217 files changed, 1800 insertions, 807 deletions
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 15356aca938c..7f9d4f53882c 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2953,7 +2953,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        improve throughput, but will also increase the
                        amount of memory reserved for use by the client.
-        swapaccount[=0|1]
+        swapaccount=[0|1]
                        [KNL] Enable accounting of swap in memory resource
                        controller if no parameter or 1 is given or disable
                        it if 0 is given (See Documentation/cgroups/memory.txt)
diff --git a/MAINTAINERS b/MAINTAINERS
index 229c66b12cc2..b140c8123098 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5884,7 +5884,7 @@ F:	drivers/i2c/busses/i2c-omap.c
 F:      include/linux/i2c-omap.h
 OMAP DEVICE TREE SUPPORT
-M:      Benoît Cousson <b-cousson@ti.com>
+M:      Benoît Cousson <bcousson@baylibre.com>
 M:      Tony Lindgren <tony@atomide.com>
 L:      linux-omap@vger.kernel.org
 L:      devicetree@vger.kernel.org
@@ -5964,14 +5964,14 @@ S:	Maintained
 F:      drivers/char/hw_random/omap-rng.c
 OMAP HWMOD SUPPORT
-M:      Benoît Cousson <b-cousson@ti.com>
+M:      Benoît Cousson <bcousson@baylibre.com>
 M:      Paul Walmsley <paul@pwsan.com>
 L:      linux-omap@vger.kernel.org
 S:      Maintained
 F:      arch/arm/mach-omap2/omap_hwmod.*
 OMAP HWMOD DATA FOR OMAP4-BASED DEVICES
-M:      Benoît Cousson <b-cousson@ti.com>
+M:      Benoît Cousson <bcousson@baylibre.com>
 L:      linux-omap@vger.kernel.org
 S:      Maintained
 F:      arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -6066,7 +6066,7 @@ M:	Rob Herring <rob.herring@calxeda.com>
 M:      Pawel Moll <pawel.moll@arm.com>
 M:      Mark Rutland <mark.rutland@arm.com>
 M:      Stephen Warren <swarren@wwwdotorg.org>
-M:      Ian Campbell <ian.campbell@citrix.com>
+M:      Ian Campbell <ijc+devicetree@hellion.org.uk>
 L:      devicetree@vger.kernel.org
 S:      Maintained
 F:      Documentation/devicetree/
diff --git a/Makefile b/Makefile
index a5a55f4547c6..369882e4fc77 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 11
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Linux for Workgroups
 # *DOCUMENTATION*
diff --git a/arch/arc/lib/strchr-700.S b/arch/arc/lib/strchr-700.S
index 99c10475d477..9c548c7cf001 100644
--- a/arch/arc/lib/strchr-700.S
+++ b/arch/arc/lib/strchr-700.S
@@ -39,9 +39,18 @@ ARC_ENTRY strchr
        ld.a    r2,[r0,4]
        sub     r12,r6,r7
        bic     r12,r12,r6
+#ifdef __LITTLE_ENDIAN__
        and     r7,r12,r4
        breq    r7,0,.Loop ; For speed, we want this branch to be unaligned.
        b       .Lfound_char ; Likewise this one.
+#else
+        and     r12,r12,r4
+        breq    r12,0,.Loop ; For speed, we want this branch to be unaligned.
+        lsr_s   r12,r12,7
+        bic     r2,r7,r6
+        b.d     .Lfound_char_b
+        and_s   r2,r2,r12
+#endif
 ; /* We require this code address to be unaligned for speed...  */
 .Laligned:
        ld_s    r2,[r0]
@@ -95,6 +104,7 @@ ARC_ENTRY strchr
        lsr     r7,r7,7
        bic     r2,r7,r6
+.Lfound_char_b:
        norm    r2,r2
        sub_s   r0,r0,4
        asr_s   r2,r2,3
diff --git a/arch/arm/boot/dts/at91sam9n12ek.dts b/arch/arm/boot/dts/at91sam9n12ek.dts
index d59b70c6a6a0..3d77dbe406f4 100644
--- a/arch/arm/boot/dts/at91sam9n12ek.dts
+++ b/arch/arm/boot/dts/at91sam9n12ek.dts
@@ -14,11 +14,11 @@
        compatible = "atmel,at91sam9n12ek", "atmel,at91sam9n12", "atmel,at91sam9";
        chosen {
-                bootargs = "mem=128M console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=jffs2";
+                bootargs = "console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=jffs2";
        };
        memory {
-                reg = <0x20000000 0x10000000>;
+                reg = <0x20000000 0x8000000>;
        };
        clocks {
diff --git a/arch/arm/boot/dts/at91sam9x5ek.dtsi b/arch/arm/boot/dts/at91sam9x5ek.dtsi
index b753855b2058..49e3c45818c2 100644
--- a/arch/arm/boot/dts/at91sam9x5ek.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5ek.dtsi
@@ -94,8 +94,9 @@
                usb0: ohci@00600000 {
                        status = "okay";
-                        num-ports = <2>;
+                        num-ports = <3>;
-                        atmel,vbus-gpio = <&pioD 19 GPIO_ACTIVE_LOW
+                        atmel,vbus-gpio = <0 /* &pioD 18 GPIO_ACTIVE_LOW *//* Activate to have access to port A */
+                                           &pioD 19 GPIO_ACTIVE_LOW
                                           &pioD 20 GPIO_ACTIVE_LOW
                                          >;
                };
diff --git a/arch/arm/boot/dts/tegra20-seaboard.dts b/arch/arm/boot/dts/tegra20-seaboard.dts
index 365760b33a26..40e6fb280333 100644
--- a/arch/arm/boot/dts/tegra20-seaboard.dts
+++ b/arch/arm/boot/dts/tegra20-seaboard.dts
@@ -830,6 +830,8 @@
                        regulator-max-microvolt = <5000000>;
                        enable-active-high;
                        gpio = <&gpio 24 0>; /* PD0 */
+                        regulator-always-on;
+                        regulator-boot-on;
                };
        };
diff --git a/arch/arm/boot/dts/tegra20-trimslice.dts b/arch/arm/boot/dts/tegra20-trimslice.dts
index ed4b901b0227..37c93d3c4812 100644
--- a/arch/arm/boot/dts/tegra20-trimslice.dts
+++ b/arch/arm/boot/dts/tegra20-trimslice.dts
@@ -412,6 +412,8 @@
                        regulator-max-microvolt = <5000000>;
                        enable-active-high;
                        gpio = <&gpio 170 0>; /* PV2 */
+                        regulator-always-on;
+                        regulator-boot-on;
                };
        };
diff --git a/arch/arm/boot/dts/tegra20-whistler.dts b/arch/arm/boot/dts/tegra20-whistler.dts
index ab67c94db280..a3d0ebad78a1 100644
--- a/arch/arm/boot/dts/tegra20-whistler.dts
+++ b/arch/arm/boot/dts/tegra20-whistler.dts
@@ -588,6 +588,8 @@
                        regulator-max-microvolt = <5000000>;
                        enable-active-high;
                        gpio = <&tca6416 0 0>; /* GPIO_PMU0 */
+                        regulator-always-on;
+                        regulator-boot-on;
                };
                vbus3_reg: regulator@3 {
@@ -598,6 +600,8 @@
                        regulator-max-microvolt = <5000000>;
                        enable-active-high;
                        gpio = <&tca6416 1 0>; /* GPIO_PMU1 */
+                        regulator-always-on;
+                        regulator-boot-on;
                };
        };
diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
index fc7920288a3d..918875d96d5d 100644
--- a/arch/arm/kernel/fiq.c
+++ b/arch/arm/kernel/fiq.c
@@ -89,7 +89,8 @@ void set_fiq_handler(void *start, unsigned int length)
        memcpy(base + offset, start, length);
        if (!cache_is_vipt_nonaliasing())
-                flush_icache_range(base + offset, offset + length);
+                flush_icache_range((unsigned long)base + offset, offset +
+                                   length);
        flush_icache_range(0xffff0000 + offset, 0xffff0000 + offset + length);
 }
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index d7c82df69243..57221e349a7c 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -82,6 +82,7 @@ void machine_crash_nonpanic_core(void *unused)
        crash_save_cpu(&regs, smp_processor_id());
        flush_cache_all();
+        set_cpu_online(smp_processor_id(), false);
        atomic_dec(&waiting_for_crash_ipi);
        while (1)
                cpu_relax();
diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
index 4a5199070430..db9cf692d4dd 100644
--- a/arch/arm/kvm/coproc.c
+++ b/arch/arm/kvm/coproc.c
@@ -146,7 +146,11 @@ static bool pm_fake(struct kvm_vcpu *vcpu,
 #define access_pmintenclr pm_fake
 /* Architected CP15 registers.
- * Important: Must be sorted ascending by CRn, CRM, Op1, Op2
+ * CRn denotes the primary register number, but is copied to the CRm in the
+ * user space API for 64-bit register access in line with the terminology used
+ * in the ARM ARM.
+ * Important: Must be sorted ascending by CRn, CRM, Op1, Op2 and with 64-bit
+ *            registers preceding 32-bit ones.
 */
 static const struct coproc_reg cp15_regs[] = {
        /* CSSELR: swapped by interrupt.S. */
@@ -154,8 +158,8 @@ static const struct coproc_reg cp15_regs[] = {
                        NULL, reset_unknown, c0_CSSELR },
        /* TTBR0/TTBR1: swapped by interrupt.S. */
-        { CRm( 2), Op1( 0), is64, NULL, reset_unknown64, c2_TTBR0 },
+        { CRm64( 2), Op1( 0), is64, NULL, reset_unknown64, c2_TTBR0 },
-        { CRm( 2), Op1( 1), is64, NULL, reset_unknown64, c2_TTBR1 },
+        { CRm64( 2), Op1( 1), is64, NULL, reset_unknown64, c2_TTBR1 },
        /* TTBCR: swapped by interrupt.S. */
        { CRn( 2), CRm( 0), Op1( 0), Op2( 2), is32,
@@ -182,7 +186,7 @@ static const struct coproc_reg cp15_regs[] = {
                        NULL, reset_unknown, c6_IFAR },
        /* PAR swapped by interrupt.S */
-        { CRn( 7), Op1( 0), is64, NULL, reset_unknown64, c7_PAR },
+        { CRm64( 7), Op1( 0), is64, NULL, reset_unknown64, c7_PAR },
        /*
         * DC{C,I,CI}SW operations:
@@ -399,12 +403,13 @@ static bool index_to_params(u64 id, struct coproc_params *params)
                              | KVM_REG_ARM_OPC1_MASK))
                        return false;
                params->is_64bit = true;
-                params->CRm = ((id & KVM_REG_ARM_CRM_MASK)
+                /* CRm to CRn: see cp15_to_index for details */
+                params->CRn = ((id & KVM_REG_ARM_CRM_MASK)
                               >> KVM_REG_ARM_CRM_SHIFT);
                params->Op1 = ((id & KVM_REG_ARM_OPC1_MASK)
                               >> KVM_REG_ARM_OPC1_SHIFT);
                params->Op2 = 0;
-                params->CRn = 0;
+                params->CRm = 0;
                return true;
        default:
                return false;
@@ -898,7 +903,14 @@ static u64 cp15_to_index(const struct coproc_reg *reg)
        if (reg->is_64) {
                val |= KVM_REG_SIZE_U64;
                val |= (reg->Op1 << KVM_REG_ARM_OPC1_SHIFT);
-                val |= (reg->CRm << KVM_REG_ARM_CRM_SHIFT);
+                /*
+                 * CRn always denotes the primary coproc. reg. nr. for the
+                 * in-kernel representation, but the user space API uses the
+                 * CRm for the encoding, because it is modelled after the
+                 * MRRC/MCRR instructions: see the ARM ARM rev. c page
+                 * B3-1445
+                 */
+                val |= (reg->CRn << KVM_REG_ARM_CRM_SHIFT);
        } else {
                val |= KVM_REG_SIZE_U32;
                val |= (reg->Op1 << KVM_REG_ARM_OPC1_SHIFT);
diff --git a/arch/arm/kvm/coproc.h b/arch/arm/kvm/coproc.h
index b7301d3e4799..0461d5c8d3de 100644
--- a/arch/arm/kvm/coproc.h
+++ b/arch/arm/kvm/coproc.h
@@ -135,6 +135,8 @@ static inline int cmp_reg(const struct coproc_reg *i1,
                return -1;
        if (i1->CRn != i2->CRn)
                return i1->CRn - i2->CRn;
+        if (i1->is_64 != i2->is_64)
+                return i2->is_64 - i1->is_64;
        if (i1->CRm != i2->CRm)
                return i1->CRm - i2->CRm;
        if (i1->Op1 != i2->Op1)
@@ -145,6 +147,7 @@ static inline int cmp_reg(const struct coproc_reg *i1,
 #define CRn(_x)         .CRn = _x
 #define CRm(_x)         .CRm = _x
+#define CRm64(_x)       .CRn = _x, .CRm = 0
 #define Op1(_x)         .Op1 = _x
 #define Op2(_x)         .Op2 = _x
 #define is64            .is_64 = true
diff --git a/arch/arm/kvm/coproc_a15.c b/arch/arm/kvm/coproc_a15.c
index 685063a6d0cf..cf93472b9dd6 100644
--- a/arch/arm/kvm/coproc_a15.c
+++ b/arch/arm/kvm/coproc_a15.c
@@ -114,7 +114,11 @@ static bool access_l2ectlr(struct kvm_vcpu *vcpu,
 /*
 * A15-specific CP15 registers.
- * Important: Must be sorted ascending by CRn, CRM, Op1, Op2
+ * CRn denotes the primary register number, but is copied to the CRm in the
+ * user space API for 64-bit register access in line with the terminology used
+ * in the ARM ARM.
+ * Important: Must be sorted ascending by CRn, CRM, Op1, Op2 and with 64-bit
+ *            registers preceding 32-bit ones.
 */
 static const struct coproc_reg a15_regs[] = {
        /* MPIDR: we use VMPIDR for guest access. */
diff --git a/arch/arm/kvm/mmio.c b/arch/arm/kvm/mmio.c
index b8e06b7a2833..0c25d9487d53 100644
--- a/arch/arm/kvm/mmio.c
+++ b/arch/arm/kvm/mmio.c
@@ -63,7 +63,8 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run)
 static int decode_hsr(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
                      struct kvm_exit_mmio *mmio)
 {
-        unsigned long rt, len;
+        unsigned long rt;
+        int len;
        bool is_write, sign_extend;
        if (kvm_vcpu_dabt_isextabt(vcpu)) {
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index ca6bea4859b4..0988d9e04dd4 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -85,6 +85,12 @@ static void *mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc)
        return p;
 }
+static bool page_empty(void *ptr)
+{
+        struct page *ptr_page = virt_to_page(ptr);
+        return page_count(ptr_page) == 1;
+}
 static void clear_pud_entry(struct kvm *kvm, pud_t *pud, phys_addr_t addr)
 {
        pmd_t *pmd_table = pmd_offset(pud, 0);
@@ -103,12 +109,6 @@ static void clear_pmd_entry(struct kvm *kvm, pmd_t *pmd, phys_addr_t addr)
        put_page(virt_to_page(pmd));
 }
-static bool pmd_empty(pmd_t *pmd)
-{
-        struct page *pmd_page = virt_to_page(pmd);
-        return page_count(pmd_page) == 1;
-}
 static void clear_pte_entry(struct kvm *kvm, pte_t *pte, phys_addr_t addr)
 {
        if (pte_present(*pte)) {
@@ -118,12 +118,6 @@ static void clear_pte_entry(struct kvm *kvm, pte_t *pte, phys_addr_t addr)
        }
 }
-static bool pte_empty(pte_t *pte)
-{
-        struct page *pte_page = virt_to_page(pte);
-        return page_count(pte_page) == 1;
-}
 static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
                        unsigned long long start, u64 size)
 {
@@ -132,37 +126,37 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
        pmd_t *pmd;
        pte_t *pte;
        unsigned long long addr = start, end = start + size;
-        u64 range;
+        u64 next;
        while (addr < end) {
                pgd = pgdp + pgd_index(addr);
                pud = pud_offset(pgd, addr);
                if (pud_none(*pud)) {
-                        addr += PUD_SIZE;
+                        addr = pud_addr_end(addr, end);
                        continue;
                }
                pmd = pmd_offset(pud, addr);
                if (pmd_none(*pmd)) {
-                        addr += PMD_SIZE;
+                        addr = pmd_addr_end(addr, end);
                        continue;
                }
                pte = pte_offset_kernel(pmd, addr);
                clear_pte_entry(kvm, pte, addr);
-                range = PAGE_SIZE;
+                next = addr + PAGE_SIZE;
                /* If we emptied the pte, walk back up the ladder */
-                if (pte_empty(pte)) {
+                if (page_empty(pte)) {
                        clear_pmd_entry(kvm, pmd, addr);
-                        range = PMD_SIZE;
+                        next = pmd_addr_end(addr, end);
-                        if (pmd_empty(pmd)) {
+                        if (page_empty(pmd) && !page_empty(pud)) {
                                clear_pud_entry(kvm, pud, addr);
-                                range = PUD_SIZE;
+                                next = pud_addr_end(addr, end);
                        }
                }
-                addr += range;
+                addr = next;
        }
 }
diff --git a/arch/arm/mach-at91/at91sam9x5.c b/arch/arm/mach-at91/at91sam9x5.c
index 2abee6626aac..916e5a142917 100644
--- a/arch/arm/mach-at91/at91sam9x5.c
+++ b/arch/arm/mach-at91/at91sam9x5.c
@@ -227,6 +227,8 @@ static struct clk_lookup periph_clocks_lookups[] = {
        CLKDEV_CON_DEV_ID("usart", "f8020000.serial", &usart1_clk),
        CLKDEV_CON_DEV_ID("usart", "f8024000.serial", &usart2_clk),
        CLKDEV_CON_DEV_ID("usart", "f8028000.serial", &usart3_clk),
+        CLKDEV_CON_DEV_ID("usart", "f8040000.serial", &uart0_clk),
+        CLKDEV_CON_DEV_ID("usart", "f8044000.serial", &uart1_clk),
        CLKDEV_CON_DEV_ID("t0_clk", "f8008000.timer", &tcb0_clk),
        CLKDEV_CON_DEV_ID("t0_clk", "f800c000.timer", &tcb0_clk),
        CLKDEV_CON_DEV_ID("mci_clk", "f0008000.mmc", &mmc0_clk),
diff --git a/arch/arm/mach-davinci/board-dm355-leopard.c b/arch/arm/mach-davinci/board-dm355-leopard.c
index dff4ddc5ef81..139e42da25f0 100644
--- a/arch/arm/mach-davinci/board-dm355-leopard.c
+++ b/arch/arm/mach-davinci/board-dm355-leopard.c
@@ -75,6 +75,7 @@ static struct davinci_nand_pdata davinci_nand_data = {
        .parts                  = davinci_nand_partitions,
        .nr_parts               = ARRAY_SIZE(davinci_nand_partitions),
        .ecc_mode               = NAND_ECC_HW_SYNDROME,
+        .ecc_bits               = 4,
        .bbt_options            = NAND_BBT_USE_FLASH,
 };
diff --git a/arch/arm/mach-davinci/board-dm644x-evm.c b/arch/arm/mach-davinci/board-dm644x-evm.c
index a33686a6fbb2..fa4bfaf952d8 100644
--- a/arch/arm/mach-davinci/board-dm644x-evm.c
+++ b/arch/arm/mach-davinci/board-dm644x-evm.c
@@ -153,6 +153,7 @@ static struct davinci_nand_pdata davinci_evm_nandflash_data = {
        .parts          = davinci_evm_nandflash_partition,
        .nr_parts       = ARRAY_SIZE(davinci_evm_nandflash_partition),
        .ecc_mode       = NAND_ECC_HW,
+        .ecc_bits       = 1,
        .bbt_options    = NAND_BBT_USE_FLASH,
        .timing         = &davinci_evm_nandflash_timing,
 };
diff --git a/arch/arm/mach-davinci/board-dm646x-evm.c b/arch/arm/mach-davinci/board-dm646x-evm.c
index fbb8e5ab1dc1..0c005e876cac 100644
--- a/arch/arm/mach-davinci/board-dm646x-evm.c
+++ b/arch/arm/mach-davinci/board-dm646x-evm.c
@@ -90,6 +90,7 @@ static struct davinci_nand_pdata davinci_nand_data = {
        .parts                  = davinci_nand_partitions,
        .nr_parts               = ARRAY_SIZE(davinci_nand_partitions),
        .ecc_mode               = NAND_ECC_HW,
+        .ecc_bits               = 1,
        .options                = 0,
 };
diff --git a/arch/arm/mach-davinci/board-neuros-osd2.c b/arch/arm/mach-davinci/board-neuros-osd2.c
index 2bc112adf565..808233b60e3d 100644
--- a/arch/arm/mach-davinci/board-neuros-osd2.c
+++ b/arch/arm/mach-davinci/board-neuros-osd2.c
@@ -88,6 +88,7 @@ static struct davinci_nand_pdata davinci_ntosd2_nandflash_data = {
        .parts          = davinci_ntosd2_nandflash_partition,
        .nr_parts       = ARRAY_SIZE(davinci_ntosd2_nandflash_partition),
        .ecc_mode       = NAND_ECC_HW,
+        .ecc_bits       = 1,
        .bbt_options    = NAND_BBT_USE_FLASH,
 };
diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
index f6eeb87e4e95..827d15009a86 100644
--- a/arch/arm/mach-omap2/board-n8x0.c
+++ b/arch/arm/mach-omap2/board-n8x0.c
@@ -122,11 +122,7 @@ static struct musb_hdrc_config musb_config = {
 };
 static struct musb_hdrc_platform_data tusb_data = {
-#ifdef CONFIG_USB_GADGET_MUSB_HDRC
        .mode           = MUSB_OTG,
-#else
-        .mode           = MUSB_HOST,
-#endif
        .set_power      = tusb_set_power,
        .min_power      = 25,   /* x2 = 50 mA drawn from VBUS as peripheral */
        .power          = 100,  /* Max 100 mA VBUS for host mode */
diff --git a/arch/arm/mach-omap2/board-rx51.c b/arch/arm/mach-omap2/board-rx51.c
index d2ea68ea678a..7735105561d8 100644
--- a/arch/arm/mach-omap2/board-rx51.c
+++ b/arch/arm/mach-omap2/board-rx51.c
@@ -85,7 +85,7 @@ static struct omap_board_mux board_mux[] __initdata = {
 static struct omap_musb_board_data musb_board_data = {
        .interface_type         = MUSB_INTERFACE_ULPI,
-        .mode                   = MUSB_PERIPHERAL,
+        .mode                   = MUSB_OTG,
        .power                  = 0,
 };
diff --git a/arch/arm/mach-omap2/usb-musb.c b/arch/arm/mach-omap2/usb-musb.c
index 8c4de2708cf2..bc897231bd10 100644
--- a/arch/arm/mach-omap2/usb-musb.c
+++ b/arch/arm/mach-omap2/usb-musb.c
@@ -38,11 +38,8 @@ static struct musb_hdrc_config musb_config = {
 };
 static struct musb_hdrc_platform_data musb_plat = {
-#ifdef CONFIG_USB_GADGET_MUSB_HDRC
        .mode           = MUSB_OTG,
-#else
-        .mode           = MUSB_HOST,
-#endif
        /* .clock is set dynamically */
        .config         = &musb_config,
diff --git a/arch/arm/mach-prima2/common.c b/arch/arm/mach-prima2/common.c
index 2c70f74fed5d..e110b6d4ae8c 100644
--- a/arch/arm/mach-prima2/common.c
+++ b/arch/arm/mach-prima2/common.c
@@ -42,7 +42,6 @@ static const char *atlas6_dt_match[] __initdata = {
 DT_MACHINE_START(ATLAS6_DT, "Generic ATLAS6 (Flattened Device Tree)")
        /* Maintainer: Barry Song <baohua.song@csr.com> */
-        .nr_irqs        = 128,
        .map_io         = sirfsoc_map_io,
        .init_time      = sirfsoc_init_time,
        .init_late      = sirfsoc_init_late,
@@ -59,7 +58,6 @@ static const char *prima2_dt_match[] __initdata = {
 DT_MACHINE_START(PRIMA2_DT, "Generic PRIMA2 (Flattened Device Tree)")
        /* Maintainer: Barry Song <baohua.song@csr.com> */
-        .nr_irqs        = 128,
        .map_io         = sirfsoc_map_io,
        .init_time      = sirfsoc_init_time,
        .dma_zone_size  = SZ_256M,
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index db5c2cab8fda..cd2c88e7a8f7 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -809,15 +809,18 @@ config KUSER_HELPERS
          the CPU type fitted to the system.  This permits binaries to be
          run on ARMv4 through to ARMv7 without modification.
+          See Documentation/arm/kernel_user_helpers.txt for details.
          However, the fixed address nature of these helpers can be used
          by ROP (return orientated programming) authors when creating
          exploits.
          If all of the binaries and libraries which run on your platform
          are built specifically for your platform, and make no use of
-          these helpers, then you can turn this option off.  However,
+          these helpers, then you can turn this option off to hinder
-          when such an binary or library is run, it will receive a SIGILL
+          such exploits. However, in that case, if a binary or library
-          signal, which will terminate the program.
+          relying on those helpers is run, it will receive a SIGILL signal,
+          which will terminate the program.
          Say N here only if you are absolutely certain that you do not
          need these helpers; otherwise, the safe option is to say Y.
diff --git a/arch/arm/plat-samsung/init.c b/arch/arm/plat-samsung/init.c
index 3e5c4619caa5..50a3ea0037db 100644
--- a/arch/arm/plat-samsung/init.c
+++ b/arch/arm/plat-samsung/init.c
@@ -55,12 +55,13 @@ void __init s3c_init_cpu(unsigned long idcode,
        printk("CPU %s (id 0x%08lx)\n", cpu->name, idcode);
-        if (cpu->map_io == NULL || cpu->init == NULL) {
+        if (cpu->init == NULL) {
                printk(KERN_ERR "CPU %s support not enabled\n", cpu->name);
                panic("Unsupported Samsung CPU");
        }
-        cpu->map_io();
+        if (cpu->map_io)
+                cpu->map_io();
 }
 /* s3c24xx_init_clocks
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index c9770ba5c7df..8a6295c86209 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -170,6 +170,7 @@ static void __init xen_percpu_init(void *unused)
        per_cpu(xen_vcpu, cpu) = vcpup;
        enable_percpu_irq(xen_events_irq, 0);
+        put_cpu();
 }
 static void xen_restart(enum reboot_mode reboot_mode, const char *cmd)
diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h
index c92de4163eba..b25763bc0ec4 100644
--- a/arch/arm64/include/asm/kvm_asm.h
+++ b/arch/arm64/include/asm/kvm_asm.h
@@ -42,14 +42,15 @@
 #define TPIDR_EL1       18      /* Thread ID, Privileged */
 #define AMAIR_EL1       19      /* Aux Memory Attribute Indirection Register */
 #define CNTKCTL_EL1     20      /* Timer Control Register (EL1) */
+#define PAR_EL1         21      /* Physical Address Register */
 /* 32bit specific registers. Keep them at the end of the range */
-#define DACR32_EL2      21      /* Domain Access Control Register */
+#define DACR32_EL2      22      /* Domain Access Control Register */
-#define IFSR32_EL2      22      /* Instruction Fault Status Register */
+#define IFSR32_EL2      23      /* Instruction Fault Status Register */
-#define FPEXC32_EL2     23      /* Floating-Point Exception Control Register */
+#define FPEXC32_EL2     24      /* Floating-Point Exception Control Register */
-#define DBGVCR32_EL2    24      /* Debug Vector Catch Register */
+#define DBGVCR32_EL2    25      /* Debug Vector Catch Register */
-#define TEECR32_EL1     25      /* ThumbEE Configuration Register */
+#define TEECR32_EL1     26      /* ThumbEE Configuration Register */
-#define TEEHBR32_EL1    26      /* ThumbEE Handler Base Register */
+#define TEEHBR32_EL1    27      /* ThumbEE Handler Base Register */
-#define NR_SYS_REGS     27
+#define NR_SYS_REGS     28
 /* 32bit mapping */
 #define c0_MPIDR        (MPIDR_EL1 * 2) /* MultiProcessor ID Register */
@@ -69,6 +70,8 @@
 #define c5_AIFSR        (AFSR1_EL1 * 2) /* Auxiliary Instr Fault Status R */
 #define c6_DFAR         (FAR_EL1 * 2)   /* Data Fault Address Register */
 #define c6_IFAR         (c6_DFAR + 1)   /* Instruction Fault Address Register */
+#define c7_PAR          (PAR_EL1 * 2)   /* Physical Address Register */
+#define c7_PAR_high     (c7_PAR + 1)    /* PAR top 32 bits */
 #define c10_PRRR        (MAIR_EL1 * 2)  /* Primary Region Remap Register */
 #define c10_NMRR        (c10_PRRR + 1)  /* Normal Memory Remap Register */
 #define c12_VBAR        (VBAR_EL1 * 2)  /* Vector Base Address Register */
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 644d73956864..0859a4ddd1e7 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -129,7 +129,7 @@ struct kvm_vcpu_arch {
        struct kvm_mmu_memory_cache mmu_page_cache;
        /* Target CPU and feature flags */
-        u32 target;
+        int target;
        DECLARE_BITMAP(features, KVM_VCPU_MAX_FEATURES);
        /* Detect first run of a vcpu */
diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
index 9ba33c40cdf8..12e6ccb88691 100644
--- a/arch/arm64/kernel/perf_event.c
+++ b/arch/arm64/kernel/perf_event.c
@@ -107,7 +107,12 @@ armpmu_map_cache_event(const unsigned (*cache_map)
 static int
 armpmu_map_event(const unsigned (*event_map)[PERF_COUNT_HW_MAX], u64 config)
 {
-        int mapping = (*event_map)[config];
+        int mapping;
+        if (config >= PERF_COUNT_HW_MAX)
+                return -EINVAL;
+        mapping = (*event_map)[config];
        return mapping == HW_OP_UNSUPPORTED ? -ENOENT : mapping;
 }
@@ -317,6 +322,9 @@ validate_event(struct pmu_hw_events *hw_events,
        struct hw_perf_event fake_event = event->hw;
        struct pmu *leader_pmu = event->group_leader->pmu;
+        if (is_software_event(event))
+                return 1;
        if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
                return 1;
diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
index ff985e3d8b72..1ac0bbbdddb2 100644
--- a/arch/arm64/kvm/hyp.S
+++ b/arch/arm64/kvm/hyp.S
@@ -214,6 +214,7 @@ __kvm_hyp_code_start:
        mrs     x21,    tpidr_el1
        mrs     x22,    amair_el1
        mrs     x23,    cntkctl_el1
+        mrs     x24,    par_el1
        stp     x4, x5, [x3]
        stp     x6, x7, [x3, #16]
@@ -225,6 +226,7 @@ __kvm_hyp_code_start:
        stp     x18, x19, [x3, #112]
        stp     x20, x21, [x3, #128]
        stp     x22, x23, [x3, #144]
+        str     x24, [x3, #160]
 .endm
 .macro restore_sysregs
@@ -243,6 +245,7 @@ __kvm_hyp_code_start:
        ldp     x18, x19, [x3, #112]
        ldp     x20, x21, [x3, #128]
        ldp     x22, x23, [x3, #144]
+        ldr     x24, [x3, #160]
        msr     vmpidr_el2,     x4
        msr     csselr_el1,     x5
@@ -264,6 +267,7 @@ __kvm_hyp_code_start:
        msr     tpidr_el1,      x21
        msr     amair_el1,      x22
        msr     cntkctl_el1,    x23
+        msr     par_el1,        x24
 .endm
 .macro skip_32bit_state tmp, target
@@ -600,6 +604,8 @@ END(__kvm_vcpu_run)
 // void __kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa);
 ENTRY(__kvm_tlb_flush_vmid_ipa)
+        dsb     ishst
        kern_hyp_va     x0
        ldr     x2, [x0, #KVM_VTTBR]
        msr     vttbr_el2, x2
@@ -621,6 +627,7 @@ ENTRY(__kvm_tlb_flush_vmid_ipa)
 ENDPROC(__kvm_tlb_flush_vmid_ipa)
 ENTRY(__kvm_flush_vm_context)
+        dsb     ishst
        tlbi    alle1is
        ic      ialluis
        dsb     sy
@@ -753,6 +760,10 @@ el1_trap:
         */
        tbnz    x1, #7, 1f      // S1PTW is set
+        /* Preserve PAR_EL1 */
+        mrs     x3, par_el1
+        push    x3, xzr
        /*
         * Permission fault, HPFAR_EL2 is invalid.
