 static LIST_HEAD(ftrace_common_fields);
 
@@ -1777,6 +1771,16 @@ static void trace_module_add_events(struct module *mod)
 {
         struct ftrace_event_call **call, **start, **end;
 
+        if (!mod->num_trace_events)
+                return;
+
+        /* Don't add infrastructure for mods without tracepoints */
+        if (trace_module_has_bad_taint(mod)) {
+                pr_err("%s: module has bad taint, not creating trace events\n",
+                       mod->name);
+                return;
+        }
+
         start = mod->trace_events;
         end = mod->trace_events + mod->num_trace_events;
 
diff --git a/kernel/trace/trace_export.c b/kernel/trace/trace_export.c
index 7c3e3e72e2b6..ee0a5098ac43 100644
--- a/kernel/trace/trace_export.c
+++ b/kernel/trace/trace_export.c
@@ -95,15 +95,12 @@ static void __always_unused ____ftrace_check_##name(void)		\
 #undef __array
 #define __array(type, item, len)                                        \
         do {                                                            \
+                char *type_str = #type"["__stringify(len)"]";           \
                 BUILD_BUG_ON(len > MAX_FILTER_STR_VAL);                 \
-                mutex_lock(&event_storage_mutex);                       \
-                snprintf(event_storage, sizeof(event_storage),          \
-                         "%s[%d]", #type, len);                         \
-                ret = trace_define_field(event_call, event_storage, #item, \
+                ret = trace_define_field(event_call, type_str, #item,   \
                                  offsetof(typeof(field), item),         \
                                  sizeof(field.item),                    \
                                  is_signed_type(type), filter_type);    \
-                mutex_unlock(&event_storage_mutex);                     \
                 if (ret)                                                \
                         return ret;                                     \
         } while (0);
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 29f26540e9c9..031cc5655a51 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -631,6 +631,11 @@ void tracepoint_iter_reset(struct tracepoint_iter *iter)
 EXPORT_SYMBOL_GPL(tracepoint_iter_reset);
 
 #ifdef CONFIG_MODULES
+bool trace_module_has_bad_taint(struct module *mod)
+{
+        return mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP));
+}
+
 static int tracepoint_module_coming(struct module *mod)
 {
         struct tp_module *tp_mod, *iter;
@@ -641,7 +646,7 @@ static int tracepoint_module_coming(struct module *mod)
          * module headers (for forced load), to make sure we don't cause a crash.
          * Staging and out-of-tree GPL modules are fine.
          */
-        if (mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP)))
+        if (trace_module_has_bad_taint(mod))
                 return 0;
         mutex_lock(&tracepoints_mutex);
         tp_mod = kmalloc(sizeof(struct tp_module), GFP_KERNEL);
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 2defd1308b04..98f2d7e91a91 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -424,111 +424,134 @@ void debug_dma_dump_mappings(struct device *dev)
 EXPORT_SYMBOL(debug_dma_dump_mappings);
 
 /*
- * For each page mapped (initial page in the case of
- * dma_alloc_coherent/dma_map_{single|page}, or each page in a
- * scatterlist) insert into this tree using the pfn as the key. At
+ * For each mapping (initial cacheline in the case of
+ * dma_alloc_coherent/dma_map_page, initial cacheline in each page of a
+ * scatterlist, or the cacheline specified in dma_map_single) insert
+ * into this tree using the cacheline as the key. At
  * dma_unmap_{single|sg|page} or dma_free_coherent delete the entry.  If
- * the pfn already exists at insertion time add a tag as a reference
+ * the entry already exists at insertion time add a tag as a reference
  * count for the overlapping mappings.  For now, the overlap tracking
- * just ensures that 'unmaps' balance 'maps' before marking the pfn
- * idle, but we should also be flagging overlaps as an API violation.
+ * just ensures that 'unmaps' balance 'maps' before marking the
+ * cacheline idle, but we should also be flagging overlaps as an API
+ * violation.
  *
  * Memory usage is mostly constrained by the maximum number of available
  * dma-debug entries in that we need a free dma_debug_entry before
- * inserting into the tree.  In the case of dma_map_{single|page} and
- * dma_alloc_coherent there is only one dma_debug_entry and one pfn to
- * track per event.  dma_map_sg(), on the other hand,
- * consumes a single dma_debug_entry, but inserts 'nents' entries into
- * the tree.
+ * inserting into the tree.  In the case of dma_map_page and
+ * dma_alloc_coherent there is only one dma_debug_entry and one
+ * dma_active_cacheline entry to track per event.  dma_map_sg(), on the
+ * other hand, consumes a single dma_debug_entry, but inserts 'nents'
+ * entries into the tree.
  *
  * At any time debug_dma_assert_idle() can be called to trigger a
- * warning if the given page is in the active set.
+ * warning if any cachelines in the given page are in the active set.
  */
-static RADIX_TREE(dma_active_pfn, GFP_NOWAIT);
+static RADIX_TREE(dma_active_cacheline, GFP_NOWAIT);
 static DEFINE_SPINLOCK(radix_lock);
-#define ACTIVE_PFN_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)
+#define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)
+#define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT)
+#define CACHELINES_PER_PAGE (1 << CACHELINE_PER_PAGE_SHIFT)
 
-static int active_pfn_read_overlap(unsigned long pfn)
+static phys_addr_t to_cacheline_number(struct dma_debug_entry *entry)
+{
+        return (entry->pfn << CACHELINE_PER_PAGE_SHIFT) +
+                (entry->offset >> L1_CACHE_SHIFT);
+}
+
+static int active_cacheline_read_overlap(phys_addr_t cln)
 {
         int overlap = 0, i;
 
         for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
-                if (radix_tree_tag_get(&dma_active_pfn, pfn, i))
+                if (radix_tree_tag_get(&dma_active_cacheline, cln, i))
                         overlap |= 1 << i;
         return overlap;
 }
 
-static int active_pfn_set_overlap(unsigned long pfn, int overlap)
+static int active_cacheline_set_overlap(phys_addr_t cln, int overlap)
 {
         int i;
 
-        if (overlap > ACTIVE_PFN_MAX_OVERLAP || overlap < 0)
+        if (overlap > ACTIVE_CACHELINE_MAX_OVERLAP || overlap < 0)
                 return overlap;
 
         for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
                 if (overlap & 1 << i)
-                        radix_tree_tag_set(&dma_active_pfn, pfn, i);
+                        radix_tree_tag_set(&dma_active_cacheline, cln, i);
                 else
-                        radix_tree_tag_clear(&dma_active_pfn, pfn, i);
+                        radix_tree_tag_clear(&dma_active_cacheline, cln, i);
 
         return overlap;
 }
 
-static void active_pfn_inc_overlap(unsigned long pfn)
+static void active_cacheline_inc_overlap(phys_addr_t cln)
 {
-        int overlap = active_pfn_read_overlap(pfn);
+        int overlap = active_cacheline_read_overlap(cln);
 
-        overlap = active_pfn_set_overlap(pfn, ++overlap);
+        overlap = active_cacheline_set_overlap(cln, ++overlap);
 
         /* If we overflowed the overlap counter then we're potentially
          * leaking dma-mappings.  Otherwise, if maps and unmaps are
          * balanced then this overflow may cause false negatives in
-         * debug_dma_assert_idle() as the pfn may be marked idle
+         * debug_dma_assert_idle() as the cacheline may be marked idle
          * prematurely.
          */
-        WARN_ONCE(overlap > ACTIVE_PFN_MAX_OVERLAP,
-                  "DMA-API: exceeded %d overlapping mappings of pfn %lx\n",
-                  ACTIVE_PFN_MAX_OVERLAP, pfn);
+        WARN_ONCE(overlap > ACTIVE_CACHELINE_MAX_OVERLAP,
+                  "DMA-API: exceeded %d overlapping mappings of cacheline %pa\n",
+                  ACTIVE_CACHELINE_MAX_OVERLAP, &cln);
 }
 
-static int active_pfn_dec_overlap(unsigned long pfn)
+static int active_cacheline_dec_overlap(phys_addr_t cln)
 {
-        int overlap = active_pfn_read_overlap(pfn);
+        int overlap = active_cacheline_read_overlap(cln);
 
-        return active_pfn_set_overlap(pfn, --overlap);
+        return active_cacheline_set_overlap(cln, --overlap);
 }
 
-static int active_pfn_insert(struct dma_debug_entry *entry)
+static int active_cacheline_insert(struct dma_debug_entry *entry)
 {
+        phys_addr_t cln = to_cacheline_number(entry);
         unsigned long flags;
         int rc;
 
+        /* If the device is not writing memory then we don't have any
+         * concerns about the cpu consuming stale data.  This mitigates
+         * legitimate usages of overlapping mappings.
+         */
+        if (entry->direction == DMA_TO_DEVICE)
+                return 0;
+
         spin_lock_irqsave(&radix_lock, flags);
-        rc = radix_tree_insert(&dma_active_pfn, entry->pfn, entry);
+        rc = radix_tree_insert(&dma_active_cacheline, cln, entry);
         if (rc == -EEXIST)
-                active_pfn_inc_overlap(entry->pfn);
+                active_cacheline_inc_overlap(cln);
         spin_unlock_irqrestore(&radix_lock, flags);
 
         return rc;
 }
 
-static void active_pfn_remove(struct dma_debug_entry *entry)
+static void active_cacheline_remove(struct dma_debug_entry *entry)
 {
+        phys_addr_t cln = to_cacheline_number(entry);
         unsigned long flags;
 
+        /* ...mirror the insert case */
+        if (entry->direction == DMA_TO_DEVICE)
+                return;
+
         spin_lock_irqsave(&radix_lock, flags);
         /* since we are counting overlaps the final put of the
-         * entry->pfn will occur when the overlap count is 0.
-         * active_pfn_dec_overlap() returns -1 in that case
+         * cacheline will occur when the overlap count is 0.
+         * active_cacheline_dec_overlap() returns -1 in that case
          */
-        if (active_pfn_dec_overlap(entry->pfn) < 0)
-                radix_tree_delete(&dma_active_pfn, entry->pfn);
+        if (active_cacheline_dec_overlap(cln) < 0)
+                radix_tree_delete(&dma_active_cacheline, cln);
         spin_unlock_irqrestore(&radix_lock, flags);
 }
 
 /**
  * debug_dma_assert_idle() - assert that a page is not undergoing dma
- * @page: page to lookup in the dma_active_pfn tree
+ * @page: page to lookup in the dma_active_cacheline tree
  *
  * Place a call to this routine in cases where the cpu touching the page
  * before the dma completes (page is dma_unmapped) will lead to data
@@ -536,22 +559,38 @@ static void active_pfn_remove(struct dma_debug_entry *entry)
  */
 void debug_dma_assert_idle(struct page *page)
 {
+        static struct dma_debug_entry *ents[CACHELINES_PER_PAGE];
+        struct dma_debug_entry *entry = NULL;
+        void **results = (void **) &ents;
+        unsigned int nents, i;
         unsigned long flags;
-        struct dma_debug_entry *entry;
+        phys_addr_t cln;
 
         if (!page)
                 return;
 
+        cln = (phys_addr_t) page_to_pfn(page) << CACHELINE_PER_PAGE_SHIFT;
         spin_lock_irqsave(&radix_lock, flags);
-        entry = radix_tree_lookup(&dma_active_pfn, page_to_pfn(page));
+        nents = radix_tree_gang_lookup(&dma_active_cacheline, results, cln,
+                                       CACHELINES_PER_PAGE);
+        for (i = 0; i < nents; i++) {
+                phys_addr_t ent_cln = to_cacheline_number(ents[i]);
+
+                if (ent_cln == cln) {
+                        entry = ents[i];
+                        break;
+                } else if (ent_cln >= cln + CACHELINES_PER_PAGE)
+                        break;
+        }
         spin_unlock_irqrestore(&radix_lock, flags);
 
         if (!entry)
                 return;
 
+        cln = to_cacheline_number(entry);
         err_printk(entry->dev, entry,
-                   "DMA-API: cpu touching an active dma mapped page "
-                   "[pfn=0x%lx]\n", entry->pfn);
+                   "DMA-API: cpu touching an active dma mapped cacheline [cln=%pa]\n",
+                   &cln);
 }
 
 /*
@@ -568,9 +607,9 @@ static void add_dma_entry(struct dma_debug_entry *entry)
         hash_bucket_add(bucket, entry);
         put_hash_bucket(bucket, &flags);
 
-        rc = active_pfn_insert(entry);
+        rc = active_cacheline_insert(entry);
         if (rc == -ENOMEM) {
-                pr_err("DMA-API: pfn tracking ENOMEM, dma-debug disabled\n");
+                pr_err("DMA-API: cacheline tracking ENOMEM, dma-debug disabled\n");
                 global_disable = true;
         }
 
@@ -631,7 +670,7 @@ static void dma_entry_free(struct dma_debug_entry *entry)
 {
         unsigned long flags;
 
-        active_pfn_remove(entry);
+        active_cacheline_remove(entry);
 
         /*
          * add to beginning of the list - this way the entries are
diff --git a/lib/fonts/Kconfig b/lib/fonts/Kconfig
index 4dc1b990aa23..34fd931b54b5 100644
--- a/lib/fonts/Kconfig
+++ b/lib/fonts/Kconfig
@@ -9,7 +9,7 @@ if FONT_SUPPORT
 
 config FONTS
         bool "Select compiled-in fonts"
-        depends on FRAMEBUFFER_CONSOLE
+        depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
         help
           Say Y here if you would like to use fonts other than the default
           your frame buffer console usually use.
@@ -22,7 +22,7 @@ config FONTS
 
 config FONT_8x8
         bool "VGA 8x8 font" if FONTS
-        depends on FRAMEBUFFER_CONSOLE
+        depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
         default y if !SPARC && !FONTS
         help
           This is the "high resolution" font for the VGA frame buffer (the one
@@ -45,7 +45,7 @@ config FONT_8x16
 
 config FONT_6x11
         bool "Mac console 6x11 font (not supported by all drivers)" if FONTS
-        depends on FRAMEBUFFER_CONSOLE
+        depends on FRAMEBUFFER_CONSOLE || STI_CONSOLE
         default y if !SPARC && !FONTS && MAC
         help
           Small console font with Macintosh-style high-half glyphs.  Some Mac
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 7811ed3b4e70..bd4a8dfdf0b8 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -1253,8 +1253,10 @@ unsigned long radix_tree_locate_item(struct radix_tree_root *root, void *item)
 
                 node = indirect_to_ptr(node);
                 max_index = radix_tree_maxindex(node->height);
-                if (cur_index > max_index)
+                if (cur_index > max_index) {
+                        rcu_read_unlock();
                         break;
+                }
 
                 cur_index = __locate(node, item, cur_index, &found_index);
                 rcu_read_unlock();
diff --git a/mm/Kconfig b/mm/Kconfig
index 2d9f1504d75e..2888024e0b0a 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -575,5 +575,5 @@ config PGTABLE_MAPPING
           then you should select this. This causes zsmalloc to use page table
           mapping rather than copying for object mapping.
 
-          You can check speed with zsmalloc benchmark[1].
-          [1] https://github.com/spartacus06/zsmalloc
+          You can check speed with zsmalloc benchmark:
+          https://github.com/spartacus06/zsmapbench
diff --git a/mm/compaction.c b/mm/compaction.c
index b48c5259ea33..918577595ea8 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -251,7 +251,6 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
 {
         int nr_scanned = 0, total_isolated = 0;
         struct page *cursor, *valid_page = NULL;
-        unsigned long nr_strict_required = end_pfn - blockpfn;
         unsigned long flags;
         bool locked = false;
 
@@ -264,11 +263,12 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
 
                 nr_scanned++;
                 if (!pfn_valid_within(blockpfn))
-                        continue;
+                        goto isolate_fail;
+
                 if (!valid_page)
                         valid_page = page;
                 if (!PageBuddy(page))
-                        continue;
+                        goto isolate_fail;
 
                 /*
                  * The zone lock must be held to isolate freepages.
@@ -289,12 +289,10 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
 
                 /* Recheck this is a buddy page under lock */
                 if (!PageBuddy(page))
-                        continue;
+                        goto isolate_fail;
 
                 /* Found a free page, break it into order-0 pages */
                 isolated = split_free_page(page);
-                if (!isolated && strict)
-                        break;
                 total_isolated += isolated;
                 for (i = 0; i < isolated; i++) {
                         list_add(&page->lru, freelist);
@@ -305,7 +303,15 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
                 if (isolated) {
                         blockpfn += isolated - 1;
                         cursor += isolated - 1;
+                        continue;
                 }
+
+isolate_fail:
+                if (strict)
+                        break;
+                else
+                        continue;
+
         }
 
         trace_mm_compaction_isolate_freepages(nr_scanned, total_isolated);
@@ -315,7 +321,7 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
          * pages requested were isolated. If there were any failures, 0 is
          * returned and CMA will fail.
          */
-        if (strict && nr_strict_required > total_isolated)
+        if (strict && blockpfn < end_pfn)
                 total_isolated = 0;
 
         if (locked)
diff --git a/mm/fremap.c b/mm/fremap.c
index bbc4d660221a..34feba60a17e 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -23,28 +23,44 @@
 
 #include "internal.h"
 
+static int mm_counter(struct page *page)
+{
+        return PageAnon(page) ? MM_ANONPAGES : MM_FILEPAGES;
+}
+
 static void zap_pte(struct mm_struct *mm, struct vm_area_struct *vma,
                         unsigned long addr, pte_t *ptep)
 {
         pte_t pte = *ptep;
+        struct page *page;
+        swp_entry_t entry;
 
         if (pte_present(pte)) {
-                struct page *page;
-
                 flush_cache_page(vma, addr, pte_pfn(pte));
                 pte = ptep_clear_flush(vma, addr, ptep);
                 page = vm_normal_page(vma, addr, pte);
                 if (page) {
                         if (pte_dirty(pte))
                                 set_page_dirty(page);
+                        update_hiwater_rss(mm);
+                        dec_mm_counter(mm, mm_counter(page));
                         page_remove_rmap(page);
                         page_cache_release(page);
+                }
+        } else {        /* zap_pte() is not called when pte_none() */
+                if (!pte_file(pte)) {
                         update_hiwater_rss(mm);
-                        dec_mm_counter(mm, MM_FILEPAGES);
+                        entry = pte_to_swp_entry(pte);
+                        if (non_swap_entry(entry)) {
+                                if (is_migration_entry(entry)) {
+                                        page = migration_entry_to_page(entry);
+                                        dec_mm_counter(mm, mm_counter(page));
+                                }
+                        } else {
+                                free_swap_and_cache(entry);
+                                dec_mm_counter(mm, MM_SWAPENTS);
+                        }
                 }
-        } else {
-                if (!pte_file(pte))
-                        free_swap_and_cache(pte_to_swp_entry(pte));
                 pte_clear_not_present_full(mm, addr, ptep, 0);
         }
 }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 4df39b1bde91..1546655a2d78 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1961,7 +1961,7 @@ out:
         return ret;
 }
 
-#define VM_NO_THP (VM_SPECIAL|VM_MIXEDMAP|VM_HUGETLB|VM_SHARED|VM_MAYSHARE)
+#define VM_NO_THP (VM_SPECIAL | VM_HUGETLB | VM_SHARED | VM_MAYSHARE)
 
 int hugepage_madvise(struct vm_area_struct *vma,
                      unsigned long *vm_flags, int advice)
diff --git a/mm/ksm.c b/mm/ksm.c
index aa4c7c7250c1..68710e80994a 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -444,7 +444,7 @@ static void break_cow(struct rmap_item *rmap_item)
 static struct page *page_trans_compound_anon(struct page *page)
 {
         if (PageTransCompound(page)) {
-                struct page *head = compound_trans_head(page);
+                struct page *head = compound_head(page);
                 /*
                  * head may actually be splitted and freed from under
                  * us but it's ok here.
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index ce7a8cc7b404..5b6b0039f725 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1127,8 +1127,8 @@ skip_node:
          * skipping css reference should be safe.
          */
         if (next_css) {
-                if ((next_css->flags & CSS_ONLINE) &&
-                                (next_css == &root->css || css_tryget(next_css)))
+                if ((next_css == &root->css) ||
+                    ((next_css->flags & CSS_ONLINE) && css_tryget(next_css)))
                         return mem_cgroup_from_css(next_css);
 
                 prev_css = next_css;
@@ -6595,6 +6595,7 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_css(css);
         struct mem_cgroup_event *event, *tmp;
+        struct cgroup_subsys_state *iter;
 