         * Resolve the IPA the hard way using the guest VA.
@@ -766,6 +777,8 @@ el1_trap:
        /* Read result */
        mrs     x3, par_el1
+        pop     x0, xzr                 // Restore PAR_EL1 from the stack
+        msr     par_el1, x0
        tbnz    x3, #0, 3f              // Bail out if we failed the translation
        ubfx    x3, x3, #12, #36        // Extract IPA
        lsl     x3, x3, #4              // and present it like HPFAR
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 94923609753b..02e9d09e1d80 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -211,6 +211,9 @@ static const struct sys_reg_desc sys_reg_descs[] = {
        /* FAR_EL1 */
        { Op0(0b11), Op1(0b000), CRn(0b0110), CRm(0b0000), Op2(0b000),
          NULL, reset_unknown, FAR_EL1 },
+        /* PAR_EL1 */
+        { Op0(0b11), Op1(0b000), CRn(0b0111), CRm(0b0100), Op2(0b000),
+          NULL, reset_unknown, PAR_EL1 },
        /* PMINTENSET_EL1 */
        { Op0(0b11), Op1(0b000), CRn(0b1001), CRm(0b1110), Op2(0b001),
diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index e773659ccf9f..46048d24328c 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -803,6 +803,32 @@ static int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
                                dec_insn.next_pc_inc;
                return 1;
                break;
+#ifdef CONFIG_CPU_CAVIUM_OCTEON
+        case lwc2_op: /* This is bbit0 on Octeon */
+                if ((regs->regs[insn.i_format.rs] & (1ull<<insn.i_format.rt)) == 0)
+                        *contpc = regs->cp0_epc + 4 + (insn.i_format.simmediate << 2);
+                else
+                        *contpc = regs->cp0_epc + 8;
+                return 1;
+        case ldc2_op: /* This is bbit032 on Octeon */
+                if ((regs->regs[insn.i_format.rs] & (1ull<<(insn.i_format.rt + 32))) == 0)
+                        *contpc = regs->cp0_epc + 4 + (insn.i_format.simmediate << 2);
+                else
+                        *contpc = regs->cp0_epc + 8;
+                return 1;
+        case swc2_op: /* This is bbit1 on Octeon */
+                if (regs->regs[insn.i_format.rs] & (1ull<<insn.i_format.rt))
+                        *contpc = regs->cp0_epc + 4 + (insn.i_format.simmediate << 2);
+                else
+                        *contpc = regs->cp0_epc + 8;
+                return 1;
+        case sdc2_op: /* This is bbit132 on Octeon */
+                if (regs->regs[insn.i_format.rs] & (1ull<<(insn.i_format.rt + 32)))
+                        *contpc = regs->cp0_epc + 4 + (insn.i_format.simmediate << 2);
+                else
+                        *contpc = regs->cp0_epc + 8;
+                return 1;
+#endif
        case cop0_op:
        case cop1_op:
        case cop2_op:
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index dbd9d3c991e8..9cf59816d3e9 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -979,6 +979,7 @@ config RELOCATABLE
          must live at a different physical address than the primary
          kernel.
+# This value must have zeroes in the bottom 60 bits otherwise lots will break
 config PAGE_OFFSET
        hex
        default "0xc000000000000000"
diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
index 988c812aab5b..b9f426212d3a 100644
--- a/arch/powerpc/include/asm/page.h
+++ b/arch/powerpc/include/asm/page.h
@@ -211,9 +211,19 @@ extern long long virt_phys_offset;
 #define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) + VIRT_PHYS_OFFSET))
 #define __pa(x) ((unsigned long)(x) - VIRT_PHYS_OFFSET)
 #else
+#ifdef CONFIG_PPC64
+/*
+ * gcc miscompiles (unsigned long)(&static_var) - PAGE_OFFSET
+ * with -mcmodel=medium, so we use & and | instead of - and + on 64-bit.
+ */
+#define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) | PAGE_OFFSET))
+#define __pa(x) ((unsigned long)(x) & 0x0fffffffffffffffUL)
+#else /* 32-bit, non book E */
 #define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) + PAGE_OFFSET - MEMORY_START))
 #define __pa(x) ((unsigned long)(x) - PAGE_OFFSET + MEMORY_START)
 #endif
+#endif
 /*
 * Unfortunately the PLT is in the BSS in the PPC32 ELF ABI,
diff --git a/arch/powerpc/kernel/lparcfg.c b/arch/powerpc/kernel/lparcfg.c
index d92f3871e9cf..e2a0a162299b 100644
--- a/arch/powerpc/kernel/lparcfg.c
+++ b/arch/powerpc/kernel/lparcfg.c
@@ -35,7 +35,13 @@
 #include <asm/vdso_datapage.h>
 #include <asm/vio.h>
 #include <asm/mmu.h>
+#include <asm/machdep.h>
+/*
+ * This isn't a module but we expose that to userspace
+ * via /proc so leave the definitions here
+ */
 #define MODULE_VERS "1.9"
 #define MODULE_NAME "lparcfg"
@@ -418,7 +424,8 @@ static void parse_em_data(struct seq_file *m)
 {
        unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
-        if (plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
+        if (firmware_has_feature(FW_FEATURE_LPAR) &&
+            plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
                seq_printf(m, "power_mode_data=%016lx\n", retbuf[0]);
 }
@@ -677,7 +684,6 @@ static int lparcfg_open(struct inode *inode, struct file *file)
 }
 static const struct file_operations lparcfg_fops = {
-        .owner          = THIS_MODULE,
        .read           = seq_read,
        .write          = lparcfg_write,
        .open           = lparcfg_open,
@@ -699,14 +705,4 @@ static int __init lparcfg_init(void)
        }
        return 0;
 }
+machine_device_initcall(pseries, lparcfg_init);
-static void __exit lparcfg_cleanup(void)
-{
-        remove_proc_subtree("powerpc/lparcfg", NULL);
-}
-module_init(lparcfg_init);
-module_exit(lparcfg_cleanup);
-MODULE_DESCRIPTION("Interface for LPAR configuration data");
-MODULE_AUTHOR("Dave Engebretsen");
-MODULE_LICENSE("GPL");
diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
index 48f8375e4c6b..30277e27431a 100644
--- a/arch/x86/kernel/sys_x86_64.c
+++ b/arch/x86/kernel/sys_x86_64.c
@@ -101,7 +101,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
                                *begin = new_begin;
                }
        } else {
-                *begin = mmap_legacy_base();
+                *begin = current->mm->mmap_legacy_base;
                *end = TASK_SIZE;
        }
 }
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index f63778cb2363..25e7e1372bb2 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -98,7 +98,7 @@ static unsigned long mmap_base(void)
 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
 * does, but not when emulating X86_32
 */
-unsigned long mmap_legacy_base(void)
+static unsigned long mmap_legacy_base(void)
 {
        if (mmap_is_ia32())
                return TASK_UNMAPPED_BASE;
@@ -112,11 +112,13 @@ unsigned long mmap_legacy_base(void)
 */
 void arch_pick_mmap_layout(struct mm_struct *mm)
 {
+        mm->mmap_legacy_base = mmap_legacy_base();
+        mm->mmap_base = mmap_base();
        if (mmap_is_legacy()) {
-                mm->mmap_base = mmap_legacy_base();
+                mm->mmap_base = mm->mmap_legacy_base;
                mm->get_unmapped_area = arch_get_unmapped_area;
        } else {
-                mm->mmap_base = mmap_base();
                mm->get_unmapped_area = arch_get_unmapped_area_topdown;
        }
 }
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index 056d11faef21..8f3eea6b80c5 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -313,6 +313,17 @@ static void xen_align_and_add_e820_region(u64 start, u64 size, int type)
        e820_add_region(start, end - start, type);
 }
+void xen_ignore_unusable(struct e820entry *list, size_t map_size)
+{
+        struct e820entry *entry;
+        unsigned int i;
+        for (i = 0, entry = list; i < map_size; i++, entry++) {
+                if (entry->type == E820_UNUSABLE)
+                        entry->type = E820_RAM;
+        }
+}
 /**
 * machine_specific_memory_setup - Hook for machine specific memory setup.
 **/
@@ -353,6 +364,17 @@ char * __init xen_memory_setup(void)
        }
        BUG_ON(rc);
+        /*
+         * Xen won't allow a 1:1 mapping to be created to UNUSABLE
+         * regions, so if we're using the machine memory map leave the
+         * region as RAM as it is in the pseudo-physical map.
+         *
+         * UNUSABLE regions in domUs are not handled and will need
+         * a patch in the future.
+         */
+        if (xen_initial_domain())
+                xen_ignore_unusable(map, memmap.nr_entries);
        /* Make sure the Xen-supplied memory map is well-ordered. */
        sanitize_e820_map(map, memmap.nr_entries, &memmap.nr_entries);
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index ca92754eb846..b81c88e51daa 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -694,8 +694,15 @@ static void __init xen_hvm_smp_prepare_cpus(unsigned int max_cpus)
 static int xen_hvm_cpu_up(unsigned int cpu, struct task_struct *tidle)
 {
        int rc;
-        rc = native_cpu_up(cpu, tidle);
+        /*
-        WARN_ON (xen_smp_intr_init(cpu));
+         * xen_smp_intr_init() needs to run before native_cpu_up()
+         * so that IPI vectors are set up on the booting CPU before
+         * it is marked online in native_cpu_up().
+        */
+        rc = xen_smp_intr_init(cpu);
+        WARN_ON(rc);
+        if (!rc)
+                rc =  native_cpu_up(cpu, tidle);
        return rc;
 }
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index e1284b8dc6ee..3270d3c8ba4e 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -908,9 +908,6 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
                device->cap._DDC = 1;
        }
-        if (acpi_video_init_brightness(device))
-                return;
        if (acpi_video_backlight_support()) {
                struct backlight_properties props;
                struct pci_dev *pdev;
@@ -920,6 +917,9 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
                static int count = 0;
                char *name;
+                result = acpi_video_init_brightness(device);
+                if (result)
+                        return;
                name = kasprintf(GFP_KERNEL, "acpi_video%d", count);
                if (!name)
                        return;
@@ -979,11 +979,6 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
                if (result)
                        printk(KERN_ERR PREFIX "Create sysfs link\n");
-        } else {
-                /* Remove the brightness object. */
-                kfree(device->brightness->levels);
-                kfree(device->brightness);
-                device->brightness = NULL;
        }
 }
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index 1c41722bb7e2..20fd337a5731 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -289,24 +289,24 @@ static int sata_pmp_configure(struct ata_device *dev, int print_info)
        /* Disable sending Early R_OK.
         * With "cached read" HDD testing and multiple ports busy on a SATA
-         * host controller, 3726 PMP will very rarely drop a deferred
+         * host controller, 3x26 PMP will very rarely drop a deferred
         * R_OK that was intended for the host. Symptom will be all
         * 5 drives under test will timeout, get reset, and recover.
         */
-        if (vendor == 0x1095 && devid == 0x3726) {
+        if (vendor == 0x1095 && (devid == 0x3726 || devid == 0x3826)) {
                u32 reg;
                err_mask = sata_pmp_read(&ap->link, PMP_GSCR_SII_POL, &reg);
                if (err_mask) {
                        rc = -EIO;
-                        reason = "failed to read Sil3726 Private Register";
+                        reason = "failed to read Sil3x26 Private Register";
                        goto fail;
                }
                reg &= ~0x1;
                err_mask = sata_pmp_write(&ap->link, PMP_GSCR_SII_POL, reg);
                if (err_mask) {
                        rc = -EIO;
-                        reason = "failed to write Sil3726 Private Register";
+                        reason = "failed to write Sil3x26 Private Register";
                        goto fail;
                }
        }
@@ -383,8 +383,8 @@ static void sata_pmp_quirks(struct ata_port *ap)
        u16 devid = sata_pmp_gscr_devid(gscr);
        struct ata_link *link;
-        if (vendor == 0x1095 && devid == 0x3726) {
+        if (vendor == 0x1095 && (devid == 0x3726 || devid == 0x3826)) {
-                /* sil3726 quirks */
+                /* sil3x26 quirks */
                ata_for_each_link(link, ap, EDGE) {
                        /* link reports offline after LPM */
                        link->flags |= ATA_LFLAG_NO_LPM;
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 19720a0a4a65..851bd3f43ac6 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -293,6 +293,7 @@ static void fsl_sata_set_irq_coalescing(struct ata_host *host,
 {
        struct sata_fsl_host_priv *host_priv = host->private_data;
        void __iomem *hcr_base = host_priv->hcr_base;
+        unsigned long flags;
        if (count > ICC_MAX_INT_COUNT_THRESHOLD)
                count = ICC_MAX_INT_COUNT_THRESHOLD;
@@ -305,12 +306,12 @@ static void fsl_sata_set_irq_coalescing(struct ata_host *host,
                        (count > ICC_MIN_INT_COUNT_THRESHOLD))
                ticks = ICC_SAFE_INT_TICKS;
-        spin_lock(&host->lock);
+        spin_lock_irqsave(&host->lock, flags);
        iowrite32((count << 24 | ticks), hcr_base + ICC);
        intr_coalescing_count = count;
        intr_coalescing_ticks = ticks;
-        spin_unlock(&host->lock);
+        spin_unlock_irqrestore(&host->lock, flags);
        DPRINTK("interrupt coalescing, count = 0x%x, ticks = %x\n",
                        intr_coalescing_count, intr_coalescing_ticks);
diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c
index d047d92a456f..e9a4f46d962e 100644
--- a/drivers/ata/sata_highbank.c
+++ b/drivers/ata/sata_highbank.c
@@ -86,11 +86,11 @@ struct ecx_plat_data {
 #define SGPIO_SIGNALS                   3
 #define ECX_ACTIVITY_BITS               0x300000
-#define ECX_ACTIVITY_SHIFT              2
+#define ECX_ACTIVITY_SHIFT              0
 #define ECX_LOCATE_BITS                 0x80000
 #define ECX_LOCATE_SHIFT                1
 #define ECX_FAULT_BITS                  0x400000
-#define ECX_FAULT_SHIFT                 0
+#define ECX_FAULT_SHIFT                 2
 static inline int sgpio_bit_shift(struct ecx_plat_data *pdata, u32 port,
                                u32 shift)
 {
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 2b7813ec6d02..ec386ee9cb22 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -141,6 +141,8 @@ static ssize_t show_mem_removable(struct device *dev,
                container_of(dev, struct memory_block, dev);
        for (i = 0; i < sections_per_block; i++) {
+                if (!present_section_nr(mem->start_section_nr + i))
+                        continue;
                pfn = section_nr_to_pfn(mem->start_section_nr + i);
                ret &= is_mem_section_removable(pfn, PAGES_PER_SECTION);
        }
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index 5c1435c4e210..0fccc99881fd 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -332,7 +332,7 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg)
        }
        if (!rbnode->blklen) {
-                rbnode->blklen = sizeof(*rbnode);
+                rbnode->blklen = 1;
                rbnode->base_reg = reg;
        }
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 6825957c97fb..643d7c7a0d8e 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -194,7 +194,7 @@ config SIRF_DMA
          Enable support for the CSR SiRFprimaII DMA engine.
 config TI_EDMA
-        tristate "TI EDMA support"
+        bool "TI EDMA support"
        depends on ARCH_DAVINCI || ARCH_OMAP
        select DMA_ENGINE
        select DMA_VIRTUAL_CHANNELS
diff --git a/drivers/gpu/drm/gma500/psb_intel_sdvo.c b/drivers/gpu/drm/gma500/psb_intel_sdvo.c
index 19e36603b23b..3bc8414533c9 100644
--- a/drivers/gpu/drm/gma500/psb_intel_sdvo.c
+++ b/drivers/gpu/drm/gma500/psb_intel_sdvo.c
@@ -500,7 +500,8 @@ static bool psb_intel_sdvo_read_response(struct psb_intel_sdvo *psb_intel_sdvo,
                                  &status))
                goto log_fail;
-        while (status == SDVO_CMD_STATUS_PENDING && retry--) {
+        while ((status == SDVO_CMD_STATUS_PENDING ||
+                status == SDVO_CMD_STATUS_TARGET_NOT_SPECIFIED) && retry--) {
                udelay(15);
                if (!psb_intel_sdvo_read_byte(psb_intel_sdvo,
                                          SDVO_I2C_CMD_STATUS,
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 6f514297c483..342f1f336168 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -752,6 +752,8 @@
                                        will not assert AGPBUSY# and will only
                                        be delivered when out of C3. */
 #define   INSTPM_FORCE_ORDERING                         (1<<7) /* GEN6+ */
+#define   INSTPM_TLB_INVALIDATE (1<<9)
+#define   INSTPM_SYNC_FLUSH     (1<<5)
 #define ACTHD           0x020c8
 #define FW_BLC          0x020d8
 #define FW_BLC2         0x020dc
@@ -4438,7 +4440,7 @@
 #define EDP_LINK_TRAIN_600MV_0DB_IVB            (0x30 <<22)
 #define EDP_LINK_TRAIN_600MV_3_5DB_IVB          (0x36 <<22)
 #define EDP_LINK_TRAIN_800MV_0DB_IVB            (0x38 <<22)
-#define EDP_LINK_TRAIN_800MV_3_5DB_IVB          (0x33 <<22)
+#define EDP_LINK_TRAIN_800MV_3_5DB_IVB          (0x3e <<22)
 /* legacy values */
 #define EDP_LINK_TRAIN_500MV_0DB_IVB            (0x00 <<22)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 664118d8c1d6..079ef0129e74 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -968,6 +968,18 @@ void intel_ring_setup_status_page(struct intel_ring_buffer *ring)
        I915_WRITE(mmio, (u32)ring->status_page.gfx_addr);
        POSTING_READ(mmio);
+        /* Flush the TLB for this page */
+        if (INTEL_INFO(dev)->gen >= 6) {
+                u32 reg = RING_INSTPM(ring->mmio_base);
+                I915_WRITE(reg,
+                           _MASKED_BIT_ENABLE(INSTPM_TLB_INVALIDATE |
+                                              INSTPM_SYNC_FLUSH));
+                if (wait_for((I915_READ(reg) & INSTPM_SYNC_FLUSH) == 0,
+                             1000))
+                        DRM_ERROR("%s: wait for SyncFlush to complete for TLB invalidation timed out\n",
+                                  ring->name);
+        }
 }
 static int
diff --git a/drivers/gpu/drm/nouveau/core/core/mm.c b/drivers/gpu/drm/nouveau/core/core/mm.c
index d8291724dbd4..7a4e0891c5f8 100644
--- a/drivers/gpu/drm/nouveau/core/core/mm.c
+++ b/drivers/gpu/drm/nouveau/core/core/mm.c
@@ -98,6 +98,8 @@ nouveau_mm_head(struct nouveau_mm *mm, u8 type, u32 size_max, u32 size_min,
        u32 splitoff;
        u32 s, e;
+        BUG_ON(!type);
        list_for_each_entry(this, &mm->free, fl_entry) {
                e = this->offset + this->length;
                s = this->offset;
@@ -162,6 +164,8 @@ nouveau_mm_tail(struct nouveau_mm *mm, u8 type, u32 size_max, u32 size_min,
        struct nouveau_mm_node *prev, *this, *next;
        u32 mask = align - 1;
+        BUG_ON(!type);
        list_for_each_entry_reverse(this, &mm->free, fl_entry) {
                u32 e = this->offset + this->length;
                u32 s = this->offset;
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
index d5502267c30f..9d2cd2006250 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
@@ -20,8 +20,8 @@ nouveau_mc(void *obj)
        return (void *)nv_device(obj)->subdev[NVDEV_SUBDEV_MC];
 }
-#define nouveau_mc_create(p,e,o,d)                                             \
+#define nouveau_mc_create(p,e,o,m,d)                                           \
-        nouveau_mc_create_((p), (e), (o), sizeof(**d), (void **)d)
+        nouveau_mc_create_((p), (e), (o), (m), sizeof(**d), (void **)d)
 #define nouveau_mc_destroy(p) ({                                               \
        struct nouveau_mc *pmc = (p); _nouveau_mc_dtor(nv_object(pmc));        \
 })
@@ -33,7 +33,8 @@ nouveau_mc(void *obj)
 })
 int  nouveau_mc_create_(struct nouveau_object *, struct nouveau_object *,
-                        struct nouveau_oclass *, int, void **);
+                        struct nouveau_oclass *, const struct nouveau_mc_intr *,
+                        int, void **);
 void _nouveau_mc_dtor(struct nouveau_object *);
 int  _nouveau_mc_init(struct nouveau_object *);
 int  _nouveau_mc_fini(struct nouveau_object *, bool);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv49.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv49.c
index 19e3a9a63a02..ab7ef0ac9e34 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv49.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv49.c
@@ -40,15 +40,15 @@ nv49_ram_create(struct nouveau_object *parent, struct nouveau_object *engine,
                return ret;
        switch (pfb914 & 0x00000003) {
-        case 0x00000000: pfb->ram->type = NV_MEM_TYPE_DDR1; break;
+        case 0x00000000: ram->type = NV_MEM_TYPE_DDR1; break;
-        case 0x00000001: pfb->ram->type = NV_MEM_TYPE_DDR2; break;
+        case 0x00000001: ram->type = NV_MEM_TYPE_DDR2; break;
-        case 0x00000002: pfb->ram->type = NV_MEM_TYPE_GDDR3; break;
+        case 0x00000002: ram->type = NV_MEM_TYPE_GDDR3; break;
        case 0x00000003: break;
        }
-        pfb->ram->size  =  nv_rd32(pfb, 0x10020c) & 0xff000000;
+        ram->size  =  nv_rd32(pfb, 0x10020c) & 0xff000000;
-        pfb->ram->parts = (nv_rd32(pfb, 0x100200) & 0x00000003) + 1;
+        ram->parts = (nv_rd32(pfb, 0x100200) & 0x00000003) + 1;
-        pfb->ram->tags  =  nv_rd32(pfb, 0x100320);
+        ram->tags  =  nv_rd32(pfb, 0x100320);
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv4e.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv4e.c
index 7192aa6e5577..63a6aab86028 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv4e.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv4e.c
@@ -38,8 +38,8 @@ nv4e_ram_create(struct nouveau_object *parent, struct nouveau_object *engine,
        if (ret)
                return ret;
-        pfb->ram->size = nv_rd32(pfb, 0x10020c) & 0xff000000;
+        ram->size = nv_rd32(pfb, 0x10020c) & 0xff000000;
-        pfb->ram->type = NV_MEM_TYPE_STOLEN;
+        ram->type = NV_MEM_TYPE_STOLEN;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c
index bcca883018f4..cce65cc56514 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c
@@ -30,8 +30,9 @@ struct nvc0_ltcg_priv {
        struct nouveau_ltcg base;
        u32 part_nr;
        u32 subp_nr;
-        struct nouveau_mm tags;
        u32 num_tags;
+        u32 tag_base;
+        struct nouveau_mm tags;
        struct nouveau_mm_node *tag_ram;
 };
@@ -117,10 +118,6 @@ nvc0_ltcg_init_tag_ram(struct nouveau_fb *pfb, struct nvc0_ltcg_priv *priv)
        u32 tag_size, tag_margin, tag_align;
        int ret;
-        nv_wr32(priv, 0x17e8d8, priv->part_nr);
-        if (nv_device(pfb)->card_type >= NV_E0)
-                nv_wr32(priv, 0x17e000, priv->part_nr);
        /* tags for 1/4 of VRAM should be enough (8192/4 per GiB of VRAM) */
        priv->num_tags = (pfb->ram->size >> 17) / 4;
        if (priv->num_tags > (1 << 17))
@@ -142,7 +139,7 @@ nvc0_ltcg_init_tag_ram(struct nouveau_fb *pfb, struct nvc0_ltcg_priv *priv)
        tag_size += tag_align;
        tag_size  = (tag_size + 0xfff) >> 12; /* round up */
-        ret = nouveau_mm_tail(&pfb->vram, 0, tag_size, tag_size, 1,
+        ret = nouveau_mm_tail(&pfb->vram, 1, tag_size, tag_size, 1,
                              &priv->tag_ram);
        if (ret) {
                priv->num_tags = 0;
@@ -152,7 +149,7 @@ nvc0_ltcg_init_tag_ram(struct nouveau_fb *pfb, struct nvc0_ltcg_priv *priv)
                tag_base += tag_align - 1;
                ret = do_div(tag_base, tag_align);
-                nv_wr32(priv, 0x17e8d4, tag_base);
+                priv->tag_base = tag_base;
        }
        ret = nouveau_mm_init(&priv->tags, 0, priv->num_tags, 1);
@@ -182,8 +179,6 @@ nvc0_ltcg_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        }
        priv->subp_nr = nv_rd32(priv, 0x17e8dc) >> 28;
-        nv_mask(priv, 0x17e820, 0x00100000, 0x00000000); /* INTR_EN &= ~0x10 */
        ret = nvc0_ltcg_init_tag_ram(pfb, priv);
        if (ret)
                return ret;
@@ -209,13 +204,32 @@ nvc0_ltcg_dtor(struct nouveau_object *object)
        nouveau_ltcg_destroy(ltcg);
 }
+static int
+nvc0_ltcg_init(struct nouveau_object *object)
+{
+        struct nouveau_ltcg *ltcg = (struct nouveau_ltcg *)object;
+        struct nvc0_ltcg_priv *priv = (struct nvc0_ltcg_priv *)ltcg;
+        int ret;
+        ret = nouveau_ltcg_init(ltcg);
+        if (ret)
+                return ret;
+        nv_mask(priv, 0x17e820, 0x00100000, 0x00000000); /* INTR_EN &= ~0x10 */
+        nv_wr32(priv, 0x17e8d8, priv->part_nr);
+        if (nv_device(ltcg)->card_type >= NV_E0)
+                nv_wr32(priv, 0x17e000, priv->part_nr);
+        nv_wr32(priv, 0x17e8d4, priv->tag_base);
+        return 0;
+}
 struct nouveau_oclass
 nvc0_ltcg_oclass = {
        .handle = NV_SUBDEV(LTCG, 0xc0),
        .ofuncs = &(struct nouveau_ofuncs) {
                .ctor = nvc0_ltcg_ctor,
                .dtor = nvc0_ltcg_dtor,
-                .init = _nouveau_ltcg_init,
+                .init = nvc0_ltcg_init,
                .fini = _nouveau_ltcg_fini,
        },
 };
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
index 1c0330b8c9a4..ec9cd6f10f91 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
@@ -80,7 +80,9 @@ _nouveau_mc_dtor(struct nouveau_object *object)
 int
 nouveau_mc_create_(struct nouveau_object *parent, struct nouveau_object *engine,
-                   struct nouveau_oclass *oclass, int length, void **pobject)
+                   struct nouveau_oclass *oclass,
+                   const struct nouveau_mc_intr *intr_map,
+                   int length, void **pobject)
 {
        struct nouveau_device *device = nv_device(parent);
        struct nouveau_mc *pmc;
@@ -92,6 +94,8 @@ nouveau_mc_create_(struct nouveau_object *parent, struct nouveau_object *engine,
        if (ret)
                return ret;
+        pmc->intr_map = intr_map;
        ret = request_irq(device->pdev->irq, nouveau_mc_intr,
                          IRQF_SHARED, "nouveau", pmc);
        if (ret < 0)
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
index 8c769715227b..64aa4edb0d9d 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
@@ -50,12 +50,11 @@ nv04_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        struct nv04_mc_priv *priv;
        int ret;
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nv04_mc_intr, &priv);
        *pobject = nv_object(priv);
        if (ret)
                return ret;
-        priv->base.intr_map = nv04_mc_intr;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
index 51919371810f..d9891782bf28 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
@@ -36,12 +36,11 @@ nv44_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        struct nv44_mc_priv *priv;
        int ret;
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nv04_mc_intr, &priv);
        *pobject = nv_object(priv);
        if (ret)
                return ret;
-        priv->base.intr_map = nv04_mc_intr;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
index f25fc5fc7dd1..2b1afe225db8 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
@@ -53,12 +53,11 @@ nv50_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        struct nv50_mc_priv *priv;
        int ret;
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nv50_mc_intr, &priv);
        *pobject = nv_object(priv);
        if (ret)
                return ret;
-        priv->base.intr_map = nv50_mc_intr;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
index e82fd21b5041..0d57b4d3e001 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
@@ -54,12 +54,11 @@ nv98_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        struct nv98_mc_priv *priv;
        int ret;
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nv98_mc_intr, &priv);
        *pobject = nv_object(priv);
        if (ret)
                return ret;
-        priv->base.intr_map = nv98_mc_intr;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
index c5da3babbc62..104175c5a2dd 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
@@ -57,12 +57,11 @@ nvc0_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        struct nvc0_mc_priv *priv;
        int ret;
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nvc0_mc_intr, &priv);
        *pobject = nv_object(priv);
        if (ret)
                return ret;
-        priv->base.intr_map = nvc0_mc_intr;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/dispnv04/crtc.c b/drivers/gpu/drm/nouveau/dispnv04/crtc.c
index 0782bd2f1e04..6a13ffb53bdb 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/crtc.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/crtc.c
@@ -606,6 +606,24 @@ nv_crtc_mode_set_regs(struct drm_crtc *crtc, struct drm_display_mode * mode)
        regp->ramdac_a34 = 0x1;
 }
+static int
+nv_crtc_swap_fbs(struct drm_crtc *crtc, struct drm_framebuffer *old_fb)
+{
+        struct nv04_display *disp = nv04_display(crtc->dev);
+        struct nouveau_framebuffer *nvfb = nouveau_framebuffer(crtc->fb);
+        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+        int ret;
+        ret = nouveau_bo_pin(nvfb->nvbo, TTM_PL_FLAG_VRAM);
+        if (ret == 0) {
+                if (disp->image[nv_crtc->index])
+                        nouveau_bo_unpin(disp->image[nv_crtc->index]);
+                nouveau_bo_ref(nvfb->nvbo, &disp->image[nv_crtc->index]);
+        }
+        return ret;
+}
 /**
 * Sets up registers for the given mode/adjusted_mode pair.
 *
@@ -622,10 +640,15 @@ nv_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *mode,
        struct drm_device *dev = crtc->dev;
        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
        struct nouveau_drm *drm = nouveau_drm(dev);
+        int ret;
        NV_DEBUG(drm, "CTRC mode on CRTC %d:\n", nv_crtc->index);
        drm_mode_debug_printmodeline(adjusted_mode);
+        ret = nv_crtc_swap_fbs(crtc, old_fb);
+        if (ret)
+                return ret;
        /* unlock must come after turning off FP_TG_CONTROL in output_prepare */
        nv_lock_vga_crtc_shadow(dev, nv_crtc->index, -1);
@@ -722,6 +745,7 @@ static void nv_crtc_commit(struct drm_crtc *crtc)
 static void nv_crtc_destroy(struct drm_crtc *crtc)
 {
+        struct nv04_display *disp = nv04_display(crtc->dev);
        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
        if (!nv_crtc)
@@ -729,6 +753,10 @@ static void nv_crtc_destroy(struct drm_crtc *crtc)
        drm_crtc_cleanup(crtc);
+        if (disp->image[nv_crtc->index])
+                nouveau_bo_unpin(disp->image[nv_crtc->index]);
+        nouveau_bo_ref(NULL, &disp->image[nv_crtc->index]);
        nouveau_bo_unmap(nv_crtc->cursor.nvbo);
        nouveau_bo_unpin(nv_crtc->cursor.nvbo);
        nouveau_bo_ref(NULL, &nv_crtc->cursor.nvbo);
@@ -754,6 +782,16 @@ nv_crtc_gamma_load(struct drm_crtc *crtc)
 }
 static void
+nv_crtc_disable(struct drm_crtc *crtc)
+{
+        struct nv04_display *disp = nv04_display(crtc->dev);
+        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+        if (disp->image[nv_crtc->index])
+                nouveau_bo_unpin(disp->image[nv_crtc->index]);
+        nouveau_bo_ref(NULL, &disp->image[nv_crtc->index]);
+}
+static void
 nv_crtc_gamma_set(struct drm_crtc *crtc, u16 *r, u16 *g, u16 *b, uint32_t start,
                  uint32_t size)
 {
@@ -791,7 +829,6 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc,
        struct drm_framebuffer *drm_fb;
        struct nouveau_framebuffer *fb;
        int arb_burst, arb_lwm;
-        int ret;
        NV_DEBUG(drm, "index %d\n", nv_crtc->index);
@@ -801,10 +838,8 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc,
                return 0;
        }
        /* If atomic, we want to switch to the fb we were passed, so
-         * now we update pointers to do that.  (We don't pin; just
+         * now we update pointers to do that.
-         * assume we're already pinned and update the base address.)
         */
        if (atomic) {
                drm_fb = passed_fb;
@@ -812,17 +847,6 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc,
        } else {
                drm_fb = crtc->fb;
                fb = nouveau_framebuffer(crtc->fb);
-                /* If not atomic, we can go ahead and pin, and unpin the
-                 * old fb we were passed.
-                 */
-                ret = nouveau_bo_pin(fb->nvbo, TTM_PL_FLAG_VRAM);
-                if (ret)
-                        return ret;
-                if (passed_fb) {
-                        struct nouveau_framebuffer *ofb = nouveau_framebuffer(passed_fb);
-                        nouveau_bo_unpin(ofb->nvbo);
-                }
        }
        nv_crtc->fb.offset = fb->nvbo->bo.offset;
@@ -877,6 +901,9 @@ static int
 nv04_crtc_mode_set_base(struct drm_crtc *crtc, int x, int y,
                        struct drm_framebuffer *old_fb)
 {
+        int ret = nv_crtc_swap_fbs(crtc, old_fb);
+        if (ret)
+                return ret;
        return nv04_crtc_do_mode_set_base(crtc, old_fb, x, y, false);
 }
@@ -1027,6 +1054,7 @@ static const struct drm_crtc_helper_funcs nv04_crtc_helper_funcs = {
        .mode_set_base = nv04_crtc_mode_set_base,
        .mode_set_base_atomic = nv04_crtc_mode_set_base_atomic,
        .load_lut = nv_crtc_gamma_load,
+        .disable = nv_crtc_disable,
 };
 int
diff --git a/drivers/gpu/drm/nouveau/dispnv04/disp.h b/drivers/gpu/drm/nouveau/dispnv04/disp.h
index a0a031dad13f..9928187f0a7d 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/disp.h
+++ b/drivers/gpu/drm/nouveau/dispnv04/disp.h
@@ -81,6 +81,7 @@ struct nv04_display {
        uint32_t saved_vga_font[4][16384];
        uint32_t dac_users[4];
        struct nouveau_object *core;
+        struct nouveau_bo *image[2];
 };
 static inline struct nv04_display *
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 907d20ef6d4d..a03e75deacaf 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -577,6 +577,9 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
                ret = nv50_display_flip_next(crtc, fb, chan, 0);
                if (ret)
                        goto fail_unreserve;
+        } else {
+                struct nv04_display *dispnv04 = nv04_display(dev);
+                nouveau_bo_ref(new_bo, &dispnv04->image[nouveau_crtc(crtc)->index]);
        }
        ret = nouveau_page_flip_emit(chan, old_bo, new_bo, s, &fence);
diff --git a/drivers/gpu/drm/nouveau/nv40_pm.c b/drivers/gpu/drm/nouveau/nv40_pm.c
index 3af5bcd0b203..625f80d53dc2 100644
--- a/drivers/gpu/drm/nouveau/nv40_pm.c
+++ b/drivers/gpu/drm/nouveau/nv40_pm.c
@@ -131,7 +131,7 @@ nv40_calc_pll(struct drm_device *dev, u32 reg, struct nvbios_pll *pll,
        if (clk < pll->vco1.max_freq)
                pll->vco2.max_freq = 0;
-        pclk->pll_calc(pclk, pll, clk, &coef);
+        ret = pclk->pll_calc(pclk, pll, clk, &coef);
        if (ret == 0)
                return -ERANGE;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
index 3751730764a5..1a0bf07fe54b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
@@ -29,7 +29,9 @@
 #include <drm/drmP.h>
 #include <drm/ttm/ttm_bo_driver.h>
-#define VMW_PPN_SIZE sizeof(unsigned long)
+#define VMW_PPN_SIZE (sizeof(unsigned long))
+/* A future safe maximum remap size. */
+#define VMW_PPN_PER_REMAP ((31 * 1024) / VMW_PPN_SIZE)
 static int vmw_gmr2_bind(struct vmw_private *dev_priv,
                         struct page *pages[],
@@ -38,43 +40,61 @@ static int vmw_gmr2_bind(struct vmw_private *dev_priv,
 {
        SVGAFifoCmdDefineGMR2 define_cmd;
        SVGAFifoCmdRemapGMR2 remap_cmd;
-        uint32_t define_size = sizeof(define_cmd) + 4;
-        uint32_t remap_size = VMW_PPN_SIZE * num_pages + sizeof(remap_cmd) + 4;
        uint32_t *cmd;
        uint32_t *cmd_orig;
+        uint32_t define_size = sizeof(define_cmd) + sizeof(*cmd);
+        uint32_t remap_num = num_pages / VMW_PPN_PER_REMAP + ((num_pages % VMW_PPN_PER_REMAP) > 0);
+        uint32_t remap_size = VMW_PPN_SIZE * num_pages + (sizeof(remap_cmd) + sizeof(*cmd)) * remap_num;
+        uint32_t remap_pos = 0;
+        uint32_t cmd_size = define_size + remap_size;
        uint32_t i;
-        cmd_orig = cmd = vmw_fifo_reserve(dev_priv, define_size + remap_size);
+        cmd_orig = cmd = vmw_fifo_reserve(dev_priv, cmd_size);
        if (unlikely(cmd == NULL))
                return -ENOMEM;
        define_cmd.gmrId = gmr_id;
        define_cmd.numPages = num_pages;
+        *cmd++ = SVGA_CMD_DEFINE_GMR2;
+        memcpy(cmd, &define_cmd, sizeof(define_cmd));
+        cmd += sizeof(define_cmd) / sizeof(*cmd);
+        /*
+         * Need to split the command if there are too many
+         * pages that goes into the gmr.
+         */
        remap_cmd.gmrId = gmr_id;
        remap_cmd.flags = (VMW_PPN_SIZE > sizeof(*cmd)) ?
                SVGA_REMAP_GMR2_PPN64 : SVGA_REMAP_GMR2_PPN32;
-        remap_cmd.offsetPages = 0;
-        remap_cmd.numPages = num_pages;
-        *cmd++ = SVGA_CMD_DEFINE_GMR2;
+        while (num_pages > 0) {
-        memcpy(cmd, &define_cmd, sizeof(define_cmd));
+                unsigned long nr = min(num_pages, (unsigned long)VMW_PPN_PER_REMAP);
-        cmd += sizeof(define_cmd) / sizeof(uint32);
+                remap_cmd.offsetPages = remap_pos;
+                remap_cmd.numPages = nr;
-        *cmd++ = SVGA_CMD_REMAP_GMR2;
+                *cmd++ = SVGA_CMD_REMAP_GMR2;
-        memcpy(cmd, &remap_cmd, sizeof(remap_cmd));
+                memcpy(cmd, &remap_cmd, sizeof(remap_cmd));
-        cmd += sizeof(remap_cmd) / sizeof(uint32);
+                cmd += sizeof(remap_cmd) / sizeof(*cmd);
-        for (i = 0; i < num_pages; ++i) {
+                for (i = 0; i < nr; ++i) {
-                if (VMW_PPN_SIZE <= 4)
+                        if (VMW_PPN_SIZE <= 4)
-                        *cmd = page_to_pfn(*pages++);
+                                *cmd = page_to_pfn(*pages++);
-                else
+                        else
-                        *((uint64_t *)cmd) = page_to_pfn(*pages++);
+                                *((uint64_t *)cmd) = page_to_pfn(*pages++);
-                cmd += VMW_PPN_SIZE / sizeof(*cmd);
+                        cmd += VMW_PPN_SIZE / sizeof(*cmd);
+                }
+                num_pages -= nr;
+                remap_pos += nr;
        }
-        vmw_fifo_commit(dev_priv, define_size + remap_size);
+        BUG_ON(cmd != cmd_orig + cmd_size / sizeof(*cmd));
+        vmw_fifo_commit(dev_priv, cmd_size);
        return 0;
 }
diff --git a/drivers/iio/light/adjd_s311.c b/drivers/iio/light/adjd_s311.c
index 5f4749e60b04..c1cd5698b8ae 100644
--- a/drivers/iio/light/adjd_s311.c
+++ b/drivers/iio/light/adjd_s311.c
@@ -232,7 +232,8 @@ static int adjd_s311_read_raw(struct iio_dev *indio_dev,
        switch (mask) {
        case IIO_CHAN_INFO_RAW:
-                ret = adjd_s311_read_data(indio_dev, chan->address, val);
+                ret = adjd_s311_read_data(indio_dev,
+                        ADJD_S311_DATA_REG(chan->address), val);
                if (ret < 0)
                        return ret;
                return IIO_VAL_INT;
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index fa061d46527f..75e3b102ce45 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -167,6 +167,7 @@ static const struct xpad_device {
        { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
        { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 },
        { 0x1689, 0xfd00, "Razer Onza Tournament Edition", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+        { 0x1689, 0xfd01, "Razer Onza Classic Edition", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
        { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 },
        { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
        { 0x1bad, 0xf016, "Mad Catz Xbox 360 Controller", 0, XTYPE_XBOX360 },
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 57b2637e153a..8551dcaf24db 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -672,6 +672,7 @@ static int elantech_packet_check_v2(struct psmouse *psmouse)
 */
 static int elantech_packet_check_v3(struct psmouse *psmouse)
 {
+        struct elantech_data *etd = psmouse->private;
        const u8 debounce_packet[] = { 0xc4, 0xff, 0xff, 0x02, 0xff, 0xff };
        unsigned char *packet = psmouse->packet;
@@ -682,19 +683,48 @@ static int elantech_packet_check_v3(struct psmouse *psmouse)
        if (!memcmp(packet, debounce_packet, sizeof(debounce_packet)))
                return PACKET_DEBOUNCE;
-        if ((packet[0] & 0x0c) == 0x04 && (packet[3] & 0xcf) == 0x02)
+        /*
-                return PACKET_V3_HEAD;
+         * If the hardware flag 'crc_enabled' is set the packets have
+         * different signatures.
+         */
+        if (etd->crc_enabled) {
+                if ((packet[3] & 0x09) == 0x08)
+                        return PACKET_V3_HEAD;
+                if ((packet[3] & 0x09) == 0x09)
+                        return PACKET_V3_TAIL;
+        } else {
+                if ((packet[0] & 0x0c) == 0x04 && (packet[3] & 0xcf) == 0x02)
+                        return PACKET_V3_HEAD;
-        if ((packet[0] & 0x0c) == 0x0c && (packet[3] & 0xce) == 0x0c)
+                if ((packet[0] & 0x0c) == 0x0c && (packet[3] & 0xce) == 0x0c)
-                return PACKET_V3_TAIL;
+                        return PACKET_V3_TAIL;
+        }
        return PACKET_UNKNOWN;
 }
 static int elantech_packet_check_v4(struct psmouse *psmouse)
 {
+        struct elantech_data *etd = psmouse->private;
        unsigned char *packet = psmouse->packet;
        unsigned char packet_type = packet[3] & 0x03;
+        bool sanity_check;
+        /*
+         * Sanity check based on the constant bits of a packet.
+         * The constant bits change depending on the value of
+         * the hardware flag 'crc_enabled' but are the same for
+         * every packet, regardless of the type.
+         */
+        if (etd->crc_enabled)
+                sanity_check = ((packet[3] & 0x08) == 0x00);
+        else
+                sanity_check = ((packet[0] & 0x0c) == 0x04 &&
+                                (packet[3] & 0x1c) == 0x10);
+        if (!sanity_check)
+                return PACKET_UNKNOWN;
        switch (packet_type) {
        case 0:
@@ -1313,6 +1343,12 @@ static int elantech_set_properties(struct elantech_data *etd)
                        etd->reports_pressure = true;
        }
+        /*
+         * The signatures of v3 and v4 packets change depending on the
+         * value of this hardware flag.
+         */
+        etd->crc_enabled = ((etd->fw_version & 0x4000) == 0x4000);
        return 0;
 }
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index 46db3be45ac9..036a04abaef7 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -129,6 +129,7 @@ struct elantech_data {
        bool paritycheck;
        bool jumpy_cursor;
        bool reports_pressure;
+        bool crc_enabled;
        unsigned char hw_version;
        unsigned int fw_version;
        unsigned int single_finger_reports;
diff --git a/drivers/input/serio/Kconfig b/drivers/input/serio/Kconfig
index 94c17c28d268..1e691a3a79cb 100644
--- a/drivers/input/serio/Kconfig
+++ b/drivers/input/serio/Kconfig
@@ -22,7 +22,8 @@ config SERIO_I8042
        tristate "i8042 PC Keyboard controller" if EXPERT || !X86
        default y
        depends on !PARISC && (!ARM || ARCH_SHARK || FOOTBRIDGE_HOST) && \
-                   (!SUPERH || SH_CAYMAN) && !M68K && !BLACKFIN && !S390
+                   (!SUPERH || SH_CAYMAN) && !M68K && !BLACKFIN && !S390 && \
+                   !ARC
        help
          i8042 is the chip over which the standard AT keyboard and PS/2
          mouse are connected to the computer. If you use these devices,
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 384fbcd0cee0..f3e91f0b57ae 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -2112,7 +2112,7 @@ static const struct wacom_features wacom_features_0xDA =
        { "Wacom Bamboo 2FG 4x5 SE", WACOM_PKGLEN_BBFUN,  14720,  9200, 1023,
          31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES,
          .touch_max = 2 };
-static struct wacom_features wacom_features_0xDB =
+static const struct wacom_features wacom_features_0xDB =
        { "Wacom Bamboo 2FG 6x8 SE", WACOM_PKGLEN_BBFUN,  21648, 13700, 1023,
          31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES,
          .touch_max = 2 };
@@ -2127,6 +2127,12 @@ static const struct wacom_features wacom_features_0xDF =
        { "Wacom Bamboo 16FG 6x8", WACOM_PKGLEN_BBPEN,    21648, 13700, 1023,
          31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES,
          .touch_max = 16 };
+static const struct wacom_features wacom_features_0x300 =
+        { "Wacom Bamboo One S",    WACOM_PKGLEN_BBPEN,    14720,  9225, 1023,
+          31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
+static const struct wacom_features wacom_features_0x301 =
+        { "Wacom Bamboo One M",    WACOM_PKGLEN_BBPEN,    21648, 13530, 1023,
+          31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
 static const struct wacom_features wacom_features_0x6004 =
        { "ISD-V4",               WACOM_PKGLEN_GRAPHIRE,  12800,  8000,  255,
          0, TABLETPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
@@ -2253,6 +2259,8 @@ const struct usb_device_id wacom_ids[] = {
        { USB_DEVICE_WACOM(0x100) },
        { USB_DEVICE_WACOM(0x101) },
        { USB_DEVICE_WACOM(0x10D) },
+        { USB_DEVICE_WACOM(0x300) },
+        { USB_DEVICE_WACOM(0x301) },
        { USB_DEVICE_WACOM(0x304) },
        { USB_DEVICE_WACOM(0x4001) },
        { USB_DEVICE_WACOM(0x47) },
diff --git a/drivers/irqchip/irq-sirfsoc.c b/drivers/irqchip/irq-sirfsoc.c
index 69ea44ebcf61..4851afae38dc 100644
--- a/drivers/irqchip/irq-sirfsoc.c
+++ b/drivers/irqchip/irq-sirfsoc.c
@@ -23,7 +23,7 @@
 #define SIRFSOC_INT_RISC_LEVEL1         0x0024
 #define SIRFSOC_INIT_IRQ_ID             0x0038
-#define SIRFSOC_NUM_IRQS                128
+#define SIRFSOC_NUM_IRQS                64
 static struct irq_domain *sirfsoc_irqdomain;
@@ -32,15 +32,18 @@ sirfsoc_alloc_gc(void __iomem *base, unsigned int irq_start, unsigned int num)
 {
        struct irq_chip_generic *gc;
        struct irq_chip_type *ct;
+        int ret;
+        unsigned int clr = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
-        gc = irq_alloc_generic_chip("SIRFINTC", 1, irq_start, base, handle_level_irq);
+        ret = irq_alloc_domain_generic_chips(sirfsoc_irqdomain, num, 1, "irq_sirfsoc",
-        ct = gc->chip_types;
+                handle_level_irq, clr, 0, IRQ_GC_INIT_MASK_CACHE);
+        gc = irq_get_domain_generic_chip(sirfsoc_irqdomain, irq_start);
+        gc->reg_base = base;
+        ct = gc->chip_types;
        ct->chip.irq_mask = irq_gc_mask_clr_bit;
        ct->chip.irq_unmask = irq_gc_mask_set_bit;
        ct->regs.mask = SIRFSOC_INT_RISC_MASK0;
-        irq_setup_generic_chip(gc, IRQ_MSK(num), IRQ_GC_INIT_MASK_CACHE, IRQ_NOREQUEST, 0);
 }
 static asmlinkage void __exception_irq_entry sirfsoc_handle_irq(struct pt_regs *regs)
@@ -60,9 +63,8 @@ static int __init sirfsoc_irq_init(struct device_node *np, struct device_node *p
        if (!base)
                panic("unable to map intc cpu registers\n");
-        /* using legacy because irqchip_generic does not work with linear */
+        sirfsoc_irqdomain = irq_domain_add_linear(np, SIRFSOC_NUM_IRQS,
-        sirfsoc_irqdomain = irq_domain_add_legacy(np, SIRFSOC_NUM_IRQS, 0, 0,
+                &irq_generic_chip_ops, base);
-                                 &irq_domain_simple_ops, base);
        sirfsoc_alloc_gc(base, 0, 32);
        sirfsoc_alloc_gc(base + 4, 32, SIRFSOC_NUM_IRQS - 32);
diff --git a/drivers/isdn/mISDN/dsp_core.c b/drivers/isdn/mISDN/dsp_core.c
index 22b720ec80cb..77025f5cb57d 100644
--- a/drivers/isdn/mISDN/dsp_core.c
+++ b/drivers/isdn/mISDN/dsp_core.c
@@ -288,8 +288,10 @@ dsp_control_req(struct dsp *dsp, struct mISDNhead *hh, struct sk_buff *skb)
        u8 *data;
        int len;
-        if (skb->len < sizeof(int))
+        if (skb->len < sizeof(int)) {
                printk(KERN_ERR "%s: PH_CONTROL message too short\n", __func__);
+                return -EINVAL;
+        }
        cont = *((int *)skb->data);
        len = skb->len - sizeof(int);
        data = skb->data + sizeof(int);
diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
index dc112a7137fe..4296155090b2 100644
--- a/drivers/md/dm-cache-policy-mq.c
+++ b/drivers/md/dm-cache-policy-mq.c
@@ -959,23 +959,21 @@ out:
        return r;
 }
-static void remove_mapping(struct mq_policy *mq, dm_oblock_t oblock)
+static void mq_remove_mapping(struct dm_cache_policy *p, dm_oblock_t oblock)
 {
-        struct entry *e = hash_lookup(mq, oblock);
+        struct mq_policy *mq = to_mq_policy(p);
+        struct entry *e;
+        mutex_lock(&mq->lock);
+        e = hash_lookup(mq, oblock);
        BUG_ON(!e || !e->in_cache);
        del(mq, e);
        e->in_cache = false;
        push(mq, e);
-}
-static void mq_remove_mapping(struct dm_cache_policy *p, dm_oblock_t oblock)
-{
-        struct mq_policy *mq = to_mq_policy(p);
-        mutex_lock(&mq->lock);
-        remove_mapping(mq, oblock);
        mutex_unlock(&mq->lock);
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index ce9b387b5a19..00b88cbfde25 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1333,6 +1333,8 @@ enum {
        BNX2X_SP_RTNL_VFPF_CHANNEL_DOWN,
        BNX2X_SP_RTNL_VFPF_STORM_RX_MODE,
        BNX2X_SP_RTNL_HYPERVISOR_VLAN,
+        BNX2X_SP_RTNL_TX_STOP,
+        BNX2X_SP_RTNL_TX_RESUME,
 };
 struct bnx2x_prev_path_list {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index f2d1ff10054b..0cc26110868d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -53,6 +53,7 @@ static inline void bnx2x_move_fp(struct bnx2x *bp, int from, int to)
        struct bnx2x_fp_stats *to_fp_stats = &bp->fp_stats[to];
        int old_max_eth_txqs, new_max_eth_txqs;
        int old_txdata_index = 0, new_txdata_index = 0;
+        struct bnx2x_agg_info *old_tpa_info = to_fp->tpa_info;
        /* Copy the NAPI object as it has been already initialized */
        from_fp->napi = to_fp->napi;
@@ -61,6 +62,11 @@ static inline void bnx2x_move_fp(struct bnx2x *bp, int from, int to)
        memcpy(to_fp, from_fp, sizeof(*to_fp));
        to_fp->index = to;
+        /* Retain the tpa_info of the original `to' version as we don't want
+         * 2 FPs to contain the same tpa_info pointer.
+         */
+        to_fp->tpa_info = old_tpa_info;
        /* move sp_objs contents as well, as their indices match fp ones */
        memcpy(to_sp_objs, from_sp_objs, sizeof(*to_sp_objs));
@@ -2956,8 +2962,9 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link)
        if (IS_PF(bp)) {
                if (CNIC_LOADED(bp))
                        bnx2x_free_mem_cnic(bp);
-                bnx2x_free_mem(bp);
        }
+        bnx2x_free_mem(bp);
        bp->state = BNX2X_STATE_CLOSED;
        bp->cnic_loaded = false;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
index f9122f2d6b65..fcf2761d8828 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
@@ -30,10 +30,8 @@
 #include "bnx2x_dcb.h"
 /* forward declarations of dcbx related functions */
-static int bnx2x_dcbx_stop_hw_tx(struct bnx2x *bp);
 static void bnx2x_pfc_set_pfc(struct bnx2x *bp);
 static void bnx2x_dcbx_update_ets_params(struct bnx2x *bp);
-static int bnx2x_dcbx_resume_hw_tx(struct bnx2x *bp);
 static void bnx2x_dcbx_get_ets_pri_pg_tbl(struct bnx2x *bp,
                                          u32 *set_configuration_ets_pg,
                                          u32 *pri_pg_tbl);
@@ -425,30 +423,52 @@ static void bnx2x_pfc_set_pfc(struct bnx2x *bp)
                bnx2x_pfc_clear(bp);
 }
-static int bnx2x_dcbx_stop_hw_tx(struct bnx2x *bp)
+int bnx2x_dcbx_stop_hw_tx(struct bnx2x *bp)
 {
        struct bnx2x_func_state_params func_params = {NULL};
+        int rc;
        func_params.f_obj = &bp->func_obj;
        func_params.cmd = BNX2X_F_CMD_TX_STOP;
+        __set_bit(RAMROD_COMP_WAIT, &func_params.ramrod_flags);
+        __set_bit(RAMROD_RETRY, &func_params.ramrod_flags);
        DP(BNX2X_MSG_DCB, "STOP TRAFFIC\n");
-        return bnx2x_func_state_change(bp, &func_params);
+        rc = bnx2x_func_state_change(bp, &func_params);
+        if (rc) {
+                BNX2X_ERR("Unable to hold traffic for HW configuration\n");
+                bnx2x_panic();
+        }
+        return rc;
 }
-static int bnx2x_dcbx_resume_hw_tx(struct bnx2x *bp)
+int bnx2x_dcbx_resume_hw_tx(struct bnx2x *bp)
 {
        struct bnx2x_func_state_params func_params = {NULL};
        struct bnx2x_func_tx_start_params *tx_params =
                &func_params.params.tx_start;
+        int rc;
        func_params.f_obj = &bp->func_obj;
        func_params.cmd = BNX2X_F_CMD_TX_START;
+        __set_bit(RAMROD_COMP_WAIT, &func_params.ramrod_flags);
+        __set_bit(RAMROD_RETRY, &func_params.ramrod_flags);
        bnx2x_dcbx_fw_struct(bp, tx_params);
        DP(BNX2X_MSG_DCB, "START TRAFFIC\n");
-        return bnx2x_func_state_change(bp, &func_params);
+        rc = bnx2x_func_state_change(bp, &func_params);
+        if (rc) {
+                BNX2X_ERR("Unable to resume traffic after HW configuration\n");
+                bnx2x_panic();
+        }
+        return rc;
 }
 static void bnx2x_dcbx_2cos_limit_update_ets_config(struct bnx2x *bp)
@@ -744,7 +764,9 @@ void bnx2x_dcbx_set_params(struct bnx2x *bp, u32 state)
                        if (IS_MF(bp))
                                bnx2x_link_sync_notify(bp);
-                        bnx2x_dcbx_stop_hw_tx(bp);
+                        set_bit(BNX2X_SP_RTNL_TX_STOP, &bp->sp_rtnl_state);
+                        schedule_delayed_work(&bp->sp_rtnl_task, 0);
                        return;
                }
@@ -757,7 +779,9 @@ void bnx2x_dcbx_set_params(struct bnx2x *bp, u32 state)
                /* ets may affect cmng configuration: reinit it in hw */
                bnx2x_set_local_cmng(bp);
-                bnx2x_dcbx_resume_hw_tx(bp);
+                set_bit(BNX2X_SP_RTNL_TX_RESUME, &bp->sp_rtnl_state);
+                schedule_delayed_work(&bp->sp_rtnl_task, 0);
                return;
        case BNX2X_DCBX_STATE_TX_RELEASED:
@@ -2367,21 +2391,24 @@ static u8 bnx2x_dcbnl_get_featcfg(struct net_device *netdev, int featid,
                case DCB_FEATCFG_ATTR_PG:
                        if (bp->dcbx_local_feat.ets.enabled)
                                *flags |= DCB_FEATCFG_ENABLE;
-                        if (bp->dcbx_error & DCBX_LOCAL_ETS_ERROR)
+                        if (bp->dcbx_error & (DCBX_LOCAL_ETS_ERROR |
+                                              DCBX_REMOTE_MIB_ERROR))
                                *flags |= DCB_FEATCFG_ERROR;
                        break;
                case DCB_FEATCFG_ATTR_PFC:
                        if (bp->dcbx_local_feat.pfc.enabled)
                                *flags |= DCB_FEATCFG_ENABLE;
                        if (bp->dcbx_error & (DCBX_LOCAL_PFC_ERROR |
-                            DCBX_LOCAL_PFC_MISMATCH))
+                                              DCBX_LOCAL_PFC_MISMATCH |
+                                              DCBX_REMOTE_MIB_ERROR))
                                *flags |= DCB_FEATCFG_ERROR;
                        break;
                case DCB_FEATCFG_ATTR_APP:
                        if (bp->dcbx_local_feat.app.enabled)
                                *flags |= DCB_FEATCFG_ENABLE;
                        if (bp->dcbx_error & (DCBX_LOCAL_APP_ERROR |
-                            DCBX_LOCAL_APP_MISMATCH))
+                                              DCBX_LOCAL_APP_MISMATCH |
+                                              DCBX_REMOTE_MIB_ERROR))
                                *flags |= DCB_FEATCFG_ERROR;
                        break;
                default:
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.h
index 125bd1b6586f..804b8f64463e 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.h
@@ -199,4 +199,7 @@ extern const struct dcbnl_rtnl_ops bnx2x_dcbnl_ops;
 int bnx2x_dcbnl_update_applist(struct bnx2x *bp, bool delall);
 #endif /* BCM_DCBNL */
+int bnx2x_dcbx_stop_hw_tx(struct bnx2x *bp);
+int bnx2x_dcbx_resume_hw_tx(struct bnx2x *bp);
 #endif /* BNX2X_DCB_H */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 955d6cfd9cb7..1627a4e09c32 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -2261,6 +2261,23 @@ static void bnx2x_set_requested_fc(struct bnx2x *bp)
                bp->link_params.req_fc_auto_adv = BNX2X_FLOW_CTRL_BOTH;
 }
+static void bnx2x_init_dropless_fc(struct bnx2x *bp)
+{
+        u32 pause_enabled = 0;
+        if (!CHIP_IS_E1(bp) && bp->dropless_fc && bp->link_vars.link_up) {
+                if (bp->link_vars.flow_ctrl & BNX2X_FLOW_CTRL_TX)
+                        pause_enabled = 1;
+                REG_WR(bp, BAR_USTRORM_INTMEM +
+                           USTORM_ETH_PAUSE_ENABLED_OFFSET(BP_PORT(bp)),
+                       pause_enabled);
+        }
+        DP(NETIF_MSG_IFUP | NETIF_MSG_LINK, "dropless_fc is %s\n",
+           pause_enabled ? "enabled" : "disabled");
+}
 int bnx2x_initial_phy_init(struct bnx2x *bp, int load_mode)
 {
        int rc, cfx_idx = bnx2x_get_link_cfg_idx(bp);
@@ -2294,6 +2311,8 @@ int bnx2x_initial_phy_init(struct bnx2x *bp, int load_mode)
                bnx2x_release_phy_lock(bp);
+                bnx2x_init_dropless_fc(bp);
                bnx2x_calc_fc_adv(bp);
                if (bp->link_vars.link_up) {
@@ -2315,6 +2334,8 @@ void bnx2x_link_set(struct bnx2x *bp)
                bnx2x_phy_init(&bp->link_params, &bp->link_vars);
                bnx2x_release_phy_lock(bp);
+                bnx2x_init_dropless_fc(bp);
                bnx2x_calc_fc_adv(bp);
        } else
                BNX2X_ERR("Bootcode is missing - can not set link\n");
@@ -2556,20 +2577,9 @@ static void bnx2x_link_attn(struct bnx2x *bp)
        bnx2x_link_update(&bp->link_params, &bp->link_vars);
-        if (bp->link_vars.link_up) {
+        bnx2x_init_dropless_fc(bp);
-                /* dropless flow control */
+        if (bp->link_vars.link_up) {
-                if (!CHIP_IS_E1(bp) && bp->dropless_fc) {
-                        int port = BP_PORT(bp);
-                        u32 pause_enabled = 0;
-                        if (bp->link_vars.flow_ctrl & BNX2X_FLOW_CTRL_TX)
-                                pause_enabled = 1;
-                        REG_WR(bp, BAR_USTRORM_INTMEM +
-                               USTORM_ETH_PAUSE_ENABLED_OFFSET(port),
-                               pause_enabled);
-                }
                if (bp->link_vars.mac_type != MAC_TYPE_EMAC) {
                        struct host_port_stats *pstats;
@@ -7845,12 +7855,15 @@ void bnx2x_free_mem(struct bnx2x *bp)
 {
        int i;
-        BNX2X_PCI_FREE(bp->def_status_blk, bp->def_status_blk_mapping,
-                       sizeof(struct host_sp_status_block));
        BNX2X_PCI_FREE(bp->fw_stats, bp->fw_stats_mapping,
                       bp->fw_stats_data_sz + bp->fw_stats_req_sz);
+        if (IS_VF(bp))
+                return;
+        BNX2X_PCI_FREE(bp->def_status_blk, bp->def_status_blk_mapping,
+                       sizeof(struct host_sp_status_block));
        BNX2X_PCI_FREE(bp->slowpath, bp->slowpath_mapping,
                       sizeof(struct bnx2x_slowpath));
@@ -9645,6 +9658,12 @@ sp_rtnl_not_reset:
                               &bp->sp_rtnl_state))
                bnx2x_pf_set_vfs_vlan(bp);
+        if (test_and_clear_bit(BNX2X_SP_RTNL_TX_STOP, &bp->sp_rtnl_state))
+                bnx2x_dcbx_stop_hw_tx(bp);
+        if (test_and_clear_bit(BNX2X_SP_RTNL_TX_RESUME, &bp->sp_rtnl_state))
+                bnx2x_dcbx_resume_hw_tx(bp);
        /* work which needs rtnl lock not-taken (as it takes the lock itself and
         * can be called from other contexts as well)
         */
@@ -11147,6 +11166,9 @@ static bool bnx2x_get_dropless_info(struct bnx2x *bp)
        int tmp;
        u32 cfg;
+        if (IS_VF(bp))
+                return 0;
        if (IS_MF(bp) && !CHIP_IS_E1x(bp)) {
                /* Take function: tmp = func */
                tmp = BP_ABS_FUNC(bp);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 44104fb27947..e8706e19f96f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -522,23 +522,6 @@ static int bnx2x_vfop_set_user_req(struct bnx2x *bp,
        return 0;
 }
-static int
-bnx2x_vfop_config_vlan0(struct bnx2x *bp,
-                        struct bnx2x_vlan_mac_ramrod_params *vlan_mac,
-                        bool add)
-{
-        int rc;
-        vlan_mac->user_req.cmd = add ? BNX2X_VLAN_MAC_ADD :
-                BNX2X_VLAN_MAC_DEL;
-        vlan_mac->user_req.u.vlan.vlan = 0;
-        rc = bnx2x_config_vlan_mac(bp, vlan_mac);
-        if (rc == -EEXIST)
-                rc = 0;
-        return rc;
-}
 static int bnx2x_vfop_config_list(struct bnx2x *bp,
                                  struct bnx2x_vfop_filters *filters,
                                  struct bnx2x_vlan_mac_ramrod_params *vlan_mac)
@@ -643,30 +626,14 @@ static void bnx2x_vfop_vlan_mac(struct bnx2x *bp, struct bnx2x_virtf *vf)
        case BNX2X_VFOP_VLAN_CONFIG_LIST:
                /* next state */
-                vfop->state = BNX2X_VFOP_VLAN_CONFIG_LIST_0;
+                vfop->state = BNX2X_VFOP_VLAN_MAC_CHK_DONE;
-                /* remove vlan0 - could be no-op */
-                vfop->rc = bnx2x_vfop_config_vlan0(bp, vlan_mac, false);
-                if (vfop->rc)
-                        goto op_err;
-                /* Do vlan list config. if this operation fails we try to
+                /* do list config */
-                 * restore vlan0 to keep the queue is working order
-                 */
                vfop->rc = bnx2x_vfop_config_list(bp, filters, vlan_mac);
                if (!vfop->rc) {
                        set_bit(RAMROD_CONT, &vlan_mac->ramrod_flags);
                        vfop->rc = bnx2x_config_vlan_mac(bp, vlan_mac);
                }
-                bnx2x_vfop_finalize(vf, vfop->rc, VFOP_CONT); /* fall-through */
-        case BNX2X_VFOP_VLAN_CONFIG_LIST_0:
-                /* next state */
-                vfop->state = BNX2X_VFOP_VLAN_MAC_CHK_DONE;
-                if (list_empty(&obj->head))
-                        /* add vlan0 */
-                        vfop->rc = bnx2x_vfop_config_vlan0(bp, vlan_mac, true);
                bnx2x_vfop_finalize(vf, vfop->rc, VFOP_DONE);
        default:
@@ -1747,11 +1714,8 @@ void bnx2x_iov_init_dq(struct bnx2x *bp)
 void bnx2x_iov_init_dmae(struct bnx2x *bp)
 {
-        DP(BNX2X_MSG_IOV, "SRIOV is %s\n", IS_SRIOV(bp) ? "ON" : "OFF");
+        if (pci_find_ext_capability(bp->pdev, PCI_EXT_CAP_ID_SRIOV))
-        if (!IS_SRIOV(bp))
+                REG_WR(bp, DMAE_REG_BACKWARD_COMP_EN, 0);
-                return;
-        REG_WR(bp, DMAE_REG_BACKWARD_COMP_EN, 0);
 }
 static int bnx2x_vf_bus(struct bnx2x *bp, int vfid)
@@ -2822,6 +2786,18 @@ int bnx2x_vf_init(struct bnx2x *bp, struct bnx2x_virtf *vf, dma_addr_t *sb_map)
        return 0;
 }
+struct set_vf_state_cookie {
+        struct bnx2x_virtf *vf;
+        u8 state;
+};
+void bnx2x_set_vf_state(void *cookie)
+{
+        struct set_vf_state_cookie *p = (struct set_vf_state_cookie *)cookie;
+        p->vf->state = p->state;
+}
 /* VFOP close (teardown the queues, delete mcasts and close HW) */
 static void bnx2x_vfop_close(struct bnx2x *bp, struct bnx2x_virtf *vf)
 {
@@ -2872,7 +2848,19 @@ static void bnx2x_vfop_close(struct bnx2x *bp, struct bnx2x_virtf *vf)
 op_err:
        BNX2X_ERR("VF[%d] CLOSE error: rc %d\n", vf->abs_vfid, vfop->rc);
 op_done:
-        vf->state = VF_ACQUIRED;
+        /* need to make sure there are no outstanding stats ramrods which may
+         * cause the device to access the VF's stats buffer which it will free
+         * as soon as we return from the close flow.