         /*
          * Unregister events and notify userspace.
@@ -6611,7 +6612,14 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
         kmem_cgroup_css_offline(memcg);
 
         mem_cgroup_invalidate_reclaim_iterators(memcg);
-        mem_cgroup_reparent_charges(memcg);
+
+        /*
+         * This requires that offlining is serialized.  Right now that is
+         * guaranteed because css_killed_work_fn() holds the cgroup_mutex.
+         */
+        css_for_each_descendant_post(iter, css)
+                mem_cgroup_reparent_charges(mem_cgroup_from_css(iter));
+
         mem_cgroup_destroy_all_caches(memcg);
         vmpressure_cleanup(&memcg->vmpressure);
 }
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 2f2f34a4e77d..90002ea43638 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1651,7 +1651,7 @@ int soft_offline_page(struct page *page, int flags)
 {
         int ret;
         unsigned long pfn = page_to_pfn(page);
-        struct page *hpage = compound_trans_head(page);
+        struct page *hpage = compound_head(page);
 
         if (PageHWPoison(page)) {
                 pr_info("soft offline: %#lx page already poisoned\n", pfn);
diff --git a/mm/migrate.c b/mm/migrate.c
index 482a33d89134..bed48809e5d0 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -178,6 +178,37 @@ out:
 }
 
 /*
+ * Congratulations to trinity for discovering this bug.
+ * mm/fremap.c's remap_file_pages() accepts any range within a single vma to
+ * convert that vma to VM_NONLINEAR; and generic_file_remap_pages() will then
+ * replace the specified range by file ptes throughout (maybe populated after).
+ * If page migration finds a page within that range, while it's still located
+ * by vma_interval_tree rather than lost to i_mmap_nonlinear list, no problem:
+ * zap_pte() clears the temporary migration entry before mmap_sem is dropped.
+ * But if the migrating page is in a part of the vma outside the range to be
+ * remapped, then it will not be cleared, and remove_migration_ptes() needs to
+ * deal with it.  Fortunately, this part of the vma is of course still linear,
+ * so we just need to use linear location on the nonlinear list.
+ */
+static int remove_linear_migration_ptes_from_nonlinear(struct page *page,
+                struct address_space *mapping, void *arg)
+{
+        struct vm_area_struct *vma;
+        /* hugetlbfs does not support remap_pages, so no huge pgoff worries */
+        pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
+        unsigned long addr;
+
+        list_for_each_entry(vma,
+                &mapping->i_mmap_nonlinear, shared.nonlinear) {
+
+                addr = vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
+                if (addr >= vma->vm_start && addr < vma->vm_end)
+                        remove_migration_pte(page, vma, addr, arg);
+        }
+        return SWAP_AGAIN;
+}
+
+/*
  * Get rid of all migration entries and replace them by
  * references to the indicated page.
  */
@@ -186,6 +217,7 @@ static void remove_migration_ptes(struct page *old, struct page *new)
         struct rmap_walk_control rwc = {
                 .rmap_one = remove_migration_pte,
                 .arg = old,
+                .file_nonlinear = remove_linear_migration_ptes_from_nonlinear,
         };
 
         rmap_walk(new, &rwc);
@@ -1158,7 +1190,7 @@ static struct page *new_page_node(struct page *p, unsigned long private,
                                         pm->node);
         else
                 return alloc_pages_exact_node(pm->node,
-                                GFP_HIGHUSER_MOVABLE | GFP_THISNODE, 0);
+                                GFP_HIGHUSER_MOVABLE | __GFP_THISNODE, 0);
 }
 
 /*
@@ -1544,9 +1576,9 @@ static struct page *alloc_misplaced_dst_page(struct page *page,
         struct page *newpage;
 
         newpage = alloc_pages_exact_node(nid,
-                                         (GFP_HIGHUSER_MOVABLE | GFP_THISNODE |
-                                          __GFP_NOMEMALLOC | __GFP_NORETRY |
-                                          __GFP_NOWARN) &
+                                         (GFP_HIGHUSER_MOVABLE |
+                                          __GFP_THISNODE | __GFP_NOMEMALLOC |
+                                          __GFP_NORETRY | __GFP_NOWARN) &
                                          ~GFP_IOFS, 0);
 
         return newpage;
@@ -1747,7 +1779,8 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
                 goto out_dropref;
 
         new_page = alloc_pages_node(node,
-                (GFP_TRANSHUGE | GFP_THISNODE) & ~__GFP_WAIT, HPAGE_PMD_ORDER);
+                (GFP_TRANSHUGE | __GFP_THISNODE) & ~__GFP_WAIT,
+                HPAGE_PMD_ORDER);
         if (!new_page)
                 goto out_fail;
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index e3758a09a009..3bac76ae4b30 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -369,9 +369,11 @@ void prep_compound_page(struct page *page, unsigned long order)
         __SetPageHead(page);
         for (i = 1; i < nr_pages; i++) {
                 struct page *p = page + i;
-                __SetPageTail(p);
                 set_page_count(p, 0);
                 p->first_page = page;
+                /* Make sure p->first_page is always valid for PageTail() */
+                smp_wmb();
+                __SetPageTail(p);
         }
 }
 
@@ -1236,6 +1238,15 @@ void drain_zone_pages(struct zone *zone, struct per_cpu_pages *pcp)
         }
         local_irq_restore(flags);
 }
+static bool gfp_thisnode_allocation(gfp_t gfp_mask)
+{
+        return (gfp_mask & GFP_THISNODE) == GFP_THISNODE;
+}
+#else
+static bool gfp_thisnode_allocation(gfp_t gfp_mask)
+{
+        return false;
+}
 #endif
 
 /*
@@ -1572,7 +1583,13 @@ again:
                                           get_pageblock_migratetype(page));
         }
 
-        __mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order));
+        /*
+         * NOTE: GFP_THISNODE allocations do not partake in the kswapd
+         * aging protocol, so they can't be fair.
+         */
+        if (!gfp_thisnode_allocation(gfp_flags))
+                __mod_zone_page_state(zone, NR_ALLOC_BATCH, -(1 << order));
+
         __count_zone_vm_events(PGALLOC, zone, 1 << order);
         zone_statistics(preferred_zone, zone, gfp_flags);
         local_irq_restore(flags);
@@ -1944,8 +1961,12 @@ zonelist_scan:
                  * ultimately fall back to remote zones that do not
                  * partake in the fairness round-robin cycle of this
                  * zonelist.
+                 *
+                 * NOTE: GFP_THISNODE allocations do not partake in
+                 * the kswapd aging protocol, so they can't be fair.
                  */
-                if (alloc_flags & ALLOC_WMARK_LOW) {
+                if ((alloc_flags & ALLOC_WMARK_LOW) &&
+                    !gfp_thisnode_allocation(gfp_mask)) {
                         if (zone_page_state(zone, NR_ALLOC_BATCH) <= 0)
                                 continue;
                         if (!zone_local(preferred_zone, zone))
@@ -2501,8 +2522,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
          * allowed per node queues are empty and that nodes are
          * over allocated.
          */
-        if (IS_ENABLED(CONFIG_NUMA) &&
-                        (gfp_mask & GFP_THISNODE) == GFP_THISNODE)
+        if (gfp_thisnode_allocation(gfp_mask))
                 goto nopage;
 
 restart:
diff --git a/mm/rmap.c b/mm/rmap.c
index d9d42316a99a..8fc049f9a5a6 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1360,8 +1360,9 @@ static int try_to_unmap_cluster(unsigned long cursor, unsigned int *mapcount,
 }
 
 static int try_to_unmap_nonlinear(struct page *page,
-                struct address_space *mapping, struct vm_area_struct *vma)
+                struct address_space *mapping, void *arg)
 {
+        struct vm_area_struct *vma;
         int ret = SWAP_AGAIN;
         unsigned long cursor;
         unsigned long max_nl_cursor = 0;
@@ -1663,7 +1664,7 @@ static int rmap_walk_file(struct page *page, struct rmap_walk_control *rwc)
         if (list_empty(&mapping->i_mmap_nonlinear))
                 goto done;
 
-        ret = rwc->file_nonlinear(page, mapping, vma);
+        ret = rwc->file_nonlinear(page, mapping, rwc->arg);
 
 done:
         mutex_unlock(&mapping->i_mmap_mutex);
diff --git a/mm/swap.c b/mm/swap.c
index b31ba67d440a..0092097b3f4c 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -98,7 +98,7 @@ static void put_compound_page(struct page *page)
         }
 
         /* __split_huge_page_refcount can run under us */
-        page_head = compound_trans_head(page);
+        page_head = compound_head(page);
 
         /*
          * THP can not break up slab pages so avoid taking
@@ -253,7 +253,7 @@ bool __get_page_tail(struct page *page)
          */
         unsigned long flags;
         bool got;
-        struct page *page_head = compound_trans_head(page);
+        struct page *page_head = compound_head(page);
 
         /* Ref to put_compound_page() comment. */
         if (!__compound_tail_refcounted(page_head)) {
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index de51c48c4393..4b65aa492fb6 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -538,6 +538,9 @@ static int vlan_passthru_hard_header(struct sk_buff *skb, struct net_device *dev
         struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
         struct net_device *real_dev = vlan->real_dev;
 
+        if (saddr == NULL)
+                saddr = dev->dev_addr;
+
         return dev_hard_header(skb, real_dev, type, daddr, saddr, len);
 }
 
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index ef66365b7354..93067ecdb9a2 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1127,9 +1127,10 @@ static void br_multicast_query_received(struct net_bridge *br,
                                         struct net_bridge_port *port,
                                         struct bridge_mcast_querier *querier,
                                         int saddr,
+                                        bool is_general_query,
                                         unsigned long max_delay)
 {
-        if (saddr)
+        if (saddr && is_general_query)
                 br_multicast_update_querier_timer(br, querier, max_delay);
         else if (timer_pending(&querier->timer))
                 return;
@@ -1181,8 +1182,16 @@ static int br_ip4_multicast_query(struct net_bridge *br,
                             IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
         }
 
+        /* RFC2236+RFC3376 (IGMPv2+IGMPv3) require the multicast link layer
+         * all-systems destination addresses (224.0.0.1) for general queries
+         */
+        if (!group && iph->daddr != htonl(INADDR_ALLHOSTS_GROUP)) {
+                err = -EINVAL;
+                goto out;
+        }
+
         br_multicast_query_received(br, port, &br->ip4_querier, !!iph->saddr,
-                                    max_delay);
+                                    !group, max_delay);
 
         if (!group)
                 goto out;
@@ -1228,6 +1237,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         unsigned long max_delay;
         unsigned long now = jiffies;
         const struct in6_addr *group = NULL;
+        bool is_general_query;
         int err = 0;
 
         spin_lock(&br->multicast_lock);
@@ -1235,6 +1245,12 @@ static int br_ip6_multicast_query(struct net_bridge *br,
             (port && port->state == BR_STATE_DISABLED))
                 goto out;
 
+        /* RFC2710+RFC3810 (MLDv1+MLDv2) require link-local source addresses */
+        if (!(ipv6_addr_type(&ip6h->saddr) & IPV6_ADDR_LINKLOCAL)) {
+                err = -EINVAL;
+                goto out;
+        }
+
         if (skb->len == sizeof(*mld)) {
                 if (!pskb_may_pull(skb, sizeof(*mld))) {
                         err = -EINVAL;
@@ -1256,8 +1272,19 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 max_delay = max(msecs_to_jiffies(mldv2_mrc(mld2q)), 1UL);
         }
 
+        is_general_query = group && ipv6_addr_any(group);
+
+        /* RFC2710+RFC3810 (MLDv1+MLDv2) require the multicast link layer
+         * all-nodes destination address (ff02::1) for general queries
+         */
+        if (is_general_query && !ipv6_addr_is_ll_all_nodes(&ip6h->daddr)) {
+                err = -EINVAL;
+                goto out;
+        }
+
         br_multicast_query_received(br, port, &br->ip6_querier,
-                                    !ipv6_addr_any(&ip6h->saddr), max_delay);
+                                    !ipv6_addr_any(&ip6h->saddr),
+                                    is_general_query, max_delay);
 
         if (!group)
                 goto out;
diff --git a/net/can/raw.c b/net/can/raw.c
index 8be757cca2ec..081e81fd017f 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -121,13 +121,9 @@ static void raw_rcv(struct sk_buff *oskb, void *data)
         if (!ro->recv_own_msgs && oskb->sk == sk)
                 return;
 
-        /* do not pass frames with DLC > 8 to a legacy socket */
-        if (!ro->fd_frames) {
-                struct canfd_frame *cfd = (struct canfd_frame *)oskb->data;
-
-                if (unlikely(cfd->len > CAN_MAX_DLEN))
-                        return;
-        }
+        /* do not pass non-CAN2.0 frames to a legacy socket */
+        if (!ro->fd_frames && oskb->len != CAN_MTU)
+                return;
 
         /* clone the given skb to be able to enqueue it into the rcv queue */
         skb = skb_clone(oskb, GFP_ATOMIC);
@@ -738,9 +734,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct socket *sock,
                        struct msghdr *msg, size_t size, int flags)
 {
         struct sock *sk = sock->sk;
-        struct raw_sock *ro = raw_sk(sk);
         struct sk_buff *skb;
-        int rxmtu;
         int err = 0;
         int noblock;
 
@@ -751,20 +745,10 @@ static int raw_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (!skb)
                 return err;
 
-        /*
-         * when serving a legacy socket the DLC <= 8 is already checked inside
-         * raw_rcv(). Now check if we need to pass a canfd_frame to a legacy
-         * socket and cut the possible CANFD_MTU/CAN_MTU length to CAN_MTU
-         */
-        if (!ro->fd_frames)
-                rxmtu = CAN_MTU;
-        else
-                rxmtu = skb->len;
-
-        if (size < rxmtu)
+        if (size < skb->len)
                 msg->msg_flags |= MSG_TRUNC;
         else
-                size = rxmtu;
+                size = skb->len;
 
         err = memcpy_toiovec(msg->msg_iov, skb->data, size);
         if (err < 0) {
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index b9e9e0d38672..e16129019c66 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -766,9 +766,6 @@ static void neigh_periodic_work(struct work_struct *work)
         nht = rcu_dereference_protected(tbl->nht,
                                         lockdep_is_held(&tbl->lock));
 
-        if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
-                goto out;
-
         /*
          *      periodically recompute ReachableTime from random function
          */
@@ -781,6 +778,9 @@ static void neigh_periodic_work(struct work_struct *work)
                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
         }
 
+        if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
+                goto out;
+
         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
                 np = &nht->hash_buckets[i];
 
@@ -3046,7 +3046,7 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
         if (!t)
                 goto err;
 
-        for (i = 0; i < ARRAY_SIZE(t->neigh_vars); i++) {
+        for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
                 t->neigh_vars[i].data += (long) p;
                 t->neigh_vars[i].extra1 = dev;
                 t->neigh_vars[i].extra2 = p;
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index a664f7829a6d..df9e6b1a9759 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -742,7 +742,7 @@ static bool pkt_is_ns(struct sk_buff *skb)
         struct nd_msg *msg;
         struct ipv6hdr *hdr;
 
-        if (skb->protocol != htons(ETH_P_ARP))
+        if (skb->protocol != htons(ETH_P_IPV6))
                 return false;
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + sizeof(struct nd_msg)))
                 return false;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 1a0dac2ef9ad..120eecc0f5a4 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2121,12 +2121,13 @@ EXPORT_SYMBOL(rtmsg_ifinfo);
 static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
                                    struct net_device *dev,
                                    u8 *addr, u32 pid, u32 seq,
-                                   int type, unsigned int flags)
+                                   int type, unsigned int flags,
+                                   int nlflags)
 {
         struct nlmsghdr *nlh;
         struct ndmsg *ndm;
 
-        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), NLM_F_MULTI);
+        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), nlflags);
         if (!nlh)
                 return -EMSGSIZE;
 
@@ -2164,7 +2165,7 @@ static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, int type)
         if (!skb)
                 goto errout;
 
-        err = nlmsg_populate_fdb_fill(skb, dev, addr, 0, 0, type, NTF_SELF);
+        err = nlmsg_populate_fdb_fill(skb, dev, addr, 0, 0, type, NTF_SELF, 0);
         if (err < 0) {
                 kfree_skb(skb);
                 goto errout;
@@ -2389,7 +2390,8 @@ static int nlmsg_populate_fdb(struct sk_buff *skb,
 
                 err = nlmsg_populate_fdb_fill(skb, dev, ha->addr,
                                               portid, seq,
-                                              RTM_NEWNEIGH, NTF_SELF);
+                                              RTM_NEWNEIGH, NTF_SELF,
+                                              NLM_F_MULTI);
                 if (err < 0)
                         return err;
 skip:
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5976ef0846bd..869c7afe3b07 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -707,9 +707,6 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->mark               = old->mark;
         new->skb_iif            = old->skb_iif;
         __nf_copy(new, old);
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
-        new->nf_trace           = old->nf_trace;
-#endif
 #ifdef CONFIG_NET_SCHED
         new->tc_index           = old->tc_index;
 #ifdef CONFIG_NET_CLS_ACT
@@ -2841,81 +2838,84 @@ EXPORT_SYMBOL_GPL(skb_pull_rcsum);
 
 /**
  *      skb_segment - Perform protocol segmentation on skb.
- *      @skb: buffer to segment
+ *      @head_skb: buffer to segment
  *      @features: features for the output path (see dev->features)
  *
  *      This function performs segmentation on the given skb.  It returns
  *      a pointer to the first in a list of new skbs for the segments.
  *      In case of error it returns ERR_PTR(err).
  */
-struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
+struct sk_buff *skb_segment(struct sk_buff *head_skb,
+                            netdev_features_t features)
 {
         struct sk_buff *segs = NULL;
         struct sk_buff *tail = NULL;
-        struct sk_buff *fskb = skb_shinfo(skb)->frag_list;
-        skb_frag_t *skb_frag = skb_shinfo(skb)->frags;
-        unsigned int mss = skb_shinfo(skb)->gso_size;
-        unsigned int doffset = skb->data - skb_mac_header(skb);
+        struct sk_buff *list_skb = skb_shinfo(head_skb)->frag_list;
+        skb_frag_t *frag = skb_shinfo(head_skb)->frags;
+        unsigned int mss = skb_shinfo(head_skb)->gso_size;
+        unsigned int doffset = head_skb->data - skb_mac_header(head_skb);
+        struct sk_buff *frag_skb = head_skb;
         unsigned int offset = doffset;
-        unsigned int tnl_hlen = skb_tnl_header_len(skb);
+        unsigned int tnl_hlen = skb_tnl_header_len(head_skb);
         unsigned int headroom;
         unsigned int len;
         __be16 proto;
         bool csum;
         int sg = !!(features & NETIF_F_SG);
-        int nfrags = skb_shinfo(skb)->nr_frags;
+        int nfrags = skb_shinfo(head_skb)->nr_frags;
         int err = -ENOMEM;
         int i = 0;
         int pos;
 
-        proto = skb_network_protocol(skb);
+        proto = skb_network_protocol(head_skb);
         if (unlikely(!proto))
                 return ERR_PTR(-EINVAL);
 
         csum = !!can_checksum_protocol(features, proto);
-        __skb_push(skb, doffset);
-        headroom = skb_headroom(skb);
-        pos = skb_headlen(skb);
+        __skb_push(head_skb, doffset);
+        headroom = skb_headroom(head_skb);
+        pos = skb_headlen(head_skb);
 
         do {
                 struct sk_buff *nskb;
-                skb_frag_t *frag;
+                skb_frag_t *nskb_frag;
                 int hsize;
                 int size;
 
-                len = skb->len - offset;
+                len = head_skb->len - offset;
                 if (len > mss)
                         len = mss;
 
-                hsize = skb_headlen(skb) - offset;
+                hsize = skb_headlen(head_skb) - offset;
                 if (hsize < 0)
                         hsize = 0;
                 if (hsize > len || !sg)
                         hsize = len;
 
-                if (!hsize && i >= nfrags && skb_headlen(fskb) &&
-                    (skb_headlen(fskb) == len || sg)) {
-                        BUG_ON(skb_headlen(fskb) > len);
+                if (!hsize && i >= nfrags && skb_headlen(list_skb) &&
+                    (skb_headlen(list_skb) == len || sg)) {
+                        BUG_ON(skb_headlen(list_skb) > len);
 
                         i = 0;
-                        nfrags = skb_shinfo(fskb)->nr_frags;
-                        skb_frag = skb_shinfo(fskb)->frags;
-                        pos += skb_headlen(fskb);
+                        nfrags = skb_shinfo(list_skb)->nr_frags;
+                        frag = skb_shinfo(list_skb)->frags;
+                        frag_skb = list_skb;
+                        pos += skb_headlen(list_skb);
 
                         while (pos < offset + len) {
                                 BUG_ON(i >= nfrags);
 
-                                size = skb_frag_size(skb_frag);
+                                size = skb_frag_size(frag);
                                 if (pos + size > offset + len)
                                         break;
 
                                 i++;
                                 pos += size;
-                                skb_frag++;
+                                frag++;
                         }
 
-                        nskb = skb_clone(fskb, GFP_ATOMIC);
-                        fskb = fskb->next;
+                        nskb = skb_clone(list_skb, GFP_ATOMIC);
+                        list_skb = list_skb->next;
 
                         if (unlikely(!nskb))
                                 goto err;
@@ -2936,7 +2936,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                         __skb_push(nskb, doffset);
                 } else {
                         nskb = __alloc_skb(hsize + doffset + headroom,
-                                           GFP_ATOMIC, skb_alloc_rx_flag(skb),
+                                           GFP_ATOMIC, skb_alloc_rx_flag(head_skb),
                                            NUMA_NO_NODE);
 