+         */
+        {
+                struct set_vf_state_cookie cookie;
+                cookie.vf = vf;
+                cookie.state = VF_ACQUIRED;
+                bnx2x_stats_safe_exec(bp, bnx2x_set_vf_state, &cookie);
+        }
        DP(BNX2X_MSG_IOV, "set state to acquired\n");
        bnx2x_vfop_end(bp, vf, vfop);
 }
@@ -3084,8 +3072,9 @@ void bnx2x_disable_sriov(struct bnx2x *bp)
        pci_disable_sriov(bp->pdev);
 }
-static int bnx2x_vf_ndo_sanity(struct bnx2x *bp, int vfidx,
+static int bnx2x_vf_ndo_prep(struct bnx2x *bp, int vfidx,
-                               struct bnx2x_virtf *vf)
+                             struct bnx2x_virtf **vf,
+                             struct pf_vf_bulletin_content **bulletin)
 {
        if (bp->state != BNX2X_STATE_OPEN) {
                BNX2X_ERR("vf ndo called though PF is down\n");
@@ -3103,12 +3092,22 @@ static int bnx2x_vf_ndo_sanity(struct bnx2x *bp, int vfidx,
                return -EINVAL;
        }
-        if (!vf) {
+        /* init members */
+        *vf = BP_VF(bp, vfidx);
+        *bulletin = BP_VF_BULLETIN(bp, vfidx);
+        if (!*vf) {
                BNX2X_ERR("vf ndo called but vf was null. vfidx was %d\n",
                          vfidx);
                return -EINVAL;
        }
+        if (!*bulletin) {
+                BNX2X_ERR("vf ndo called but Bulletin Board struct is null. vfidx was %d\n",
+                          vfidx);
+                return -EINVAL;
+        }
        return 0;
 }
@@ -3116,17 +3115,19 @@ int bnx2x_get_vf_config(struct net_device *dev, int vfidx,
                        struct ifla_vf_info *ivi)
 {
        struct bnx2x *bp = netdev_priv(dev);
-        struct bnx2x_virtf *vf = BP_VF(bp, vfidx);
+        struct bnx2x_virtf *vf = NULL;
-        struct bnx2x_vlan_mac_obj *mac_obj = &bnx2x_vfq(vf, 0, mac_obj);
+        struct pf_vf_bulletin_content *bulletin = NULL;
-        struct bnx2x_vlan_mac_obj *vlan_obj = &bnx2x_vfq(vf, 0, vlan_obj);
+        struct bnx2x_vlan_mac_obj *mac_obj;
-        struct pf_vf_bulletin_content *bulletin = BP_VF_BULLETIN(bp, vfidx);
+        struct bnx2x_vlan_mac_obj *vlan_obj;
        int rc;
-        /* sanity */
+        /* sanity and init */
-        rc = bnx2x_vf_ndo_sanity(bp, vfidx, vf);
+        rc = bnx2x_vf_ndo_prep(bp, vfidx, &vf, &bulletin);
        if (rc)
                return rc;
-        if (!mac_obj || !vlan_obj || !bulletin) {
+        mac_obj = &bnx2x_vfq(vf, 0, mac_obj);
+        vlan_obj = &bnx2x_vfq(vf, 0, vlan_obj);
+        if (!mac_obj || !vlan_obj) {
                BNX2X_ERR("VF partially initialized\n");
                return -EINVAL;
        }
@@ -3183,11 +3184,11 @@ int bnx2x_set_vf_mac(struct net_device *dev, int vfidx, u8 *mac)
 {
        struct bnx2x *bp = netdev_priv(dev);
        int rc, q_logical_state;
-        struct bnx2x_virtf *vf = BP_VF(bp, vfidx);
+        struct bnx2x_virtf *vf = NULL;
-        struct pf_vf_bulletin_content *bulletin = BP_VF_BULLETIN(bp, vfidx);
+        struct pf_vf_bulletin_content *bulletin = NULL;
-        /* sanity */
+        /* sanity and init */
-        rc = bnx2x_vf_ndo_sanity(bp, vfidx, vf);
+        rc = bnx2x_vf_ndo_prep(bp, vfidx, &vf, &bulletin);
        if (rc)
                return rc;
        if (!is_valid_ether_addr(mac)) {
@@ -3249,11 +3250,11 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
 {
        struct bnx2x *bp = netdev_priv(dev);
        int rc, q_logical_state;
-        struct bnx2x_virtf *vf = BP_VF(bp, vfidx);
+        struct bnx2x_virtf *vf = NULL;
-        struct pf_vf_bulletin_content *bulletin = BP_VF_BULLETIN(bp, vfidx);
+        struct pf_vf_bulletin_content *bulletin = NULL;
-        /* sanity */
+        /* sanity and init */
-        rc = bnx2x_vf_ndo_sanity(bp, vfidx, vf);
+        rc = bnx2x_vf_ndo_prep(bp, vfidx, &vf, &bulletin);
        if (rc)
                return rc;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index d63d1327b051..86436c77af03 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -522,20 +522,16 @@ static void bnx2x_func_stats_init(struct bnx2x *bp)
 /* should be called under stats_sema */
 static void __bnx2x_stats_start(struct bnx2x *bp)
 {
-        /* vfs travel through here as part of the statistics FSM, but no action
+        if (IS_PF(bp)) {
-         * is required
+                if (bp->port.pmf)
-         */
+                        bnx2x_port_stats_init(bp);
-        if (IS_VF(bp))
-                return;
-        if (bp->port.pmf)
-                bnx2x_port_stats_init(bp);
-        else if (bp->func_stx)
+                else if (bp->func_stx)
-                bnx2x_func_stats_init(bp);
+                        bnx2x_func_stats_init(bp);
-        bnx2x_hw_stats_post(bp);
+                bnx2x_hw_stats_post(bp);
-        bnx2x_storm_stats_post(bp);
+                bnx2x_storm_stats_post(bp);
+        }
        bp->stats_started = true;
 }
@@ -1997,3 +1993,14 @@ void bnx2x_afex_collect_stats(struct bnx2x *bp, void *void_afex_stats,
                       estats->mac_discard);
        }
 }
+void bnx2x_stats_safe_exec(struct bnx2x *bp,
+                           void (func_to_exec)(void *cookie),
+                           void *cookie){
+        if (down_timeout(&bp->stats_sema, HZ/10))
+                BNX2X_ERR("Unable to acquire stats lock\n");
+        bnx2x_stats_comp(bp);
+        func_to_exec(cookie);
+        __bnx2x_stats_start(bp);
+        up(&bp->stats_sema);
+}
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
index 853824d258e8..f35845006cdd 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
@@ -539,6 +539,9 @@ struct bnx2x;
 void bnx2x_memset_stats(struct bnx2x *bp);
 void bnx2x_stats_init(struct bnx2x *bp);
 void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event);
+void bnx2x_stats_safe_exec(struct bnx2x *bp,
+                           void (func_to_exec)(void *cookie),
+                           void *cookie);
 /**
 * bnx2x_save_statistics - save statistics when unloading.
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 181edb522450..3d91a5ec61a4 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2563,8 +2563,8 @@ static int be_close(struct net_device *netdev)
        /* Wait for all pending tx completions to arrive so that
         * all tx skbs are freed.
         */
-        be_tx_compl_clean(adapter);
        netif_tx_disable(netdev);
+        be_tx_compl_clean(adapter);
        be_rx_qs_destroy(adapter);
@@ -4373,6 +4373,10 @@ static int be_resume(struct pci_dev *pdev)
        pci_set_power_state(pdev, PCI_D0);
        pci_restore_state(pdev);
+        status = be_fw_wait_ready(adapter);
+        if (status)
+                return status;
        /* tell fw we're ready to fire cmds */
        status = be_cmd_fw_init(adapter);
        if (status)
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 77ea0db0bbfc..c610a2716be4 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -971,8 +971,7 @@ fec_enet_rx(struct net_device *ndev, int budget)
                                                       htons(ETH_P_8021Q),
                                                       vlan_tag);
-                        if (!skb_defer_rx_timestamp(skb))
+                        napi_gro_receive(&fep->napi, skb);
-                                napi_gro_receive(&fep->napi, skb);
                }
                bdp->cbd_bufaddr = dma_map_single(&fep->pdev->dev, data,
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 7fbe6abf6054..23de82a9da82 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -3069,7 +3069,7 @@ jme_init_one(struct pci_dev *pdev,
                jwrite32(jme, JME_APMC, apmc);
        }
-        NETIF_NAPI_SET(netdev, &jme->napi, jme_poll, jme->rx_ring_size >> 2)
+        NETIF_NAPI_SET(netdev, &jme->napi, jme_poll, NAPI_POLL_WEIGHT)
        spin_lock_init(&jme->phy_lock);
        spin_lock_init(&jme->macaddr_lock);
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic.h b/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
index 3fe09ab2d7c9..32675e16021e 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
@@ -1171,7 +1171,6 @@ typedef struct {
 #define NETXEN_DB_MAPSIZE_BYTES         0x1000
-#define NETXEN_NETDEV_WEIGHT 128
 #define NETXEN_ADAPTER_UP_MAGIC 777
 #define NETXEN_NIC_PEG_TUNE 0
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index c401b0b4353d..ec4cf7fd4123 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -197,7 +197,7 @@ netxen_napi_add(struct netxen_adapter *adapter, struct net_device *netdev)
        for (ring = 0; ring < adapter->max_sds_rings; ring++) {
                sds_ring = &recv_ctx->sds_rings[ring];
                netif_napi_add(netdev, &sds_ring->napi,
-                                netxen_nic_poll, NETXEN_NETDEV_WEIGHT);
+                                netxen_nic_poll, NAPI_POLL_WEIGHT);
        }
        return 0;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index b5eb4195fc99..85e5c97191dd 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -7088,7 +7088,7 @@ rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        RTL_W8(Cfg9346, Cfg9346_Unlock);
        RTL_W8(Config1, RTL_R8(Config1) | PMEnable);
-        RTL_W8(Config5, RTL_R8(Config5) & PMEStatus);
+        RTL_W8(Config5, RTL_R8(Config5) & (BWF | MWF | UWF | LanWake | PMEStatus));
        if ((RTL_R8(Config3) & (LinkUp | MagicPacket)) != 0)
                tp->features |= RTL_FEATURE_WOL;
        if ((RTL_R8(Config5) & (UWF | BWF | MWF)) != 0)
diff --git a/drivers/net/ethernet/sfc/filter.c b/drivers/net/ethernet/sfc/filter.c
index 2a469b27a506..30d744235d27 100644
--- a/drivers/net/ethernet/sfc/filter.c
+++ b/drivers/net/ethernet/sfc/filter.c
@@ -675,7 +675,7 @@ s32 efx_filter_insert_filter(struct efx_nic *efx, struct efx_filter_spec *spec,
                BUILD_BUG_ON(EFX_FILTER_INDEX_UC_DEF != 0);
                BUILD_BUG_ON(EFX_FILTER_INDEX_MC_DEF !=
                             EFX_FILTER_MC_DEF - EFX_FILTER_UC_DEF);
-                rep_index = spec->type - EFX_FILTER_INDEX_UC_DEF;
+                rep_index = spec->type - EFX_FILTER_UC_DEF;
                ins_index = rep_index;
                spin_lock_bh(&state->lock);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 03de76c7a177..1c83a44c547b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -71,14 +71,18 @@ static int stmmac_probe_config_dt(struct platform_device *pdev,
                plat->force_sf_dma_mode = 1;
        }
-        dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*dma_cfg), GFP_KERNEL);
+        if (of_find_property(np, "snps,pbl", NULL)) {
-        if (!dma_cfg)
+                dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*dma_cfg),
-                return -ENOMEM;
+                                       GFP_KERNEL);
+                if (!dma_cfg)
-        plat->dma_cfg = dma_cfg;
+                        return -ENOMEM;
-        of_property_read_u32(np, "snps,pbl", &dma_cfg->pbl);
+                plat->dma_cfg = dma_cfg;
-        dma_cfg->fixed_burst = of_property_read_bool(np, "snps,fixed-burst");
+                of_property_read_u32(np, "snps,pbl", &dma_cfg->pbl);
-        dma_cfg->mixed_burst = of_property_read_bool(np, "snps,mixed-burst");
+                dma_cfg->fixed_burst =
+                        of_property_read_bool(np, "snps,fixed-burst");
+                dma_cfg->mixed_burst =
+                        of_property_read_bool(np, "snps,mixed-burst");
+        }
        return 0;
 }
diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
index ad32af67e618..9c805e0c0cae 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
@@ -1466,8 +1466,7 @@ static void gelic_ether_setup_netdev_ops(struct net_device *netdev,
 {
        netdev->watchdog_timeo = GELIC_NET_WATCHDOG_TIMEOUT;
        /* NAPI */
-        netif_napi_add(netdev, napi,
+        netif_napi_add(netdev, napi, gelic_net_poll, NAPI_POLL_WEIGHT);
-                       gelic_net_poll, GELIC_NET_NAPI_WEIGHT);
        netdev->ethtool_ops = &gelic_ether_ethtool_ops;
        netdev->netdev_ops = &gelic_netdevice_ops;
 }
diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
index a93df6ac1909..309abb472aa2 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
@@ -37,7 +37,6 @@
 #define GELIC_NET_RXBUF_ALIGN           128
 #define GELIC_CARD_RX_CSUM_DEFAULT      1 /* hw chksum */
 #define GELIC_NET_WATCHDOG_TIMEOUT      5*HZ
-#define GELIC_NET_NAPI_WEIGHT           (GELIC_NET_RX_DESCRIPTORS)
 #define GELIC_NET_BROADCAST_ADDR        0xffffffffffffL
 #define GELIC_NET_MC_COUNT_MAX          32 /* multicast address list */
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c b/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
index e90e1f46121e..64b4639f43b6 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
@@ -175,6 +175,7 @@ int axienet_mdio_setup(struct axienet_local *lp, struct device_node *np)
                printk(KERN_WARNING "Setting MDIO clock divisor to "
                       "default %d\n", DEFAULT_CLOCK_DIVISOR);
                clk_div = DEFAULT_CLOCK_DIVISOR;
+                of_node_put(np1);
                goto issue;
        }
diff --git a/drivers/net/irda/via-ircc.c b/drivers/net/irda/via-ircc.c
index 51f2bc376101..2dcc60fb37f1 100644
--- a/drivers/net/irda/via-ircc.c
+++ b/drivers/net/irda/via-ircc.c
@@ -210,8 +210,7 @@ static int via_init_one(struct pci_dev *pcidev, const struct pci_device_id *id)
                        pci_write_config_byte(pcidev,0x42,(bTmp | 0xf0));
                        pci_write_config_byte(pcidev,0x5a,0xc0);
                        WriteLPCReg(0x28, 0x70 );
-                        if (via_ircc_open(pcidev, &info, 0x3076) == 0)
+                        rc = via_ircc_open(pcidev, &info, 0x3076);
-                                rc=0;
                } else
                        rc = -ENODEV; //IR not turn on   
        } else { //Not VT1211
@@ -249,8 +248,7 @@ static int via_init_one(struct pci_dev *pcidev, const struct pci_device_id *id)
                        info.irq=FirIRQ;
                        info.dma=FirDRQ1;
                        info.dma2=FirDRQ0;
-                        if (via_ircc_open(pcidev, &info, 0x3096) == 0)
+                        rc = via_ircc_open(pcidev, &info, 0x3096);
-                                rc=0;
                } else
                        rc = -ENODEV; //IR not turn on !!!!!
        }//Not VT1211
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index b51db2abfe44..ea53abb20988 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -68,6 +68,8 @@ static const struct proto_ops macvtap_socket_ops;
 #define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \
                      NETIF_F_TSO6 | NETIF_F_UFO)
 #define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO)
+#define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG)
 /*
 * RCU usage:
 * The macvtap_queue and the macvlan_dev are loosely coupled, the
@@ -278,7 +280,8 @@ static int macvtap_forward(struct net_device *dev, struct sk_buff *skb)
 {
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct macvtap_queue *q = macvtap_get_queue(dev, skb);
-        netdev_features_t features;
+        netdev_features_t features = TAP_FEATURES;
        if (!q)
                goto drop;
@@ -287,9 +290,11 @@ static int macvtap_forward(struct net_device *dev, struct sk_buff *skb)
        skb->dev = dev;
        /* Apply the forward feature mask so that we perform segmentation
-         * according to users wishes.
+         * according to users wishes.  This only works if VNET_HDR is
+         * enabled.
         */
-        features = netif_skb_features(skb) & vlan->tap_features;
+        if (q->flags & IFF_VNET_HDR)
+                features |= vlan->tap_features;
        if (netif_needs_gso(skb, features)) {
                struct sk_buff *segs = __skb_gso_segment(skb, features, false);
@@ -1064,8 +1069,7 @@ static int set_offload(struct macvtap_queue *q, unsigned long arg)
        /* tap_features are the same as features on tun/tap and
         * reflect user expectations.
         */
-        vlan->tap_features = vlan->dev->features &
+        vlan->tap_features = feature_mask;
-                            (feature_mask | ~TUN_OFFLOADS);
        vlan->set_features = features;
        netdev_update_features(vlan->dev);
@@ -1161,10 +1165,6 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
                            TUN_F_TSO_ECN | TUN_F_UFO))
                        return -EINVAL;
-                /* TODO: only accept frames with the features that
-                         got enabled for forwarded frames */
-                if (!(q->flags & IFF_VNET_HDR))
-                        return  -EINVAL;
                rtnl_lock();
                ret = set_offload(q, arg);
                rtnl_unlock();
diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
index 8e7af8354342..138de837977f 100644
--- a/drivers/net/phy/realtek.c
+++ b/drivers/net/phy/realtek.c
@@ -23,7 +23,7 @@
 #define RTL821x_INER_INIT       0x6400
 #define RTL821x_INSR            0x13
-#define RTL8211E_INER_LINK_STAT 0x10
+#define RTL8211E_INER_LINK_STATUS       0x400
 MODULE_DESCRIPTION("Realtek PHY driver");
 MODULE_AUTHOR("Johnson Leung");
@@ -57,7 +57,7 @@ static int rtl8211e_config_intr(struct phy_device *phydev)
        if (phydev->interrupts == PHY_INTERRUPT_ENABLED)
                err = phy_write(phydev, RTL821x_INER,
-                                RTL8211E_INER_LINK_STAT);
+                                RTL8211E_INER_LINK_STATUS);
        else
                err = phy_write(phydev, RTL821x_INER, 0);
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 872819851aef..25ba7eca9a13 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -400,6 +400,10 @@ static const struct usb_device_id mbim_devs[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68a2, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
          .driver_info = (unsigned long)&cdc_mbim_info_zlp,
        },
+        /* HP hs2434 Mobile Broadband Module needs ZLPs */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x3f0, 0x4b1d, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&cdc_mbim_info_zlp,
+        },
        { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
          .driver_info = (unsigned long)&cdc_mbim_info,
        },
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index cba1d46e672e..86292e6aaf49 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2816,13 +2816,16 @@ exit:
 static int hso_get_config_data(struct usb_interface *interface)
 {
        struct usb_device *usbdev = interface_to_usbdev(interface);
-        u8 config_data[17];
+        u8 *config_data = kmalloc(17, GFP_KERNEL);
        u32 if_num = interface->altsetting->desc.bInterfaceNumber;
        s32 result;
+        if (!config_data)
+                return -ENOMEM;
        if (usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
                            0x86, 0xC0, 0, 0, config_data, 17,
                            USB_CTRL_SET_TIMEOUT) != 0x11) {
+                kfree(config_data);
                return -EIO;
        }
@@ -2873,6 +2876,7 @@ static int hso_get_config_data(struct usb_interface *interface)
        if (config_data[16] & 0x1)
                result |= HSO_INFO_CRC_BUG;
+        kfree(config_data);
        return result;
 }
@@ -2886,6 +2890,11 @@ static int hso_probe(struct usb_interface *interface,
        struct hso_shared_int *shared_int;
        struct hso_device *tmp_dev = NULL;
+        if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) {
+                dev_err(&interface->dev, "Not our interface\n");
+                return -ENODEV;
+        }
        if_num = interface->altsetting->desc.bInterfaceNumber;
        /* Get the interface/port specification from either driver_info or from
@@ -2895,10 +2904,6 @@ static int hso_probe(struct usb_interface *interface,
        else
                port_spec = hso_get_config_data(interface);
-        if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) {
-                dev_err(&interface->dev, "Not our interface\n");
-                return -ENODEV;
-        }
        /* Check if we need to switch to alt interfaces prior to port
         * configuration */
        if (interface->num_altsetting > 1)
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index e602c9519709..c028df76b564 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -448,6 +448,7 @@ static void ath9k_htc_tx_process(struct ath9k_htc_priv *priv,
        struct ieee80211_conf *cur_conf = &priv->hw->conf;
        bool txok;
        int slot;
+        int hdrlen, padsize;
        slot = strip_drv_header(priv, skb);
        if (slot < 0) {
@@ -504,6 +505,15 @@ send_mac80211:
        ath9k_htc_tx_clear_slot(priv, slot);
+        /* Remove padding before handing frame back to mac80211 */
+        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+        padsize = hdrlen & 3;
+        if (padsize && skb->len > hdrlen + padsize) {
+                memmove(skb->data + padsize, skb->data, hdrlen);
+                skb_pull(skb, padsize);
+        }
        /* Send status to mac80211 */
        ieee80211_tx_status(priv->hw, skb);
 }
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 16f8b201642b..026a2a067b46 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -802,7 +802,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                IEEE80211_HW_PS_NULLFUNC_STACK |
                IEEE80211_HW_SPECTRUM_MGMT |
                IEEE80211_HW_REPORTS_TX_ACK_STATUS |
-                IEEE80211_HW_SUPPORTS_RC_TABLE;
+                IEEE80211_HW_SUPPORTS_RC_TABLE |
+                IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
                hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 1737a3e33685..cb5a65553ac7 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -173,8 +173,7 @@ static void ath_restart_work(struct ath_softc *sc)
 {
        ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
-        if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9485(sc->sc_ah) ||
+        if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9330(sc->sc_ah))
-            AR_SREV_9550(sc->sc_ah))
                ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
                                     msecs_to_jiffies(ATH_PLL_WORK_INTERVAL));
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 4a33c6e39ca2..349fa22a921a 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1860,7 +1860,8 @@ void *carl9170_alloc(size_t priv_size)
                     IEEE80211_HW_PS_NULLFUNC_STACK |
                     IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC |
                     IEEE80211_HW_SUPPORTS_RC_TABLE |
-                     IEEE80211_HW_SIGNAL_DBM;
+                     IEEE80211_HW_SIGNAL_DBM |
+                     IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
        if (!modparam_noht) {
                /*
diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
index ac074731335a..e5090309824e 100644
--- a/drivers/net/wireless/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
@@ -523,9 +523,9 @@ static int prism2_ioctl_giwaplist(struct net_device *dev,
        data->length = prism2_ap_get_sta_qual(local, addr, qual, IW_MAX_AP, 1);
-        memcpy(extra, &addr, sizeof(struct sockaddr) * data->length);
+        memcpy(extra, addr, sizeof(struct sockaddr) * data->length);
        data->flags = 1; /* has quality information */
-        memcpy(extra + sizeof(struct sockaddr) * data->length, &qual,
+        memcpy(extra + sizeof(struct sockaddr) * data->length, qual,
               sizeof(struct iw_quality) * data->length);
        kfree(addr);
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index f2ed62e37340..7acf5ee23582 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -4464,9 +4464,9 @@ il4965_irq_tasklet(struct il_priv *il)
                        set_bit(S_RFKILL, &il->status);
                } else {
                        clear_bit(S_RFKILL, &il->status);
-                        wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill);
                        il_force_reset(il, true);
                }
+                wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill);
                handled |= CSR_INT_BIT_RF_KILL;
        }
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 822f1a00efbb..319387263e12 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1068,7 +1068,10 @@ void iwl_chswitch_done(struct iwl_priv *priv, bool is_success)
        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                return;
-        if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+        if (!test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+                return;
+        if (ctx->vif)
                ieee80211_chswitch_done(ctx->vif, is_success);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index a70c7b9d9bad..ff8cc75c189d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -97,8 +97,6 @@
 #define APMG_PCIDEV_STT_VAL_L1_ACT_DIS          (0x00000800)
-#define APMG_RTC_INT_STT_RFKILL         (0x10000000)
 /* Device system time */
 #define DEVICE_SYSTEM_TIME_REG 0xA0206C
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index ad9bbca99213..7fd6fbfbc1b3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -138,6 +138,20 @@ static void iwl_mvm_roc_finished(struct iwl_mvm *mvm)
        schedule_work(&mvm->roc_done_wk);
 }
+static bool iwl_mvm_te_check_disconnect(struct iwl_mvm *mvm,
+                                        struct ieee80211_vif *vif,
+                                        const char *errmsg)
+{
+        if (vif->type != NL80211_IFTYPE_STATION)
+                return false;
+        if (vif->bss_conf.assoc && vif->bss_conf.dtim_period)
+                return false;
+        if (errmsg)
+                IWL_ERR(mvm, "%s\n", errmsg);
+        ieee80211_connection_loss(vif);
+        return true;
+}
 /*
 * Handles a FW notification for an event that is known to the driver.
 *
@@ -163,8 +177,13 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
         * P2P Device discoveribility, while there are other higher priority
         * events in the system).
         */
-        WARN_ONCE(!le32_to_cpu(notif->status),
+        if (WARN_ONCE(!le32_to_cpu(notif->status),
-                  "Failed to schedule time event\n");
+                      "Failed to schedule time event\n")) {
+                if (iwl_mvm_te_check_disconnect(mvm, te_data->vif, NULL)) {
+                        iwl_mvm_te_clear_data(mvm, te_data);
+                        return;
+                }
+        }
        if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_END) {
                IWL_DEBUG_TE(mvm,
@@ -180,14 +199,8 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
                 * By now, we should have finished association
                 * and know the dtim period.
                 */
-                if (te_data->vif->type == NL80211_IFTYPE_STATION &&
+                iwl_mvm_te_check_disconnect(mvm, te_data->vif,
-                    (!te_data->vif->bss_conf.assoc ||
+                        "No assocation and the time event is over already...");
-                     !te_data->vif->bss_conf.dtim_period)) {
-                        IWL_ERR(mvm,
-                                "No assocation and the time event is over already...\n");
-                        ieee80211_connection_loss(te_data->vif);
-                }
                iwl_mvm_te_clear_data(mvm, te_data);
        } else if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_START) {
                te_data->running = true;
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index f600e68a410a..fd848cd1583e 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -888,14 +888,6 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
                iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
                if (hw_rfkill) {
-                        /*
-                         * Clear the interrupt in APMG if the NIC is going down.
-                         * Note that when the NIC exits RFkill (else branch), we
-                         * can't access prph and the NIC will be reset in
-                         * start_hw anyway.