                         if (unlikely(!nskb))
@@ -2952,12 +2952,12 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                         segs = nskb;
                 tail = nskb;
 
-                __copy_skb_header(nskb, skb);
-                nskb->mac_len = skb->mac_len;
+                __copy_skb_header(nskb, head_skb);
+                nskb->mac_len = head_skb->mac_len;
 
                 skb_headers_offset_update(nskb, skb_headroom(nskb) - headroom);
 
-                skb_copy_from_linear_data_offset(skb, -tnl_hlen,
+                skb_copy_from_linear_data_offset(head_skb, -tnl_hlen,
                                                  nskb->data - tnl_hlen,
                                                  doffset + tnl_hlen);
 
@@ -2966,30 +2966,32 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
 
                 if (!sg) {
                         nskb->ip_summed = CHECKSUM_NONE;
-                        nskb->csum = skb_copy_and_csum_bits(skb, offset,
+                        nskb->csum = skb_copy_and_csum_bits(head_skb, offset,
                                                             skb_put(nskb, len),
                                                             len, 0);
                         continue;
                 }
 
-                frag = skb_shinfo(nskb)->frags;
+                nskb_frag = skb_shinfo(nskb)->frags;
 
-                skb_copy_from_linear_data_offset(skb, offset,
+                skb_copy_from_linear_data_offset(head_skb, offset,
                                                  skb_put(nskb, hsize), hsize);
 
-                skb_shinfo(nskb)->tx_flags = skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG;
+                skb_shinfo(nskb)->tx_flags = skb_shinfo(head_skb)->tx_flags &
+                        SKBTX_SHARED_FRAG;
 
                 while (pos < offset + len) {
                         if (i >= nfrags) {
-                                BUG_ON(skb_headlen(fskb));
+                                BUG_ON(skb_headlen(list_skb));
 
                                 i = 0;
-                                nfrags = skb_shinfo(fskb)->nr_frags;
-                                skb_frag = skb_shinfo(fskb)->frags;
+                                nfrags = skb_shinfo(list_skb)->nr_frags;
+                                frag = skb_shinfo(list_skb)->frags;
+                                frag_skb = list_skb;
 
                                 BUG_ON(!nfrags);
 
-                                fskb = fskb->next;
+                                list_skb = list_skb->next;
                         }
 
                         if (unlikely(skb_shinfo(nskb)->nr_frags >=
@@ -3000,27 +3002,30 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                                 goto err;
                         }
 
-                        *frag = *skb_frag;
-                        __skb_frag_ref(frag);
-                        size = skb_frag_size(frag);
+                        if (unlikely(skb_orphan_frags(frag_skb, GFP_ATOMIC)))
+                                goto err;
+
+                        *nskb_frag = *frag;
+                        __skb_frag_ref(nskb_frag);
+                        size = skb_frag_size(nskb_frag);
 
                         if (pos < offset) {
-                                frag->page_offset += offset - pos;
-                                skb_frag_size_sub(frag, offset - pos);
+                                nskb_frag->page_offset += offset - pos;
+                                skb_frag_size_sub(nskb_frag, offset - pos);
                         }
 
                         skb_shinfo(nskb)->nr_frags++;
 
                         if (pos + size <= offset + len) {
                                 i++;
-                                skb_frag++;
+                                frag++;
                                 pos += size;
                         } else {
-                                skb_frag_size_sub(frag, pos + size - (offset + len));
+                                skb_frag_size_sub(nskb_frag, pos + size - (offset + len));
                                 goto skip_fraglist;
                         }
 
-                        frag++;
+                        nskb_frag++;
                 }
 
 skip_fraglist:
@@ -3034,7 +3039,7 @@ perform_csum_check:
                                                   nskb->len - doffset, 0);
                         nskb->ip_summed = CHECKSUM_NONE;
                 }
-        } while ((offset += len) < skb->len);
+        } while ((offset += len) < head_skb->len);
 
         return segs;
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 5b6a9431b017..c0fc6bdad1e3 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2357,10 +2357,13 @@ void release_sock(struct sock *sk)
         if (sk->sk_backlog.tail)
                 __release_sock(sk);
 
+        /* Warning : release_cb() might need to release sk ownership,
+         * ie call sock_release_ownership(sk) before us.
+         */
         if (sk->sk_prot->release_cb)
                 sk->sk_prot->release_cb(sk);
 
-        sk->sk_lock.owned = 0;
+        sock_release_ownership(sk);
         if (waitqueue_active(&sk->sk_lock.wq))
                 wake_up(&sk->sk_lock.wq);
         spin_unlock_bh(&sk->sk_lock.slock);
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 327060c6c874..7ae0d7f6dbd0 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -297,7 +297,7 @@ static bool seq_nr_after(u16 a, u16 b)
 
 void hsr_register_frame_in(struct node_entry *node, enum hsr_dev_idx dev_idx)
 {
-        if ((dev_idx < 0) || (dev_idx >= HSR_MAX_DEV)) {
+        if ((dev_idx < 0) || (dev_idx >= HSR_MAX_SLAVE)) {
                 WARN_ONCE(1, "%s: Invalid dev_idx (%d)\n", __func__, dev_idx);
                 return;
         }
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index ecd2c3f245ce..19ab78aca547 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1296,8 +1296,11 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb,
 
         segs = ERR_PTR(-EPROTONOSUPPORT);
 
-        /* Note : following gso_segment() might change skb->encapsulation */
-        udpfrag = !skb->encapsulation && proto == IPPROTO_UDP;
+        if (skb->encapsulation &&
+            skb_shinfo(skb)->gso_type & (SKB_GSO_SIT|SKB_GSO_IPIP))
+                udpfrag = proto == IPPROTO_UDP && encap;
+        else
+                udpfrag = proto == IPPROTO_UDP && !skb->encapsulation;
 
         ops = rcu_dereference(inet_offloads[proto]);
         if (likely(ops && ops->callbacks.gso_segment))
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index bb075fc9a14f..3b01959bf4bb 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -208,7 +208,7 @@ int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f, bool force)
         }
 
         work = frag_mem_limit(nf) - nf->low_thresh;
-        while (work > 0) {
+        while (work > 0 || force) {
                 spin_lock(&nf->lru_lock);
 
                 if (list_empty(&nf->lru_list)) {
@@ -278,9 +278,10 @@ static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf,
 
         atomic_inc(&qp->refcnt);
         hlist_add_head(&qp->list, &hb->chain);
+        inet_frag_lru_add(nf, qp);
         spin_unlock(&hb->chain_lock);
         read_unlock(&f->lock);
-        inet_frag_lru_add(nf, qp);
+
         return qp;
 }
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 8971780aec7c..73c6b63bba74 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -422,9 +422,6 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->tc_index = from->tc_index;
 #endif
         nf_copy(to, from);
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
-        to->nf_trace = from->nf_trace;
-#endif
 #if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
         to->ipvs_property = from->ipvs_property;
 #endif
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 50228be5c17b..78a89e61925d 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -93,13 +93,14 @@ static void tunnel_dst_reset(struct ip_tunnel *t)
         tunnel_dst_set(t, NULL);
 }
 
-static void tunnel_dst_reset_all(struct ip_tunnel *t)
+void ip_tunnel_dst_reset_all(struct ip_tunnel *t)
 {
         int i;
 
         for_each_possible_cpu(i)
                 __tunnel_dst_set(per_cpu_ptr(t->dst_cache, i), NULL);
 }
+EXPORT_SYMBOL(ip_tunnel_dst_reset_all);
 
 static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, u32 cookie)
 {
@@ -119,52 +120,6 @@ static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, u32 cookie)
         return (struct rtable *)dst;
 }
 
-/* Often modified stats are per cpu, other are shared (netdev->stats) */
-struct rtnl_link_stats64 *ip_tunnel_get_stats64(struct net_device *dev,
-                                                struct rtnl_link_stats64 *tot)
-{
-        int i;
-
-        for_each_possible_cpu(i) {
-                const struct pcpu_sw_netstats *tstats =
-                                                   per_cpu_ptr(dev->tstats, i);
-                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
-                unsigned int start;
-
-                do {
-                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
-                        rx_packets = tstats->rx_packets;
-                        tx_packets = tstats->tx_packets;
-                        rx_bytes = tstats->rx_bytes;
-                        tx_bytes = tstats->tx_bytes;
-                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
-
-                tot->rx_packets += rx_packets;
-                tot->tx_packets += tx_packets;
-                tot->rx_bytes   += rx_bytes;
-                tot->tx_bytes   += tx_bytes;
-        }
-
-        tot->multicast = dev->stats.multicast;
-
-        tot->rx_crc_errors = dev->stats.rx_crc_errors;
-        tot->rx_fifo_errors = dev->stats.rx_fifo_errors;
-        tot->rx_length_errors = dev->stats.rx_length_errors;
-        tot->rx_frame_errors = dev->stats.rx_frame_errors;
-        tot->rx_errors = dev->stats.rx_errors;
-
-        tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
-        tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
-        tot->tx_dropped = dev->stats.tx_dropped;
-        tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
-        tot->tx_errors = dev->stats.tx_errors;
-
-        tot->collisions  = dev->stats.collisions;
-
-        return tot;
-}
-EXPORT_SYMBOL_GPL(ip_tunnel_get_stats64);
-
 static bool ip_tunnel_key_match(const struct ip_tunnel_parm *p,
                                 __be16 flags, __be32 key)
 {
@@ -759,7 +714,7 @@ static void ip_tunnel_update(struct ip_tunnel_net *itn,
                 if (set_mtu)
                         dev->mtu = mtu;
         }
-        tunnel_dst_reset_all(t);
+        ip_tunnel_dst_reset_all(t);
         netdev_state_change(dev);
 }
 
@@ -1088,7 +1043,7 @@ void ip_tunnel_uninit(struct net_device *dev)
         if (itn->fb_tunnel_dev != dev)
                 ip_tunnel_del(netdev_priv(dev));
 
-        tunnel_dst_reset_all(tunnel);
+        ip_tunnel_dst_reset_all(tunnel);
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_uninit);
 
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 6156f4ef5e91..6f847dd56dbc 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -108,7 +108,6 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto)
         nf_reset(skb);
         secpath_reset(skb);
         skb_clear_hash_if_not_l4(skb);
-        skb_dst_drop(skb);
         skb->vlan_tci = 0;
         skb_set_queue_mapping(skb, 0);
         skb->pkt_type = PACKET_HOST;
@@ -148,3 +147,49 @@ error:
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(iptunnel_handle_offloads);
+
+/* Often modified stats are per cpu, other are shared (netdev->stats) */
+struct rtnl_link_stats64 *ip_tunnel_get_stats64(struct net_device *dev,
+                                                struct rtnl_link_stats64 *tot)
+{
+        int i;
+
+        for_each_possible_cpu(i) {
+                const struct pcpu_sw_netstats *tstats =
+                                                   per_cpu_ptr(dev->tstats, i);
+                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
+                unsigned int start;
+
+                do {
+                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
+                        rx_packets = tstats->rx_packets;
+                        tx_packets = tstats->tx_packets;
+                        rx_bytes = tstats->rx_bytes;
+                        tx_bytes = tstats->tx_bytes;
+                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
+
+                tot->rx_packets += rx_packets;
+                tot->tx_packets += tx_packets;
+                tot->rx_bytes   += rx_bytes;
+                tot->tx_bytes   += tx_bytes;
+        }
+
+        tot->multicast = dev->stats.multicast;
+
+        tot->rx_crc_errors = dev->stats.rx_crc_errors;
+        tot->rx_fifo_errors = dev->stats.rx_fifo_errors;
+        tot->rx_length_errors = dev->stats.rx_length_errors;
+        tot->rx_frame_errors = dev->stats.rx_frame_errors;
+        tot->rx_errors = dev->stats.rx_errors;
+
+        tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
+        tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
+        tot->tx_dropped = dev->stats.tx_dropped;
+        tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
+        tot->tx_errors = dev->stats.tx_errors;
+
+        tot->collisions  = dev->stats.collisions;
+
+        return tot;
+}
+EXPORT_SYMBOL_GPL(ip_tunnel_get_stats64);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index b9b3472975ba..28863570dd60 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -2255,13 +2255,14 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,
 }
 
 static int ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
-                            u32 portid, u32 seq, struct mfc_cache *c, int cmd)
+                            u32 portid, u32 seq, struct mfc_cache *c, int cmd,
+                            int flags)
 {
         struct nlmsghdr *nlh;
         struct rtmsg *rtm;
         int err;
 
-        nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), NLM_F_MULTI);
+        nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), flags);
         if (nlh == NULL)
                 return -EMSGSIZE;
 
@@ -2329,7 +2330,7 @@ static void mroute_netlink_event(struct mr_table *mrt, struct mfc_cache *mfc,
         if (skb == NULL)
                 goto errout;
 
-        err = ipmr_fill_mroute(mrt, skb, 0, 0, mfc, cmd);
+        err = ipmr_fill_mroute(mrt, skb, 0, 0, mfc, cmd, 0);
         if (err < 0)
                 goto errout;
 
@@ -2368,7 +2369,8 @@ static int ipmr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
                                 if (ipmr_fill_mroute(mrt, skb,
                                                      NETLINK_CB(cb->skb).portid,
                                                      cb->nlh->nlmsg_seq,
-                                                     mfc, RTM_NEWROUTE) < 0)
+                                                     mfc, RTM_NEWROUTE,
+                                                     NLM_F_MULTI) < 0)
                                         goto done;
 next_entry:
                                 e++;
@@ -2382,7 +2384,8 @@ next_entry:
                         if (ipmr_fill_mroute(mrt, skb,
                                              NETLINK_CB(cb->skb).portid,
                                              cb->nlh->nlmsg_seq,
-                                             mfc, RTM_NEWROUTE) < 0) {
+                                             mfc, RTM_NEWROUTE,
+                                             NLM_F_MULTI) < 0) {
                                 spin_unlock_bh(&mfc_unres_lock);
                                 goto done;
                         }
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index d551e31b416e..7c676671329d 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -1198,8 +1198,8 @@ static int snmp_translate(struct nf_conn *ct,
                 map.to = NOCT1(&ct->tuplehash[!dir].tuple.dst.u3.ip);
         } else {
                 /* DNAT replies */
-                map.from = NOCT1(&ct->tuplehash[dir].tuple.src.u3.ip);
-                map.to = NOCT1(&ct->tuplehash[!dir].tuple.dst.u3.ip);
+                map.from = NOCT1(&ct->tuplehash[!dir].tuple.src.u3.ip);
+                map.to = NOCT1(&ct->tuplehash[dir].tuple.dst.u3.ip);
         }
 
         if (map.from == map.to)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9f3a2db9109e..97c8f5620c43 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1044,7 +1044,8 @@ void tcp_free_fastopen_req(struct tcp_sock *tp)
         }
 }
 
-static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, int *size)
+static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
+                                int *copied, size_t size)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int err, flags;
@@ -1059,11 +1060,12 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, int *size)
         if (unlikely(tp->fastopen_req == NULL))
                 return -ENOBUFS;
         tp->fastopen_req->data = msg;
+        tp->fastopen_req->size = size;
 
         flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0;
         err = __inet_stream_connect(sk->sk_socket, msg->msg_name,
                                     msg->msg_namelen, flags);
-        *size = tp->fastopen_req->copied;
+        *copied = tp->fastopen_req->copied;
         tcp_free_fastopen_req(tp);
         return err;
 }
@@ -1083,7 +1085,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         flags = msg->msg_flags;
         if (flags & MSG_FASTOPEN) {
-                err = tcp_sendmsg_fastopen(sk, msg, &copied_syn);
+                err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size);
                 if (err == -EINPROGRESS && copied_syn > 0)
                         goto out;
                 else if (err)
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index ad37bf18ae4b..2388275adb9b 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -290,8 +290,7 @@ bool tcp_is_cwnd_limited(const struct sock *sk, u32 in_flight)
         left = tp->snd_cwnd - in_flight;
         if (sk_can_gso(sk) &&
             left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd &&
-            left * tp->mss_cache < sk->sk_gso_max_size &&
-            left < sk->sk_gso_max_segs)
+            left < tp->xmit_size_goal_segs)
                 return true;
         return left <= tcp_max_tso_deferred_mss(tp);
 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 227cba79fa6b..eeaac399420d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1945,8 +1945,9 @@ void tcp_enter_loss(struct sock *sk, int how)
                 if (skb == tcp_send_head(sk))
                         break;
 
-                if (TCP_SKB_CB(skb)->sacked & TCPCB_RETRANS)
+                if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)
                         tp->undo_marker = 0;
+
                 TCP_SKB_CB(skb)->sacked &= (~TCPCB_TAGBITS)|TCPCB_SACKED_ACKED;
                 if (!(TCP_SKB_CB(skb)->sacked&TCPCB_SACKED_ACKED) || how) {
                         TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_ACKED;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 3be16727f058..17a11e65e57f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -767,6 +767,17 @@ void tcp_release_cb(struct sock *sk)
         if (flags & (1UL << TCP_TSQ_DEFERRED))
                 tcp_tsq_handler(sk);
 
+        /* Here begins the tricky part :
+         * We are called from release_sock() with :
+         * 1) BH disabled
+         * 2) sk_lock.slock spinlock held
+         * 3) socket owned by us (sk->sk_lock.owned == 1)
+         *
+         * But following code is meant to be called from BH handlers,
+         * so we should keep BH disabled, but early release socket ownership
+         */
+        sock_release_ownership(sk);
+
         if (flags & (1UL << TCP_WRITE_TIMER_DEFERRED)) {
                 tcp_write_timer_handler(sk);
                 __sock_put(sk);
@@ -864,8 +875,8 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 
                 if (unlikely(skb->fclone == SKB_FCLONE_ORIG &&
                              fclone->fclone == SKB_FCLONE_CLONE))
-                        NET_INC_STATS_BH(sock_net(sk),
-                                         LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES);
+                        NET_INC_STATS(sock_net(sk),
+                                      LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES);
 
                 if (unlikely(skb_cloned(skb)))
                         skb = pskb_copy(skb, gfp_mask);
@@ -2337,6 +2348,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
         unsigned int cur_mss;
+        int err;
 
         /* Inconslusive MTU probe */
         if (icsk->icsk_mtup.probe_size) {
@@ -2400,11 +2412,15 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                      skb_headroom(skb) >= 0xFFFF)) {
                 struct sk_buff *nskb = __pskb_copy(skb, MAX_TCP_HEADER,
                                                    GFP_ATOMIC);
-                return nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
-                              -ENOBUFS;
+                err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
+                             -ENOBUFS;
         } else {
-                return tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
+                err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
         }
+
+        if (likely(!err))
+                TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS;
+        return err;
 }
 
 int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
@@ -2908,7 +2924,12 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
         space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
                 MAX_TCP_OPTION_SPACE;
 
-        syn_data = skb_copy_expand(syn, skb_headroom(syn), space,
+        space = min_t(size_t, space, fo->size);
+
+        /* limit to order-0 allocations */
+        space = min_t(size_t, space, SKB_MAX_HEAD(MAX_TCP_HEADER));
+
+        syn_data = skb_copy_expand(syn, MAX_TCP_HEADER, space,
                                    sk->sk_allocation);
         if (syn_data == NULL)
                 goto fallback;
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index d92e5586783e..438a73aa777c 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -138,6 +138,7 @@ config INET6_XFRM_MODE_ROUTEOPTIMIZATION
 config IPV6_VTI
 tristate "Virtual (secure) IPv6: tunneling"
         select IPV6_TUNNEL
+        select NET_IP_TUNNEL
         depends on INET6_XFRM_MODE_TUNNEL
         ---help---
         Tunneling means encapsulating data of one protocol type within
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index fdbfeca36d63..344e972426df 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1103,8 +1103,11 @@ retry:
          * Lifetime is greater than REGEN_ADVANCE time units.  In particular,
          * an implementation must not create a temporary address with a zero
          * Preferred Lifetime.
+         * Use age calculation as in addrconf_verify to avoid unnecessary
+         * temporary addresses being generated.
          */
-        if (tmp_prefered_lft <= regen_advance) {
+        age = (now - tmp_tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
+        if (tmp_prefered_lft <= regen_advance + age) {
                 in6_ifa_put(ifp);
                 in6_dev_put(idev);
                 ret = -1;
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index 140748debc4a..8af3eb57f438 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -212,7 +212,7 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                 found = (nexthdr == target);
 
                 if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
-                        if (target < 0)
+                        if (target < 0 || found)
                                 break;
                         return -ENOENT;
                 }
diff --git a/net/ipv6/exthdrs_offload.c b/net/ipv6/exthdrs_offload.c
index cf77f3abfd06..447a7fbd1bb6 100644
--- a/net/ipv6/exthdrs_offload.c
+++ b/net/ipv6/exthdrs_offload.c
@@ -25,11 +25,11 @@ int __init ipv6_exthdrs_offload_init(void)
         int ret;
 
         ret = inet6_add_offload(&rthdr_offload, IPPROTO_ROUTING);
-        if (!ret)
+        if (ret)
                 goto out;
 
         ret = inet6_add_offload(&dstopt_offload, IPPROTO_DSTOPTS);
-        if (!ret)
+        if (ret)
                 goto out_rt;
 
 out:
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 1e8683b135bb..59f95affceb0 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -89,7 +89,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
         unsigned int unfrag_ip6hlen;
         u8 *prevhdr;
         int offset = 0;
-        bool tunnel;
+        bool encap, udpfrag;
         int nhoff;
 
         if (unlikely(skb_shinfo(skb)->gso_type &
@@ -110,8 +110,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
         if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
                 goto out;
 
-        tunnel = SKB_GSO_CB(skb)->encap_level > 0;
-        if (tunnel)
+        encap = SKB_GSO_CB(skb)->encap_level > 0;
+        if (encap)
                 features = skb->dev->hw_enc_features & netif_skb_features(skb);
         SKB_GSO_CB(skb)->encap_level += sizeof(*ipv6h);
 
@@ -121,6 +121,12 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
 
         proto = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
 
+        if (skb->encapsulation &&
+            skb_shinfo(skb)->gso_type & (SKB_GSO_SIT|SKB_GSO_IPIP))
+                udpfrag = proto == IPPROTO_UDP && encap;
+        else
+                udpfrag = proto == IPPROTO_UDP && !skb->encapsulation;
+
         ops = rcu_dereference(inet6_offloads[proto]);
         if (likely(ops && ops->callbacks.gso_segment)) {
                 skb_reset_transport_header(skb);
@@ -133,13 +139,9 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
         for (skb = segs; skb; skb = skb->next) {
                 ipv6h = (struct ipv6hdr *)(skb_mac_header(skb) + nhoff);
                 ipv6h->payload_len = htons(skb->len - nhoff - sizeof(*ipv6h));
-                if (tunnel) {
-                        skb_reset_inner_headers(skb);
-                        skb->encapsulation = 1;
-                }
                 skb->network_header = (u8 *)ipv6h - skb->head;
 
-                if (!tunnel && proto == IPPROTO_UDP) {
+                if (udpfrag) {
                         unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
                         fptr = (struct frag_hdr *)((u8 *)ipv6h + unfrag_ip6hlen);
                         fptr->frag_off = htons(offset);
@@ -148,6 +150,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                         offset += (ntohs(ipv6h->payload_len) -
                                    sizeof(struct frag_hdr));
                 }
+                if (encap)
+                        skb_reset_inner_headers(skb);
         }
 
 out:
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 070a2fae2375..64d6073731d3 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -530,9 +530,6 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->tc_index = from->tc_index;
 #endif
         nf_copy(to, from);
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
-        to->nf_trace = from->nf_trace;
-#endif
         skb_copy_secmark(to, from);
 }
 
@@ -1104,21 +1101,19 @@ static void ip6_append_data_mtu(unsigned int *mtu,
                                 unsigned int fragheaderlen,
                                 struct sk_buff *skb,
                                 struct rt6_info *rt,
-                                bool pmtuprobe)
+                                unsigned int orig_mtu)
 {
         if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
                 if (skb == NULL) {
                         /* first fragment, reserve header_len */
-                        *mtu = *mtu - rt->dst.header_len;
+                        *mtu = orig_mtu - rt->dst.header_len;
 
                 } else {
                         /*
                          * this fragment is not first, the headers
                          * space is regarded as data space.
                          */
-                        *mtu = min(*mtu, pmtuprobe ?
-                                   rt->dst.dev->mtu :
-                                   dst_mtu(rt->dst.path));
+                        *mtu = orig_mtu;
                 }
                 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
                               + fragheaderlen - sizeof(struct frag_hdr);
@@ -1135,7 +1130,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct inet_cork *cork;
         struct sk_buff *skb, *skb_prev = NULL;
-        unsigned int maxfraglen, fragheaderlen, mtu;
+        unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
         int exthdrlen;
         int dst_exthdrlen;
         int hh_len;
@@ -1217,6 +1212,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 dst_exthdrlen = 0;
                 mtu = cork->fragsize;
         }
+        orig_mtu = mtu;
 
         hh_len = LL_RESERVED_SPACE(rt->dst.dev);
 
@@ -1314,8 +1310,7 @@ alloc_new_skb:
                         if (skb == NULL || skb_prev == NULL)
                                 ip6_append_data_mtu(&mtu, &maxfraglen,
                                                     fragheaderlen, skb, rt,
-                                                    np->pmtudisc >=
-                                                    IPV6_PMTUDISC_PROBE);
+                                                    orig_mtu);
 
                         skb_prev = skb;
 
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 0eb4038a4d63..8737400af0a0 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -2349,13 +2349,14 @@ int ip6mr_get_route(struct net *net,
 }
 
 static int ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
-                             u32 portid, u32 seq, struct mfc6_cache *c, int cmd)
+                             u32 portid, u32 seq, struct mfc6_cache *c, int cmd,
+                             int flags)
 {
         struct nlmsghdr *nlh;
         struct rtmsg *rtm;
         int err;
 
-        nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), NLM_F_MULTI);
+        nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), flags);
         if (nlh == NULL)
                 return -EMSGSIZE;
 
@@ -2423,7 +2424,7 @@ static void mr6_netlink_event(struct mr6_table *mrt, struct mfc6_cache *mfc,
         if (skb == NULL)
                 goto errout;
 
-        err = ip6mr_fill_mroute(mrt, skb, 0, 0, mfc, cmd);
+        err = ip6mr_fill_mroute(mrt, skb, 0, 0, mfc, cmd, 0);
         if (err < 0)
                 goto errout;
 
@@ -2462,7 +2463,8 @@ static int ip6mr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
                                 if (ip6mr_fill_mroute(mrt, skb,
                                                       NETLINK_CB(cb->skb).portid,
                                                       cb->nlh->nlmsg_seq,
-                                                      mfc, RTM_NEWROUTE) < 0)
+                                                      mfc, RTM_NEWROUTE,
+                                                      NLM_F_MULTI) < 0)
                                         goto done;
 next_entry:
                                 e++;
@@ -2476,7 +2478,8 @@ next_entry:
                         if (ip6mr_fill_mroute(mrt, skb,
                                               NETLINK_CB(cb->skb).portid,
                                               cb->nlh->nlmsg_seq,
-                                              mfc, RTM_NEWROUTE) < 0) {
+                                              mfc, RTM_NEWROUTE,
+                                              NLM_F_MULTI) < 0) {
                                 spin_unlock_bh(&mfc_unres_lock);
                                 goto done;
                         }
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index fb9beb78f00b..587bbdcb22b4 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -135,6 +135,7 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         fl6.flowi6_proto = IPPROTO_ICMPV6;
         fl6.saddr = np->saddr;
         fl6.daddr = *daddr;
+        fl6.flowi6_mark = sk->sk_mark;
         fl6.fl6_icmp_type = user_icmph.icmp6_type;
         fl6.fl6_icmp_code = user_icmph.icmp6_code;
         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 11dac21e6586..fba54a407bb2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1513,7 +1513,7 @@ int ip6_route_add(struct fib6_config *cfg)
         if (!table)
                 goto out;
 
-        rt = ip6_dst_alloc(net, NULL, DST_NOCOUNT, table);
+        rt = ip6_dst_alloc(net, NULL, (cfg->fc_flags & RTF_ADDRCONF) ? 0 : DST_NOCOUNT, table);
 
         if (!rt) {
                 err = -ENOMEM;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 3dfbcf1dcb1c..b4d74c86586c 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -475,6 +475,7 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
                 ipip6_tunnel_unlink(sitn, tunnel);
                 ipip6_tunnel_del_prl(tunnel, NULL);
         }
+        ip_tunnel_dst_reset_all(tunnel);
         dev_put(dev);
 }
 
@@ -1082,6 +1083,7 @@ static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p)
                 t->parms.link = p->link;
                 ipip6_tunnel_bind_dev(t->dev);
         }
+        ip_tunnel_dst_reset_all(t);
         netdev_state_change(t->dev);
 }
 
@@ -1112,6 +1114,7 @@ static int ipip6_tunnel_update_6rd(struct ip_tunnel *t,
         t->ip6rd.relay_prefix = relay_prefix;
         t->ip6rd.prefixlen = ip6rd->prefixlen;
         t->ip6rd.relay_prefixlen = ip6rd->relay_prefixlen;
+        ip_tunnel_dst_reset_all(t);
         netdev_state_change(t->dev);
         return 0;
 }
@@ -1271,6 +1274,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                         err = ipip6_tunnel_add_prl(t, &prl, cmd == SIOCCHGPRL);
                         break;
                 }
+                ip_tunnel_dst_reset_all(t);
                 netdev_state_change(dev);
                 break;
 
@@ -1326,6 +1330,9 @@ static const struct net_device_ops ipip6_netdev_ops = {
 
 static void ipip6_dev_free(struct net_device *dev)
 {
+        struct ip_tunnel *tunnel = netdev_priv(dev);
+
+        free_percpu(tunnel->dst_cache);
         free_percpu(dev->tstats);
         free_netdev(dev);
 }
@@ -1375,6 +1382,12 @@ static int ipip6_tunnel_init(struct net_device *dev)
                 u64_stats_init(&ipip6_tunnel_stats->syncp);
         }
 
+        tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
+        if (!tunnel->dst_cache) {
+                free_percpu(dev->tstats);
+                return -ENOMEM;
+        }
+
         return 0;
 }
 
@@ -1405,6 +1418,12 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
                 u64_stats_init(&ipip6_fb_stats->syncp);
         }
 
+        tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
+        if (!tunnel->dst_cache) {
+                free_percpu(dev->tstats);
+                return -ENOMEM;
+        }
+
         dev_hold(dev);
         rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
         return 0;
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index e7359f9eaa8d..b261ee8b83fc 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -113,7 +113,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
                 fptr->nexthdr = nexthdr;
                 fptr->reserved = 0;
-                ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
+                fptr->identification = skb_shinfo(skb)->ip6_frag_id;
 
                 /* Fragment the skb. ipv6 header and the remaining fields of the
                  * fragment header are updated in ipv6_gso_segment()
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 1a04c1329362..79326978517a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -433,12 +433,13 @@ static inline int verify_sec_ctx_len(const void *p)
         return 0;
 }
 
-static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(const struct sadb_x_sec_ctx *sec_ctx)
+static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(const struct sadb_x_sec_ctx *sec_ctx,
+                                                                     gfp_t gfp)
 {
         struct xfrm_user_sec_ctx *uctx = NULL;
         int ctx_size = sec_ctx->sadb_x_ctx_len;
 
-        uctx = kmalloc((sizeof(*uctx)+ctx_size), GFP_KERNEL);
+        uctx = kmalloc((sizeof(*uctx)+ctx_size), gfp);
 
         if (!uctx)
                 return NULL;
@@ -1124,7 +1125,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
 
         sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];
         if (sec_ctx != NULL) {
-                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);
 
                 if (!uctx)
                         goto out;
@@ -2231,14 +2232,14 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, const struct sadb_
 
         sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];
         if (sec_ctx != NULL) {
-                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);
 
                 if (!uctx) {
                         err = -ENOBUFS;
                         goto out;
                 }
 
-                err = security_xfrm_policy_alloc(&xp->security, uctx);
+                err = security_xfrm_policy_alloc(&xp->security, uctx, GFP_KERNEL);
                 kfree(uctx);
 
                 if (err)
@@ -2335,12 +2336,12 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa
 
         sec_ctx = ext_hdrs[SADB_X_EXT_SEC_CTX - 1];
         if (sec_ctx != NULL) {
-                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_KERNEL);
 
                 if (!uctx)
                         return -ENOMEM;
 
-                err = security_xfrm_policy_alloc(&pol_ctx, uctx);
+                err = security_xfrm_policy_alloc(&pol_ctx, uctx, GFP_KERNEL);
                 kfree(uctx);
                 if (err)
                         return err;
@@ -3239,8 +3240,8 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
                 }
                 if ((*dir = verify_sec_ctx_len(p)))
                         goto out;
-                uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
-                *dir = security_xfrm_policy_alloc(&xp->security, uctx);
+                uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx, GFP_ATOMIC);
+                *dir = security_xfrm_policy_alloc(&xp->security, uctx, GFP_ATOMIC);
                 kfree(uctx);
 
                 if (*dir)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 735d0f60c83a..85d9d94c0a3c 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -112,7 +112,6 @@ struct l2tp_net {
         spinlock_t l2tp_session_hlist_lock;
 };
 
-static void l2tp_session_set_header_len(struct l2tp_session *session, int version);
 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
 
 static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
@@ -1863,7 +1862,7 @@ EXPORT_SYMBOL_GPL(l2tp_session_delete);
 /* We come here whenever a session's send_seq, cookie_len or
  * l2specific_len parameters are set.
  */
-static void l2tp_session_set_header_len(struct l2tp_session *session, int version)
+void l2tp_session_set_header_len(struct l2tp_session *session, int version)
 {
         if (version == L2TP_HDR_VER_2) {
                 session->hdr_len = 6;
@@ -1876,6 +1875,7 @@ static void l2tp_session_set_header_len(struct l2tp_session *session, int versio
         }
 
 }
+EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
 
 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
 {
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 1f01ba3435bc..3f93ccd6ba97 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -263,6 +263,7 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                       int length, int (*payload_hook)(struct sk_buff *skb));
 int l2tp_session_queue_purge(struct l2tp_session *session);
 int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb);
+void l2tp_session_set_header_len(struct l2tp_session *session, int version);
 
 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb,
                   int hdr_len);
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index 4cfd722e9153..bd7387adea9e 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -578,8 +578,10 @@ static int l2tp_nl_cmd_session_modify(struct sk_buff *skb, struct genl_info *inf
         if (info->attrs[L2TP_ATTR_RECV_SEQ])
                 session->recv_seq = nla_get_u8(info->attrs[L2TP_ATTR_RECV_SEQ]);
 
-        if (info->attrs[L2TP_ATTR_SEND_SEQ])
+        if (info->attrs[L2TP_ATTR_SEND_SEQ]) {
                 session->send_seq = nla_get_u8(info->attrs[L2TP_ATTR_SEND_SEQ]);
+                l2tp_session_set_header_len(session, session->tunnel->version);
+        }
 
         if (info->attrs[L2TP_ATTR_LNS_MODE])
                 session->lns_mode = nla_get_u8(info->attrs[L2TP_ATTR_LNS_MODE]);
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index be5fadf34739..5990919356a5 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -254,12 +254,14 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int
                 po = pppox_sk(sk);
                 ppp_input(&po->chan, skb);
         } else {
-                l2tp_info(session, PPPOL2TP_MSG_DATA, "%s: socket not bound\n",
-                          session->name);
+                l2tp_dbg(session, PPPOL2TP_MSG_DATA,
+                         "%s: recv %d byte data frame, passing to L2TP socket\n",
+                         session->name, data_len);
 
-                /* Not bound. Nothing we can do, so discard. */
-                atomic_long_inc(&session->stats.rx_errors);
-                kfree_skb(skb);
+                if (sock_queue_rcv_skb(sk, skb) < 0) {
+                        atomic_long_inc(&session->stats.rx_errors);
+                        kfree_skb(skb);
+                }
         }
 
         return;
@@ -1312,6 +1314,7 @@ static int pppol2tp_session_setsockopt(struct sock *sk,
                         po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
                                 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
                 }
+                l2tp_session_set_header_len(session, session->tunnel->version);
                 l2tp_info(session, PPPOL2TP_MSG_CONTROL,
                           "%s: set send_seq=%d\n",
                           session->name, session->send_seq);
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index f43613a97dd6..0c1ecfdf9a12 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -100,6 +100,12 @@ ieee80211_get_chanctx_max_required_bw(struct ieee80211_local *local,
                 }
                 max_bw = max(max_bw, width);
         }
+
+        /* use the configured bandwidth in case of monitor interface */
+        sdata = rcu_dereference(local->monitor_sdata);
+        if (sdata && rcu_access_pointer(sdata->vif.chanctx_conf) == conf)
+                max_bw = max(max_bw, conf->def.width);
+
         rcu_read_unlock();
 
         return max_bw;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 3701930c6649..5e44e3179e02 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1692,14 +1692,8 @@ void ieee80211_stop_queue_by_reason(struct ieee80211_hw *hw, int queue,
 void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue);
 void ieee80211_add_pending_skb(struct ieee80211_local *local,
                                struct sk_buff *skb);
-void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
-                                   struct sk_buff_head *skbs,
-                                   void (*fn)(void *data), void *data);
-static inline void ieee80211_add_pending_skbs(struct ieee80211_local *local,
-                                              struct sk_buff_head *skbs)
-{
-        ieee80211_add_pending_skbs_fn(local, skbs, NULL, NULL);
-}
+void ieee80211_add_pending_skbs(struct ieee80211_local *local,
+                                struct sk_buff_head *skbs);
 void ieee80211_flush_queues(struct ieee80211_local *local,
                             struct ieee80211_sub_if_data *sdata);
 
diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c
index 2802f9d9279d..ad8b377b4b9f 100644
--- a/net/mac80211/mesh_ps.c
+++ b/net/mac80211/mesh_ps.c
@@ -36,6 +36,7 @@ static struct sk_buff *mps_qos_null_get(struct sta_info *sta)
                                       sdata->vif.addr);
         nullfunc->frame_control = fc;
         nullfunc->duration_id = 0;
+        nullfunc->seq_ctrl = 0;
         /* no address resolution for this frame -> set addr 1 immediately */
         memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
         memset(skb_put(skb, 2), 0, 2); /* append QoS control field */
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index fc1d82465b3c..245dce969b31 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -222,6 +222,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
         switch (vht_oper->chan_width) {
         case IEEE80211_VHT_CHANWIDTH_USE_HT:
                 vht_chandef.width = chandef->width;
+                vht_chandef.center_freq1 = chandef->center_freq1;
                 break;
         case IEEE80211_VHT_CHANWIDTH_80MHZ:
                 vht_chandef.width = NL80211_CHAN_WIDTH_80;
@@ -271,6 +272,28 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
         ret = 0;
 
 out:
+        /*
+         * When tracking the current AP, don't do any further checks if the
+         * new chandef is identical to the one we're currently using for the
+         * connection. This keeps us from playing ping-pong with regulatory,
+         * without it the following can happen (for example):
+         *  - connect to an AP with 80 MHz, world regdom allows 80 MHz
+         *  - AP advertises regdom US
+         *  - CRDA loads regdom US with 80 MHz prohibited (old database)
+         *  - the code below detects an unsupported channel, downgrades, and
+         *    we disconnect from the AP in the caller
+         *  - disconnect causes CRDA to reload world regdomain and the game
+         *    starts anew.
+         * (see https://bugzilla.kernel.org/show_bug.cgi?id=70881)
+         *
+         * It seems possible that there are still scenarios with CSA or real
+         * bandwidth changes where a this could happen, but those cases are
+         * less common and wouldn't completely prevent using the AP.
+         */
+        if (tracking &&
+            cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef))
+                return ret;
+
         /* don't print the message below for VHT mismatch if VHT is disabled */
         if (ret & IEEE80211_STA_DISABLE_VHT)
                 vht_chandef = *chandef;
@@ -3753,6 +3776,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
                 if (WARN_ON(!chanctx_conf)) {
                         rcu_read_unlock();
+                        sta_info_free(local, new_sta);
                         return -EINVAL;
                 }
                 rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index c24ca0d0f469..3e57f96c9666 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1128,6 +1128,13 @@ static void sta_ps_end(struct sta_info *sta)
                sta->sta.addr, sta->sta.aid);
 
         if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
+                /*
+                 * Clear the flag only if the other one is still set
+                 * so that the TX path won't start TX'ing new frames
+                 * directly ... In the case that the driver flag isn't
+                 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
+                 */
+                clear_sta_flag(sta, WLAN_STA_PS_STA);
                 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
                        sta->sta.addr, sta->sta.aid);
                 return;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index decd30c1e290..137a192e64bc 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -91,7 +91,7 @@ static int sta_info_hash_del(struct ieee80211_local *local,
         return -ENOENT;
 }
 
-static void cleanup_single_sta(struct sta_info *sta)
+static void __cleanup_single_sta(struct sta_info *sta)
 {
         int ac, i;
         struct tid_ampdu_tx *tid_tx;
@@ -99,7 +99,8 @@ static void cleanup_single_sta(struct sta_info *sta)
         struct ieee80211_local *local = sdata->local;
         struct ps_data *ps;
 
-        if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
+        if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
+            test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
                 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
                     sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                         ps = &sdata->bss->ps;
@@ -109,6 +110,7 @@ static void cleanup_single_sta(struct sta_info *sta)
                         return;
 
                 clear_sta_flag(sta, WLAN_STA_PS_STA);
+                clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
 
                 atomic_dec(&ps->num_sta_ps);
                 sta_info_recalc_tim(sta);
@@ -139,7 +141,14 @@ static void cleanup_single_sta(struct sta_info *sta)
                 ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
                 kfree(tid_tx);
         }
+}
 