-                         */
-                        iwl_write_prph(trans, APMG_RTC_INT_STT_REG,
-                                       APMG_RTC_INT_STT_RFKILL);
                        set_bit(STATUS_RFKILL, &trans_pcie->status);
                        if (test_and_clear_bit(STATUS_HCMD_ACTIVE,
                                               &trans_pcie->status))
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 96cfcdd39079..390e2f058aff 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1502,16 +1502,16 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        spin_lock_init(&trans_pcie->reg_lock);
        init_waitqueue_head(&trans_pcie->ucode_write_waitq);
-        /* W/A - seems to solve weird behavior. We need to remove this if we
-         * don't want to stay in L1 all the time. This wastes a lot of power */
-        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
-                               PCIE_LINK_STATE_CLKPM);
        if (pci_enable_device(pdev)) {
                err = -ENODEV;
                goto out_no_pci;
        }
+        /* W/A - seems to solve weird behavior. We need to remove this if we
+         * don't want to stay in L1 all the time. This wastes a lot of power */
+        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
+                               PCIE_LINK_STATE_CLKPM);
        pci_set_master(pdev);
        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 1f80ea5e29dd..1b41c8eda12d 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -6133,7 +6133,8 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
            IEEE80211_HW_SUPPORTS_PS |
            IEEE80211_HW_PS_NULLFUNC_STACK |
            IEEE80211_HW_AMPDU_AGGREGATION |
-            IEEE80211_HW_REPORTS_TX_ACK_STATUS;
+            IEEE80211_HW_REPORTS_TX_ACK_STATUS |
+            IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
        /*
         * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING for USB devices
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index 4941f201d6c8..b8ba1f925e75 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -98,10 +98,12 @@ static int zd1201_fw_upload(struct usb_device *dev, int apfw)
                goto exit;
        err = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), 0x4,
-            USB_DIR_IN | 0x40, 0,0, &ret, sizeof(ret), ZD1201_FW_TIMEOUT);
+            USB_DIR_IN | 0x40, 0, 0, buf, sizeof(ret), ZD1201_FW_TIMEOUT);
        if (err < 0)
                goto exit;
+        memcpy(&ret, buf, sizeof(ret));
        if (ret & 0x80) {
                err = -EIO;
                goto exit;
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 6bb7cf2de556..b10ba00cc3e6 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -392,6 +392,8 @@ static void __unflatten_device_tree(struct boot_param_header *blob,
        mem = (unsigned long)
                dt_alloc(size + 4, __alignof__(struct device_node));
+        memset((void *)mem, 0, size);
        ((__be32 *)mem)[size / 4] = cpu_to_be32(0xdeadbeef);
        pr_debug("  unflattening %lx...\n", mem);
diff --git a/drivers/pinctrl/pinctrl-sunxi.c b/drivers/pinctrl/pinctrl-sunxi.c
index c47fd1e5450b..94716c779800 100644
--- a/drivers/pinctrl/pinctrl-sunxi.c
+++ b/drivers/pinctrl/pinctrl-sunxi.c
@@ -278,6 +278,7 @@ static int sunxi_pconf_group_set(struct pinctrl_dev *pctldev,
 {
        struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
        struct sunxi_pinctrl_group *g = &pctl->groups[group];
+        unsigned long flags;
        u32 val, mask;
        u16 strength;
        u8 dlevel;
@@ -295,22 +296,35 @@ static int sunxi_pconf_group_set(struct pinctrl_dev *pctldev,
                 *   3: 40mA
                 */
                dlevel = strength / 10 - 1;
+                spin_lock_irqsave(&pctl->lock, flags);
                val = readl(pctl->membase + sunxi_dlevel_reg(g->pin));
                mask = DLEVEL_PINS_MASK << sunxi_dlevel_offset(g->pin);
                writel((val & ~mask) | dlevel << sunxi_dlevel_offset(g->pin),
                        pctl->membase + sunxi_dlevel_reg(g->pin));
+                spin_unlock_irqrestore(&pctl->lock, flags);
                break;
        case PIN_CONFIG_BIAS_PULL_UP:
+                spin_lock_irqsave(&pctl->lock, flags);
                val = readl(pctl->membase + sunxi_pull_reg(g->pin));
                mask = PULL_PINS_MASK << sunxi_pull_offset(g->pin);
                writel((val & ~mask) | 1 << sunxi_pull_offset(g->pin),
                        pctl->membase + sunxi_pull_reg(g->pin));
+                spin_unlock_irqrestore(&pctl->lock, flags);
                break;
        case PIN_CONFIG_BIAS_PULL_DOWN:
+                spin_lock_irqsave(&pctl->lock, flags);
                val = readl(pctl->membase + sunxi_pull_reg(g->pin));
                mask = PULL_PINS_MASK << sunxi_pull_offset(g->pin);
                writel((val & ~mask) | 2 << sunxi_pull_offset(g->pin),
                        pctl->membase + sunxi_pull_reg(g->pin));
+                spin_unlock_irqrestore(&pctl->lock, flags);
                break;
        default:
                break;
@@ -360,11 +374,17 @@ static void sunxi_pmx_set(struct pinctrl_dev *pctldev,
                                 u8 config)
 {
        struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
+        unsigned long flags;
+        u32 val, mask;
+        spin_lock_irqsave(&pctl->lock, flags);
-        u32 val = readl(pctl->membase + sunxi_mux_reg(pin));
+        val = readl(pctl->membase + sunxi_mux_reg(pin));
-        u32 mask = MUX_PINS_MASK << sunxi_mux_offset(pin);
+        mask = MUX_PINS_MASK << sunxi_mux_offset(pin);
        writel((val & ~mask) | config << sunxi_mux_offset(pin),
                pctl->membase + sunxi_mux_reg(pin));
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 static int sunxi_pmx_enable(struct pinctrl_dev *pctldev,
@@ -464,8 +484,21 @@ static void sunxi_pinctrl_gpio_set(struct gpio_chip *chip,
        struct sunxi_pinctrl *pctl = dev_get_drvdata(chip->dev);
        u32 reg = sunxi_data_reg(offset);
        u8 index = sunxi_data_offset(offset);
+        unsigned long flags;
+        u32 regval;
+        spin_lock_irqsave(&pctl->lock, flags);
+        regval = readl(pctl->membase + reg);
-        writel((value & DATA_PINS_MASK) << index, pctl->membase + reg);
+        if (value)
+                regval |= BIT(index);
+        else
+                regval &= ~(BIT(index));
+        writel(regval, pctl->membase + reg);
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 static int sunxi_pinctrl_gpio_of_xlate(struct gpio_chip *gc,
@@ -526,6 +559,8 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d,
        struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
        u32 reg = sunxi_irq_cfg_reg(d->hwirq);
        u8 index = sunxi_irq_cfg_offset(d->hwirq);
+        unsigned long flags;
+        u32 regval;
        u8 mode;
        switch (type) {
@@ -548,7 +583,13 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d,
                return -EINVAL;
        }
-        writel((mode & IRQ_CFG_IRQ_MASK) << index, pctl->membase + reg);
+        spin_lock_irqsave(&pctl->lock, flags);
+        regval = readl(pctl->membase + reg);
+        regval &= ~IRQ_CFG_IRQ_MASK;
+        writel(regval | (mode << index), pctl->membase + reg);
+        spin_unlock_irqrestore(&pctl->lock, flags);
        return 0;
 }
@@ -560,14 +601,19 @@ static void sunxi_pinctrl_irq_mask_ack(struct irq_data *d)
        u8 ctrl_idx = sunxi_irq_ctrl_offset(d->hwirq);
        u32 status_reg = sunxi_irq_status_reg(d->hwirq);
        u8 status_idx = sunxi_irq_status_offset(d->hwirq);
+        unsigned long flags;
        u32 val;
+        spin_lock_irqsave(&pctl->lock, flags);
        /* Mask the IRQ */
        val = readl(pctl->membase + ctrl_reg);
        writel(val & ~(1 << ctrl_idx), pctl->membase + ctrl_reg);
        /* Clear the IRQ */
        writel(1 << status_idx, pctl->membase + status_reg);
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 static void sunxi_pinctrl_irq_mask(struct irq_data *d)
@@ -575,11 +621,16 @@ static void sunxi_pinctrl_irq_mask(struct irq_data *d)
        struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
        u32 reg = sunxi_irq_ctrl_reg(d->hwirq);
        u8 idx = sunxi_irq_ctrl_offset(d->hwirq);
+        unsigned long flags;
        u32 val;
+        spin_lock_irqsave(&pctl->lock, flags);
        /* Mask the IRQ */
        val = readl(pctl->membase + reg);
        writel(val & ~(1 << idx), pctl->membase + reg);
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 static void sunxi_pinctrl_irq_unmask(struct irq_data *d)
@@ -588,6 +639,7 @@ static void sunxi_pinctrl_irq_unmask(struct irq_data *d)
        struct sunxi_desc_function *func;
        u32 reg = sunxi_irq_ctrl_reg(d->hwirq);
        u8 idx = sunxi_irq_ctrl_offset(d->hwirq);
+        unsigned long flags;
        u32 val;
        func = sunxi_pinctrl_desc_find_function_by_pin(pctl,
@@ -597,9 +649,13 @@ static void sunxi_pinctrl_irq_unmask(struct irq_data *d)
        /* Change muxing to INT mode */
        sunxi_pmx_set(pctl->pctl_dev, pctl->irq_array[d->hwirq], func->muxval);
+        spin_lock_irqsave(&pctl->lock, flags);
        /* Unmask the IRQ */
        val = readl(pctl->membase + reg);
        writel(val | (1 << idx), pctl->membase + reg);
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 static struct irq_chip sunxi_pinctrl_irq_chip = {
@@ -752,6 +808,8 @@ static int sunxi_pinctrl_probe(struct platform_device *pdev)
                return -ENOMEM;
        platform_set_drvdata(pdev, pctl);
+        spin_lock_init(&pctl->lock);
        pctl->membase = of_iomap(node, 0);
        if (!pctl->membase)
                return -ENOMEM;
diff --git a/drivers/pinctrl/pinctrl-sunxi.h b/drivers/pinctrl/pinctrl-sunxi.h
index d68047d8f699..01c494f8a14f 100644
--- a/drivers/pinctrl/pinctrl-sunxi.h
+++ b/drivers/pinctrl/pinctrl-sunxi.h
@@ -14,6 +14,7 @@
 #define __PINCTRL_SUNXI_H
 #include <linux/kernel.h>
+#include <linux/spinlock.h>
 #define PA_BASE 0
 #define PB_BASE 32
@@ -407,6 +408,7 @@ struct sunxi_pinctrl {
        unsigned                        ngroups;
        int                             irq;
        int                             irq_array[SUNXI_IRQ_NUMBER];
+        spinlock_t                      lock;
        struct pinctrl_dev              *pctl_dev;
 };
diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c
index 0f9f8596b300..f9119525f557 100644
--- a/drivers/platform/olpc/olpc-ec.c
+++ b/drivers/platform/olpc/olpc-ec.c
@@ -330,7 +330,7 @@ static int __init olpc_ec_init_module(void)
        return platform_driver_register(&olpc_ec_plat_driver);
 }
-module_init(olpc_ec_init_module);
+arch_initcall(olpc_ec_init_module);
 MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 97bb05edcb5a..d6970f47ae72 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -53,7 +53,6 @@ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
 #define HPWMI_ALS_QUERY 0x3
 #define HPWMI_HARDWARE_QUERY 0x4
 #define HPWMI_WIRELESS_QUERY 0x5
-#define HPWMI_BIOS_QUERY 0x9
 #define HPWMI_HOTKEY_QUERY 0xc
 #define HPWMI_WIRELESS2_QUERY 0x1b
 #define HPWMI_POSTCODEERROR_QUERY 0x2a
@@ -293,19 +292,6 @@ static int hp_wmi_tablet_state(void)
        return (state & 0x4) ? 1 : 0;
 }
-static int hp_wmi_enable_hotkeys(void)
-{
-        int ret;
-        int query = 0x6e;
-        ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &query, sizeof(query),
-                                   0);
-        if (ret)
-                return -EINVAL;
-        return 0;
-}
 static int hp_wmi_set_block(void *data, bool blocked)
 {
        enum hp_wmi_radio r = (enum hp_wmi_radio) data;
@@ -1009,8 +995,6 @@ static int __init hp_wmi_init(void)
                err = hp_wmi_input_setup();
                if (err)
                        return err;
-                hp_wmi_enable_hotkeys();
        }
        if (bios_capable) {
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index 2ac045f27f10..3a1b6bf326a8 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -2440,7 +2440,10 @@ static ssize_t sony_nc_gfx_switch_status_show(struct device *dev,
        if (pos < 0)
                return pos;
-        return snprintf(buffer, PAGE_SIZE, "%s\n", pos ? "speed" : "stamina");
+        return snprintf(buffer, PAGE_SIZE, "%s\n",
+                                        pos == SPEED ? "speed" :
+                                        pos == STAMINA ? "stamina" :
+                                        pos == AUTO ? "auto" : "unknown");
 }
 static int sony_nc_gfx_switch_setup(struct platform_device *pd,
@@ -4320,7 +4323,8 @@ static int sony_pic_add(struct acpi_device *device)
                goto err_free_resources;
        }
-        if (sonypi_compat_init())
+        result = sonypi_compat_init();
+        if (result)
                goto err_remove_input;
        /* request io port */
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 1d4c8fe72752..c82fe65c4128 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -102,10 +102,13 @@ static void zfcp_erp_action_dismiss_port(struct zfcp_port *port)
        if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_INUSE)
                zfcp_erp_action_dismiss(&port->erp_action);
-        else
+        else {
-                shost_for_each_device(sdev, port->adapter->scsi_host)
+                spin_lock(port->adapter->scsi_host->host_lock);
+                __shost_for_each_device(sdev, port->adapter->scsi_host)
                        if (sdev_to_zfcp(sdev)->port == port)
                                zfcp_erp_action_dismiss_lun(sdev);
+                spin_unlock(port->adapter->scsi_host->host_lock);
+        }
 }
 static void zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *adapter)
@@ -592,9 +595,11 @@ static void _zfcp_erp_lun_reopen_all(struct zfcp_port *port, int clear,
 {
        struct scsi_device *sdev;
-        shost_for_each_device(sdev, port->adapter->scsi_host)
+        spin_lock(port->adapter->scsi_host->host_lock);
+        __shost_for_each_device(sdev, port->adapter->scsi_host)
                if (sdev_to_zfcp(sdev)->port == port)
                        _zfcp_erp_lun_reopen(sdev, clear, id, 0);
+        spin_unlock(port->adapter->scsi_host->host_lock);
 }
 static void zfcp_erp_strategy_followup_failed(struct zfcp_erp_action *act)
@@ -1434,8 +1439,10 @@ void zfcp_erp_set_adapter_status(struct zfcp_adapter *adapter, u32 mask)
                atomic_set_mask(common_mask, &port->status);
        read_unlock_irqrestore(&adapter->port_list_lock, flags);
-        shost_for_each_device(sdev, adapter->scsi_host)
+        spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
+        __shost_for_each_device(sdev, adapter->scsi_host)
                atomic_set_mask(common_mask, &sdev_to_zfcp(sdev)->status);
+        spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
 }
 /**
@@ -1469,11 +1476,13 @@ void zfcp_erp_clear_adapter_status(struct zfcp_adapter *adapter, u32 mask)
        }
        read_unlock_irqrestore(&adapter->port_list_lock, flags);
-        shost_for_each_device(sdev, adapter->scsi_host) {
+        spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
+        __shost_for_each_device(sdev, adapter->scsi_host) {
                atomic_clear_mask(common_mask, &sdev_to_zfcp(sdev)->status);
                if (clear_counter)
                        atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0);
        }
+        spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
 }
 /**
@@ -1487,16 +1496,19 @@ void zfcp_erp_set_port_status(struct zfcp_port *port, u32 mask)
 {
        struct scsi_device *sdev;
        u32 common_mask = mask & ZFCP_COMMON_FLAGS;
+        unsigned long flags;
        atomic_set_mask(mask, &port->status);
        if (!common_mask)
                return;
-        shost_for_each_device(sdev, port->adapter->scsi_host)
+        spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags);
+        __shost_for_each_device(sdev, port->adapter->scsi_host)
                if (sdev_to_zfcp(sdev)->port == port)
                        atomic_set_mask(common_mask,
                                        &sdev_to_zfcp(sdev)->status);
+        spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags);
 }
 /**
@@ -1511,6 +1523,7 @@ void zfcp_erp_clear_port_status(struct zfcp_port *port, u32 mask)
        struct scsi_device *sdev;
        u32 common_mask = mask & ZFCP_COMMON_FLAGS;
        u32 clear_counter = mask & ZFCP_STATUS_COMMON_ERP_FAILED;
+        unsigned long flags;
        atomic_clear_mask(mask, &port->status);
@@ -1520,13 +1533,15 @@ void zfcp_erp_clear_port_status(struct zfcp_port *port, u32 mask)
        if (clear_counter)
                atomic_set(&port->erp_counter, 0);
-        shost_for_each_device(sdev, port->adapter->scsi_host)
+        spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags);
+        __shost_for_each_device(sdev, port->adapter->scsi_host)
                if (sdev_to_zfcp(sdev)->port == port) {
                        atomic_clear_mask(common_mask,
                                          &sdev_to_zfcp(sdev)->status);
                        if (clear_counter)
                                atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0);
                }
+        spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags);
 }
 /**
diff --git a/drivers/s390/scsi/zfcp_qdio.c b/drivers/s390/scsi/zfcp_qdio.c
index 665e3cfaaf85..de0598eaacd2 100644
--- a/drivers/s390/scsi/zfcp_qdio.c
+++ b/drivers/s390/scsi/zfcp_qdio.c
@@ -224,11 +224,9 @@ int zfcp_qdio_sbals_from_sg(struct zfcp_qdio *qdio, struct zfcp_qdio_req *q_req,
 static int zfcp_qdio_sbal_check(struct zfcp_qdio *qdio)
 {
-        spin_lock_irq(&qdio->req_q_lock);
        if (atomic_read(&qdio->req_q_free) ||
            !(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP))
                return 1;
-        spin_unlock_irq(&qdio->req_q_lock);
        return 0;
 }
@@ -246,9 +244,8 @@ int zfcp_qdio_sbal_get(struct zfcp_qdio *qdio)
 {
        long ret;
-        spin_unlock_irq(&qdio->req_q_lock);
+        ret = wait_event_interruptible_lock_irq_timeout(qdio->req_q_wq,
-        ret = wait_event_interruptible_timeout(qdio->req_q_wq,
+                       zfcp_qdio_sbal_check(qdio), qdio->req_q_lock, 5 * HZ);
-                               zfcp_qdio_sbal_check(qdio), 5 * HZ);
        if (!(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP))
                return -EIO;
@@ -262,7 +259,6 @@ int zfcp_qdio_sbal_get(struct zfcp_qdio *qdio)
                zfcp_erp_adapter_reopen(qdio->adapter, 0, "qdsbg_1");
        }
-        spin_lock_irq(&qdio->req_q_lock);
        return -EIO;
 }
diff --git a/drivers/s390/scsi/zfcp_sysfs.c b/drivers/s390/scsi/zfcp_sysfs.c
index 3f01bbf0609f..890639274bcf 100644
--- a/drivers/s390/scsi/zfcp_sysfs.c
+++ b/drivers/s390/scsi/zfcp_sysfs.c
@@ -27,6 +27,16 @@ static ssize_t zfcp_sysfs_##_feat##_##_name##_show(struct device *dev,	       \
 static ZFCP_DEV_ATTR(_feat, _name, S_IRUGO,                                    \
                     zfcp_sysfs_##_feat##_##_name##_show, NULL);
+#define ZFCP_DEFINE_ATTR_CONST(_feat, _name, _format, _value)                  \
+static ssize_t zfcp_sysfs_##_feat##_##_name##_show(struct device *dev,         \
+                                                   struct device_attribute *at,\
+                                                   char *buf)                  \
+{                                                                              \
+        return sprintf(buf, _format, _value);                                  \
+}                                                                              \
+static ZFCP_DEV_ATTR(_feat, _name, S_IRUGO,                                    \
+                     zfcp_sysfs_##_feat##_##_name##_show, NULL);
 #define ZFCP_DEFINE_A_ATTR(_name, _format, _value)                           \
 static ssize_t zfcp_sysfs_adapter_##_name##_show(struct device *dev,         \
                                                 struct device_attribute *at,\
@@ -75,6 +85,8 @@ ZFCP_DEFINE_ATTR(zfcp_unit, unit, in_recovery, "%d\n",
 ZFCP_DEFINE_ATTR(zfcp_unit, unit, access_denied, "%d\n",
                 (zfcp_unit_sdev_status(unit) &
                  ZFCP_STATUS_COMMON_ACCESS_DENIED) != 0);
+ZFCP_DEFINE_ATTR_CONST(unit, access_shared, "%d\n", 0);
+ZFCP_DEFINE_ATTR_CONST(unit, access_readonly, "%d\n", 0);
 static ssize_t zfcp_sysfs_port_failed_show(struct device *dev,
                                           struct device_attribute *attr,
@@ -347,6 +359,8 @@ static struct attribute *zfcp_unit_attrs[] = {
        &dev_attr_unit_in_recovery.attr,
        &dev_attr_unit_status.attr,
        &dev_attr_unit_access_denied.attr,
+        &dev_attr_unit_access_shared.attr,
+        &dev_attr_unit_access_readonly.attr,
        NULL
 };
 static struct attribute_group zfcp_unit_attr_group = {
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 48b2918e0d65..92ff027746f2 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1353,7 +1353,6 @@ config SCSI_LPFC
        tristate "Emulex LightPulse Fibre Channel Support"
        depends on PCI && SCSI
        select SCSI_FC_ATTRS
-        select GENERIC_CSUM
        select CRC_T10DIF
        help
          This lpfc driver supports the Emulex LightPulse
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index e25eba5713c1..b3b5125faa72 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -482,7 +482,7 @@ int comedi_device_attach(struct comedi_device *dev, struct comedi_devconfig *it)
                ret = comedi_device_postconfig(dev);
        if (ret < 0) {
                comedi_device_detach(dev);
-                module_put(dev->driver->module);
+                module_put(driv->module);
        }
        /* On success, the driver module count has been incremented. */
        return ret;
diff --git a/drivers/tty/hvc/hvsi_lib.c b/drivers/tty/hvc/hvsi_lib.c
index 3396eb9d57a3..ac2767100df5 100644
--- a/drivers/tty/hvc/hvsi_lib.c
+++ b/drivers/tty/hvc/hvsi_lib.c
@@ -341,8 +341,8 @@ void hvsilib_establish(struct hvsi_priv *pv)
        pr_devel("HVSI@%x:   ... waiting handshake\n", pv->termno);
-        /* Try for up to 200s */
+        /* Try for up to 400ms */
-        for (timeout = 0; timeout < 20; timeout++) {
+        for (timeout = 0; timeout < 40; timeout++) {
                if (pv->established)
                        goto established;
                if (!hvsi_get_packet(pv))
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index 08613e241894..279b04910f00 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -304,6 +304,13 @@ static int __init ohci_pci_init(void)
        pr_info("%s: " DRIVER_DESC "\n", hcd_name);
        ohci_init_driver(&ohci_pci_hc_driver, &pci_overrides);
+#ifdef  CONFIG_PM
+        /* Entries for the PCI suspend/resume callbacks are special */
+        ohci_pci_hc_driver.pci_suspend = ohci_suspend;
+        ohci_pci_hc_driver.pci_resume = ohci_resume;
+#endif
        return pci_register_driver(&ohci_pci_driver);
 }
 module_init(ohci_pci_init);
diff --git a/drivers/usb/phy/phy-fsl-usb.h b/drivers/usb/phy/phy-fsl-usb.h
index ca266280895d..e1859b8ef567 100644
--- a/drivers/usb/phy/phy-fsl-usb.h
+++ b/drivers/usb/phy/phy-fsl-usb.h
@@ -15,7 +15,7 @@
 * 675 Mass Ave, Cambridge, MA 02139, USA.
 */
-#include "otg_fsm.h"
+#include "phy-fsm-usb.h"
 #include <linux/usb/otg.h>
 #include <linux/ioctl.h>
diff --git a/drivers/usb/phy/phy-fsm-usb.c b/drivers/usb/phy/phy-fsm-usb.c
index c520b3548e7c..7f4596606e18 100644
--- a/drivers/usb/phy/phy-fsm-usb.c
+++ b/drivers/usb/phy/phy-fsm-usb.c
@@ -29,7 +29,7 @@
 #include <linux/usb/gadget.h>
 #include <linux/usb/otg.h>
-#include "phy-otg-fsm.h"
+#include "phy-fsm-usb.h"
 /* Change USB protocol when there is a protocol change */
 static int otg_set_protocol(struct otg_fsm *fsm, int protocol)
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index a58ac435a9a4..5e8be462aed5 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -348,7 +348,7 @@ static void init_evtchn_cpu_bindings(void)
        for_each_possible_cpu(i)
                memset(per_cpu(cpu_evtchn_mask, i),
-                       (i == 0) ? ~0 : 0, sizeof(*per_cpu(cpu_evtchn_mask, i)));
+                       (i == 0) ? ~0 : 0, NR_EVENT_CHANNELS/8);
 }
 static inline void clear_evtchn(int port)
@@ -1493,8 +1493,10 @@ void rebind_evtchn_irq(int evtchn, int irq)
 /* Rebind an evtchn so that it gets delivered to a specific cpu */
 static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
 {
+        struct shared_info *s = HYPERVISOR_shared_info;
        struct evtchn_bind_vcpu bind_vcpu;
        int evtchn = evtchn_from_irq(irq);
+        int masked;
        if (!VALID_EVTCHN(evtchn))
                return -1;
@@ -1511,6 +1513,12 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
        bind_vcpu.vcpu = tcpu;
        /*
+         * Mask the event while changing the VCPU binding to prevent
+         * it being delivered on an unexpected VCPU.
+         */
+        masked = sync_test_and_set_bit(evtchn, BM(s->evtchn_mask));
+        /*
         * If this fails, it usually just indicates that we're dealing with a
         * virq or IPI channel, which don't actually need to be rebound. Ignore
         * it, but don't do the xenlinux-level rebind in that case.
@@ -1518,6 +1526,9 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
        if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0)
                bind_evtchn_to_cpu(evtchn, tcpu);
+        if (!masked)
+                unmask_evtchn(evtchn);
        return 0;
 }
diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
index 5e376bb93419..8defc6b3f9a2 100644
--- a/fs/bfs/inode.c
+++ b/fs/bfs/inode.c
@@ -40,7 +40,7 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
        int block, off;
        inode = iget_locked(sb, ino);
-        if (IS_ERR(inode))
+        if (!inode)
                return ERR_PTR(-ENOMEM);
        if (!(inode->i_state & I_NEW))
                return inode;
diff --git a/fs/bio.c b/fs/bio.c
index 94bbc04dba77..c5eae7251490 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -1045,12 +1045,22 @@ static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs,
 int bio_uncopy_user(struct bio *bio)
 {
        struct bio_map_data *bmd = bio->bi_private;
-        int ret = 0;
+        struct bio_vec *bvec;
+        int ret = 0, i;
-        if (!bio_flagged(bio, BIO_NULL_MAPPED))
+        if (!bio_flagged(bio, BIO_NULL_MAPPED)) {
-                ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs,
+                /*
-                                     bmd->nr_sgvecs, bio_data_dir(bio) == READ,
+                 * if we're in a workqueue, the request is orphaned, so
-                                     0, bmd->is_our_pages);
+                 * don't copy into a random user address space, just free.
+                 */
+                if (current->mm)
+                        ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs,
+                                             bmd->nr_sgvecs, bio_data_dir(bio) == READ,
+                                             0, bmd->is_our_pages);
+                else if (bmd->is_our_pages)
+                        bio_for_each_segment_all(bvec, bio, i)
+                                __free_page(bvec->bv_page);
+        }
        bio_free_map_data(bmd);
        bio_put(bio);
        return ret;
diff --git a/fs/dcache.c b/fs/dcache.c
index 87bdb5329c3c..b949af850cd6 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -229,7 +229,7 @@ static void __d_free(struct rcu_head *head)
 */
 static void d_free(struct dentry *dentry)
 {
-        BUG_ON(dentry->d_count);
+        BUG_ON(dentry->d_lockref.count);
        this_cpu_dec(nr_dentry);
        if (dentry->d_op && dentry->d_op->d_release)
                dentry->d_op->d_release(dentry);
@@ -467,7 +467,7 @@ relock:
        }
        if (ref)
-                dentry->d_count--;
+                dentry->d_lockref.count--;
        /*
         * inform the fs via d_prune that this dentry is about to be
         * unhashed and destroyed.
@@ -513,15 +513,10 @@ void dput(struct dentry *dentry)
                return;
 repeat:
-        if (dentry->d_count == 1)
+        if (dentry->d_lockref.count == 1)
                might_sleep();
-        spin_lock(&dentry->d_lock);
+        if (lockref_put_or_lock(&dentry->d_lockref))
-        BUG_ON(!dentry->d_count);
-        if (dentry->d_count > 1) {
-                dentry->d_count--;
-                spin_unlock(&dentry->d_lock);
                return;
-        }
        if (dentry->d_flags & DCACHE_OP_DELETE) {
                if (dentry->d_op->d_delete(dentry))
@@ -535,7 +530,7 @@ repeat:
        dentry->d_flags |= DCACHE_REFERENCED;
        dentry_lru_add(dentry);
-        dentry->d_count--;
+        dentry->d_lockref.count--;
        spin_unlock(&dentry->d_lock);
        return;
@@ -590,7 +585,7 @@ int d_invalidate(struct dentry * dentry)
         * We also need to leave mountpoints alone,
         * directory or not.
         */
-        if (dentry->d_count > 1 && dentry->d_inode) {
+        if (dentry->d_lockref.count > 1 && dentry->d_inode) {
                if (S_ISDIR(dentry->d_inode->i_mode) || d_mountpoint(dentry)) {
                        spin_unlock(&dentry->d_lock);
                        return -EBUSY;
@@ -606,14 +601,12 @@ EXPORT_SYMBOL(d_invalidate);
 /* This must be called with d_lock held */
 static inline void __dget_dlock(struct dentry *dentry)
 {
-        dentry->d_count++;
+        dentry->d_lockref.count++;
 }
 static inline void __dget(struct dentry *dentry)
 {
-        spin_lock(&dentry->d_lock);
+        lockref_get(&dentry->d_lockref);
-        __dget_dlock(dentry);
-        spin_unlock(&dentry->d_lock);
 }
 struct dentry *dget_parent(struct dentry *dentry)
@@ -634,8 +627,8 @@ repeat:
                goto repeat;
        }
        rcu_read_unlock();
-        BUG_ON(!ret->d_count);
+        BUG_ON(!ret->d_lockref.count);
-        ret->d_count++;
+        ret->d_lockref.count++;
        spin_unlock(&ret->d_lock);
        return ret;
 }
@@ -718,7 +711,7 @@ restart:
        spin_lock(&inode->i_lock);
        hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
                spin_lock(&dentry->d_lock);
-                if (!dentry->d_count) {
+                if (!dentry->d_lockref.count) {
                        __dget_dlock(dentry);
                        __d_drop(dentry);
                        spin_unlock(&dentry->d_lock);
@@ -763,12 +756,8 @@ static void try_prune_one_dentry(struct dentry *dentry)
        /* Prune ancestors. */
        dentry = parent;
        while (dentry) {
-                spin_lock(&dentry->d_lock);
+                if (lockref_put_or_lock(&dentry->d_lockref))
-                if (dentry->d_count > 1) {
-                        dentry->d_count--;
-                        spin_unlock(&dentry->d_lock);
                        return;
-                }
                dentry = dentry_kill(dentry, 1);
        }
 }
@@ -793,7 +782,7 @@ static void shrink_dentry_list(struct list_head *list)
                 * the LRU because of laziness during lookup.  Do not free
                 * it - just keep it off the LRU list.
                 */
-                if (dentry->d_count) {
+                if (dentry->d_lockref.count) {
                        dentry_lru_del(dentry);
                        spin_unlock(&dentry->d_lock);
                        continue;
@@ -913,7 +902,7 @@ static void shrink_dcache_for_umount_subtree(struct dentry *dentry)
                        dentry_lru_del(dentry);
                        __d_shrink(dentry);
-                        if (dentry->d_count != 0) {
+                        if (dentry->d_lockref.count != 0) {
                                printk(KERN_ERR
                                       "BUG: Dentry %p{i=%lx,n=%s}"
                                       " still in use (%d)"
@@ -922,7 +911,7 @@ static void shrink_dcache_for_umount_subtree(struct dentry *dentry)
                                       dentry->d_inode ?
                                       dentry->d_inode->i_ino : 0UL,
                                       dentry->d_name.name,
-                                       dentry->d_count,
+                                       dentry->d_lockref.count,
                                       dentry->d_sb->s_type->name,
                                       dentry->d_sb->s_id);
                                BUG();
@@ -933,7 +922,7 @@ static void shrink_dcache_for_umount_subtree(struct dentry *dentry)
                                list_del(&dentry->d_u.d_child);
                        } else {
                                parent = dentry->d_parent;
-                                parent->d_count--;
+                                parent->d_lockref.count--;
                                list_del(&dentry->d_u.d_child);
                        }
@@ -981,7 +970,7 @@ void shrink_dcache_for_umount(struct super_block *sb)
        dentry = sb->s_root;
        sb->s_root = NULL;
-        dentry->d_count--;
+        dentry->d_lockref.count--;
        shrink_dcache_for_umount_subtree(dentry);
        while (!hlist_bl_empty(&sb->s_anon)) {
@@ -1147,7 +1136,7 @@ resume:
                 * loop in shrink_dcache_parent() might not make any progress
                 * and loop forever.