+static void cleanup_single_sta(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
+
+        __cleanup_single_sta(sta);
         sta_info_free(local, sta);
 }
 
@@ -330,6 +339,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         rcu_read_unlock();
 
         spin_lock_init(&sta->lock);
+        spin_lock_init(&sta->ps_lock);
         INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
         INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
         mutex_init(&sta->ampdu_mlme.mtx);
@@ -487,21 +497,26 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
                 goto out_err;
         }
 
-        /* notify driver */
-        err = sta_info_insert_drv_state(local, sdata, sta);
-        if (err)
-                goto out_err;
-
         local->num_sta++;
         local->sta_generation++;
         smp_mb();
 
+        /* simplify things and don't accept BA sessions yet */
+        set_sta_flag(sta, WLAN_STA_BLOCK_BA);
+
         /* make the station visible */
         sta_info_hash_add(local, sta);
 
         list_add_rcu(&sta->list, &local->sta_list);
 
+        /* notify driver */
+        err = sta_info_insert_drv_state(local, sdata, sta);
+        if (err)
+                goto out_remove;
+
         set_sta_flag(sta, WLAN_STA_INSERTED);
+        /* accept BA sessions now */
+        clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
 
         ieee80211_recalc_min_chandef(sdata);
         ieee80211_sta_debugfs_add(sta);
@@ -522,6 +537,12 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
                 mesh_accept_plinks_update(sdata);
 
         return 0;
+ out_remove:
+        sta_info_hash_del(local, sta);
+        list_del_rcu(&sta->list);
+        local->num_sta--;
+        synchronize_net();
+        __cleanup_single_sta(sta);
  out_err:
         mutex_unlock(&local->sta_mtx);
         rcu_read_lock();
@@ -1071,10 +1092,14 @@ struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
 }
 EXPORT_SYMBOL(ieee80211_find_sta);
 
-static void clear_sta_ps_flags(void *_sta)
+/* powersave support code */
+void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 {
-        struct sta_info *sta = _sta;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff_head pending;
+        int filtered = 0, buffered = 0, ac;
+        unsigned long flags;
         struct ps_data *ps;
 
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
@@ -1085,20 +1110,6 @@ static void clear_sta_ps_flags(void *_sta)
         else
                 return;
 
-        clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
-        if (test_and_clear_sta_flag(sta, WLAN_STA_PS_STA))
-                atomic_dec(&ps->num_sta_ps);
-}
-
-/* powersave support code */
-void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
-{
-        struct ieee80211_sub_if_data *sdata = sta->sdata;
-        struct ieee80211_local *local = sdata->local;
-        struct sk_buff_head pending;
-        int filtered = 0, buffered = 0, ac;
-        unsigned long flags;
-
         clear_sta_flag(sta, WLAN_STA_SP);
 
         BUILD_BUG_ON(BITS_TO_LONGS(IEEE80211_NUM_TIDS) > 1);
@@ -1109,6 +1120,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 
         skb_queue_head_init(&pending);
 
+        /* sync with ieee80211_tx_h_unicast_ps_buf */
+        spin_lock(&sta->ps_lock);
         /* Send all buffered frames to the station */
         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                 int count = skb_queue_len(&pending), tmp;
@@ -1127,7 +1140,12 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
                 buffered += tmp - count;
         }
 
-        ieee80211_add_pending_skbs_fn(local, &pending, clear_sta_ps_flags, sta);
+        ieee80211_add_pending_skbs(local, &pending);
+        clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
+        clear_sta_flag(sta, WLAN_STA_PS_STA);
+        spin_unlock(&sta->ps_lock);
+
+        atomic_dec(&ps->num_sta_ps);
 
         /* This station just woke up and isn't aware of our SMPS state */
         if (!ieee80211_smps_is_restrictive(sta->known_smps_mode,
@@ -1188,6 +1206,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
         memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
         memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
         memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
+        nullfunc->seq_ctrl = 0;
 
         skb->priority = tid;
         skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index d77ff7090630..d3a6d8208f2f 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -267,6 +267,7 @@ struct ieee80211_tx_latency_stat {
  * @drv_unblock_wk: used for driver PS unblocking
  * @listen_interval: listen interval of this station, when we're acting as AP
  * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly
+ * @ps_lock: used for powersave (when mac80211 is the AP) related locking
  * @ps_tx_buf: buffers (per AC) of frames to transmit to this station
  *      when it leaves power saving state or polls
  * @tx_filtered: buffers (per AC) of frames we already tried to
@@ -356,10 +357,8 @@ struct sta_info {
         /* use the accessors defined below */
         unsigned long _flags;
 
-        /*
-         * STA powersave frame queues, no more than the internal
-         * locking required.
-         */
+        /* STA powersave lock and frame queues */
+        spinlock_t ps_lock;
         struct sk_buff_head ps_tx_buf[IEEE80211_NUM_ACS];
         struct sk_buff_head tx_filtered[IEEE80211_NUM_ACS];
         unsigned long driver_buffered_tids;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 97a02d3f7d87..4080c615636f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -478,6 +478,20 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                        sta->sta.addr, sta->sta.aid, ac);
                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
                         purge_old_ps_buffers(tx->local);
+
+                /* sync with ieee80211_sta_ps_deliver_wakeup */
+                spin_lock(&sta->ps_lock);
+                /*
+                 * STA woke up the meantime and all the frames on ps_tx_buf have
+                 * been queued to pending queue. No reordering can happen, go
+                 * ahead and Tx the packet.
+                 */
+                if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
+                    !test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
+                        spin_unlock(&sta->ps_lock);
+                        return TX_CONTINUE;
+                }
+
                 if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
                         struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
                         ps_dbg(tx->sdata,
@@ -492,6 +506,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
                 skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
+                spin_unlock(&sta->ps_lock);
 
                 if (!timer_pending(&local->sta_cleanup))
                         mod_timer(&local->sta_cleanup,
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 676dc0967f37..b8700d417a9c 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -435,9 +435,8 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }
 
-void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
-                                   struct sk_buff_head *skbs,
-                                   void (*fn)(void *data), void *data)
+void ieee80211_add_pending_skbs(struct ieee80211_local *local,
+                                struct sk_buff_head *skbs)
 {
         struct ieee80211_hw *hw = &local->hw;
         struct sk_buff *skb;
@@ -461,9 +460,6 @@ void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
                 __skb_queue_tail(&local->pending[queue], skb);
         }
 
-        if (fn)
-                fn(data);
-
         for (i = 0; i < hw->queues; i++)
                 __ieee80211_wake_queue(hw, i,
                         IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
@@ -1741,6 +1737,26 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                                         IEEE80211_QUEUE_STOP_REASON_SUSPEND);
 
         /*
+         * Reconfigure sched scan if it was interrupted by FW restart or
+         * suspend.
+         */
+        mutex_lock(&local->mtx);
+        sched_scan_sdata = rcu_dereference_protected(local->sched_scan_sdata,
+                                                lockdep_is_held(&local->mtx));
+        if (sched_scan_sdata && local->sched_scan_req)
+                /*
+                 * Sched scan stopped, but we don't want to report it. Instead,
+                 * we're trying to reschedule.
+                 */
+                if (__ieee80211_request_sched_scan_start(sched_scan_sdata,
+                                                         local->sched_scan_req))
+                        sched_scan_stopped = true;
+        mutex_unlock(&local->mtx);
+
+        if (sched_scan_stopped)
+                cfg80211_sched_scan_stopped(local->hw.wiphy);
+
+        /*
          * If this is for hw restart things are still running.
          * We may want to change that later, however.
          */
@@ -1768,26 +1784,6 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         WARN_ON(1);
 #endif
 
-        /*
-         * Reconfigure sched scan if it was interrupted by FW restart or
-         * suspend.
-         */
-        mutex_lock(&local->mtx);
-        sched_scan_sdata = rcu_dereference_protected(local->sched_scan_sdata,
-                                                lockdep_is_held(&local->mtx));
-        if (sched_scan_sdata && local->sched_scan_req)
-                /*
-                 * Sched scan stopped, but we don't want to report it. Instead,
-                 * we're trying to reschedule.
-                 */
-                if (__ieee80211_request_sched_scan_start(sched_scan_sdata,
-                                                         local->sched_scan_req))
-                        sched_scan_stopped = true;
-        mutex_unlock(&local->mtx);
-
-        if (sched_scan_stopped)
-                cfg80211_sched_scan_stopped(local->hw.wiphy);
-
         return 0;
 }
 
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 21211c60ca98..d51422c778de 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -154,6 +154,11 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
                 return IEEE80211_AC_BE;
         }
 
+        if (skb->protocol == sdata->control_port_protocol) {
+                skb->priority = 7;
+                return ieee80211_downgrade_queue(sdata, skb);
+        }
+
         /* use the data classifier to determine what 802.1d tag the
          * data frame has */
         rcu_read_lock();
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index bb322d0beb48..b9f0e0374322 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1310,27 +1310,22 @@ ctnetlink_change_status(struct nf_conn *ct, const struct nlattr * const cda[])
 }
 
 static int
-ctnetlink_change_nat(struct nf_conn *ct, const struct nlattr * const cda[])
+ctnetlink_setup_nat(struct nf_conn *ct, const struct nlattr * const cda[])
 {
 #ifdef CONFIG_NF_NAT_NEEDED
         int ret;
 
-        if (cda[CTA_NAT_DST]) {
-                ret = ctnetlink_parse_nat_setup(ct,
-                                                NF_NAT_MANIP_DST,
-                                                cda[CTA_NAT_DST]);
-                if (ret < 0)
-                        return ret;
-        }
-        if (cda[CTA_NAT_SRC]) {
-                ret = ctnetlink_parse_nat_setup(ct,
-                                                NF_NAT_MANIP_SRC,
-                                                cda[CTA_NAT_SRC]);
-                if (ret < 0)
-                        return ret;
-        }
-        return 0;
+        ret = ctnetlink_parse_nat_setup(ct, NF_NAT_MANIP_DST,
+                                        cda[CTA_NAT_DST]);
+        if (ret < 0)
+                return ret;
+
+        ret = ctnetlink_parse_nat_setup(ct, NF_NAT_MANIP_SRC,
+                                        cda[CTA_NAT_SRC]);
+        return ret;
 #else
+        if (!cda[CTA_NAT_DST] && !cda[CTA_NAT_SRC])
+                return 0;
         return -EOPNOTSUPP;
 #endif
 }
@@ -1659,11 +1654,9 @@ ctnetlink_create_conntrack(struct net *net, u16 zone,
                         goto err2;
         }
 
-        if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {
-                err = ctnetlink_change_nat(ct, cda);
-                if (err < 0)
-                        goto err2;
-        }
+        err = ctnetlink_setup_nat(ct, cda);
+        if (err < 0)
+                goto err2;
 
         nf_ct_acct_ext_add(ct, GFP_ATOMIC);
         nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index d3f5cd6dd962..52ca952b802c 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -432,15 +432,15 @@ nf_nat_setup_info(struct nf_conn *ct,
 }
 EXPORT_SYMBOL(nf_nat_setup_info);
 
-unsigned int
-nf_nat_alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
+static unsigned int
+__nf_nat_alloc_null_binding(struct nf_conn *ct, enum nf_nat_manip_type manip)
 {
         /* Force range to this IP; let proto decide mapping for
          * per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
          * Use reply in case it's already been mangled (eg local packet).
          */
         union nf_inet_addr ip =
-                (HOOK2MANIP(hooknum) == NF_NAT_MANIP_SRC ?
+                (manip == NF_NAT_MANIP_SRC ?
                 ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3 :
                 ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3);
         struct nf_nat_range range = {
@@ -448,7 +448,13 @@ nf_nat_alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
                 .min_addr       = ip,
                 .max_addr       = ip,
         };
-        return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
+        return nf_nat_setup_info(ct, &range, manip);
+}
+
+unsigned int
+nf_nat_alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
+{
+        return __nf_nat_alloc_null_binding(ct, HOOK2MANIP(hooknum));
 }
 EXPORT_SYMBOL_GPL(nf_nat_alloc_null_binding);
 
@@ -702,9 +708,9 @@ static const struct nla_policy nat_nla_policy[CTA_NAT_MAX+1] = {
 
 static int
 nfnetlink_parse_nat(const struct nlattr *nat,
-                    const struct nf_conn *ct, struct nf_nat_range *range)
+                    const struct nf_conn *ct, struct nf_nat_range *range,
+                    const struct nf_nat_l3proto *l3proto)
 {
-        const struct nf_nat_l3proto *l3proto;
         struct nlattr *tb[CTA_NAT_MAX+1];
         int err;
 
@@ -714,38 +720,46 @@ nfnetlink_parse_nat(const struct nlattr *nat,
         if (err < 0)
                 return err;
 
-        rcu_read_lock();
-        l3proto = __nf_nat_l3proto_find(nf_ct_l3num(ct));
-        if (l3proto == NULL) {
-                err = -EAGAIN;
-                goto out;
-        }
         err = l3proto->nlattr_to_range(tb, range);
         if (err < 0)
-                goto out;
+                return err;
 
         if (!tb[CTA_NAT_PROTO])
-                goto out;
+                return 0;
 
-        err = nfnetlink_parse_nat_proto(tb[CTA_NAT_PROTO], ct, range);
-out:
-        rcu_read_unlock();
-        return err;
+        return nfnetlink_parse_nat_proto(tb[CTA_NAT_PROTO], ct, range);
 }
 
+/* This function is called under rcu_read_lock() */
 static int
 nfnetlink_parse_nat_setup(struct nf_conn *ct,
                           enum nf_nat_manip_type manip,
                           const struct nlattr *attr)
 {
         struct nf_nat_range range;
+        const struct nf_nat_l3proto *l3proto;
         int err;
 
-        err = nfnetlink_parse_nat(attr, ct, &range);
+        /* Should not happen, restricted to creating new conntracks
+         * via ctnetlink.
+         */
+        if (WARN_ON_ONCE(nf_nat_initialized(ct, manip)))
+                return -EEXIST;
+
+        /* Make sure that L3 NAT is there by when we call nf_nat_setup_info to
+         * attach the null binding, otherwise this may oops.
+         */
+        l3proto = __nf_nat_l3proto_find(nf_ct_l3num(ct));
+        if (l3proto == NULL)
+                return -EAGAIN;
+
+        /* No NAT information has been passed, allocate the null-binding */
+        if (attr == NULL)
+                return __nf_nat_alloc_null_binding(ct, manip);
+
+        err = nfnetlink_parse_nat(attr, ct, &range, l3proto);
         if (err < 0)
                 return err;
-        if (nf_nat_initialized(ct, manip))
-                return -EEXIST;
 
         return nf_nat_setup_info(ct, &range, manip);
 }
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index e8254ad2e5a9..425cf39af890 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -116,7 +116,7 @@ static void nft_meta_get_eval(const struct nft_expr *expr,
                                  skb->sk->sk_socket->file->f_cred->fsgid);
                 read_unlock_bh(&skb->sk->sk_callback_lock);
                 break;
-#ifdef CONFIG_NET_CLS_ROUTE
+#ifdef CONFIG_IP_ROUTE_CLASSID
         case NFT_META_RTCLASSID: {
                 const struct dst_entry *dst = skb_dst(skb);
 
@@ -199,7 +199,7 @@ static int nft_meta_init_validate_get(uint32_t key)
         case NFT_META_OIFTYPE:
         case NFT_META_SKUID:
         case NFT_META_SKGID:
-#ifdef CONFIG_NET_CLS_ROUTE
+#ifdef CONFIG_IP_ROUTE_CLASSID
         case NFT_META_RTCLASSID:
 #endif
 #ifdef CONFIG_NETWORK_SECMARK
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index a2aeb318678f..85daa84bfdfe 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -135,7 +135,8 @@ nft_payload_select_ops(const struct nft_ctx *ctx,
         if (len == 0 || len > FIELD_SIZEOF(struct nft_data, data))
                 return ERR_PTR(-EINVAL);
 
-        if (len <= 4 && IS_ALIGNED(offset, len) && base != NFT_PAYLOAD_LL_HEADER)
+        if (len <= 4 && is_power_of_2(len) && IS_ALIGNED(offset, len) &&
+            base != NFT_PAYLOAD_LL_HEADER)
                 return &nft_payload_fast_ops;
         else
                 return &nft_payload_ops;
diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c
index 8a310f239c93..b718a52a4654 100644
--- a/net/netfilter/nft_reject_inet.c
+++ b/net/netfilter/nft_reject_inet.c
@@ -21,9 +21,9 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,
 {
         switch (pkt->ops->pf) {
         case NFPROTO_IPV4:
-                nft_reject_ipv4_eval(expr, data, pkt);
+                return nft_reject_ipv4_eval(expr, data, pkt);
         case NFPROTO_IPV6:
-                nft_reject_ipv6_eval(expr, data, pkt);
+                return nft_reject_ipv6_eval(expr, data, pkt);
         }
 }
 
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index fdf51353cf78..04748ab649c2 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1489,8 +1489,8 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
         if (addr->sa_family != AF_NETLINK)
                 return -EINVAL;
 
-        /* Only superuser is allowed to send multicasts */
-        if (nladdr->nl_groups && !netlink_capable(sock, NL_CFG_F_NONROOT_SEND))
+        if ((nladdr->nl_groups || nladdr->nl_pid) &&
+            !netlink_capable(sock, NL_CFG_F_NONROOT_SEND))
                 return -EPERM;
 
         if (!nlk->portid)
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 46bda010bf11..56db888b1cd5 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -301,7 +301,7 @@ static int nci_open_device(struct nci_dev *ndev)
         rc = __nci_request(ndev, nci_reset_req, 0,
                            msecs_to_jiffies(NCI_RESET_TIMEOUT));
 
-        if (ndev->ops->setup(ndev))
+        if (ndev->ops->setup)
                 ndev->ops->setup(ndev);
 
         if (!rc) {
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index e9a48baf8551..8601b320b443 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1174,7 +1174,7 @@ static void ovs_dp_reset_user_features(struct sk_buff *skb, struct genl_info *in
         struct datapath *dp;
 
         dp = lookup_datapath(sock_net(skb->sk), info->userhdr, info->attrs);
-        if (!dp)
+        if (IS_ERR(dp))
                 return;
 
         WARN(dp->user_features, "Dropping previously announced user features\n");
@@ -1762,11 +1762,12 @@ static int ovs_vport_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
         int bucket = cb->args[0], skip = cb->args[1];
         int i, j = 0;
 
+        rcu_read_lock();
         dp = get_dp(sock_net(skb->sk), ovs_header->dp_ifindex);
-        if (!dp)
+        if (!dp) {
+                rcu_read_unlock();
                 return -ENODEV;
-
-        rcu_read_lock();
+        }
         for (i = bucket; i < DP_VPORT_HASH_BUCKETS; i++) {
                 struct vport *vport;
 
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 16f4b46161d4..dda451f4429c 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -73,6 +73,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, struct sk_buff *skb)
 
         if ((flow->key.eth.type == htons(ETH_P_IP) ||
              flow->key.eth.type == htons(ETH_P_IPV6)) &&
+            flow->key.ip.frag != OVS_FRAG_TYPE_LATER &&
             flow->key.ip.proto == IPPROTO_TCP &&
             likely(skb->len >= skb_transport_offset(skb) + sizeof(struct tcphdr))) {
                 tcp_flags = TCP_FLAGS_BE16(tcp_hdr(skb));
@@ -91,7 +92,7 @@ static void stats_read(struct flow_stats *stats,
                        unsigned long *used, __be16 *tcp_flags)
 {
         spin_lock(&stats->lock);
-        if (time_after(stats->used, *used))
+        if (!*used || time_after(stats->used, *used))
                 *used = stats->used;
         *tcp_flags |= stats->tcp_flags;
         ovs_stats->n_packets += stats->packet_count;
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 1313145e3b86..a07d55e75698 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -273,11 +273,12 @@ static struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
 
 void qdisc_list_add(struct Qdisc *q)
 {
-        struct Qdisc *root = qdisc_dev(q)->qdisc;
+        if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
+                struct Qdisc *root = qdisc_dev(q)->qdisc;
 
-        WARN_ON_ONCE(root == &noop_qdisc);
-        if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS))
+                WARN_ON_ONCE(root == &noop_qdisc);
                 list_add_tail(&q->list, &root->list);
+        }
 }
 EXPORT_SYMBOL(qdisc_list_add);
 
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 08ef7a42c0e4..21e251766eb1 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -601,6 +601,7 @@ static int fq_resize(struct Qdisc *sch, u32 log)
 {
         struct fq_sched_data *q = qdisc_priv(sch);
         struct rb_root *array;
+        void *old_fq_root;
         u32 idx;
 
         if (q->fq_root && log == q->fq_trees_log)
@@ -615,13 +616,19 @@ static int fq_resize(struct Qdisc *sch, u32 log)
         for (idx = 0; idx < (1U << log); idx++)
                 array[idx] = RB_ROOT;
 
-        if (q->fq_root) {
-                fq_rehash(q, q->fq_root, q->fq_trees_log, array, log);
-                fq_free(q->fq_root);
-        }
+        sch_tree_lock(sch);
+
+        old_fq_root = q->fq_root;
+        if (old_fq_root)
+                fq_rehash(q, old_fq_root, q->fq_trees_log, array, log);
+
         q->fq_root = array;
         q->fq_trees_log = log;
 
+        sch_tree_unlock(sch);
+
+        fq_free(old_fq_root);
+
         return 0;
 }
 
@@ -697,9 +704,11 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
                 q->flow_refill_delay = usecs_to_jiffies(usecs_delay);
         }
 
-        if (!err)
+        if (!err) {
+                sch_tree_unlock(sch);
                 err = fq_resize(sch, fq_log);
-
+                sch_tree_lock(sch);
+        }
         while (sch->q.qlen > sch->limit) {
                 struct sk_buff *skb = fq_dequeue(sch);
 
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 1cb413fead89..4f505a006896 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -334,18 +334,6 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
                         qdisc_put_rtab(qdisc_get_rtab(&qopt->peakrate,
                                                       tb[TCA_TBF_PTAB]));
 
-        if (q->qdisc != &noop_qdisc) {
-                err = fifo_set_limit(q->qdisc, qopt->limit);
-                if (err)
-                        goto done;
-        } else if (qopt->limit > 0) {
-                child = fifo_create_dflt(sch, &bfifo_qdisc_ops, qopt->limit);
-                if (IS_ERR(child)) {
-                        err = PTR_ERR(child);
-                        goto done;
-                }
-        }
-
         buffer = min_t(u64, PSCHED_TICKS2NS(qopt->buffer), ~0U);
         mtu = min_t(u64, PSCHED_TICKS2NS(qopt->mtu), ~0U);
 
@@ -390,6 +378,18 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
                 goto done;
         }
 
+        if (q->qdisc != &noop_qdisc) {
+                err = fifo_set_limit(q->qdisc, qopt->limit);
+                if (err)
+                        goto done;
+        } else if (qopt->limit > 0) {
+                child = fifo_create_dflt(sch, &bfifo_qdisc_ops, qopt->limit);
+                if (IS_ERR(child)) {
+                        err = PTR_ERR(child);
+                        goto done;
+                }
+        }
+
         sch_tree_lock(sch);
         if (child) {
                 qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index f558433537b8..ee13d28d39d1 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1239,78 +1239,107 @@ void sctp_assoc_update(struct sctp_association *asoc,
 }
 
 /* Update the retran path for sending a retransmitted packet.
- * Round-robin through the active transports, else round-robin
- * through the inactive transports as this is the next best thing
- * we can try.
+ * See also RFC4960, 6.4. Multi-Homed SCTP Endpoints:
+ *
+ *   When there is outbound data to send and the primary path
+ *   becomes inactive (e.g., due to failures), or where the
+ *   SCTP user explicitly requests to send data to an
+ *   inactive destination transport address, before reporting
+ *   an error to its ULP, the SCTP endpoint should try to send
+ *   the data to an alternate active destination transport
+ *   address if one exists.
+ *
+ *   When retransmitting data that timed out, if the endpoint
+ *   is multihomed, it should consider each source-destination
+ *   address pair in its retransmission selection policy.
+ *   When retransmitting timed-out data, the endpoint should
+ *   attempt to pick the most divergent source-destination
+ *   pair from the original source-destination pair to which
+ *   the packet was transmitted.
+ *
+ *   Note: Rules for picking the most divergent source-destination
+ *   pair are an implementation decision and are not specified
+ *   within this document.
+ *
+ * Our basic strategy is to round-robin transports in priorities
+ * according to sctp_state_prio_map[] e.g., if no such
+ * transport with state SCTP_ACTIVE exists, round-robin through
+ * SCTP_UNKNOWN, etc. You get the picture.
  */
-void sctp_assoc_update_retran_path(struct sctp_association *asoc)
+static const u8 sctp_trans_state_to_prio_map[] = {
+        [SCTP_ACTIVE]   = 3,    /* best case */
+        [SCTP_UNKNOWN]  = 2,
+        [SCTP_PF]       = 1,
+        [SCTP_INACTIVE] = 0,    /* worst case */
+};
+
+static u8 sctp_trans_score(const struct sctp_transport *trans)
 {
-        struct sctp_transport *t, *next;
-        struct list_head *head = &asoc->peer.transport_addr_list;
-        struct list_head *pos;
+        return sctp_trans_state_to_prio_map[trans->state];
+}
 
-        if (asoc->peer.transport_count == 1)
-                return;
+static struct sctp_transport *sctp_trans_elect_best(struct sctp_transport *curr,
+                                                    struct sctp_transport *best)
+{
+        if (best == NULL)
+                return curr;
 
-        /* Find the next transport in a round-robin fashion. */
-        t = asoc->peer.retran_path;
-        pos = &t->transports;
-        next = NULL;
+        return sctp_trans_score(curr) > sctp_trans_score(best) ? curr : best;
+}
 
-        while (1) {
-                /* Skip the head. */
-                if (pos->next == head)
-                        pos = head->next;
-                else
-                        pos = pos->next;
+void sctp_assoc_update_retran_path(struct sctp_association *asoc)
+{
+        struct sctp_transport *trans = asoc->peer.retran_path;
+        struct sctp_transport *trans_next = NULL;
 
-                t = list_entry(pos, struct sctp_transport, transports);
+        /* We're done as we only have the one and only path. */
+        if (asoc->peer.transport_count == 1)
+                return;
+        /* If active_path and retran_path are the same and active,
+         * then this is the only active path. Use it.
+         */
+        if (asoc->peer.active_path == asoc->peer.retran_path &&
+            asoc->peer.active_path->state == SCTP_ACTIVE)
+                return;
 
-                /* We have exhausted the list, but didn't find any
-                 * other active transports.  If so, use the next
-                 * transport.
-                 */
-                if (t == asoc->peer.retran_path) {
-                        t = next;
+        /* Iterate from retran_path's successor back to retran_path. */
+        for (trans = list_next_entry(trans, transports); 1;
+             trans = list_next_entry(trans, transports)) {
+                /* Manually skip the head element. */
+                if (&trans->transports == &asoc->peer.transport_addr_list)
+                        continue;
+                if (trans->state == SCTP_UNCONFIRMED)
+                        continue;
+                trans_next = sctp_trans_elect_best(trans, trans_next);
+                /* Active is good enough for immediate return. */
+                if (trans_next->state == SCTP_ACTIVE)
                         break;
-                }
-
-                /* Try to find an active transport. */
-
-                if ((t->state == SCTP_ACTIVE) ||
-                    (t->state == SCTP_UNKNOWN)) {
+                /* We've reached the end, time to update path. */
+                if (trans == asoc->peer.retran_path)
                         break;
-                } else {
-                        /* Keep track of the next transport in case
-                         * we don't find any active transport.
-                         */
-                        if (t->state != SCTP_UNCONFIRMED && !next)
-                                next = t;
-                }
         }
 
-        if (t)
-                asoc->peer.retran_path = t;
-        else
-                t = asoc->peer.retran_path;
+        if (trans_next != NULL)
+                asoc->peer.retran_path = trans_next;
 
-        pr_debug("%s: association:%p addr:%pISpc\n", __func__, asoc,
-                 &t->ipaddr.sa);
+        pr_debug("%s: association:%p updated new path to addr:%pISpc\n",
+                 __func__, asoc, &asoc->peer.retran_path->ipaddr.sa);
 }
 
-/* Choose the transport for sending retransmit packet.  */
-struct sctp_transport *sctp_assoc_choose_alter_transport(
-        struct sctp_association *asoc, struct sctp_transport *last_sent_to)
+struct sctp_transport *
+sctp_assoc_choose_alter_transport(struct sctp_association *asoc,
+                                  struct sctp_transport *last_sent_to)
 {
         /* If this is the first time packet is sent, use the active path,
          * else use the retran path. If the last packet was sent over the
          * retran path, update the retran path and use it.
          */
-        if (!last_sent_to)
+        if (last_sent_to == NULL) {
                 return asoc->peer.active_path;
-        else {
+        } else {
                 if (last_sent_to == asoc->peer.retran_path)
                         sctp_assoc_update_retran_path(asoc);
+
                 return asoc->peer.retran_path;
         }
 }
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 632090b961c3..3a1767ef3201 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1421,8 +1421,8 @@ static void sctp_chunk_destroy(struct sctp_chunk *chunk)
         BUG_ON(!list_empty(&chunk->list));
         list_del_init(&chunk->transmitted_list);
 
-        /* Free the chunk skb data and the SCTP_chunk stub itself. */
-        dev_kfree_skb(chunk->skb);
+        consume_skb(chunk->skb);
+        consume_skb(chunk->auth_chunk);
 
         SCTP_DBG_OBJCNT_DEC(chunk);
         kmem_cache_free(sctp_chunk_cachep, chunk);
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index bd859154000e..5d6883ff00c3 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -495,11 +495,12 @@ static void sctp_do_8_2_transport_strike(sctp_cmd_seq_t *commands,
         }
 
         /* If the transport error count is greater than the pf_retrans
-         * threshold, and less than pathmaxrtx, then mark this transport
-         * as Partially Failed, ee SCTP Quick Failover Draft, secon 5.1,
-         * point 1
+         * threshold, and less than pathmaxrtx, and if the current state
+         * is not SCTP_UNCONFIRMED, then mark this transport as Partially
+         * Failed, see SCTP Quick Failover Draft, section 5.1
          */
         if ((transport->state != SCTP_PF) &&
+           (transport->state != SCTP_UNCONFIRMED) &&
            (asoc->pf_retrans < transport->pathmaxrxt) &&
            (transport->error_count > asoc->pf_retrans)) {
 
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 591b44d3b7de..01e002430c85 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -758,6 +758,12 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
                 struct sctp_chunk auth;
                 sctp_ierror_t ret;
 
+                /* Make sure that we and the peer are AUTH capable */
+                if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) {
+                        sctp_association_free(new_asoc);
+                        return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+                }
+
                 /* set-up our fake chunk so that we can process it */
                 auth.skb = chunk->auth_chunk;
                 auth.asoc = chunk->asoc;
@@ -768,10 +774,6 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
                 auth.transport = chunk->transport;
 
                 ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth);
-
-                /* We can now safely free the auth_chunk clone */
-                kfree_skb(chunk->auth_chunk);
-
                 if (ret != SCTP_IERROR_NO_ERROR) {
                         sctp_association_free(new_asoc);
                         return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
diff --git a/net/socket.c b/net/socket.c
index 879933aaed4c..a19ae1968d37 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -450,16 +450,17 @@ EXPORT_SYMBOL(sockfd_lookup);
 
 static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
 {
-        struct file *file;
+        struct fd f = fdget(fd);
         struct socket *sock;
 
         *err = -EBADF;
-        file = fget_light(fd, fput_needed);
-        if (file) {
-                sock = sock_from_file(file, err);
-                if (sock)
+        if (f.file) {
+                sock = sock_from_file(f.file, err);
+                if (likely(sock)) {
+                        *fput_needed = f.flags;
                         return sock;
-                fput_light(file, *fput_needed);
+                }
+                fdput(f);
         }
         return NULL;
 }
@@ -1985,6 +1986,10 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
 {
         if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
                 return -EFAULT;
+
+        if (kmsg->msg_namelen < 0)
+                return -EINVAL;
+
         if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
                 kmsg->msg_namelen = sizeof(struct sockaddr_storage);
         return 0;
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index a38c89969c68..574b86193b15 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -610,8 +610,13 @@ static struct notifier_block notifier = {
 
 int tipc_bearer_setup(void)
 {
+        int err;
+
+        err = register_netdevice_notifier(&notifier);
+        if (err)
+                return err;
         dev_add_pack(&tipc_packet_type);
-        return register_netdevice_notifier(&notifier);
+        return 0;
 }
 
 void tipc_bearer_cleanup(void)
diff --git a/net/tipc/config.c b/net/tipc/config.c
index c301a9a592d8..e6d721692ae0 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -181,7 +181,7 @@ static struct sk_buff *cfg_set_own_addr(void)
         if (tipc_own_addr)
                 return tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
                                                    " (cannot change node address once assigned)");
-        tipc_core_start_net(addr);
+        tipc_net_start(addr);
         return tipc_cfg_reply_none();
 }
 
@@ -376,7 +376,6 @@ static void cfg_conn_msg_event(int conid, struct sockaddr_tipc *addr,
         struct tipc_cfg_msg_hdr *req_hdr;
         struct tipc_cfg_msg_hdr *rep_hdr;
         struct sk_buff *rep_buf;
-        int ret;
 
         /* Validate configuration message header (ignore invalid message) */
         req_hdr = (struct tipc_cfg_msg_hdr *)buf;
@@ -398,12 +397,8 @@ static void cfg_conn_msg_event(int conid, struct sockaddr_tipc *addr,
                 memcpy(rep_hdr, req_hdr, sizeof(*rep_hdr));
                 rep_hdr->tcm_len = htonl(rep_buf->len);
                 rep_hdr->tcm_flags &= htons(~TCM_F_REQUEST);
-
-                ret = tipc_conn_sendmsg(&cfgsrv, conid, addr, rep_buf->data,
-                                        rep_buf->len);
-                if (ret < 0)
-                        pr_err("Sending cfg reply message failed, no memory\n");
-
+                tipc_conn_sendmsg(&cfgsrv, conid, addr, rep_buf->data,
+                                  rep_buf->len);
                 kfree_skb(rep_buf);
         }
 }
diff --git a/net/tipc/core.c b/net/tipc/core.c
index f9e88d8b04ca..80c20647b3d2 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -77,37 +77,13 @@ struct sk_buff *tipc_buf_acquire(u32 size)
 }
 
 /**
- * tipc_core_stop_net - shut down TIPC networking sub-systems
- */
-static void tipc_core_stop_net(void)
-{
-        tipc_net_stop();
-        tipc_bearer_cleanup();
-}
-
-/**
- * start_net - start TIPC networking sub-systems
- */
-int tipc_core_start_net(unsigned long addr)
-{
-        int res;
-
-        tipc_net_start(addr);
-        res = tipc_bearer_setup();
-        if (res < 0)
-                goto err;
-        return res;
-
-err:
-        tipc_core_stop_net();
-        return res;
-}
-
-/**
  * tipc_core_stop - switch TIPC from SINGLE NODE to NOT RUNNING mode
  */
 static void tipc_core_stop(void)
 {
+        tipc_handler_stop();
+        tipc_net_stop();
+        tipc_bearer_cleanup();
         tipc_netlink_stop();
         tipc_cfg_stop();
         tipc_subscr_stop();
@@ -122,30 +98,65 @@ static void tipc_core_stop(void)
  */
 static int tipc_core_start(void)
 {
-        int res;
+        int err;
 
         get_random_bytes(&tipc_random, sizeof(tipc_random));
 
-        res = tipc_handler_start();
-        if (!res)
-                res = tipc_ref_table_init(tipc_max_ports, tipc_random);
-        if (!res)
-                res = tipc_nametbl_init();
-        if (!res)
-                res = tipc_netlink_start();
-        if (!res)
-                res = tipc_socket_init();
-        if (!res)
-                res = tipc_register_sysctl();
-        if (!res)
-                res = tipc_subscr_start();
-        if (!res)
-                res = tipc_cfg_init();
-        if (res) {
-                tipc_handler_stop();
-                tipc_core_stop();
-        }
-        return res;
+        err = tipc_handler_start();
+        if (err)
+                goto out_handler;
+
+        err = tipc_ref_table_init(tipc_max_ports, tipc_random);
+        if (err)
+                goto out_reftbl;
+
+        err = tipc_nametbl_init();
+        if (err)
+                goto out_nametbl;
+
+        err = tipc_netlink_start();
+        if (err)
+                goto out_netlink;
+
+        err = tipc_socket_init();
+        if (err)
+                goto out_socket;
+
+        err = tipc_register_sysctl();
+        if (err)
+                goto out_sysctl;
+
+        err = tipc_subscr_start();
+        if (err)
+                goto out_subscr;
+
+        err = tipc_cfg_init();
+        if (err)
+                goto out_cfg;
+
+        err = tipc_bearer_setup();
+        if (err)
+                goto out_bearer;
+
+        return 0;
+out_bearer:
+        tipc_cfg_stop();
+out_cfg:
+        tipc_subscr_stop();
+out_subscr:
+        tipc_unregister_sysctl();
+out_sysctl:
+        tipc_socket_stop();
+out_socket:
+        tipc_netlink_stop();
+out_netlink:
+        tipc_nametbl_stop();
+out_nametbl:
+        tipc_ref_table_stop();
+out_reftbl:
+        tipc_handler_stop();
+out_handler:
+        return err;
 }
 
 static int __init tipc_init(void)
@@ -174,8 +185,6 @@ static int __init tipc_init(void)
 
 static void __exit tipc_exit(void)
 {
-        tipc_handler_stop();
-        tipc_core_stop_net();
         tipc_core_stop();
         pr_info("Deactivated\n");
 }
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 5569d96b4da3..4dfe137587bb 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -90,7 +90,6 @@ extern int tipc_random __read_mostly;
 /*
  * Routines available to privileged subsystems
  */
-int tipc_core_start_net(unsigned long);
 int tipc_handler_start(void);
 void tipc_handler_stop(void);
 int tipc_netlink_start(void);
diff --git a/net/tipc/handler.c b/net/tipc/handler.c
index e4bc8a296744..1fabf160501f 100644
--- a/net/tipc/handler.c
+++ b/net/tipc/handler.c
@@ -58,7 +58,6 @@ unsigned int tipc_k_signal(Handler routine, unsigned long argument)
 
         spin_lock_bh(&qitem_lock);
         if (!handler_enabled) {
-                pr_err("Signal request ignored by handler\n");
                 spin_unlock_bh(&qitem_lock);
                 return -ENOPROTOOPT;
         }
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 92a1533af4e0..042e8e3cabc0 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -941,20 +941,48 @@ int tipc_nametbl_init(void)
         return 0;
 }
 
-void tipc_nametbl_stop(void)
+/**
+ * tipc_purge_publications - remove all publications for a given type
+ *
+ * tipc_nametbl_lock must be held when calling this function
+ */
+static void tipc_purge_publications(struct name_seq *seq)
 {
-        u32 i;
+        struct publication *publ, *safe;
+        struct sub_seq *sseq;
+        struct name_info *info;
 
-        if (!table.types)
+        if (!seq->sseqs) {
+                nameseq_delete_empty(seq);
                 return;
+        }
+        sseq = seq->sseqs;
+        info = sseq->info;
+        list_for_each_entry_safe(publ, safe, &info->zone_list, zone_list) {
+                tipc_nametbl_remove_publ(publ->type, publ->lower, publ->node,
+                                         publ->ref, publ->key);
+        }
+}
+
+void tipc_nametbl_stop(void)
+{
+        u32 i;
+        struct name_seq *seq;
+        struct hlist_head *seq_head;
+        struct hlist_node *safe;
 
-        /* Verify name table is empty, then release it */
+        /* Verify name table is empty and purge any lingering
+         * publications, then release the name table
+         */
         write_lock_bh(&tipc_nametbl_lock);
         for (i = 0; i < TIPC_NAMETBL_SIZE; i++) {
                 if (hlist_empty(&table.types[i]))
                         continue;
-                pr_err("nametbl_stop(): orphaned hash chain detected\n");
-                break;
+                seq_head = &table.types[i];
+                hlist_for_each_entry_safe(seq, safe, seq_head, ns_list) {
+                        tipc_purge_publications(seq);
+                }
+                continue;
         }
         kfree(table.types);
         table.types = NULL;
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 9f72a6376362..3aaf73de9e2d 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -83,8 +83,6 @@ static struct genl_ops tipc_genl_ops[] = {
         },
 };
 
-static int tipc_genl_family_registered;
-
 int tipc_netlink_start(void)
 {
         int res;
@@ -94,16 +92,10 @@ int tipc_netlink_start(void)
                 pr_err("Failed to register netlink interface\n");
                 return res;
         }
-
-        tipc_genl_family_registered = 1;
         return 0;
 }
 
 void tipc_netlink_stop(void)
 {
-        if (!tipc_genl_family_registered)
-                return;
-
         genl_unregister_family(&tipc_genl_family);
-        tipc_genl_family_registered = 0;
 }
diff --git a/net/tipc/ref.c b/net/tipc/ref.c
index 2a2a938dc22c..de3d593e2fee 100644
--- a/net/tipc/ref.c
+++ b/net/tipc/ref.c
@@ -126,9 +126,6 @@ int tipc_ref_table_init(u32 requested_size, u32 start)
  */
 void tipc_ref_table_stop(void)
 {
-        if (!tipc_ref_table.entries)
-                return;
-
         vfree(tipc_ref_table.entries);
         tipc_ref_table.entries = NULL;
 }
diff --git a/net/tipc/server.c b/net/tipc/server.c
index b635ca347a87..646a930eefbf 100644
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -87,7 +87,6 @@ static void tipc_clean_outqueues(struct tipc_conn *con);
 static void tipc_conn_kref_release(struct kref *kref)
 {
         struct tipc_conn *con = container_of(kref, struct tipc_conn, kref);
-        struct tipc_server *s = con->server;
 
         if (con->sock) {
                 tipc_sock_release_local(con->sock);
@@ -95,10 +94,6 @@ static void tipc_conn_kref_release(struct kref *kref)
         }
 
         tipc_clean_outqueues(con);
-
-        if (con->conid)
-                s->tipc_conn_shutdown(con->conid, con->usr_data);
-
         kfree(con);
 }
 