                 */
-                if (dentry->d_count) {
+                if (dentry->d_lockref.count) {
                        dentry_lru_del(dentry);
                } else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) {
                        dentry_lru_move_list(dentry, dispose);
@@ -1269,7 +1258,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
        smp_wmb();
        dentry->d_name.name = dname;
-        dentry->d_count = 1;
+        dentry->d_lockref.count = 1;
        dentry->d_flags = 0;
        spin_lock_init(&dentry->d_lock);
        seqcount_init(&dentry->d_seq);
@@ -1970,7 +1959,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
                                goto next;
                }
-                dentry->d_count++;
+                dentry->d_lockref.count++;
                found = dentry;
                spin_unlock(&dentry->d_lock);
                break;
@@ -2069,7 +2058,7 @@ again:
        spin_lock(&dentry->d_lock);
        inode = dentry->d_inode;
        isdir = S_ISDIR(inode->i_mode);
-        if (dentry->d_count == 1) {
+        if (dentry->d_lockref.count == 1) {
                if (!spin_trylock(&inode->i_lock)) {
                        spin_unlock(&dentry->d_lock);
                        cpu_relax();
@@ -2724,6 +2713,17 @@ char *dynamic_dname(struct dentry *dentry, char *buffer, int buflen,
        return memcpy(buffer, temp, sz);
 }
+char *simple_dname(struct dentry *dentry, char *buffer, int buflen)
+{
+        char *end = buffer + buflen;
+        /* these dentries are never renamed, so d_lock is not needed */
+        if (prepend(&end, &buflen, " (deleted)", 11) ||
+            prepend_name(&end, &buflen, &dentry->d_name) ||
+            prepend(&end, &buflen, "/", 1))  
+                end = ERR_PTR(-ENAMETOOLONG);
+        return end;  
+}
 /*
 * Write full pathname from the root of the filesystem into the buffer.
 */
@@ -2937,7 +2937,7 @@ resume:
                }
                if (!(dentry->d_flags & DCACHE_GENOCIDE)) {
                        dentry->d_flags |= DCACHE_GENOCIDE;
-                        dentry->d_count--;
+                        dentry->d_lockref.count--;
                }
                spin_unlock(&dentry->d_lock);
        }
@@ -2945,7 +2945,7 @@ resume:
                struct dentry *child = this_parent;
                if (!(this_parent->d_flags & DCACHE_GENOCIDE)) {
                        this_parent->d_flags |= DCACHE_GENOCIDE;
-                        this_parent->d_count--;
+                        this_parent->d_lockref.count--;
                }
                this_parent = try_to_ascend(this_parent, locked, seq);
                if (!this_parent)
diff --git a/fs/efs/inode.c b/fs/efs/inode.c
index f3913eb2c474..d15ccf20f1b3 100644
--- a/fs/efs/inode.c
+++ b/fs/efs/inode.c
@@ -57,7 +57,7 @@ struct inode *efs_iget(struct super_block *super, unsigned long ino)
        struct inode *inode;
        inode = iget_locked(super, ino);
-        if (IS_ERR(inode))
+        if (!inode)
                return ERR_PTR(-ENOMEM);
        if (!(inode->i_state & I_NEW))
                return inode;
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 34423978b170..d19b30ababf1 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -926,14 +926,8 @@ static int get_hstate_idx(int page_size_log)
        return h - hstates;
 }
-static char *hugetlb_dname(struct dentry *dentry, char *buffer, int buflen)
-{
-        return dynamic_dname(dentry, buffer, buflen, "/%s (deleted)",
-                                dentry->d_name.name);
-}
 static struct dentry_operations anon_ops = {
-        .d_dname = hugetlb_dname
+        .d_dname = simple_dname
 };
 /*
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 8743ba9c6742..984c2bbf4f61 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -3047,6 +3047,14 @@ int jfs_readdir(struct file *file, struct dir_context *ctx)
                dir_index = (u32) ctx->pos;
+                /*
+                 * NFSv4 reserves cookies 1 and 2 for . and .. so the value
+                 * we return to the vfs is one greater than the one we use
+                 * internally.
+                 */
+                if (dir_index)
+                        dir_index--;
                if (dir_index > 1) {
                        struct dir_table_slot dirtab_slot;
@@ -3086,7 +3094,7 @@ int jfs_readdir(struct file *file, struct dir_context *ctx)
                        if (p->header.flag & BT_INTERNAL) {
                                jfs_err("jfs_readdir: bad index table");
                                DT_PUTPAGE(mp);
-                                ctx->pos = -1;
+                                ctx->pos = DIREND;
                                return 0;
                        }
                } else {
@@ -3094,14 +3102,14 @@ int jfs_readdir(struct file *file, struct dir_context *ctx)
                                /*
                                 * self "."
                                 */
-                                ctx->pos = 0;
+                                ctx->pos = 1;
                                if (!dir_emit(ctx, ".", 1, ip->i_ino, DT_DIR))
                                        return 0;
                        }
                        /*
                         * parent ".."
                         */
-                        ctx->pos = 1;
+                        ctx->pos = 2;
                        if (!dir_emit(ctx, "..", 2, PARENT(ip), DT_DIR))
                                return 0;
@@ -3122,22 +3130,23 @@ int jfs_readdir(struct file *file, struct dir_context *ctx)
                /*
                 * Legacy filesystem - OS/2 & Linux JFS < 0.3.6
                 *
-                 * pn = index = 0:      First entry "."
+                 * pn = 0; index = 1:   First entry "."
-                 * pn = 0; index = 1:   Second entry ".."
+                 * pn = 0; index = 2:   Second entry ".."
                 * pn > 0:              Real entries, pn=1 -> leftmost page
                 * pn = index = -1:     No more entries
                 */
                dtpos = ctx->pos;
-                if (dtpos == 0) {
+                if (dtpos < 2) {
                        /* build "." entry */
+                        ctx->pos = 1;
                        if (!dir_emit(ctx, ".", 1, ip->i_ino, DT_DIR))
                                return 0;
-                        dtoffset->index = 1;
+                        dtoffset->index = 2;
                        ctx->pos = dtpos;
                }
                if (dtoffset->pn == 0) {
-                        if (dtoffset->index == 1) {
+                        if (dtoffset->index == 2) {
                                /* build ".." entry */
                                if (!dir_emit(ctx, "..", 2, PARENT(ip), DT_DIR))
                                        return 0;
@@ -3228,6 +3237,12 @@ int jfs_readdir(struct file *file, struct dir_context *ctx)
                                        }
                                        jfs_dirent->position = unique_pos++;
                                }
+                                /*
+                                 * We add 1 to the index because we may
+                                 * use a value of 2 internally, and NFSv4
+                                 * doesn't like that.
+                                 */
+                                jfs_dirent->position++;
                        } else {
                                jfs_dirent->position = dtpos;
                                len = min(d_namleft, DTLHDRDATALEN_LEGACY);
diff --git a/fs/namei.c b/fs/namei.c
index 89a612e392eb..7720fbd5277b 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -536,8 +536,8 @@ static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
                 * a reference at this point.
                 */
                BUG_ON(!IS_ROOT(dentry) && dentry->d_parent != parent);
-                BUG_ON(!parent->d_count);
+                BUG_ON(!parent->d_lockref.count);
-                parent->d_count++;
+                parent->d_lockref.count++;
                spin_unlock(&dentry->d_lock);
        }
        spin_unlock(&parent->d_lock);
@@ -3327,7 +3327,7 @@ void dentry_unhash(struct dentry *dentry)
 {
        shrink_dcache_parent(dentry);
        spin_lock(&dentry->d_lock);
-        if (dentry->d_count == 1)
+        if (dentry->d_lockref.count == 1)
                __d_drop(dentry);
        spin_unlock(&dentry->d_lock);
 }
@@ -3671,11 +3671,15 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
        if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
                return -EINVAL;
        /*
-         * Using empty names is equivalent to using AT_SYMLINK_FOLLOW
+         * To use null names we require CAP_DAC_READ_SEARCH
-         * on /proc/self/fd/<fd>.
+         * This ensures that not everyone will be able to create
+         * handlink using the passed filedescriptor.
         */
-        if (flags & AT_EMPTY_PATH)
+        if (flags & AT_EMPTY_PATH) {
+                if (!capable(CAP_DAC_READ_SEARCH))
+                        return -ENOENT;
                how = LOOKUP_EMPTY;
+        }
        if (flags & AT_SYMLINK_FOLLOW)
                how |= LOOKUP_FOLLOW;
diff --git a/fs/namespace.c b/fs/namespace.c
index 7b1ca9ba0b0a..a45ba4f267fe 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1429,7 +1429,7 @@ struct vfsmount *collect_mounts(struct path *path)
                         CL_COPY_ALL | CL_PRIVATE);
        namespace_unlock();
        if (IS_ERR(tree))
-                return NULL;
+                return ERR_CAST(tree);
        return &tree->mnt;
 }
diff --git a/fs/nilfs2/segbuf.c b/fs/nilfs2/segbuf.c
index dc9a913784ab..2d8be51f90dc 100644
--- a/fs/nilfs2/segbuf.c
+++ b/fs/nilfs2/segbuf.c
@@ -345,8 +345,7 @@ static void nilfs_end_bio_write(struct bio *bio, int err)
        if (err == -EOPNOTSUPP) {
                set_bit(BIO_EOPNOTSUPP, &bio->bi_flags);
-                bio_put(bio);
+                /* to be detected by nilfs_segbuf_submit_bio() */
-                /* to be detected by submit_seg_bio() */
        }
        if (!uptodate)
@@ -377,12 +376,12 @@ static int nilfs_segbuf_submit_bio(struct nilfs_segment_buffer *segbuf,
        bio->bi_private = segbuf;
        bio_get(bio);
        submit_bio(mode, bio);
+        segbuf->sb_nbio++;
        if (bio_flagged(bio, BIO_EOPNOTSUPP)) {
                bio_put(bio);
                err = -EOPNOTSUPP;
                goto failed;
        }
-        segbuf->sb_nbio++;
        bio_put(bio);
        wi->bio = NULL;
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 854d80955bf8..121da2dc3be8 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1022,7 +1022,7 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent)
        struct inode *inode = NULL;
        struct ocfs2_super *osb = NULL;
        struct buffer_head *bh = NULL;
-        char nodestr[8];
+        char nodestr[12];
        struct ocfs2_blockcheck_stats stats;
        trace_ocfs2_fill_super(sb, data, silent);
diff --git a/fs/proc/fd.c b/fs/proc/fd.c
index 75f2890abbd8..0ff80f9b930f 100644
--- a/fs/proc/fd.c
+++ b/fs/proc/fd.c
@@ -230,8 +230,6 @@ static int proc_readfd_common(struct file *file, struct dir_context *ctx,
        if (!dir_emit_dots(file, ctx))
                goto out;
-        if (!dir_emit_dots(file, ctx))
-                goto out;
        files = get_files_struct(p);
        if (!files)
                goto out;
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index b90337c9d468..efdc94434c30 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -9,6 +9,7 @@
 #include <linux/seqlock.h>
 #include <linux/cache.h>
 #include <linux/rcupdate.h>
+#include <linux/lockref.h>
 struct nameidata;
 struct path;
@@ -100,6 +101,8 @@ extern unsigned int full_name_hash(const unsigned char *, unsigned int);
 # endif
 #endif
+#define d_lock  d_lockref.lock
 struct dentry {
        /* RCU lookup touched fields */
        unsigned int d_flags;           /* protected by d_lock */
@@ -112,8 +115,7 @@ struct dentry {
        unsigned char d_iname[DNAME_INLINE_LEN];        /* small names */
        /* Ref lookup also touches following */
-        unsigned int d_count;           /* protected by d_lock */
+        struct lockref d_lockref;       /* per-dentry lock and refcount */
-        spinlock_t d_lock;              /* per dentry lock */
        const struct dentry_operations *d_op;
        struct super_block *d_sb;       /* The root of the dentry tree */
        unsigned long d_time;           /* used by d_revalidate */
@@ -318,7 +320,7 @@ static inline int __d_rcu_to_refcount(struct dentry *dentry, unsigned seq)
        assert_spin_locked(&dentry->d_lock);
        if (!read_seqcount_retry(&dentry->d_seq, seq)) {
                ret = 1;
-                dentry->d_count++;
+                dentry->d_lockref.count++;
        }
        return ret;
@@ -326,7 +328,7 @@ static inline int __d_rcu_to_refcount(struct dentry *dentry, unsigned seq)
 static inline unsigned d_count(const struct dentry *dentry)
 {
-        return dentry->d_count;
+        return dentry->d_lockref.count;
 }
 /* validate "insecure" dentry pointer */
@@ -336,6 +338,7 @@ extern int d_validate(struct dentry *, struct dentry *);
 * helper function for dentry_operations.d_dname() members
 */
 extern char *dynamic_dname(struct dentry *, char *, int, const char *, ...);
+extern char *simple_dname(struct dentry *, char *, int);
 extern char *__d_path(const struct path *, const struct path *, char *, int);
 extern char *d_absolute_path(const struct path *, char *, int);
@@ -356,17 +359,14 @@ extern char *dentry_path(struct dentry *, char *, int);
 static inline struct dentry *dget_dlock(struct dentry *dentry)
 {
        if (dentry)
-                dentry->d_count++;
+                dentry->d_lockref.count++;
        return dentry;
 }
 static inline struct dentry *dget(struct dentry *dentry)
 {
-        if (dentry) {
+        if (dentry)
-                spin_lock(&dentry->d_lock);
+                lockref_get(&dentry->d_lockref);
-                dget_dlock(dentry);
-                spin_unlock(&dentry->d_lock);
-        }
        return dentry;
 }
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index b99cd23f3474..79640e015a86 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -5,45 +5,13 @@
 #include <linux/bitmap.h>
 #include <linux/if.h>
+#include <linux/ip.h>
 #include <linux/netdevice.h>
 #include <linux/rcupdate.h>
 #include <linux/timer.h>
 #include <linux/sysctl.h>
 #include <linux/rtnetlink.h>
-enum
-{
-        IPV4_DEVCONF_FORWARDING=1,
-        IPV4_DEVCONF_MC_FORWARDING,
-        IPV4_DEVCONF_PROXY_ARP,
-        IPV4_DEVCONF_ACCEPT_REDIRECTS,
-        IPV4_DEVCONF_SECURE_REDIRECTS,
-        IPV4_DEVCONF_SEND_REDIRECTS,
-        IPV4_DEVCONF_SHARED_MEDIA,
-        IPV4_DEVCONF_RP_FILTER,
-        IPV4_DEVCONF_ACCEPT_SOURCE_ROUTE,
-        IPV4_DEVCONF_BOOTP_RELAY,
-        IPV4_DEVCONF_LOG_MARTIANS,
-        IPV4_DEVCONF_TAG,
-        IPV4_DEVCONF_ARPFILTER,
-        IPV4_DEVCONF_MEDIUM_ID,
-        IPV4_DEVCONF_NOXFRM,
-        IPV4_DEVCONF_NOPOLICY,
-        IPV4_DEVCONF_FORCE_IGMP_VERSION,
-        IPV4_DEVCONF_ARP_ANNOUNCE,
-        IPV4_DEVCONF_ARP_IGNORE,
-        IPV4_DEVCONF_PROMOTE_SECONDARIES,
-        IPV4_DEVCONF_ARP_ACCEPT,
-        IPV4_DEVCONF_ARP_NOTIFY,
-        IPV4_DEVCONF_ACCEPT_LOCAL,
-        IPV4_DEVCONF_SRC_VMARK,
-        IPV4_DEVCONF_PROXY_ARP_PVLAN,
-        IPV4_DEVCONF_ROUTE_LOCALNET,
-        __IPV4_DEVCONF_MAX
-};
-#define IPV4_DEVCONF_MAX (__IPV4_DEVCONF_MAX - 1)
 struct ipv4_devconf {
        void    *sysctl;
        int     data[IPV4_DEVCONF_MAX];
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 850e95bc766c..b8b7dc755752 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -101,6 +101,7 @@ struct inet6_skb_parm {
 #define IP6SKB_FORWARDED        2
 #define IP6SKB_REROUTED         4
 #define IP6SKB_ROUTERALERT      8
+#define IP6SKB_FRAGMENTED      16
 };
 #define IP6CB(skb)      ((struct inet6_skb_parm*)((skb)->cb))
diff --git a/include/linux/lockref.h b/include/linux/lockref.h
new file mode 100644
index 000000000000..01233e01627a
--- /dev/null
+++ b/include/linux/lockref.h
@@ -0,0 +1,71 @@
+#ifndef __LINUX_LOCKREF_H
+#define __LINUX_LOCKREF_H
+/*
+ * Locked reference counts.
+ *
+ * These are different from just plain atomic refcounts in that they
+ * are atomic with respect to the spinlock that goes with them.  In
+ * particular, there can be implementations that don't actually get
+ * the spinlock for the common decrement/increment operations, but they
+ * still have to check that the operation is done semantically as if
+ * the spinlock had been taken (using a cmpxchg operation that covers
+ * both the lock and the count word, or using memory transactions, for
+ * example).
+ */
+#include <linux/spinlock.h>
+struct lockref {
+        spinlock_t lock;
+        unsigned int count;
+};
+/**
+ * lockref_get - Increments reference count unconditionally
+ * @lockcnt: pointer to lockref structure
+ *
+ * This operation is only valid if you already hold a reference
+ * to the object, so you know the count cannot be zero.
+ */
+static inline void lockref_get(struct lockref *lockref)
+{
+        spin_lock(&lockref->lock);
+        lockref->count++;
+        spin_unlock(&lockref->lock);
+}
+/**
+ * lockref_get_not_zero - Increments count unless the count is 0
+ * @lockcnt: pointer to lockref structure
+ * Return: 1 if count updated successfully or 0 if count is 0
+ */
+static inline int lockref_get_not_zero(struct lockref *lockref)
+{
+        int retval = 0;
+        spin_lock(&lockref->lock);
+        if (lockref->count) {
+                lockref->count++;
+                retval = 1;
+        }
+        spin_unlock(&lockref->lock);
+        return retval;
+}
+/**
+ * lockref_put_or_lock - decrements count unless count <= 1 before decrement
+ * @lockcnt: pointer to lockref structure
+ * Return: 1 if count updated successfully or 0 if count <= 1 and lock taken
+ */
+static inline int lockref_put_or_lock(struct lockref *lockref)
+{
+        spin_lock(&lockref->lock);
+        if (lockref->count <= 1)
+                return 0;
+        lockref->count--;
+        spin_unlock(&lockref->lock);
+        return 1;
+}
+#endif /* __LINUX_LOCKREF_H */
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index fb425aa16c01..faf4b7c1ad12 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -332,6 +332,7 @@ struct mm_struct {
                                unsigned long pgoff, unsigned long flags);
 #endif
        unsigned long mmap_base;                /* base of mmap area */
+        unsigned long mmap_legacy_base;         /* base of mmap area in bottom-up allocations */
        unsigned long task_size;                /* size of task vm space */
        unsigned long highest_vm_end;           /* highest vma end address */
        pgd_t * pgd;
diff --git a/include/linux/nsproxy.h b/include/linux/nsproxy.h
index 10e5947491c7..b4ec59d159ac 100644
--- a/include/linux/nsproxy.h
+++ b/include/linux/nsproxy.h
@@ -14,6 +14,10 @@ struct fs_struct;
 * A structure to contain pointers to all per-process
 * namespaces - fs (mount), uts, network, sysvipc, etc.
 *
+ * The pid namespace is an exception -- it's accessed using
+ * task_active_pid_ns.  The pid namespace here is the
+ * namespace that children will use.
+ *
 * 'count' is the number of tasks holding a reference.
 * The count for each namespace, then, will be the number
 * of nsproxies pointing to it, not the number of tasks.
@@ -27,7 +31,7 @@ struct nsproxy {
        struct uts_namespace *uts_ns;
        struct ipc_namespace *ipc_ns;
        struct mnt_namespace *mnt_ns;
-        struct pid_namespace *pid_ns;
+        struct pid_namespace *pid_ns_for_children;
        struct net           *net_ns;
 };
 extern struct nsproxy init_nsproxy;
diff --git a/include/linux/regmap.h b/include/linux/regmap.h
index 580a5320cc96..6d91fcb4c5cb 100644
--- a/include/linux/regmap.h
+++ b/include/linux/regmap.h
@@ -16,6 +16,7 @@
 #include <linux/list.h>
 #include <linux/rbtree.h>
 #include <linux/err.h>
+#include <linux/bug.h>
 struct module;
 struct device;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index e9995eb5985c..078066daffd4 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -314,7 +314,6 @@ struct nsproxy;
 struct user_namespace;
 #ifdef CONFIG_MMU
-extern unsigned long mmap_legacy_base(void);
 extern void arch_pick_mmap_layout(struct mm_struct *mm);
 extern unsigned long
 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
diff --git a/include/linux/wait.h b/include/linux/wait.h
index f487a4750b7f..a67fc1635592 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -811,6 +811,63 @@ do {									\
        __ret;                                                          \
 })
+#define __wait_event_interruptible_lock_irq_timeout(wq, condition,      \
+                                                    lock, ret)          \
+do {                                                                    \
+        DEFINE_WAIT(__wait);                                            \
+                                                                        \
+        for (;;) {                                                      \
+                prepare_to_wait(&wq, &__wait, TASK_INTERRUPTIBLE);      \
+                if (condition)                                          \
+                        break;                                          \
+                if (signal_pending(current)) {                          \
+                        ret = -ERESTARTSYS;                             \
+                        break;                                          \
+                }                                                       \
+                spin_unlock_irq(&lock);                                 \
+                ret = schedule_timeout(ret);                            \
+                spin_lock_irq(&lock);                                   \
+                if (!ret)                                               \
+                        break;                                          \
+        }                                                               \
+        finish_wait(&wq, &__wait);                                      \
+} while (0)
+/**
+ * wait_event_interruptible_lock_irq_timeout - sleep until a condition gets true or a timeout elapses.
+ *              The condition is checked under the lock. This is expected
+ *              to be called with the lock taken.
+ * @wq: the waitqueue to wait on
+ * @condition: a C expression for the event to wait for
+ * @lock: a locked spinlock_t, which will be released before schedule()
+ *        and reacquired afterwards.
+ * @timeout: timeout, in jiffies
+ *
+ * The process is put to sleep (TASK_INTERRUPTIBLE) until the
+ * @condition evaluates to true or signal is received. The @condition is
+ * checked each time the waitqueue @wq is woken up.
+ *
+ * wake_up() has to be called after changing any variable that could
+ * change the result of the wait condition.
+ *
+ * This is supposed to be called while holding the lock. The lock is
+ * dropped before going to sleep and is reacquired afterwards.
+ *
+ * The function returns 0 if the @timeout elapsed, -ERESTARTSYS if it
+ * was interrupted by a signal, and the remaining jiffies otherwise
+ * if the condition evaluated to true before the timeout elapsed.
+ */
+#define wait_event_interruptible_lock_irq_timeout(wq, condition, lock,  \
+                                                  timeout)              \
+({                                                                      \
+        int __ret = timeout;                                            \
+                                                                        \
+        if (!(condition))                                               \
+                __wait_event_interruptible_lock_irq_timeout(            \
+                                        wq, condition, lock, __ret);    \
+        __ret;                                                          \
+})
 /*
 * These are the old interfaces to sleep waiting for an event.
diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
index 8a358a2c97e6..829627d7b846 100644
--- a/include/net/busy_poll.h
+++ b/include/net/busy_poll.h
@@ -123,6 +123,7 @@ static inline bool sk_busy_loop(struct sock *sk, int nonblock)
                        /* local bh are disabled so it is ok to use _BH */
                        NET_ADD_STATS_BH(sock_net(sk),
                                         LINUX_MIB_BUSYPOLLRXPACKETS, rc);
+                cpu_relax();
        } while (!nonblock && skb_queue_empty(&sk->sk_receive_queue) &&
                 !need_resched() && !busy_loop_timeout(end_time));
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 93024a47e0e2..8e0b6c856a13 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -61,6 +61,7 @@ struct genl_family {
        struct list_head        ops_list;       /* private */
        struct list_head        family_list;    /* private */
        struct list_head        mcast_groups;   /* private */
+        struct module           *module;
 };
 /**
@@ -121,9 +122,24 @@ struct genl_ops {
        struct list_head        ops_list;
 };
-extern int genl_register_family(struct genl_family *family);
+extern int __genl_register_family(struct genl_family *family);
-extern int genl_register_family_with_ops(struct genl_family *family,
+static inline int genl_register_family(struct genl_family *family)
+{
+        family->module = THIS_MODULE;
+        return __genl_register_family(family);
+}
+extern int __genl_register_family_with_ops(struct genl_family *family,
        struct genl_ops *ops, size_t n_ops);
+static inline int genl_register_family_with_ops(struct genl_family *family,
+        struct genl_ops *ops, size_t n_ops)
+{
+        family->module = THIS_MODULE;
+        return __genl_register_family_with_ops(family, ops, n_ops);
+}
 extern int genl_unregister_family(struct genl_family *family);
 extern int genl_register_ops(struct genl_family *, struct genl_ops *ops);
 extern int genl_unregister_ops(struct genl_family *, struct genl_ops *ops);
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 260f83f16bcf..f667248202b6 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -135,6 +135,8 @@ extern void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
 extern void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk,
                               __be32 mtu);
 extern void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark);
+extern void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif,
+                                   u32 mark);
 extern void ip6_sk_redirect(struct sk_buff *skb, struct sock *sk);
 struct netlink_callback;
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 5b7a3dadadde..551ba6a6a073 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1499,6 +1499,7 @@ enum ieee80211_hw_flags {
        IEEE80211_HW_SUPPORTS_RC_TABLE                  = 1<<24,
        IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF              = 1<<25,
        IEEE80211_HW_TIMING_BEACON_ONLY                 = 1<<26,
+        IEEE80211_HW_SUPPORTS_HT_CCK_RATES              = 1<<27,
 };
 /**
diff --git a/include/net/route.h b/include/net/route.h
index 2ea40c1b5e00..afdeeb5bec25 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -317,4 +317,12 @@ static inline int ip4_dst_hoplimit(const struct dst_entry *dst)
        return hoplimit;
 }
+static inline int ip_skb_dst_mtu(struct sk_buff *skb)
+{
+        struct inet_sock *inet = skb->sk ? inet_sk(skb->sk) : NULL;
+        return (inet && inet->pmtudisc == IP_PMTUDISC_PROBE) ?
+               skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
+}
 #endif  /* _ROUTE_H */
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 94ce082b29dc..e823786e7c66 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -341,10 +341,13 @@ struct xfrm_state_afinfo {
                                                  struct sk_buff *skb);
        int                     (*transport_finish)(struct sk_buff *skb,
                                                    int async);
+        void                    (*local_error)(struct sk_buff *skb, u32 mtu);
 };
 extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
 extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
+extern struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
+extern void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
 extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
@@ -1477,6 +1480,7 @@ extern int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
 extern int xfrm_output_resume(struct sk_buff *skb, int err);
 extern int xfrm_output(struct sk_buff *skb);
 extern int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
+extern void xfrm_local_error(struct sk_buff *skb, int mtu);
 extern int xfrm4_extract_header(struct sk_buff *skb);
 extern int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
@@ -1497,6 +1501,7 @@ extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short fam
 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
 extern int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel *handler);
 extern int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel *handler);
+extern void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
 extern int xfrm6_extract_header(struct sk_buff *skb);
 extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
@@ -1514,6 +1519,7 @@ extern int xfrm6_output(struct sk_buff *skb);
 extern int xfrm6_output_finish(struct sk_buff *skb);
 extern int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
                                 u8 **prevhdr);
+extern void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
 #ifdef CONFIG_XFRM
 extern int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
diff --git a/include/uapi/linux/cm4000_cs.h b/include/uapi/linux/cm4000_cs.h
index bc51f77db918..1217f751a1bc 100644
--- a/include/uapi/linux/cm4000_cs.h
+++ b/include/uapi/linux/cm4000_cs.h
@@ -2,6 +2,7 @@
 #define _UAPI_CM4000_H_
 #include <linux/types.h>
+#include <linux/ioctl.h>
 #define MAX_ATR                 33
diff --git a/include/uapi/linux/ip.h b/include/uapi/linux/ip.h
index 6cf06bfd841b..2fee45bdec0a 100644
--- a/include/uapi/linux/ip.h
+++ b/include/uapi/linux/ip.h
@@ -133,4 +133,38 @@ struct ip_beet_phdr {
        __u8 reserved;
 };
+/* index values for the variables in ipv4_devconf */
+enum
+{
+        IPV4_DEVCONF_FORWARDING=1,
+        IPV4_DEVCONF_MC_FORWARDING,
+        IPV4_DEVCONF_PROXY_ARP,
+        IPV4_DEVCONF_ACCEPT_REDIRECTS,
+        IPV4_DEVCONF_SECURE_REDIRECTS,
+        IPV4_DEVCONF_SEND_REDIRECTS,
+        IPV4_DEVCONF_SHARED_MEDIA,
+        IPV4_DEVCONF_RP_FILTER,
+        IPV4_DEVCONF_ACCEPT_SOURCE_ROUTE,
+        IPV4_DEVCONF_BOOTP_RELAY,
+        IPV4_DEVCONF_LOG_MARTIANS,
+        IPV4_DEVCONF_TAG,
+        IPV4_DEVCONF_ARPFILTER,
+        IPV4_DEVCONF_MEDIUM_ID,
+        IPV4_DEVCONF_NOXFRM,
+        IPV4_DEVCONF_NOPOLICY,
+        IPV4_DEVCONF_FORCE_IGMP_VERSION,
+        IPV4_DEVCONF_ARP_ANNOUNCE,
+        IPV4_DEVCONF_ARP_IGNORE,
+        IPV4_DEVCONF_PROMOTE_SECONDARIES,
+        IPV4_DEVCONF_ARP_ACCEPT,
+        IPV4_DEVCONF_ARP_NOTIFY,
+        IPV4_DEVCONF_ACCEPT_LOCAL,
+        IPV4_DEVCONF_SRC_VMARK,
+        IPV4_DEVCONF_PROXY_ARP_PVLAN,
+        IPV4_DEVCONF_ROUTE_LOCALNET,
+        __IPV4_DEVCONF_MAX
+};
+#define IPV4_DEVCONF_MAX (__IPV4_DEVCONF_MAX - 1)
 #endif /* _UAPI_LINUX_IP_H */
diff --git a/init/Kconfig b/init/Kconfig
index 247084be0590..fed81b576f29 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -955,7 +955,7 @@ config MEMCG_SWAP_ENABLED
          Memory Resource Controller Swap Extension comes with its price in
          a bigger memory consumption. General purpose distribution kernels
          which want to enable the feature but keep it disabled by default
-          and let the user enable it by swapaccount boot command line
+          and let the user enable it by swapaccount=1 boot command line
          parameter should have this option unselected.
          For those who want to have the feature enabled by default should
          select this option (if, for some reason, they need to disable it
diff --git a/ipc/msg.c b/ipc/msg.c
index bd60d7e159e8..9f29d9e89bac 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -839,7 +839,7 @@ static inline void free_copy(struct msg_msg *copy)
 static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
 {
-        struct msg_msg *msg;
+        struct msg_msg *msg, *found = NULL;
        long count = 0;
        list_for_each_entry(msg, &msq->q_messages, m_list) {
@@ -848,6 +848,7 @@ static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
                                               *msgtyp, mode)) {
                        if (mode == SEARCH_LESSEQUAL && msg->m_type != 1) {
                                *msgtyp = msg->m_type - 1;
+                                found = msg;
                        } else if (mode == SEARCH_NUMBER) {
                                if (*msgtyp == count)
                                        return msg;
@@ -857,7 +858,7 @@ static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
                }
        }
-        return ERR_PTR(-EAGAIN);
+        return found ?: ERR_PTR(-EAGAIN);
 }
 long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgflg,
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 781845a013ab..e91963302c0d 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -4480,6 +4480,7 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
        struct dentry *d = cgrp->dentry;
        struct cgroup_event *event, *tmp;
        struct cgroup_subsys *ss;
+        struct cgroup *child;
        bool empty;
        lockdep_assert_held(&d->d_inode->i_mutex);
@@ -4490,12 +4491,28 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
         * @cgrp from being removed while __put_css_set() is in progress.