@@ -181,6 +176,9 @@ static void tipc_close_conn(struct tipc_conn *con)
         struct tipc_server *s = con->server;
 
         if (test_and_clear_bit(CF_CONNECTED, &con->flags)) {
+                if (con->conid)
+                        s->tipc_conn_shutdown(con->conid, con->usr_data);
+
                 spin_lock_bh(&s->idr_lock);
                 idr_remove(&s->conn_idr, con->conid);
                 s->idr_in_use--;
@@ -429,10 +427,12 @@ int tipc_conn_sendmsg(struct tipc_server *s, int conid,
         list_add_tail(&e->list, &con->outqueue);
         spin_unlock_bh(&con->outqueue_lock);
 
-        if (test_bit(CF_CONNECTED, &con->flags))
+        if (test_bit(CF_CONNECTED, &con->flags)) {
                 if (!queue_work(s->send_wq, &con->swork))
                         conn_put(con);
-
+        } else {
+                conn_put(con);
+        }
         return 0;
 }
 
@@ -573,7 +573,6 @@ int tipc_server_start(struct tipc_server *s)
                 kmem_cache_destroy(s->rcvbuf_cache);
                 return ret;
         }
-        s->enabled = 1;
         return ret;
 }
 
@@ -583,10 +582,6 @@ void tipc_server_stop(struct tipc_server *s)
         int total = 0;
         int id;
 
-        if (!s->enabled)
-                return;
-
-        s->enabled = 0;
         spin_lock_bh(&s->idr_lock);
         for (id = 0; total < s->idr_in_use; id++) {
                 con = idr_find(&s->conn_idr, id);
diff --git a/net/tipc/server.h b/net/tipc/server.h
index 98b23f20bc0f..be817b0b547e 100644
--- a/net/tipc/server.h
+++ b/net/tipc/server.h
@@ -56,7 +56,6 @@
  * @name: server name
  * @imp: message importance
  * @type: socket type
- * @enabled: identify whether server is launched or not
  */
 struct tipc_server {
         struct idr conn_idr;
@@ -74,7 +73,6 @@ struct tipc_server {
         const char name[TIPC_SERVER_NAME_LEN];
         int imp;
         int type;
-        int enabled;
 };
 
 int tipc_conn_sendmsg(struct tipc_server *s, int conid,
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index aab4948f0aff..0ed0eaa62f29 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -70,8 +70,6 @@ static const struct proto_ops msg_ops;
 static struct proto tipc_proto;
 static struct proto tipc_proto_kern;
 
-static int sockets_enabled;
-
 /*
  * Revised TIPC socket locking policy:
  *
@@ -999,7 +997,7 @@ static int tipc_wait_for_rcvmsg(struct socket *sock, long timeo)
 
         for (;;) {
                 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
-                if (skb_queue_empty(&sk->sk_receive_queue)) {
+                if (timeo && skb_queue_empty(&sk->sk_receive_queue)) {
                         if (sock->state == SS_DISCONNECTING) {
                                 err = -ENOTCONN;
                                 break;
@@ -1625,7 +1623,7 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo)
         for (;;) {
                 prepare_to_wait_exclusive(sk_sleep(sk), &wait,
                                           TASK_INTERRUPTIBLE);
-                if (skb_queue_empty(&sk->sk_receive_queue)) {
+                if (timeo && skb_queue_empty(&sk->sk_receive_queue)) {
                         release_sock(sk);
                         timeo = schedule_timeout(timeo);
                         lock_sock(sk);
@@ -2027,8 +2025,6 @@ int tipc_socket_init(void)
                 proto_unregister(&tipc_proto);
                 goto out;
         }
-
-        sockets_enabled = 1;
  out:
         return res;
 }
@@ -2038,10 +2034,6 @@ int tipc_socket_init(void)
  */
 void tipc_socket_stop(void)
 {
-        if (!sockets_enabled)
-                return;
-
-        sockets_enabled = 0;
         sock_unregister(tipc_family_ops.family);
         proto_unregister(&tipc_proto);
 }
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 7cb0bd5b1176..642437231ad5 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -96,20 +96,16 @@ static void subscr_send_event(struct tipc_subscription *sub, u32 found_lower,
 {
         struct tipc_subscriber *subscriber = sub->subscriber;
         struct kvec msg_sect;
-        int ret;
 
         msg_sect.iov_base = (void *)&sub->evt;
         msg_sect.iov_len = sizeof(struct tipc_event);
-
         sub->evt.event = htohl(event, sub->swap);
         sub->evt.found_lower = htohl(found_lower, sub->swap);
         sub->evt.found_upper = htohl(found_upper, sub->swap);
         sub->evt.port.ref = htohl(port_ref, sub->swap);
         sub->evt.port.node = htohl(node, sub->swap);
-        ret = tipc_conn_sendmsg(&topsrv, subscriber->conid, NULL,
-                                msg_sect.iov_base, msg_sect.iov_len);
-        if (ret < 0)
-                pr_err("Sending subscription event failed, no memory\n");
+        tipc_conn_sendmsg(&topsrv, subscriber->conid, NULL, msg_sect.iov_base,
+                          msg_sect.iov_len);
 }
 
 /**
@@ -153,14 +149,6 @@ static void subscr_timeout(struct tipc_subscription *sub)
         /* The spin lock per subscriber is used to protect its members */
         spin_lock_bh(&subscriber->lock);
 
-        /* Validate if the connection related to the subscriber is
-         * closed (in case subscriber is terminating)
-         */
-        if (subscriber->conid == 0) {
-                spin_unlock_bh(&subscriber->lock);
-                return;
-        }
-
         /* Validate timeout (in case subscription is being cancelled) */
         if (sub->timeout == TIPC_WAIT_FOREVER) {
                 spin_unlock_bh(&subscriber->lock);
@@ -215,9 +203,6 @@ static void subscr_release(struct tipc_subscriber *subscriber)
 
         spin_lock_bh(&subscriber->lock);
 
-        /* Invalidate subscriber reference */
-        subscriber->conid = 0;
-
         /* Destroy any existing subscriptions for subscriber */
         list_for_each_entry_safe(sub, sub_temp, &subscriber->subscription_list,
                                  subscription_list) {
@@ -278,9 +263,9 @@ static void subscr_cancel(struct tipc_subscr *s,
  *
  * Called with subscriber lock held.
  */
-static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
-                                             struct tipc_subscriber *subscriber)
-{
+static int subscr_subscribe(struct tipc_subscr *s,
+                            struct tipc_subscriber *subscriber,
+                            struct tipc_subscription **sub_p) {
         struct tipc_subscription *sub;
         int swap;
 
@@ -291,23 +276,21 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
         if (s->filter & htohl(TIPC_SUB_CANCEL, swap)) {
                 s->filter &= ~htohl(TIPC_SUB_CANCEL, swap);
                 subscr_cancel(s, subscriber);
-                return NULL;
+                return 0;
         }
 
         /* Refuse subscription if global limit exceeded */
         if (atomic_read(&subscription_count) >= TIPC_MAX_SUBSCRIPTIONS) {
                 pr_warn("Subscription rejected, limit reached (%u)\n",
                         TIPC_MAX_SUBSCRIPTIONS);
-                subscr_terminate(subscriber);
-                return NULL;
+                return -EINVAL;
         }
 
         /* Allocate subscription object */
         sub = kmalloc(sizeof(*sub), GFP_ATOMIC);
         if (!sub) {
                 pr_warn("Subscription rejected, no memory\n");
-                subscr_terminate(subscriber);
-                return NULL;
+                return -ENOMEM;
         }
 
         /* Initialize subscription object */
@@ -321,8 +304,7 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
             (sub->seq.lower > sub->seq.upper)) {
                 pr_warn("Subscription rejected, illegal request\n");
                 kfree(sub);
-                subscr_terminate(subscriber);
-                return NULL;
+                return -EINVAL;
         }
         INIT_LIST_HEAD(&sub->nameseq_list);
         list_add(&sub->subscription_list, &subscriber->subscription_list);
@@ -335,8 +317,8 @@ static struct tipc_subscription *subscr_subscribe(struct tipc_subscr *s,
                              (Handler)subscr_timeout, (unsigned long)sub);
                 k_start_timer(&sub->timer, sub->timeout);
         }
-
-        return sub;
+        *sub_p = sub;
+        return 0;
 }
 
 /* Handle one termination request for the subscriber */
@@ -350,10 +332,14 @@ static void subscr_conn_msg_event(int conid, struct sockaddr_tipc *addr,
                                   void *usr_data, void *buf, size_t len)
 {
         struct tipc_subscriber *subscriber = usr_data;
-        struct tipc_subscription *sub;
+        struct tipc_subscription *sub = NULL;
 
         spin_lock_bh(&subscriber->lock);
-        sub = subscr_subscribe((struct tipc_subscr *)buf, subscriber);
+        if (subscr_subscribe((struct tipc_subscr *)buf, subscriber, &sub) < 0) {
+                spin_unlock_bh(&subscriber->lock);
+                subscr_terminate(subscriber);
+                return;
+        }
         if (sub)
                 tipc_nametbl_subscribe(sub);
         spin_unlock_bh(&subscriber->lock);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 29fc8bee9702..ce6ec6c2f4de 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -163,9 +163,8 @@ static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
 
 static inline unsigned int unix_hash_fold(__wsum n)
 {
-        unsigned int hash = (__force unsigned int)n;
+        unsigned int hash = (__force unsigned int)csum_fold(n);
 
-        hash ^= hash>>16;
         hash ^= hash>>8;
         return hash&(UNIX_HASH_SIZE-1);
 }
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 010892b81a06..a3bf18d11609 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -788,8 +788,6 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
         default:
                 break;
         }
-
-        wdev->beacon_interval = 0;
 }
 
 static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 9b897fca7487..f0541370e68e 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1700,7 +1700,7 @@ static void reg_process_hint(struct regulatory_request *reg_request)
                 return;
         case NL80211_REGDOM_SET_BY_USER:
                 treatment = reg_process_hint_user(reg_request);
-                if (treatment == REG_REQ_OK ||
+                if (treatment == REG_REQ_IGNORE ||
                     treatment == REG_REQ_ALREADY_SET)
                         return;
                 schedule_delayed_work(&reg_timeout, msecs_to_jiffies(3142));
@@ -2373,6 +2373,7 @@ static int reg_set_rd_country_ie(const struct ieee80211_regdomain *rd,
 int set_regdom(const struct ieee80211_regdomain *rd)
 {
         struct regulatory_request *lr;
+        bool user_reset = false;
         int r;
 
         if (!reg_is_valid_request(rd->alpha2)) {
@@ -2389,6 +2390,7 @@ int set_regdom(const struct ieee80211_regdomain *rd)
                 break;
         case NL80211_REGDOM_SET_BY_USER:
                 r = reg_set_rd_user(rd, lr);
+                user_reset = true;
                 break;
         case NL80211_REGDOM_SET_BY_DRIVER:
                 r = reg_set_rd_driver(rd, lr);
@@ -2402,8 +2404,14 @@ int set_regdom(const struct ieee80211_regdomain *rd)
         }
 
         if (r) {
-                if (r == -EALREADY)
+                switch (r) {
+                case -EALREADY:
                         reg_set_request_processed();
+                        break;
+                default:
+                        /* Back to world regulatory in case of errors */
+                        restore_regulatory_settings(user_reset);
+                }
 
                 kfree(rd);
                 return r;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 4b98b25793c5..1d5c7bf29938 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1158,7 +1158,7 @@ static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
         if (hlist_unhashed(&pol->bydst))
                 return NULL;
 
-        hlist_del(&pol->bydst);
+        hlist_del_init(&pol->bydst);
         hlist_del(&pol->byidx);
         list_del(&pol->walk.all);
         net->xfrm.policy_count[dir]--;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index a26b7aa79475..40f1b3e92e78 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1159,6 +1159,11 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
         }
         x->props.aalgo = orig->props.aalgo;
 
+        if (orig->aead) {
+                x->aead = xfrm_algo_aead_clone(orig->aead);
+                if (!x->aead)
+                        goto error;
+        }
         if (orig->ealg) {
                 x->ealg = xfrm_algo_clone(orig->ealg);
                 if (!x->ealg)
@@ -1201,6 +1206,9 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
         x->props.flags = orig->props.flags;
         x->props.extra_flags = orig->props.extra_flags;
 
+        x->tfcpad = orig->tfcpad;
+        x->replay_maxdiff = orig->replay_maxdiff;
+        x->replay_maxage = orig->replay_maxage;
         x->curlft.add_time = orig->curlft.add_time;
         x->km.state = orig->km.state;
         x->km.seq = orig->km.seq;
@@ -1215,11 +1223,12 @@ out:
         return NULL;
 }
 
-/* net->xfrm.xfrm_state_lock is held */
 struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net)
 {
         unsigned int h;
-        struct xfrm_state *x;
+        struct xfrm_state *x = NULL;
+
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
 
         if (m->reqid) {
                 h = xfrm_dst_hash(net, &m->old_daddr, &m->old_saddr,
@@ -1236,7 +1245,7 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n
                                              m->old_family))
                                 continue;
                         xfrm_state_hold(x);
-                        return x;
+                        break;
                 }
         } else {
                 h = xfrm_src_hash(net, &m->old_daddr, &m->old_saddr,
@@ -1251,11 +1260,13 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n
                                              m->old_family))
                                 continue;
                         xfrm_state_hold(x);
-                        return x;
+                        break;
                 }
         }
 
-        return NULL;
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+
+        return x;
 }
 EXPORT_SYMBOL(xfrm_migrate_state_find);
 
@@ -1451,7 +1462,7 @@ xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
 {
         int err = 0;
         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
-        struct net *net = xs_net(*dst);
+        struct net *net = xs_net(*src);
 
         if (!afinfo)
                 return -EAFNOSUPPORT;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 1ae3ec7c18b0..2f7ddc3a59b4 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -32,11 +32,6 @@
 #include <linux/in6.h>
 #endif
 
-static inline int aead_len(struct xfrm_algo_aead *alg)
-{
-        return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
-}
-
 static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
 {
         struct nlattr *rt = attrs[type];
@@ -1226,7 +1221,7 @@ static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs
                 return 0;
 
         uctx = nla_data(rt);
-        return security_xfrm_policy_alloc(&pol->security, uctx);
+        return security_xfrm_policy_alloc(&pol->security, uctx, GFP_KERNEL);
 }
 
 static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
@@ -1631,7 +1626,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                 if (rt) {
                         struct xfrm_user_sec_ctx *uctx = nla_data(rt);
 
-                        err = security_xfrm_policy_alloc(&ctx, uctx);
+                        err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
                         if (err)
                                 return err;
                 }
@@ -1933,7 +1928,7 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
                 if (rt) {
                         struct xfrm_user_sec_ctx *uctx = nla_data(rt);
 
-                        err = security_xfrm_policy_alloc(&ctx, uctx);
+                        err = security_xfrm_policy_alloc(&ctx, uctx, GFP_KERNEL);
                         if (err)
                                 return err;
                 }
diff --git a/scripts/gen_initramfs_list.sh b/scripts/gen_initramfs_list.sh
index ef474098d9f1..17fa901418ae 100644
--- a/scripts/gen_initramfs_list.sh
+++ b/scripts/gen_initramfs_list.sh
@@ -257,7 +257,7 @@ case "$arg" in
                 && compr="lzop -9 -f"
                 echo "$output_file" | grep -q "\.lz4$" \
                 && [ -x "`which lz4 2> /dev/null`" ] \
-                && compr="lz4 -9 -f"
+                && compr="lz4 -l -9 -f"
                 echo "$output_file" | grep -q "\.cpio$" && compr="cat"
                 shift
                 ;;
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 40610984a1b5..99a45fdc1bbf 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1502,6 +1502,16 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
 #define R_ARM_JUMP24    29
 #endif
 
+#ifndef R_ARM_THM_CALL
+#define R_ARM_THM_CALL          10
+#endif
+#ifndef R_ARM_THM_JUMP24
+#define R_ARM_THM_JUMP24        30
+#endif
+#ifndef R_ARM_THM_JUMP19
+#define R_ARM_THM_JUMP19        51
+#endif
+
 static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
 {
         unsigned int r_typ = ELF_R_TYPE(r->r_info);
@@ -1515,6 +1525,9 @@ static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
         case R_ARM_PC24:
         case R_ARM_CALL:
         case R_ARM_JUMP24:
+        case R_ARM_THM_CALL:
+        case R_ARM_THM_JUMP24:
+        case R_ARM_THM_JUMP19:
                 /* From ARM ABI: ((S + A) | T) - P */
                 r->r_addend = (int)(long)(elf->hdr +
                               sechdr->sh_offset +
diff --git a/security/capability.c b/security/capability.c
index 8b4f24ae4338..21e2b9cae685 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -757,7 +757,8 @@ static void cap_skb_owned_by(struct sk_buff *skb, struct sock *sk)
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 static int cap_xfrm_policy_alloc_security(struct xfrm_sec_ctx **ctxp,
-                                          struct xfrm_user_sec_ctx *sec_ctx)
+                                          struct xfrm_user_sec_ctx *sec_ctx,
+                                          gfp_t gfp)
 {
         return 0;
 }
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index d46cbc5e335e..2fb2576dc644 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -1000,7 +1000,11 @@ static int keyring_detect_cycle_iterator(const void *object,
 
         kenter("{%d}", key->serial);
 
-        BUG_ON(key != ctx->match_data);
+        /* We might get a keyring with matching index-key that is nonetheless a
+         * different keyring. */
+        if (key != ctx->match_data)
+                return 0;
+
         ctx->result = ERR_PTR(-EDEADLK);
         return 1;
 }
diff --git a/security/security.c b/security/security.c
index 15b6928592ef..919cad93ac82 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1317,9 +1317,11 @@ void security_skb_owned_by(struct sk_buff *skb, struct sock *sk)
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 
-int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx)
+int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
+                               struct xfrm_user_sec_ctx *sec_ctx,
+                               gfp_t gfp)
 {
-        return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx);
+        return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx, gfp);
 }
 EXPORT_SYMBOL(security_xfrm_policy_alloc);
 
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 4b34847208cc..b332e2cc0954 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -668,7 +668,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
                 if (flags[i] == SBLABEL_MNT)
                         continue;
                 rc = security_context_to_sid(mount_options[i],
-                                             strlen(mount_options[i]), &sid);
+                                             strlen(mount_options[i]), &sid, GFP_KERNEL);
                 if (rc) {
                         printk(KERN_WARNING "SELinux: security_context_to_sid"
                                "(%s) failed for (dev %s, type %s) errno=%d\n",
@@ -2489,7 +2489,8 @@ static int selinux_sb_remount(struct super_block *sb, void *data)
                 if (flags[i] == SBLABEL_MNT)
                         continue;
                 len = strlen(mount_options[i]);
-                rc = security_context_to_sid(mount_options[i], len, &sid);
+                rc = security_context_to_sid(mount_options[i], len, &sid,
+                                             GFP_KERNEL);
                 if (rc) {
                         printk(KERN_WARNING "SELinux: security_context_to_sid"
                                "(%s) failed for (dev %s, type %s) errno=%d\n",
@@ -2893,7 +2894,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
         if (rc)
                 return rc;
 
-        rc = security_context_to_sid(value, size, &newsid);
+        rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
         if (rc == -EINVAL) {
                 if (!capable(CAP_MAC_ADMIN)) {
                         struct audit_buffer *ab;
@@ -3050,7 +3051,7 @@ static int selinux_inode_setsecurity(struct inode *inode, const char *name,
         if (!value || !size)
                 return -EACCES;
 
-        rc = security_context_to_sid((void *)value, size, &newsid);
+        rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
         if (rc)
                 return rc;
 
@@ -5529,7 +5530,7 @@ static int selinux_setprocattr(struct task_struct *p,
                         str[size-1] = 0;
                         size--;
                 }
-                error = security_context_to_sid(value, size, &sid);
+                error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
                         if (!capable(CAP_MAC_ADMIN)) {
                                 struct audit_buffer *ab;
@@ -5638,7 +5639,7 @@ static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
 
 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
 {
-        return security_context_to_sid(secdata, seclen, secid);
+        return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
 }
 
 static void selinux_release_secctx(char *secdata, u32 seclen)
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 8ed8daf7f1ee..ce7852cf526b 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -134,7 +134,7 @@ int security_sid_to_context(u32 sid, char **scontext,
 int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len);
 
 int security_context_to_sid(const char *scontext, u32 scontext_len,
-        u32 *out_sid);
+                            u32 *out_sid, gfp_t gfp);
 
 int security_context_to_sid_default(const char *scontext, u32 scontext_len,
                                     u32 *out_sid, u32 def_sid, gfp_t gfp_flags);
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 48c3cc94c168..9f0584710c85 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -10,7 +10,8 @@
 #include <net/flow.h>
 