         */
        read_lock(&css_set_lock);
-        empty = list_empty(&cgrp->cset_links) && list_empty(&cgrp->children);
+        empty = list_empty(&cgrp->cset_links);
        read_unlock(&css_set_lock);
        if (!empty)
                return -EBUSY;
        /*
+         * Make sure there's no live children.  We can't test ->children
+         * emptiness as dead children linger on it while being destroyed;
+         * otherwise, "rmdir parent/child parent" may fail with -EBUSY.
+         */
+        empty = true;
+        rcu_read_lock();
+        list_for_each_entry_rcu(child, &cgrp->children, sibling) {
+                empty = cgroup_is_dead(child);
+                if (!empty)
+                        break;
+        }
+        rcu_read_unlock();
+        if (!empty)
+                return -EBUSY;
+        /*
         * Block new css_tryget() by killing css refcnts.  cgroup core
         * guarantees that, by the time ->css_offline() is invoked, no new
         * css reference will be given out via css_tryget().  We can't
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 010a0083c0ae..ea1966db34f2 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -475,13 +475,17 @@ static int validate_change(const struct cpuset *cur, const struct cpuset *trial)
        /*
         * Cpusets with tasks - existing or newly being attached - can't
-         * have empty cpus_allowed or mems_allowed.
+         * be changed to have empty cpus_allowed or mems_allowed.
         */
        ret = -ENOSPC;
-        if ((cgroup_task_count(cur->css.cgroup) || cur->attach_in_progress) &&
+        if ((cgroup_task_count(cur->css.cgroup) || cur->attach_in_progress)) {
-            (cpumask_empty(trial->cpus_allowed) &&
+                if (!cpumask_empty(cur->cpus_allowed) &&
-             nodes_empty(trial->mems_allowed)))
+                    cpumask_empty(trial->cpus_allowed))
-                goto out;
+                        goto out;
+                if (!nodes_empty(cur->mems_allowed) &&
+                    nodes_empty(trial->mems_allowed))
+                        goto out;
+        }
        ret = 0;
 out:
diff --git a/kernel/fork.c b/kernel/fork.c
index e23bb19e2a3e..bf46287c91a4 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1177,7 +1177,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         * don't allow the creation of threads.
         */
        if ((clone_flags & (CLONE_VM|CLONE_NEWPID)) &&
-            (task_active_pid_ns(current) != current->nsproxy->pid_ns))
+            (task_active_pid_ns(current) !=
+             current->nsproxy->pid_ns_for_children))
                return ERR_PTR(-EINVAL);
        retval = security_task_create(clone_flags);
@@ -1351,7 +1352,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
        if (pid != &init_struct_pid) {
                retval = -ENOMEM;
-                pid = alloc_pid(p->nsproxy->pid_ns);
+                pid = alloc_pid(p->nsproxy->pid_ns_for_children);
                if (!pid)
                        goto bad_fork_cleanup_io;
        }
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index 364ceab15f0c..997cbb951a3b 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -29,15 +29,15 @@
 static struct kmem_cache *nsproxy_cachep;
 struct nsproxy init_nsproxy = {
-        .count  = ATOMIC_INIT(1),
+        .count                  = ATOMIC_INIT(1),
-        .uts_ns = &init_uts_ns,
+        .uts_ns                 = &init_uts_ns,
 #if defined(CONFIG_POSIX_MQUEUE) || defined(CONFIG_SYSVIPC)
-        .ipc_ns = &init_ipc_ns,
+        .ipc_ns                 = &init_ipc_ns,
 #endif
-        .mnt_ns = NULL,
+        .mnt_ns                 = NULL,
-        .pid_ns = &init_pid_ns,
+        .pid_ns_for_children    = &init_pid_ns,
 #ifdef CONFIG_NET
-        .net_ns = &init_net,
+        .net_ns                 = &init_net,
 #endif
 };
@@ -85,9 +85,10 @@ static struct nsproxy *create_new_namespaces(unsigned long flags,
                goto out_ipc;
        }
-        new_nsp->pid_ns = copy_pid_ns(flags, user_ns, tsk->nsproxy->pid_ns);
+        new_nsp->pid_ns_for_children =
-        if (IS_ERR(new_nsp->pid_ns)) {
+                copy_pid_ns(flags, user_ns, tsk->nsproxy->pid_ns_for_children);
-                err = PTR_ERR(new_nsp->pid_ns);
+        if (IS_ERR(new_nsp->pid_ns_for_children)) {
+                err = PTR_ERR(new_nsp->pid_ns_for_children);
                goto out_pid;
        }
@@ -100,8 +101,8 @@ static struct nsproxy *create_new_namespaces(unsigned long flags,
        return new_nsp;
 out_net:
-        if (new_nsp->pid_ns)
+        if (new_nsp->pid_ns_for_children)
-                put_pid_ns(new_nsp->pid_ns);
+                put_pid_ns(new_nsp->pid_ns_for_children);
 out_pid:
        if (new_nsp->ipc_ns)
                put_ipc_ns(new_nsp->ipc_ns);
@@ -174,8 +175,8 @@ void free_nsproxy(struct nsproxy *ns)
                put_uts_ns(ns->uts_ns);
        if (ns->ipc_ns)
                put_ipc_ns(ns->ipc_ns);
-        if (ns->pid_ns)
+        if (ns->pid_ns_for_children)
-                put_pid_ns(ns->pid_ns);
+                put_pid_ns(ns->pid_ns_for_children);
        put_net(ns->net_ns);
        kmem_cache_free(nsproxy_cachep, ns);
 }
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 6917e8edb48e..601bb361c235 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -349,8 +349,8 @@ static int pidns_install(struct nsproxy *nsproxy, void *ns)
        if (ancestor != active)
                return -EINVAL;
-        put_pid_ns(nsproxy->pid_ns);
+        put_pid_ns(nsproxy->pid_ns_for_children);
-        nsproxy->pid_ns = get_pid_ns(new);
+        nsproxy->pid_ns_for_children = get_pid_ns(new);
        return 0;
 }
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index 3bdf28323012..61ed862cdd37 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -265,10 +265,9 @@ static inline void timer_list_header(struct seq_file *m, u64 now)
 static int timer_list_show(struct seq_file *m, void *v)
 {
        struct timer_list_iter *iter = v;
-        u64 now = ktime_to_ns(ktime_get());
        if (iter->cpu == -1 && !iter->second_pass)
-                timer_list_header(m, now);
+                timer_list_header(m, iter->now);
        else if (!iter->second_pass)
                print_cpu(m, iter->cpu, iter->now);
 #ifdef CONFIG_GENERIC_CLOCKEVENTS
@@ -298,33 +297,41 @@ void sysrq_timer_list_show(void)
        return;
 }
-static void *timer_list_start(struct seq_file *file, loff_t *offset)
+static void *move_iter(struct timer_list_iter *iter, loff_t offset)
 {
-        struct timer_list_iter *iter = file->private;
+        for (; offset; offset--) {
+                iter->cpu = cpumask_next(iter->cpu, cpu_online_mask);
-        if (!*offset) {
+                if (iter->cpu >= nr_cpu_ids) {
-                iter->cpu = -1;
-                iter->now = ktime_to_ns(ktime_get());
-        } else if (iter->cpu >= nr_cpu_ids) {
 #ifdef CONFIG_GENERIC_CLOCKEVENTS
-                if (!iter->second_pass) {
+                        if (!iter->second_pass) {
-                        iter->cpu = -1;
+                                iter->cpu = -1;
-                        iter->second_pass = true;
+                                iter->second_pass = true;
-                } else
+                        } else
-                        return NULL;
+                                return NULL;
 #else
-                return NULL;
+                        return NULL;
 #endif
+                }
        }
        return iter;
 }
+static void *timer_list_start(struct seq_file *file, loff_t *offset)
+{
+        struct timer_list_iter *iter = file->private;
+        if (!*offset)
+                iter->now = ktime_to_ns(ktime_get());
+        iter->cpu = -1;
+        iter->second_pass = false;
+        return move_iter(iter, *offset);
+}
 static void *timer_list_next(struct seq_file *file, void *v, loff_t *offset)
 {
        struct timer_list_iter *iter = file->private;
-        iter->cpu = cpumask_next(iter->cpu, cpu_online_mask);
        ++*offset;
-        return timer_list_start(file, offset);
+        return move_iter(iter, 1);
 }
 static void timer_list_stop(struct seq_file *seq, void *v)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 7f5d4be22034..e93f7b9067d8 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2201,6 +2201,15 @@ __acquires(&pool->lock)
                dump_stack();
        }
+        /*
+         * The following prevents a kworker from hogging CPU on !PREEMPT
+         * kernels, where a requeueing work item waiting for something to
+         * happen could deadlock with stop_machine as such work item could
+         * indefinitely requeue itself while all other CPUs are trapped in
+         * stop_machine.
+         */
+        cond_resched();
        spin_lock_irq(&pool->lock);
        /* clear cpu intensive status */
diff --git a/lib/lz4/lz4_compress.c b/lib/lz4/lz4_compress.c
index fd94058bd7f9..28321d8f75ef 100644
--- a/lib/lz4/lz4_compress.c
+++ b/lib/lz4/lz4_compress.c
@@ -437,7 +437,7 @@ int lz4_compress(const unsigned char *src, size_t src_len,
 exit:
        return ret;
 }
-EXPORT_SYMBOL_GPL(lz4_compress);
+EXPORT_SYMBOL(lz4_compress);
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("Dual BSD/GPL");
 MODULE_DESCRIPTION("LZ4 compressor");
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index d3414eae73a1..411be80ddb46 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -299,7 +299,7 @@ exit_0:
        return ret;
 }
 #ifndef STATIC
-EXPORT_SYMBOL_GPL(lz4_decompress);
+EXPORT_SYMBOL(lz4_decompress);
 #endif
 int lz4_decompress_unknownoutputsize(const char *src, size_t src_len,
@@ -319,8 +319,8 @@ exit_0:
        return ret;
 }
 #ifndef STATIC
-EXPORT_SYMBOL_GPL(lz4_decompress_unknownoutputsize);
+EXPORT_SYMBOL(lz4_decompress_unknownoutputsize);
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("Dual BSD/GPL");
 MODULE_DESCRIPTION("LZ4 Decompressor");
 #endif
diff --git a/lib/lz4/lz4hc_compress.c b/lib/lz4/lz4hc_compress.c
index eb1a74f5e368..f344f76b6559 100644
--- a/lib/lz4/lz4hc_compress.c
+++ b/lib/lz4/lz4hc_compress.c
@@ -533,7 +533,7 @@ int lz4hc_compress(const unsigned char *src, size_t src_len,
 exit:
        return ret;
 }
-EXPORT_SYMBOL_GPL(lz4hc_compress);
+EXPORT_SYMBOL(lz4hc_compress);
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("Dual BSD/GPL");
 MODULE_DESCRIPTION("LZ4HC compressor");
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index c5792a5d87ce..0878ff7c26a9 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -6969,7 +6969,6 @@ struct cgroup_subsys mem_cgroup_subsys = {
 #ifdef CONFIG_MEMCG_SWAP
 static int __init enable_swap_account(char *s)
 {
-        /* consider enabled if no parameter or 1 is given */
        if (!strcmp(s, "1"))
                really_do_swap_account = 1;
        else if (!strcmp(s, "0"))
diff --git a/mm/mremap.c b/mm/mremap.c
index 457d34ef3bf2..0843feb66f3d 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -15,6 +15,7 @@
 #include <linux/swap.h>
 #include <linux/capability.h>
 #include <linux/fs.h>
+#include <linux/swapops.h>
 #include <linux/highmem.h>
 #include <linux/security.h>
 #include <linux/syscalls.h>
@@ -69,6 +70,23 @@ static pmd_t *alloc_new_pmd(struct mm_struct *mm, struct vm_area_struct *vma,
        return pmd;
 }
+static pte_t move_soft_dirty_pte(pte_t pte)
+{
+        /*
+         * Set soft dirty bit so we can notice
+         * in userspace the ptes were moved.
+         */
+#ifdef CONFIG_MEM_SOFT_DIRTY
+        if (pte_present(pte))
+                pte = pte_mksoft_dirty(pte);
+        else if (is_swap_pte(pte))
+                pte = pte_swp_mksoft_dirty(pte);
+        else if (pte_file(pte))
+                pte = pte_file_mksoft_dirty(pte);
+#endif
+        return pte;
+}
 static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
                unsigned long old_addr, unsigned long old_end,
                struct vm_area_struct *new_vma, pmd_t *new_pmd,
@@ -126,7 +144,8 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
                        continue;
                pte = ptep_get_and_clear(mm, old_addr, old_pte);
                pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
-                set_pte_at(mm, new_addr, new_pte, pte_mksoft_dirty(pte));
+                pte = move_soft_dirty_pte(pte);
+                set_pte_at(mm, new_addr, new_pte, pte);
        }
        arch_leave_lazy_mmu_mode();
diff --git a/mm/shmem.c b/mm/shmem.c
index 8335dbd3fc35..e43dc555069d 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2909,14 +2909,8 @@ EXPORT_SYMBOL_GPL(shmem_truncate_range);
 /* common code */
-static char *shmem_dname(struct dentry *dentry, char *buffer, int buflen)
-{
-        return dynamic_dname(dentry, buffer, buflen, "/%s (deleted)",
-                                dentry->d_name.name);
-}
 static struct dentry_operations anon_ops = {
-        .d_dname = shmem_dname
+        .d_dname = simple_dname
 };
 /**
diff --git a/mm/slab.h b/mm/slab.h
index 620ceeddbe1a..a535033f7e9a 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -162,6 +162,8 @@ static inline const char *cache_name(struct kmem_cache *s)
 static inline struct kmem_cache *cache_from_memcg(struct kmem_cache *s, int idx)
 {
+        if (!s->memcg_params)
+                return NULL;
        return s->memcg_params->memcg_caches[idx];
 }
diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
index 688a0419756b..857e1b8349ee 100644
--- a/net/batman-adv/unicast.c
+++ b/net/batman-adv/unicast.c
@@ -432,12 +432,16 @@ find_router:
        switch (packet_type) {
        case BATADV_UNICAST:
-                batadv_unicast_prepare_skb(skb, orig_node);
+                if (!batadv_unicast_prepare_skb(skb, orig_node))
+                        goto out;
                header_len = sizeof(struct batadv_unicast_packet);
                break;
        case BATADV_UNICAST_4ADDR:
-                batadv_unicast_4addr_prepare_skb(bat_priv, skb, orig_node,
+                if (!batadv_unicast_4addr_prepare_skb(bat_priv, skb, orig_node,
-                                                 packet_subtype);
+                                                      packet_subtype))
+                        goto out;
                header_len = sizeof(struct batadv_unicast_4addr_packet);
                break;
        default:
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 69363bd37f64..89659d4ed1f9 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -71,7 +71,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
                mdst = br_mdb_get(br, skb, vid);
                if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
-                    br_multicast_querier_exists(br))
+                    br_multicast_querier_exists(br, eth_hdr(skb)))
                        br_multicast_deliver(mdst, skb);
                else
                        br_flood_deliver(br, skb, false);
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 60aca9109a50..ffd5874f2592 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -161,7 +161,7 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
        if (!pv)
                return;
-        for_each_set_bit_from(vid, pv->vlan_bitmap, BR_VLAN_BITMAP_LEN) {
+        for_each_set_bit_from(vid, pv->vlan_bitmap, VLAN_N_VID) {
                f = __br_fdb_get(br, br->dev->dev_addr, vid);
                if (f && f->is_local && !f->dst)
                        fdb_delete(br, f);
@@ -730,7 +730,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                /* VID was specified, so use it. */
                err = __br_fdb_add(ndm, p, addr, nlh_flags, vid);
        } else {
-                if (!pv || bitmap_empty(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN)) {
+                if (!pv || bitmap_empty(pv->vlan_bitmap, VLAN_N_VID)) {
                        err = __br_fdb_add(ndm, p, addr, nlh_flags, 0);
                        goto out;
                }
@@ -739,7 +739,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                 * specify a VLAN.  To be nice, add/update entry for every
                 * vlan on this port.
                 */
-                for_each_set_bit(vid, pv->vlan_bitmap, BR_VLAN_BITMAP_LEN) {
+                for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID) {
                        err = __br_fdb_add(ndm, p, addr, nlh_flags, vid);
                        if (err)
                                goto out;
@@ -817,7 +817,7 @@ int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
                err = __br_fdb_delete(p, addr, vid);
        } else {
-                if (!pv || bitmap_empty(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN)) {
+                if (!pv || bitmap_empty(pv->vlan_bitmap, VLAN_N_VID)) {
                        err = __br_fdb_delete(p, addr, 0);
                        goto out;
                }
@@ -827,7 +827,7 @@ int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
                 * vlan on this port.
                 */
                err = -ENOENT;
-                for_each_set_bit(vid, pv->vlan_bitmap, BR_VLAN_BITMAP_LEN) {
+                for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID) {
                        err &= __br_fdb_delete(p, addr, vid);
                }
        }
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 8c561c0aa636..a2fd37ec35f7 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -102,7 +102,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
        } else if (is_multicast_ether_addr(dest)) {
                mdst = br_mdb_get(br, skb, vid);
                if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
-                    br_multicast_querier_exists(br)) {
+                    br_multicast_querier_exists(br, eth_hdr(skb))) {
                        if ((mdst && mdst->mglist) ||
                            br_multicast_is_router(br))
                                skb2 = skb;
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index 0daae3ec2355..6319c4333c39 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -414,16 +414,20 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
        if (!netif_running(br->dev) || br->multicast_disabled)
                return -EINVAL;
-        if (timer_pending(&br->multicast_querier_timer))
-                return -EBUSY;
        ip.proto = entry->addr.proto;
-        if (ip.proto == htons(ETH_P_IP))
+        if (ip.proto == htons(ETH_P_IP)) {
+                if (timer_pending(&br->ip4_querier.timer))
+                        return -EBUSY;
                ip.u.ip4 = entry->addr.u.ip4;
 #if IS_ENABLED(CONFIG_IPV6)
-        else
+        } else {
+                if (timer_pending(&br->ip6_querier.timer))
+                        return -EBUSY;
                ip.u.ip6 = entry->addr.u.ip6;
 #endif
+        }
        spin_lock_bh(&br->multicast_lock);
        mdb = mlock_dereference(br->mdb, br);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 08e576ada0b2..bbcb43582496 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -33,7 +33,8 @@
 #include "br_private.h"
-static void br_multicast_start_querier(struct net_bridge *br);
+static void br_multicast_start_querier(struct net_bridge *br,
+                                       struct bridge_mcast_query *query);
 unsigned int br_mdb_rehash_seq;
 static inline int br_ip_equal(const struct br_ip *a, const struct br_ip *b)
@@ -755,20 +756,35 @@ static void br_multicast_local_router_expired(unsigned long data)
 {
 }
-static void br_multicast_querier_expired(unsigned long data)
+static void br_multicast_querier_expired(struct net_bridge *br,
+                                         struct bridge_mcast_query *query)
 {
-        struct net_bridge *br = (void *)data;
        spin_lock(&br->multicast_lock);
        if (!netif_running(br->dev) || br->multicast_disabled)
                goto out;
-        br_multicast_start_querier(br);
+        br_multicast_start_querier(br, query);
 out:
        spin_unlock(&br->multicast_lock);
 }
+static void br_ip4_multicast_querier_expired(unsigned long data)
+{
+        struct net_bridge *br = (void *)data;
+        br_multicast_querier_expired(br, &br->ip4_query);
+}
+#if IS_ENABLED(CONFIG_IPV6)
+static void br_ip6_multicast_querier_expired(unsigned long data)
+{
+        struct net_bridge *br = (void *)data;
+        br_multicast_querier_expired(br, &br->ip6_query);
+}
+#endif
 static void __br_multicast_send_query(struct net_bridge *br,
                                      struct net_bridge_port *port,
                                      struct br_ip *ip)
@@ -789,37 +805,45 @@ static void __br_multicast_send_query(struct net_bridge *br,
 }
 static void br_multicast_send_query(struct net_bridge *br,
-                                    struct net_bridge_port *port, u32 sent)
+                                    struct net_bridge_port *port,
+                                    struct bridge_mcast_query *query)
 {
        unsigned long time;
        struct br_ip br_group;
+        struct bridge_mcast_querier *querier = NULL;
        if (!netif_running(br->dev) || br->multicast_disabled ||
-            !br->multicast_querier ||
+            !br->multicast_querier)
-            timer_pending(&br->multicast_querier_timer))
                return;
        memset(&br_group.u, 0, sizeof(br_group.u));
-        br_group.proto = htons(ETH_P_IP);
+        if (port ? (query == &port->ip4_query) :
-        __br_multicast_send_query(br, port, &br_group);
+                   (query == &br->ip4_query)) {
+                querier = &br->ip4_querier;
+                br_group.proto = htons(ETH_P_IP);
 #if IS_ENABLED(CONFIG_IPV6)
-        br_group.proto = htons(ETH_P_IPV6);
+        } else {
-        __br_multicast_send_query(br, port, &br_group);
+                querier = &br->ip6_querier;
+                br_group.proto = htons(ETH_P_IPV6);
 #endif
+        }
+        if (!querier || timer_pending(&querier->timer))
+                return;
+        __br_multicast_send_query(br, port, &br_group);
        time = jiffies;
-        time += sent < br->multicast_startup_query_count ?
+        time += query->startup_sent < br->multicast_startup_query_count ?
                br->multicast_startup_query_interval :
                br->multicast_query_interval;
-        mod_timer(port ? &port->multicast_query_timer :
+        mod_timer(&query->timer, time);
-                         &br->multicast_query_timer, time);
 }
-static void br_multicast_port_query_expired(unsigned long data)
+static void br_multicast_port_query_expired(struct net_bridge_port *port,
+                                            struct bridge_mcast_query *query)
 {
-        struct net_bridge_port *port = (void *)data;
        struct net_bridge *br = port->br;
        spin_lock(&br->multicast_lock);
@@ -827,25 +851,43 @@ static void br_multicast_port_query_expired(unsigned long data)
            port->state == BR_STATE_BLOCKING)
                goto out;
-        if (port->multicast_startup_queries_sent <
+        if (query->startup_sent < br->multicast_startup_query_count)
-            br->multicast_startup_query_count)
+                query->startup_sent++;
-                port->multicast_startup_queries_sent++;
-        br_multicast_send_query(port->br, port,
+        br_multicast_send_query(port->br, port, query);
-                                port->multicast_startup_queries_sent);
 out:
        spin_unlock(&br->multicast_lock);
 }
+static void br_ip4_multicast_port_query_expired(unsigned long data)
+{
+        struct net_bridge_port *port = (void *)data;
+        br_multicast_port_query_expired(port, &port->ip4_query);
+}
+#if IS_ENABLED(CONFIG_IPV6)
+static void br_ip6_multicast_port_query_expired(unsigned long data)
+{
+        struct net_bridge_port *port = (void *)data;
+        br_multicast_port_query_expired(port, &port->ip6_query);
+}
+#endif
 void br_multicast_add_port(struct net_bridge_port *port)
 {
        port->multicast_router = 1;
        setup_timer(&port->multicast_router_timer, br_multicast_router_expired,
                    (unsigned long)port);
-        setup_timer(&port->multicast_query_timer,
+        setup_timer(&port->ip4_query.timer, br_ip4_multicast_port_query_expired,
-                    br_multicast_port_query_expired, (unsigned long)port);
+                    (unsigned long)port);
+#if IS_ENABLED(CONFIG_IPV6)
+        setup_timer(&port->ip6_query.timer, br_ip6_multicast_port_query_expired,
+                    (unsigned long)port);
+#endif
 }
 void br_multicast_del_port(struct net_bridge_port *port)
@@ -853,13 +895,13 @@ void br_multicast_del_port(struct net_bridge_port *port)
        del_timer_sync(&port->multicast_router_timer);
 }
-static void __br_multicast_enable_port(struct net_bridge_port *port)
+static void br_multicast_enable(struct bridge_mcast_query *query)
 {
-        port->multicast_startup_queries_sent = 0;
+        query->startup_sent = 0;
-        if (try_to_del_timer_sync(&port->multicast_query_timer) >= 0 ||
+        if (try_to_del_timer_sync(&query->timer) >= 0 ||
-            del_timer(&port->multicast_query_timer))
+            del_timer(&query->timer))
-                mod_timer(&port->multicast_query_timer, jiffies);
+                mod_timer(&query->timer, jiffies);
 }
 void br_multicast_enable_port(struct net_bridge_port *port)
@@ -870,7 +912,10 @@ void br_multicast_enable_port(struct net_bridge_port *port)
        if (br->multicast_disabled || !netif_running(br->dev))
                goto out;
-        __br_multicast_enable_port(port);
+        br_multicast_enable(&port->ip4_query);
+#if IS_ENABLED(CONFIG_IPV6)
+        br_multicast_enable(&port->ip6_query);
+#endif
 out:
        spin_unlock(&br->multicast_lock);
@@ -889,7 +934,10 @@ void br_multicast_disable_port(struct net_bridge_port *port)
        if (!hlist_unhashed(&port->rlist))
                hlist_del_init_rcu(&port->rlist);
        del_timer(&port->multicast_router_timer);
-        del_timer(&port->multicast_query_timer);
+        del_timer(&port->ip4_query.timer);
+#if IS_ENABLED(CONFIG_IPV6)
+        del_timer(&port->ip6_query.timer);
+#endif
        spin_unlock(&br->multicast_lock);
 }
@@ -1014,14 +1062,15 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
 }
 #endif
-static void br_multicast_update_querier_timer(struct net_bridge *br,
+static void
-                                              unsigned long max_delay)
+br_multicast_update_querier_timer(struct net_bridge *br,
+                                  struct bridge_mcast_querier *querier,
+                                  unsigned long max_delay)
 {
-        if (!timer_pending(&br->multicast_querier_timer))
+        if (!timer_pending(&querier->timer))
-                br->multicast_querier_delay_time = jiffies + max_delay;
+                querier->delay_time = jiffies + max_delay;
-        mod_timer(&br->multicast_querier_timer,
+        mod_timer(&querier->timer, jiffies + br->multicast_querier_interval);
-                  jiffies + br->multicast_querier_interval);
 }
 /*
@@ -1074,12 +1123,13 @@ timer:
 static void br_multicast_query_received(struct net_bridge *br,
                                        struct net_bridge_port *port,
+                                        struct bridge_mcast_querier *querier,
                                        int saddr,
                                        unsigned long max_delay)
 {
        if (saddr)
-                br_multicast_update_querier_timer(br, max_delay);
+                br_multicast_update_querier_timer(br, querier, max_delay);
-        else if (timer_pending(&br->multicast_querier_timer))
+        else if (timer_pending(&querier->timer))
                return;
        br_multicast_mark_router(br, port);
@@ -1129,7 +1179,8 @@ static int br_ip4_multicast_query(struct net_bridge *br,
                            IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
        }
-        br_multicast_query_received(br, port, !!iph->saddr, max_delay);
+        br_multicast_query_received(br, port, &br->ip4_querier, !!iph->saddr,
+                                    max_delay);
        if (!group)
                goto out;
@@ -1203,11 +1254,12 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                mld2q = (struct mld2_query *)icmp6_hdr(skb);
                if (!mld2q->mld2q_nsrcs)
                        group = &mld2q->mld2q_mca;
-                max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(ntohs(mld2q->mld2q_mrc)) : 1;
+                max_delay = max(msecs_to_jiffies(MLDV2_MRC(ntohs(mld2q->mld2q_mrc))), 1UL);
        }
-        br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr),
+        br_multicast_query_received(br, port, &br->ip6_querier,
-                                    max_delay);
+                                    !ipv6_addr_any(&ip6h->saddr), max_delay);
        if (!group)
                goto out;
@@ -1244,7 +1296,9 @@ out:
 static void br_multicast_leave_group(struct net_bridge *br,
                                     struct net_bridge_port *port,
-                                     struct br_ip *group)
+                                     struct br_ip *group,
+                                     struct bridge_mcast_querier *querier,
+                                     struct bridge_mcast_query *query)
 {
        struct net_bridge_mdb_htable *mdb;
        struct net_bridge_mdb_entry *mp;
@@ -1255,7 +1309,7 @@ static void br_multicast_leave_group(struct net_bridge *br,
        spin_lock(&br->multicast_lock);
        if (!netif_running(br->dev) ||
            (port && port->state == BR_STATE_DISABLED) ||
-            timer_pending(&br->multicast_querier_timer))
+            timer_pending(&querier->timer))
                goto out;
        mdb = mlock_dereference(br->mdb, br);
@@ -1263,14 +1317,13 @@ static void br_multicast_leave_group(struct net_bridge *br,
        if (!mp)
                goto out;
-        if (br->multicast_querier &&
+        if (br->multicast_querier) {
-            !timer_pending(&br->multicast_querier_timer)) {
                __br_multicast_send_query(br, port, &mp->addr);
                time = jiffies + br->multicast_last_member_count *
                                 br->multicast_last_member_interval;
-                mod_timer(port ? &port->multicast_query_timer :
-                                 &br->multicast_query_timer, time);
+                mod_timer(&query->timer, time);
                for (p = mlock_dereference(mp->ports, br);
                     p != NULL;
@@ -1323,7 +1376,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
                        mod_timer(&mp->timer, time);
                }
        }
 out:
        spin_unlock(&br->multicast_lock);
 }
@@ -1334,6 +1386,8 @@ static void br_ip4_multicast_leave_group(struct net_bridge *br,
                                         __u16 vid)
 {
        struct br_ip br_group;
+        struct bridge_mcast_query *query = port ? &port->ip4_query :
+                                                  &br->ip4_query;
        if (ipv4_is_local_multicast(group))
                return;
@@ -1342,7 +1396,7 @@ static void br_ip4_multicast_leave_group(struct net_bridge *br,
        br_group.proto = htons(ETH_P_IP);
        br_group.vid = vid;
-        br_multicast_leave_group(br, port, &br_group);
+        br_multicast_leave_group(br, port, &br_group, &br->ip4_querier, query);
 }
 #if IS_ENABLED(CONFIG_IPV6)
@@ -1352,6 +1406,9 @@ static void br_ip6_multicast_leave_group(struct net_bridge *br,
                                         __u16 vid)
 {
        struct br_ip br_group;
+        struct bridge_mcast_query *query = port ? &port->ip6_query :
+                                                  &br->ip6_query;
        if (!ipv6_is_transient_multicast(group))
                return;
@@ -1360,7 +1417,7 @@ static void br_ip6_multicast_leave_group(struct net_bridge *br,
        br_group.proto = htons(ETH_P_IPV6);
        br_group.vid = vid;
-        br_multicast_leave_group(br, port, &br_group);
+        br_multicast_leave_group(br, port, &br_group, &br->ip6_querier, query);
 }
 #endif
@@ -1622,19 +1679,32 @@ int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
        return 0;
 }
-static void br_multicast_query_expired(unsigned long data)
+static void br_multicast_query_expired(struct net_bridge *br,
+                                       struct bridge_mcast_query *query)
+{
+        spin_lock(&br->multicast_lock);
+        if (query->startup_sent < br->multicast_startup_query_count)
+                query->startup_sent++;
+        br_multicast_send_query(br, NULL, query);
+        spin_unlock(&br->multicast_lock);
+}
+static void br_ip4_multicast_query_expired(unsigned long data)
 {
        struct net_bridge *br = (void *)data;
-        spin_lock(&br->multicast_lock);
+        br_multicast_query_expired(br, &br->ip4_query);
-        if (br->multicast_startup_queries_sent <
+}
-            br->multicast_startup_query_count)
-                br->multicast_startup_queries_sent++;
-        br_multicast_send_query(br, NULL, br->multicast_startup_queries_sent);
+#if IS_ENABLED(CONFIG_IPV6)
+static void br_ip6_multicast_query_expired(unsigned long data)
+{
+        struct net_bridge *br = (void *)data;
-        spin_unlock(&br->multicast_lock);
+        br_multicast_query_expired(br, &br->ip6_query);
 }
+#endif
 void br_multicast_init(struct net_bridge *br)
 {
@@ -1654,25 +1724,43 @@ void br_multicast_init(struct net_bridge *br)
        br->multicast_querier_interval = 255 * HZ;
        br->multicast_membership_interval = 260 * HZ;
-        br->multicast_querier_delay_time = 0;
+        br->ip4_querier.delay_time = 0;
+#if IS_ENABLED(CONFIG_IPV6)
+        br->ip6_querier.delay_time = 0;
+#endif
        spin_lock_init(&br->multicast_lock);
        setup_timer(&br->multicast_router_timer,
                    br_multicast_local_router_expired, 0);
-        setup_timer(&br->multicast_querier_timer,
+        setup_timer(&br->ip4_querier.timer, br_ip4_multicast_querier_expired,
-                    br_multicast_querier_expired, (unsigned long)br);
+                    (unsigned long)br);
-        setup_timer(&br->multicast_query_timer, br_multicast_query_expired,
+        setup_timer(&br->ip4_query.timer, br_ip4_multicast_query_expired,
                    (unsigned long)br);
+#if IS_ENABLED(CONFIG_IPV6)
+        setup_timer(&br->ip6_querier.timer, br_ip6_multicast_querier_expired,
+                    (unsigned long)br);
+        setup_timer(&br->ip6_query.timer, br_ip6_multicast_query_expired,
+                    (unsigned long)br);
+#endif
 }
-void br_multicast_open(struct net_bridge *br)
+static void __br_multicast_open(struct net_bridge *br,
+                                struct bridge_mcast_query *query)
 {
-        br->multicast_startup_queries_sent = 0;
+        query->startup_sent = 0;
        if (br->multicast_disabled)
                return;
-        mod_timer(&br->multicast_query_timer, jiffies);
+        mod_timer(&query->timer, jiffies);
+}
+void br_multicast_open(struct net_bridge *br)