 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
-                              struct xfrm_user_sec_ctx *uctx);
+                              struct xfrm_user_sec_ctx *uctx,
+                              gfp_t gfp);
 int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
                               struct xfrm_sec_ctx **new_ctxp);
 void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 5122affe06a8..d60c0ee66387 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -576,7 +576,7 @@ static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
         if (length)
                 goto out;
 
-        length = security_context_to_sid(buf, size, &sid);
+        length = security_context_to_sid(buf, size, &sid, GFP_KERNEL);
         if (length)
                 goto out;
 
@@ -731,11 +731,13 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
         if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
                 goto out;
 
-        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
+        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
+                                         GFP_KERNEL);
         if (length)
                 goto out;
 
-        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
+        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
+                                         GFP_KERNEL);
         if (length)
                 goto out;
 
@@ -817,11 +819,13 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
                 objname = namebuf;
         }
 
-        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
+        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
+                                         GFP_KERNEL);
         if (length)
                 goto out;
 
-        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
+        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
+                                         GFP_KERNEL);
         if (length)
                 goto out;
 
@@ -878,11 +882,13 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
         if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
                 goto out;
 
-        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
+        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
+                                         GFP_KERNEL);
         if (length)
                 goto out;
 
-        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
+        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
+                                         GFP_KERNEL);
         if (length)
                 goto out;
 
@@ -934,7 +940,7 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
         if (sscanf(buf, "%s %s", con, user) != 2)
                 goto out;
 
-        length = security_context_to_sid(con, strlen(con) + 1, &sid);
+        length = security_context_to_sid(con, strlen(con) + 1, &sid, GFP_KERNEL);
         if (length)
                 goto out;
 
@@ -994,11 +1000,13 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
         if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
                 goto out;
 
-        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
+        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid,
+                                         GFP_KERNEL);
         if (length)
                 goto out;
 
-        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
+        length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid,
+                                         GFP_KERNEL);
         if (length)
                 goto out;
 
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 5d0144ee8ed6..4bca49414a40 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1289,16 +1289,18 @@ out:
  * @scontext: security context
  * @scontext_len: length in bytes
  * @sid: security identifier, SID
+ * @gfp: context for the allocation
  *
  * Obtains a SID associated with the security context that
  * has the string representation specified by @scontext.
  * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
  * memory is available, or 0 on success.
  */
-int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid)
+int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid,
+                            gfp_t gfp)
 {
         return security_context_to_sid_core(scontext, scontext_len,
-                                            sid, SECSID_NULL, GFP_KERNEL, 0);
+                                            sid, SECSID_NULL, gfp, 0);
 }
 
 /**
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 0462cb3ff0a7..98b042630a9e 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -78,7 +78,8 @@ static inline int selinux_authorizable_xfrm(struct xfrm_state *x)
  * xfrm_user_sec_ctx context.
  */
 static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
-                                   struct xfrm_user_sec_ctx *uctx)
+                                   struct xfrm_user_sec_ctx *uctx,
+                                   gfp_t gfp)
 {
         int rc;
         const struct task_security_struct *tsec = current_security();
@@ -94,7 +95,7 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
         if (str_len >= PAGE_SIZE)
                 return -ENOMEM;
 
-        ctx = kmalloc(sizeof(*ctx) + str_len + 1, GFP_KERNEL);
+        ctx = kmalloc(sizeof(*ctx) + str_len + 1, gfp);
         if (!ctx)
                 return -ENOMEM;
 
@@ -103,7 +104,7 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
         ctx->ctx_len = str_len;
         memcpy(ctx->ctx_str, &uctx[1], str_len);
         ctx->ctx_str[str_len] = '\0';
-        rc = security_context_to_sid(ctx->ctx_str, str_len, &ctx->ctx_sid);
+        rc = security_context_to_sid(ctx->ctx_str, str_len, &ctx->ctx_sid, gfp);
         if (rc)
                 goto err;
 
@@ -282,9 +283,10 @@ int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
  * LSM hook implementation that allocs and transfers uctx spec to xfrm_policy.
  */
 int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
-                              struct xfrm_user_sec_ctx *uctx)
+                              struct xfrm_user_sec_ctx *uctx,
+                              gfp_t gfp)
 {
-        return selinux_xfrm_alloc_user(ctxp, uctx);
+        return selinux_xfrm_alloc_user(ctxp, uctx, gfp);
 }
 
 /*
@@ -332,7 +334,7 @@ int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
 int selinux_xfrm_state_alloc(struct xfrm_state *x,
                              struct xfrm_user_sec_ctx *uctx)
 {
-        return selinux_xfrm_alloc_user(&x->security, uctx);
+        return selinux_xfrm_alloc_user(&x->security, uctx, GFP_KERNEL);
 }
 
 /*
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 7a20897d33db..7403f348ed14 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -133,7 +133,7 @@ static int snd_compr_open(struct inode *inode, struct file *f)
                 kfree(data);
         }
         snd_card_unref(compr->card);
-        return 0;
+        return ret;
 }
 
 static int snd_compr_free(struct inode *inode, struct file *f)
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index df3652ad15ef..8ed0bcc01386 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -1026,6 +1026,9 @@ static void ad1884_fixup_thinkpad(struct hda_codec *codec,
                 spec->gen.keep_eapd_on = 1;
                 spec->gen.vmaster_mute.hook = ad_vmaster_eapd_hook;
                 spec->eapd_nid = 0x12;
+                /* Analog PC Beeper - allow firmware/ACPI beeps */
+                spec->beep_amp = HDA_COMPOSE_AMP_VAL(0x20, 3, 3, HDA_INPUT);
+                spec->gen.beep_nid = 0; /* no digital beep */
         }
 }
 
@@ -1092,6 +1095,7 @@ static int patch_ad1884(struct hda_codec *codec)
         spec = codec->spec;
 
         spec->gen.mixer_nid = 0x20;
+        spec->gen.mixer_merge_nid = 0x21;
         spec->gen.beep_nid = 0x10;
         set_beep_amp(spec, 0x10, 0, HDA_OUTPUT);
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index ec304f3ae3b4..8d0a84436674 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3616,6 +3616,19 @@ static void alc_fixup_auto_mute_via_amp(struct hda_codec *codec,
         }
 }
 
+static void alc_no_shutup(struct hda_codec *codec)
+{
+}
+
+static void alc_fixup_no_shutup(struct hda_codec *codec,
+                                const struct hda_fixup *fix, int action)
+{
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                struct alc_spec *spec = codec->spec;
+                spec->shutup = alc_no_shutup;
+        }
+}
+
 static void alc_fixup_headset_mode_alc668(struct hda_codec *codec,
                                 const struct hda_fixup *fix, int action)
 {
@@ -3844,6 +3857,7 @@ enum {
         ALC269_FIXUP_HP_GPIO_LED,
         ALC269_FIXUP_INV_DMIC,
         ALC269_FIXUP_LENOVO_DOCK,
+        ALC269_FIXUP_NO_SHUTUP,
         ALC286_FIXUP_SONY_MIC_NO_PRESENCE,
         ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
         ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -4020,6 +4034,10 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_inv_dmic_0x12,
         },
+        [ALC269_FIXUP_NO_SHUTUP] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_no_shutup,
+        },
         [ALC269_FIXUP_LENOVO_DOCK] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
@@ -4253,6 +4271,7 @@ static const struct hda_fixup alc269_fixups[] = {
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+        SND_PCI_QUIRK(0x1025, 0x0283, "Acer TravelMate 8371", ALC269_FIXUP_INV_DMIC),
         SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC),
         SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
         SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700),
@@ -4404,6 +4423,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
         SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
         SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
@@ -5163,7 +5183,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0625, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0626, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0628, "Dell", ALC668_FIXUP_AUTO_MUTE),
-        SND_PCI_QUIRK(0x1028, 0x064e, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x064e, "Dell", ALC668_FIXUP_AUTO_MUTE),
         SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
         SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A_CHMAP),
         SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_CHMAP),
diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c
index ed6f199f8a38..4cf3200e988b 100644
--- a/sound/pci/oxygen/xonar_dg.c
+++ b/sound/pci/oxygen/xonar_dg.c
@@ -238,11 +238,21 @@ void set_cs4245_adc_params(struct oxygen *chip,
         cs4245_write_spi(chip, CS4245_MCLK_FREQ);
 }
 
+static inline unsigned int shift_bits(unsigned int value,
+                                      unsigned int shift_from,
+                                      unsigned int shift_to,
+                                      unsigned int mask)
+{
+        if (shift_from < shift_to)
+                return (value << (shift_to - shift_from)) & mask;
+        else
+                return (value >> (shift_from - shift_to)) & mask;
+}
+
 unsigned int adjust_dg_dac_routing(struct oxygen *chip,
                                           unsigned int play_routing)
 {
         struct dg *data = chip->model_data;
-        unsigned int routing = 0;
 
         switch (data->output_sel) {
         case PLAYBACK_DST_HP:
@@ -252,15 +262,23 @@ unsigned int adjust_dg_dac_routing(struct oxygen *chip,
                         OXYGEN_PLAY_MUTE67, OXYGEN_PLAY_MUTE_MASK);
                 break;
         case PLAYBACK_DST_MULTICH:
-                routing = (0 << OXYGEN_PLAY_DAC0_SOURCE_SHIFT) |
-                          (2 << OXYGEN_PLAY_DAC1_SOURCE_SHIFT) |
-                          (1 << OXYGEN_PLAY_DAC2_SOURCE_SHIFT) |
-                          (0 << OXYGEN_PLAY_DAC3_SOURCE_SHIFT);
                 oxygen_write8_masked(chip, OXYGEN_PLAY_ROUTING,
                         OXYGEN_PLAY_MUTE01, OXYGEN_PLAY_MUTE_MASK);
                 break;
         }
-        return routing;
+        return (play_routing & OXYGEN_PLAY_DAC0_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC2_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC1_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC1_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC1_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC2_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC2_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC0_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC3_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC3_SOURCE_MASK);
 }
 
 void dump_cs4245_registers(struct oxygen *chip,
diff --git a/sound/soc/codecs/88pm860x-codec.c b/sound/soc/codecs/88pm860x-codec.c
index 75d0ad5d2dcb..647a72cda005 100644
--- a/sound/soc/codecs/88pm860x-codec.c
+++ b/sound/soc/codecs/88pm860x-codec.c
@@ -1328,6 +1328,9 @@ static int pm860x_probe(struct snd_soc_codec *codec)
         pm860x->codec = codec;
 
         codec->control_data = pm860x->regmap;
+        ret = snd_soc_codec_set_cache_io(codec, 0, 0, SND_SOC_REGMAP);
+        if (ret)
+                return ret;
 
         for (i = 0; i < 4; i++) {
                 ret = request_threaded_irq(pm860x->irq[i], NULL,
diff --git a/sound/soc/codecs/si476x.c b/sound/soc/codecs/si476x.c
index 52e7cb08434b..fa2b8e07f420 100644
--- a/sound/soc/codecs/si476x.c
+++ b/sound/soc/codecs/si476x.c
@@ -210,7 +210,7 @@ out:
 static int si476x_codec_probe(struct snd_soc_codec *codec)
 {
         codec->control_data = dev_get_regmap(codec->dev->parent, NULL);
-        return 0;
+        return snd_soc_codec_set_cache_io(codec, 0, 0, SND_SOC_REGMAP);
 }
 
 static struct snd_soc_dai_ops si476x_dai_ops = {
diff --git a/sound/soc/omap/n810.c b/sound/soc/omap/n810.c
index 3fde9e402710..d163e18d85d4 100644
--- a/sound/soc/omap/n810.c
+++ b/sound/soc/omap/n810.c
@@ -305,7 +305,9 @@ static int __init n810_soc_init(void)
         int err;
         struct device *dev;
 
-        if (!(machine_is_nokia_n810() || machine_is_nokia_n810_wimax()))
+        if (!of_have_populated_dt() ||
+            (!of_machine_is_compatible("nokia,n810") &&
+             !of_machine_is_compatible("nokia,n810-wimax")))
                 return -ENODEV;
 
         n810_snd_device = platform_device_alloc("soc-audio", -1);
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 47e1ce771e65..28522bd03b8e 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1989,6 +1989,7 @@ int soc_dpcm_runtime_update(struct snd_soc_card *card)
 
                 paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_PLAYBACK, &list);
                 if (paths < 0) {
+                        dpcm_path_put(&list);
                         dev_warn(fe->dev, "ASoC: %s no valid %s path\n",
                                         fe->dai_link->name,  "playback");
                         mutex_unlock(&card->mutex);
@@ -2018,6 +2019,7 @@ capture:
 
                 paths = dpcm_path_get(fe, SNDRV_PCM_STREAM_CAPTURE, &list);
                 if (paths < 0) {
+                        dpcm_path_put(&list);
                         dev_warn(fe->dev, "ASoC: %s no valid %s path\n",
                                         fe->dai_link->name,  "capture");
                         mutex_unlock(&card->mutex);
@@ -2082,6 +2084,7 @@ static int dpcm_fe_dai_open(struct snd_pcm_substream *fe_substream)
         fe->dpcm[stream].runtime = fe_substream->runtime;
 
         if (dpcm_path_get(fe, stream, &list) <= 0) {
+                dpcm_path_put(&list);
                 dev_dbg(fe->dev, "ASoC: %s no valid %s route\n",
                         fe->dai_link->name, stream ? "capture" : "playback");
         }
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 44b0ba4feab3..1bed780e21d9 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -883,6 +883,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
                 }
                 break;
 
+        case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */
         case USB_ID(0x046d, 0x0808):
         case USB_ID(0x046d, 0x0809):
         case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
diff --git a/tools/lib/lockdep/Makefile b/tools/lib/lockdep/Makefile
index da8b7aa3d351..07b0b7542511 100644
--- a/tools/lib/lockdep/Makefile
+++ b/tools/lib/lockdep/Makefile
@@ -87,8 +87,8 @@ endif # BUILD_SRC
 # We process the rest of the Makefile if this is the final invocation of make
 ifeq ($(skip-makefile),)
 
-srctree         := $(if $(BUILD_SRC),$(BUILD_SRC),$(CURDIR))
-objtree         := $(CURDIR)
+srctree         := $(realpath $(if $(BUILD_SRC),$(BUILD_SRC),$(CURDIR)))
+objtree         := $(realpath $(CURDIR))
 src             := $(srctree)
 obj             := $(objtree)
 
@@ -112,7 +112,7 @@ export Q VERBOSE
 
 LIBLOCKDEP_VERSION = $(LL_VERSION).$(LL_PATCHLEVEL).$(LL_EXTRAVERSION)
 
-INCLUDES = -I. -I/usr/local/include -I./uinclude $(CONFIG_INCLUDES)
+INCLUDES = -I. -I/usr/local/include -I./uinclude -I./include $(CONFIG_INCLUDES)
 
 # Set compile option CFLAGS if not set elsewhere
 CFLAGS ?= -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"$(LIBLOCKDEP_VERSION)"' -rdynamic -O0 -g
diff --git a/tools/lib/lockdep/preload.c b/tools/lib/lockdep/preload.c
index f8465a811aa5..23bd69cb5ade 100644
--- a/tools/lib/lockdep/preload.c
+++ b/tools/lib/lockdep/preload.c
@@ -418,7 +418,7 @@ int pthread_rwlock_unlock(pthread_rwlock_t *rwlock)
 
 __attribute__((constructor)) static void init_preload(void)
 {
-        if (__init_state != done)
+        if (__init_state == done)
                 return;
 
 #ifndef __GLIBC__
diff --git a/tools/lib/lockdep/run_tests.sh b/tools/lib/lockdep/run_tests.sh
index 5334ad9d39b7..5334ad9d39b7 100644..100755
--- a/tools/lib/lockdep/run_tests.sh
+++ b/tools/lib/lockdep/run_tests.sh
diff --git a/tools/lib/lockdep/uinclude/asm/hash.h b/tools/lib/lockdep/uinclude/asm/hash.h
new file mode 100644
index 000000000000..d82b170bb216
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/asm/hash.h
@@ -0,0 +1,6 @@
+#ifndef __ASM_GENERIC_HASH_H
+#define __ASM_GENERIC_HASH_H
+
+/* Stub */
+
+#endif /* __ASM_GENERIC_HASH_H */
diff --git a/tools/lib/lockdep/uinclude/linux/rcu.h b/tools/lib/lockdep/uinclude/linux/rcu.h
index 4c99fcb5da27..042ee8e463c9 100644
--- a/tools/lib/lockdep/uinclude/linux/rcu.h
+++ b/tools/lib/lockdep/uinclude/linux/rcu.h
@@ -13,4 +13,9 @@ static inline int rcu_is_cpu_idle(void)
         return 1;
 }
 
+static inline bool rcu_is_watching(void)
+{
+        return false;
+}
+
 #endif
diff --git a/tools/net/Makefile b/tools/net/Makefile
index 004cd74734b6..ee577ea03ba5 100644
--- a/tools/net/Makefile
+++ b/tools/net/Makefile
@@ -12,7 +12,7 @@ YACC = bison
 
 all : bpf_jit_disasm bpf_dbg bpf_asm
 
-bpf_jit_disasm : CFLAGS = -Wall -O2
+bpf_jit_disasm : CFLAGS = -Wall -O2 -DPACKAGE='bpf_jit_disasm'
 bpf_jit_disasm : LDLIBS = -lopcodes -lbfd -ldl
 bpf_jit_disasm : bpf_jit_disasm.o
 
diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
index d4c83c60b9b2..97d86d828190 100644
--- a/tools/perf/bench/numa.c
+++ b/tools/perf/bench/numa.c
@@ -1593,6 +1593,7 @@ static void init_params(struct params *p, const char *name, int argc, const char
         p->data_rand_walk               = true;
         p->nr_loops                     = -1;
         p->init_random                  = true;
+        p->run_all                      = argc == 1;
 }
 
 static int run_bench_numa(const char *name, const char **argv)
diff --git a/tools/perf/builtin-bench.c b/tools/perf/builtin-bench.c
index e47f90cc7b98..8a987d252780 100644
--- a/tools/perf/builtin-bench.c
+++ b/tools/perf/builtin-bench.c
@@ -76,7 +76,7 @@ static struct collection collections[] = {
 
 /* Iterate over all benchmarks within a collection: */
 #define for_each_bench(coll, bench) \
-        for (bench = coll->benchmarks; bench->name; bench++)
+        for (bench = coll->benchmarks; bench && bench->name; bench++)
 
 static void dump_benchmarks(struct collection *coll)
 {
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 6aa6fb6f7bd9..f954c26de231 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -825,7 +825,6 @@ static size_t syscall_arg__scnprintf_signum(char *bf, size_t size, struct syscal
         P_SIGNUM(PIPE);
         P_SIGNUM(ALRM);
         P_SIGNUM(TERM);
-        P_SIGNUM(STKFLT);
         P_SIGNUM(CHLD);
         P_SIGNUM(CONT);
         P_SIGNUM(STOP);
@@ -841,6 +840,15 @@ static size_t syscall_arg__scnprintf_signum(char *bf, size_t size, struct syscal
         P_SIGNUM(IO);
         P_SIGNUM(PWR);
         P_SIGNUM(SYS);
+#ifdef SIGEMT
+        P_SIGNUM(EMT);
+#endif
+#ifdef SIGSTKFLT
+        P_SIGNUM(STKFLT);
+#endif
+#ifdef SIGSWI
+        P_SIGNUM(SWI);
+#endif
         default: break;
         }
 
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index c872991e0f65..620a1983b76b 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1213,7 +1213,7 @@ static void ip__resolve_ams(struct machine *machine, struct thread *thread,
                  */
                 thread__find_addr_location(thread, machine, m, MAP__FUNCTION,
                                 ip, &al);
-                if (al.sym)
+                if (al.map)
                         goto found;
         }
 found:
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 3e9f336740fa..516d19fb999b 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -151,15 +151,15 @@ Elf_Scn *elf_section_by_name(Elf *elf, GElf_Ehdr *ep,
 
                 gelf_getshdr(sec, shp);
                 str = elf_strptr(elf, ep->e_shstrndx, shp->sh_name);
-                if (!strcmp(name, str)) {
+                if (str && !strcmp(name, str)) {
                         if (idx)
                                 *idx = cnt;
-                        break;
+                        return sec;
                 }
                 ++cnt;
         }
 
-        return sec;
+        return NULL;
 }
 
 #define elf_section__for_each_rel(reldata, pos, pos_mem, idx, nr_entries) \
diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
index d66418237d21..aa290c0de6f5 100644
--- a/tools/testing/selftests/ipc/msgque.c
+++ b/tools/testing/selftests/ipc/msgque.c
@@ -201,6 +201,7 @@ int main(int argc, char **argv)
 
         msgque.msq_id = msgget(msgque.key, IPC_CREAT | IPC_EXCL | 0666);
         if (msgque.msq_id == -1) {
+                err = -errno;
                 printf("Can't create queue\n");
                 goto err_out;
         }