+{
+        __br_multicast_open(br, &br->ip4_query);
+#if IS_ENABLED(CONFIG_IPV6)
+        __br_multicast_open(br, &br->ip6_query);
+#endif
 }
 void br_multicast_stop(struct net_bridge *br)
@@ -1684,8 +1772,12 @@ void br_multicast_stop(struct net_bridge *br)
        int i;
        del_timer_sync(&br->multicast_router_timer);
-        del_timer_sync(&br->multicast_querier_timer);
+        del_timer_sync(&br->ip4_querier.timer);
-        del_timer_sync(&br->multicast_query_timer);
+        del_timer_sync(&br->ip4_query.timer);
+#if IS_ENABLED(CONFIG_IPV6)
+        del_timer_sync(&br->ip6_querier.timer);
+        del_timer_sync(&br->ip6_query.timer);
+#endif
        spin_lock_bh(&br->multicast_lock);
        mdb = mlock_dereference(br->mdb, br);
@@ -1788,18 +1880,24 @@ unlock:
        return err;
 }
-static void br_multicast_start_querier(struct net_bridge *br)
+static void br_multicast_start_querier(struct net_bridge *br,
+                                       struct bridge_mcast_query *query)
 {
        struct net_bridge_port *port;
-        br_multicast_open(br);
+        __br_multicast_open(br, query);
        list_for_each_entry(port, &br->port_list, list) {
                if (port->state == BR_STATE_DISABLED ||
                    port->state == BR_STATE_BLOCKING)
                        continue;
-                __br_multicast_enable_port(port);
+                if (query == &br->ip4_query)
+                        br_multicast_enable(&port->ip4_query);
+#if IS_ENABLED(CONFIG_IPV6)
+                else
+                        br_multicast_enable(&port->ip6_query);
+#endif
        }
 }
@@ -1834,7 +1932,10 @@ rollback:
                        goto rollback;
        }
-        br_multicast_start_querier(br);
+        br_multicast_start_querier(br, &br->ip4_query);
+#if IS_ENABLED(CONFIG_IPV6)
+        br_multicast_start_querier(br, &br->ip6_query);
+#endif
 unlock:
        spin_unlock_bh(&br->multicast_lock);
@@ -1857,10 +1958,18 @@ int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
                goto unlock;
        max_delay = br->multicast_query_response_interval;
-        if (!timer_pending(&br->multicast_querier_timer))
-                br->multicast_querier_delay_time = jiffies + max_delay;
-        br_multicast_start_querier(br);
+        if (!timer_pending(&br->ip4_querier.timer))
+                br->ip4_querier.delay_time = jiffies + max_delay;
+        br_multicast_start_querier(br, &br->ip4_query);
+#if IS_ENABLED(CONFIG_IPV6)
+        if (!timer_pending(&br->ip6_querier.timer))
+                br->ip6_querier.delay_time = jiffies + max_delay;
+        br_multicast_start_querier(br, &br->ip6_query);
+#endif
 unlock:
        spin_unlock_bh(&br->multicast_lock);
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 1fc30abd3a52..b9259efa636e 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -132,7 +132,7 @@ static int br_fill_ifinfo(struct sk_buff *skb,
                else
                        pv = br_get_vlan_info(br);
-                if (!pv || bitmap_empty(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN))
+                if (!pv || bitmap_empty(pv->vlan_bitmap, VLAN_N_VID))
                        goto done;
                af = nla_nest_start(skb, IFLA_AF_SPEC);
@@ -140,7 +140,7 @@ static int br_fill_ifinfo(struct sk_buff *skb,
                        goto nla_put_failure;
                pvid = br_get_pvid(pv);
-                for_each_set_bit(vid, pv->vlan_bitmap, BR_VLAN_BITMAP_LEN) {
+                for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID) {
                        vinfo.vid = vid;
                        vinfo.flags = 0;
                        if (vid == pvid)
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 2f7da41851bf..263ba9034468 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -66,6 +66,20 @@ struct br_ip
        __u16           vid;
 };
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+/* our own querier */
+struct bridge_mcast_query {
+        struct timer_list       timer;
+        u32                     startup_sent;
+};
+/* other querier */
+struct bridge_mcast_querier {
+        struct timer_list               timer;
+        unsigned long                   delay_time;
+};
+#endif
 struct net_port_vlans {
        u16                             port_idx;
        u16                             pvid;
@@ -162,10 +176,12 @@ struct net_bridge_port
 #define BR_FLOOD                0x00000040
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
-        u32                             multicast_startup_queries_sent;
+        struct bridge_mcast_query       ip4_query;
+#if IS_ENABLED(CONFIG_IPV6)
+        struct bridge_mcast_query       ip6_query;
+#endif /* IS_ENABLED(CONFIG_IPV6) */
        unsigned char                   multicast_router;
        struct timer_list               multicast_router_timer;
-        struct timer_list               multicast_query_timer;
        struct hlist_head               mglist;
        struct hlist_node               rlist;
 #endif
@@ -258,7 +274,6 @@ struct net_bridge
        u32                             hash_max;
        u32                             multicast_last_member_count;
-        u32                             multicast_startup_queries_sent;
        u32                             multicast_startup_query_count;
        unsigned long                   multicast_last_member_interval;
@@ -267,15 +282,18 @@ struct net_bridge
        unsigned long                   multicast_query_interval;
        unsigned long                   multicast_query_response_interval;
        unsigned long                   multicast_startup_query_interval;
-        unsigned long                   multicast_querier_delay_time;
        spinlock_t                      multicast_lock;
        struct net_bridge_mdb_htable __rcu *mdb;
        struct hlist_head               router_list;
        struct timer_list               multicast_router_timer;
-        struct timer_list               multicast_querier_timer;
+        struct bridge_mcast_querier     ip4_querier;
-        struct timer_list               multicast_query_timer;
+        struct bridge_mcast_query       ip4_query;
+#if IS_ENABLED(CONFIG_IPV6)
+        struct bridge_mcast_querier     ip6_querier;
+        struct bridge_mcast_query       ip6_query;
+#endif /* IS_ENABLED(CONFIG_IPV6) */
 #endif
        struct timer_list               hello_timer;
@@ -503,11 +521,27 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
                timer_pending(&br->multicast_router_timer));
 }
-static inline bool br_multicast_querier_exists(struct net_bridge *br)
+static inline bool
+__br_multicast_querier_exists(struct net_bridge *br,
+                              struct bridge_mcast_querier *querier)
+{
+        return time_is_before_jiffies(querier->delay_time) &&
+               (br->multicast_querier || timer_pending(&querier->timer));
+}
+static inline bool br_multicast_querier_exists(struct net_bridge *br,
+                                               struct ethhdr *eth)
 {
-        return time_is_before_jiffies(br->multicast_querier_delay_time) &&
+        switch (eth->h_proto) {
-               (br->multicast_querier ||
+        case (htons(ETH_P_IP)):
-                timer_pending(&br->multicast_querier_timer));
+                return __br_multicast_querier_exists(br, &br->ip4_querier);
+#if IS_ENABLED(CONFIG_IPV6)
+        case (htons(ETH_P_IPV6)):
+                return __br_multicast_querier_exists(br, &br->ip6_querier);
+#endif
+        default:
+                return false;
+        }
 }
 #else
 static inline int br_multicast_rcv(struct net_bridge *br,
@@ -565,7 +599,8 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
 {
        return 0;
 }
-static inline bool br_multicast_querier_exists(struct net_bridge *br)
+static inline bool br_multicast_querier_exists(struct net_bridge *br,
+                                               struct ethhdr *eth)
 {
        return false;
 }
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index bd58b45f5f90..9a9ffe7e4019 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -108,7 +108,7 @@ static int __vlan_del(struct net_port_vlans *v, u16 vid)
        clear_bit(vid, v->vlan_bitmap);
        v->num_vlans--;
-        if (bitmap_empty(v->vlan_bitmap, BR_VLAN_BITMAP_LEN)) {
+        if (bitmap_empty(v->vlan_bitmap, VLAN_N_VID)) {
                if (v->port_idx)
                        rcu_assign_pointer(v->parent.port->vlan_info, NULL);
                else
@@ -122,7 +122,7 @@ static void __vlan_flush(struct net_port_vlans *v)
 {
        smp_wmb();
        v->pvid = 0;
-        bitmap_zero(v->vlan_bitmap, BR_VLAN_BITMAP_LEN);
+        bitmap_zero(v->vlan_bitmap, VLAN_N_VID);
        if (v->port_idx)
                rcu_assign_pointer(v->parent.port->vlan_info, NULL);
        else
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index b84a1b155bc1..d12e3a9a5356 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -346,14 +346,9 @@ u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
                if (new_index < 0)
                        new_index = skb_tx_hash(dev, skb);
-                if (queue_index != new_index && sk) {
+                if (queue_index != new_index && sk &&
-                        struct dst_entry *dst =
+                    rcu_access_pointer(sk->sk_dst_cache))
-                                    rcu_dereference_check(sk->sk_dst_cache, 1);
+                        sk_tx_queue_set(sk, queue_index);
-                        if (dst && skb_dst(skb) == dst)
-                                sk_tx_queue_set(sk, queue_index);
-                }
                queue_index = new_index;
        }
diff --git a/net/core/scm.c b/net/core/scm.c
index 03795d0147f2..b4da80b1cc07 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -54,7 +54,7 @@ static __inline__ int scm_check_creds(struct ucred *creds)
                return -EINVAL;
        if ((creds->pid == task_tgid_vnr(current) ||
-             ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
+             ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
            ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
              uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
            ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 4bcabf3ab4ca..9ee17e3d11c3 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -211,14 +211,6 @@ static inline int ip_finish_output2(struct sk_buff *skb)
        return -EINVAL;
 }
-static inline int ip_skb_dst_mtu(struct sk_buff *skb)
-{
-        struct inet_sock *inet = skb->sk ? inet_sk(skb->sk) : NULL;
-        return (inet && inet->pmtudisc == IP_PMTUDISC_PROBE) ?
-               skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
-}
 static int ip_finish_output(struct sk_buff *skb)
 {
 #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 51fc2a1dcdd3..b3ac3c3f6219 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -190,15 +190,14 @@ static int ipip_rcv(struct sk_buff *skb)
        struct ip_tunnel *tunnel;
        const struct iphdr *iph;
-        if (iptunnel_pull_header(skb, 0, tpi.proto))
-                goto drop;
        iph = ip_hdr(skb);
        tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
                        iph->saddr, iph->daddr, 0);
        if (tunnel) {
                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
                        goto drop;
+                if (iptunnel_pull_header(skb, 0, tpi.proto))
+                        goto drop;
                return ip_tunnel_rcv(tunnel, skb, &tpi, log_ecn_error);
        }
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index dd44e0ab600c..61e60d67adca 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -571,7 +571,8 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
                           RT_SCOPE_UNIVERSE,
                           inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
-                           inet_sk_flowi_flags(sk) | FLOWI_FLAG_CAN_SLEEP,
+                           inet_sk_flowi_flags(sk) | FLOWI_FLAG_CAN_SLEEP |
+                            (inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
                           daddr, saddr, 0, 0);
        if (!inet->hdrincl) {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 5423223e93c2..b2f6c74861af 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1121,6 +1121,13 @@ new_segment:
                                        goto wait_for_memory;
                                /*
+                                 * All packets are restored as if they have
+                                 * already been sent.
+                                 */
+                                if (tp->repair)
+                                        TCP_SKB_CB(skb)->when = tcp_time_stamp;
+                                /*
                                 * Check whether we can use HW checksum.
                                 */
                                if (sk->sk_route_caps & NETIF_F_ALL_CSUM)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 28af45abe062..3ca2139a130b 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3535,7 +3535,10 @@ static bool tcp_parse_aligned_timestamp(struct tcp_sock *tp, const struct tcphdr
                ++ptr;
                tp->rx_opt.rcv_tsval = ntohl(*ptr);
                ++ptr;
-                tp->rx_opt.rcv_tsecr = ntohl(*ptr) - tp->tsoffset;
+                if (*ptr)
+                        tp->rx_opt.rcv_tsecr = ntohl(*ptr) - tp->tsoffset;
+                else
+                        tp->rx_opt.rcv_tsecr = 0;
                return true;
        }
        return false;
@@ -3560,7 +3563,7 @@ static bool tcp_fast_parse_options(const struct sk_buff *skb,
        }
        tcp_parse_options(skb, &tp->rx_opt, 1, NULL);
-        if (tp->rx_opt.saw_tstamp)
+        if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr)
                tp->rx_opt.rcv_tsecr -= tp->tsoffset;
        return true;
@@ -5316,7 +5319,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
        int saved_clamp = tp->rx_opt.mss_clamp;
        tcp_parse_options(skb, &tp->rx_opt, 0, &foc);
-        if (tp->rx_opt.saw_tstamp)
+        if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr)
                tp->rx_opt.rcv_tsecr -= tp->tsoffset;
        if (th->ack) {
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 92fde8d1aa82..170737a9d56d 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2670,7 +2670,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
        int tcp_header_size;
        int mss;
-        skb = alloc_skb(MAX_TCP_HEADER + 15, sk_gfp_atomic(sk, GFP_ATOMIC));
+        skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
        if (unlikely(!skb)) {
                dst_release(dst);
                return NULL;
@@ -2814,6 +2814,8 @@ void tcp_connect_init(struct sock *sk)
        if (likely(!tp->repair))
                tp->rcv_nxt = 0;
+        else
+                tp->rcv_tstamp = tcp_time_stamp;
        tp->rcv_wup = tp->rcv_nxt;
        tp->copied_seq = tp->rcv_nxt;
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 327a617d594c..baa0f63731fd 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -21,7 +21,6 @@
 static int xfrm4_tunnel_check_size(struct sk_buff *skb)
 {
        int mtu, ret = 0;
-        struct dst_entry *dst;
        if (IPCB(skb)->flags & IPSKB_XFRM_TUNNEL_SIZE)
                goto out;
@@ -29,12 +28,10 @@ static int xfrm4_tunnel_check_size(struct sk_buff *skb)
        if (!(ip_hdr(skb)->frag_off & htons(IP_DF)) || skb->local_df)
                goto out;
-        dst = skb_dst(skb);
+        mtu = dst_mtu(skb_dst(skb));
-        mtu = dst_mtu(dst);
        if (skb->len > mtu) {
                if (skb->sk)
-                        ip_local_error(skb->sk, EMSGSIZE, ip_hdr(skb)->daddr,
+                        xfrm_local_error(skb, mtu);
-                                       inet_sk(skb->sk)->inet_dport, mtu);
                else
                        icmp_send(skb, ICMP_DEST_UNREACH,
                                  ICMP_FRAG_NEEDED, htonl(mtu));
@@ -99,3 +96,12 @@ int xfrm4_output(struct sk_buff *skb)
                            x->outer_mode->afinfo->output_finish,
                            !(IPCB(skb)->flags & IPSKB_REROUTED));
 }
+void xfrm4_local_error(struct sk_buff *skb, u32 mtu)
+{
+        struct iphdr *hdr;
+        hdr = skb->encapsulation ? inner_ip_hdr(skb) : ip_hdr(skb);
+        ip_local_error(skb->sk, EMSGSIZE, hdr->daddr,
+                       inet_sk(skb->sk)->inet_dport, mtu);
+}
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 9258e751baba..0b2a0641526a 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -83,6 +83,7 @@ static struct xfrm_state_afinfo xfrm4_state_afinfo = {
        .extract_input          = xfrm4_extract_input,
        .extract_output         = xfrm4_extract_output,
        .transport_finish       = xfrm4_transport_finish,
+        .local_error            = xfrm4_local_error,
 };
 void __init xfrm4_state_init(void)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index da4241c8c7da..498ea99194af 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1126,12 +1126,10 @@ retry:
        if (ifp->flags & IFA_F_OPTIMISTIC)
                addr_flags |= IFA_F_OPTIMISTIC;
-        ift = !max_addresses ||
+        ift = ipv6_add_addr(idev, &addr, NULL, tmp_plen,
-              ipv6_count_addresses(idev) < max_addresses ?
+                            ipv6_addr_scope(&addr), addr_flags,
-                ipv6_add_addr(idev, &addr, NULL, tmp_plen,
+                            tmp_valid_lft, tmp_prefered_lft);
-                              ipv6_addr_scope(&addr), addr_flags,
+        if (IS_ERR(ift)) {
-                              tmp_valid_lft, tmp_prefered_lft) : NULL;
-        if (IS_ERR_OR_NULL(ift)) {
                in6_ifa_put(ifp);
                in6_dev_put(idev);
                pr_info("%s: retry temporary address regeneration\n", __func__);
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index ecd60733e5e2..90747f1973fe 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -724,6 +724,11 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
                ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
        }
+        if (likely(!skb->encapsulation)) {
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+        }
        skb_push(skb, gre_hlen);
        skb_reset_network_header(skb);
        skb_set_transport_header(skb, sizeof(*ipv6h));
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 6e3ddf806ec2..e7ceb6c871d1 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -238,6 +238,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
        hdr->saddr = fl6->saddr;
        hdr->daddr = *first_hop;
+        skb->protocol = htons(ETH_P_IPV6);
        skb->priority = sk->sk_priority;
        skb->mark = sk->sk_mark;
@@ -1057,6 +1058,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                /* initialize protocol header pointer */
                skb->transport_header = skb->network_header + fragheaderlen;
+                skb->protocol = htons(ETH_P_IPV6);
                skb->ip_summed = CHECKSUM_PARTIAL;
                skb->csum = 0;
        }
@@ -1359,6 +1361,7 @@ alloc_new_skb:
                        /*
                         *      Fill in the control structures
                         */
+                        skb->protocol = htons(ETH_P_IPV6);
                        skb->ip_summed = CHECKSUM_NONE;
                        skb->csum = 0;
                        /* reserve for fragmentation and ipsec header */
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 1e55866cead7..46ba243605a3 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1027,6 +1027,12 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                init_tel_txopt(&opt, encap_limit);
                ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
        }
+        if (likely(!skb->encapsulation)) {
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+        }
        skb_push(skb, sizeof(struct ipv6hdr));
        skb_reset_network_header(skb);
        ipv6h = ipv6_hdr(skb);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 79aa9652ed86..04d31c2fbef1 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1369,8 +1369,10 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
        if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
                return;
-        if (!ndopts.nd_opts_rh)
+        if (!ndopts.nd_opts_rh) {
+                ip6_redirect_no_header(skb, dev_net(skb->dev), 0, 0);
                return;
+        }
        hdr = (u8 *)ndopts.nd_opts_rh;
        hdr += 8;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index c45f7a5c36e9..cdaed47ba932 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -628,6 +628,7 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
                goto error;
        skb_reserve(skb, hlen);
+        skb->protocol = htons(ETH_P_IPV6);
        skb->priority = sk->sk_priority;
        skb->mark = sk->sk_mark;
        skb_dst_set(skb, &rt->dst);
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 790d9f4b8b0b..1aeb473b2cc6 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -490,6 +490,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
        ipv6_hdr(head)->payload_len = htons(payload_len);
        ipv6_change_dsfield(ipv6_hdr(head), 0xff, ecn);
        IP6CB(head)->nhoff = nhoff;
+        IP6CB(head)->flags |= IP6SKB_FRAGMENTED;
        /* Yes, and fold redundant checksum back. 8) */
        if (head->ip_summed == CHECKSUM_COMPLETE)
@@ -524,6 +525,9 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
        struct net *net = dev_net(skb_dst(skb)->dev);
        int evicted;
+        if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED)
+                goto fail_hdr;
        IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS);
        /* Jumbo payload inhibits frag. header */
@@ -544,6 +548,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
                                 ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMOKS);
                IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
+                IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;
                return 1;
        }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b70f8979003b..8d9a93ed9c59 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1178,6 +1178,27 @@ void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark)
 }
 EXPORT_SYMBOL_GPL(ip6_redirect);
+void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif,
+                            u32 mark)
+{
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct rd_msg *msg = (struct rd_msg *)icmp6_hdr(skb);
+        struct dst_entry *dst;
+        struct flowi6 fl6;
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_oif = oif;
+        fl6.flowi6_mark = mark;
+        fl6.flowi6_flags = 0;
+        fl6.daddr = msg->dest;
+        fl6.saddr = iph->daddr;
+        dst = ip6_route_output(net, NULL, &fl6);
+        if (!dst->error)
+                rt6_do_redirect(dst, NULL, skb);
+        dst_release(dst);
+}
 void ip6_sk_redirect(struct sk_buff *skb, struct sock *sk)
 {
        ip6_redirect(skb, sock_net(sk), sk->sk_bound_dev_if, sk->sk_mark);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index a3437a4cd07e..21b25dd8466b 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -645,11 +645,7 @@ static int ipip_rcv(struct sk_buff *skb)
        const struct iphdr *iph;
        struct ip_tunnel *tunnel;
-        if (iptunnel_pull_header(skb, 0, tpi.proto))
-                goto drop;
        iph = ip_hdr(skb);
        tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
                                     iph->saddr, iph->daddr);
        if (tunnel != NULL) {
@@ -659,6 +655,8 @@ static int ipip_rcv(struct sk_buff *skb)
                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
                        goto drop;
+                if (iptunnel_pull_header(skb, 0, tpi.proto))
+                        goto drop;
                return ip_tunnel_rcv(tunnel, skb, &tpi, log_ecn_error);
        }
@@ -888,6 +886,11 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                ttl = iph6->hop_limit;
        tos = INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
+        if (likely(!skb->encapsulation)) {
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+        }
        err = iptunnel_xmit(dev_net(dev), rt, skb, fl4.saddr, fl4.daddr,
                            IPPROTO_IPV6, tos, ttl, df);
        iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 8755a3079d0f..6cd625e37706 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -34,8 +34,10 @@ static int xfrm6_local_dontfrag(struct sk_buff *skb)
        struct sock *sk = skb->sk;
        if (sk) {
-                proto = sk->sk_protocol;
+                if (sk->sk_family != AF_INET6)
+                        return 0;
+                proto = sk->sk_protocol;
                if (proto == IPPROTO_UDP || proto == IPPROTO_RAW)
                        return inet6_sk(sk)->dontfrag;
        }
@@ -54,13 +56,15 @@ static void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu)
        ipv6_local_rxpmtu(sk, &fl6, mtu);
 }
-static void xfrm6_local_error(struct sk_buff *skb, u32 mtu)
+void xfrm6_local_error(struct sk_buff *skb, u32 mtu)
 {
        struct flowi6 fl6;
+        const struct ipv6hdr *hdr;
        struct sock *sk = skb->sk;
+        hdr = skb->encapsulation ? inner_ipv6_hdr(skb) : ipv6_hdr(skb);
        fl6.fl6_dport = inet_sk(sk)->inet_dport;
-        fl6.daddr = ipv6_hdr(skb)->daddr;
+        fl6.daddr = hdr->daddr;
        ipv6_local_error(sk, EMSGSIZE, &fl6, mtu);
 }
@@ -80,7 +84,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
                if (xfrm6_local_dontfrag(skb))
                        xfrm6_local_rxpmtu(skb, mtu);
                else if (skb->sk)
-                        xfrm6_local_error(skb, mtu);
+                        xfrm_local_error(skb, mtu);
                else
                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                ret = -EMSGSIZE;
@@ -136,13 +140,18 @@ static int __xfrm6_output(struct sk_buff *skb)
 {
        struct dst_entry *dst = skb_dst(skb);
        struct xfrm_state *x = dst->xfrm;
-        int mtu = ip6_skb_dst_mtu(skb);
+        int mtu;
+        if (skb->protocol == htons(ETH_P_IPV6))
+                mtu = ip6_skb_dst_mtu(skb);
+        else
+                mtu = dst_mtu(skb_dst(skb));
        if (skb->len > mtu && xfrm6_local_dontfrag(skb)) {
                xfrm6_local_rxpmtu(skb, mtu);
                return -EMSGSIZE;
        } else if (!skb->local_df && skb->len > mtu && skb->sk) {
-                xfrm6_local_error(skb, mtu);
+                xfrm_local_error(skb, mtu);
                return -EMSGSIZE;
        }
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index d8c70b8efc24..3fc970135fc6 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -183,6 +183,7 @@ static struct xfrm_state_afinfo xfrm6_state_afinfo = {
        .extract_input          = xfrm6_extract_input,
        .extract_output         = xfrm6_extract_output,
        .transport_finish       = xfrm6_transport_finish,
+        .local_error            = xfrm6_local_error,
 };
 int __init xfrm6_state_init(void)
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index ea7b9c2c7e66..2d45643c964e 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -36,7 +36,7 @@
 static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                                      const u8 *bssid, const int beacon_int,
-                                      struct ieee80211_channel *chan,
+                                      struct cfg80211_chan_def *req_chandef,
                                      const u32 basic_rates,
                                      const u16 capability, u64 tsf,
                                      bool creator)
@@ -51,6 +51,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
        u32 bss_change;
        u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
        struct cfg80211_chan_def chandef;
+        struct ieee80211_channel *chan;
        struct beacon_data *presp;
        int frame_len;
@@ -81,7 +82,9 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
        sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
-        chandef = ifibss->chandef;
+        /* make a copy of the chandef, it could be modified below. */
+        chandef = *req_chandef;
+        chan = chandef.chan;
        if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
                chandef.width = NL80211_CHAN_WIDTH_20;
                chandef.center_freq1 = chan->center_freq;
@@ -259,10 +262,12 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
        struct cfg80211_bss *cbss =
                container_of((void *)bss, struct cfg80211_bss, priv);
        struct ieee80211_supported_band *sband;
+        struct cfg80211_chan_def chandef;
        u32 basic_rates;
        int i, j;
        u16 beacon_int = cbss->beacon_interval;
        const struct cfg80211_bss_ies *ies;
+        enum nl80211_channel_type chan_type;
        u64 tsf;
        sdata_assert_lock(sdata);
@@ -270,6 +275,26 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
        if (beacon_int < 10)
                beacon_int = 10;
+        switch (sdata->u.ibss.chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_40:
+                chan_type = cfg80211_get_chandef_type(&sdata->u.ibss.chandef);
+                cfg80211_chandef_create(&chandef, cbss->channel, chan_type);
+                break;
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
+                cfg80211_chandef_create(&chandef, cbss->channel,
+                                        NL80211_CHAN_WIDTH_20_NOHT);
+                chandef.width = sdata->u.ibss.chandef.width;
+                break;
+        default:
+                /* fall back to 20 MHz for unsupported modes */
+                cfg80211_chandef_create(&chandef, cbss->channel,
+                                        NL80211_CHAN_WIDTH_20_NOHT);
+                break;
+        }
        sband = sdata->local->hw.wiphy->bands[cbss->channel->band];
        basic_rates = 0;
@@ -294,7 +319,7 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
        __ieee80211_sta_join_ibss(sdata, cbss->bssid,
                                  beacon_int,
-                                  cbss->channel,
+                                  &chandef,
                                  basic_rates,
                                  cbss->capability,
                                  tsf, false);
@@ -736,7 +761,7 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
                sdata->drop_unencrypted = 0;
        __ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
-                                  ifibss->chandef.chan, ifibss->basic_rates,
+                                  &ifibss->chandef, ifibss->basic_rates,
                                  capability, 0, true);
 }
@@ -1138,6 +1163,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
        clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
                                                BSS_CHANGED_IBSS);
+        ieee80211_vif_release_channel(sdata);
        synchronize_rcu();
        kfree(presp);
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index f5aed963b22e..f3bbea1eb9e7 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -828,6 +828,9 @@ minstrel_ht_update_cck(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
        if (sband->band != IEEE80211_BAND_2GHZ)
                return;
+        if (!(mp->hw->flags & IEEE80211_HW_SUPPORTS_HT_CCK_RATES))
+                return;
        mi->cck_supported = 0;
        mi->cck_supported_short = 0;
        for (i = 0; i < 4; i++) {
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index f85f8a2ad6cf..0c741cec4d0d 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -364,7 +364,7 @@ int genl_unregister_ops(struct genl_family *family, struct genl_ops *ops)
 EXPORT_SYMBOL(genl_unregister_ops);
 /**
- * genl_register_family - register a generic netlink family
+ * __genl_register_family - register a generic netlink family
 * @family: generic netlink family
 *
 * Registers the specified family after validating it first. Only one
@@ -374,7 +374,7 @@ EXPORT_SYMBOL(genl_unregister_ops);
 *
 * Return 0 on success or a negative error code.
 */
-int genl_register_family(struct genl_family *family)
+int __genl_register_family(struct genl_family *family)
 {
        int err = -EINVAL;
@@ -430,10 +430,10 @@ errout_locked:
 errout:
        return err;
 }
-EXPORT_SYMBOL(genl_register_family);
+EXPORT_SYMBOL(__genl_register_family);
 /**
- * genl_register_family_with_ops - register a generic netlink family
+ * __genl_register_family_with_ops - register a generic netlink family
 * @family: generic netlink family
 * @ops: operations to be registered
 * @n_ops: number of elements to register
@@ -457,12 +457,12 @@ EXPORT_SYMBOL(genl_register_family);
 *
 * Return 0 on success or a negative error code.
 */
-int genl_register_family_with_ops(struct genl_family *family,
+int __genl_register_family_with_ops(struct genl_family *family,
        struct genl_ops *ops, size_t n_ops)
 {
        int err, i;
-        err = genl_register_family(family);
+        err = __genl_register_family(family);
        if (err)
                return err;
@@ -476,7 +476,7 @@ err_out:
        genl_unregister_family(family);
        return err;
 }
-EXPORT_SYMBOL(genl_register_family_with_ops);
+EXPORT_SYMBOL(__genl_register_family_with_ops);
 /**
 * genl_unregister_family - unregister generic netlink family
@@ -544,6 +544,30 @@ void *genlmsg_put(struct sk_buff *skb, u32 portid, u32 seq,
 }
 EXPORT_SYMBOL(genlmsg_put);
+static int genl_lock_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        struct genl_ops *ops = cb->data;
+        int rc;
+        genl_lock();
+        rc = ops->dumpit(skb, cb);
+        genl_unlock();
+        return rc;
+}
+static int genl_lock_done(struct netlink_callback *cb)
+{
+        struct genl_ops *ops = cb->data;
+        int rc = 0;
+        if (ops->done) {
+                genl_lock();
+                rc = ops->done(cb);
+                genl_unlock();
+        }
+        return rc;
+}
 static int genl_family_rcv_msg(struct genl_family *family,
                               struct sk_buff *skb,
                               struct nlmsghdr *nlh)
@@ -572,15 +596,34 @@ static int genl_family_rcv_msg(struct genl_family *family,
                return -EPERM;
        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
-                struct netlink_dump_control c = {
+                int rc;
-                        .dump = ops->dumpit,
-                        .done = ops->done,
-                };
                if (ops->dumpit == NULL)
                        return -EOPNOTSUPP;
-                return netlink_dump_start(net->genl_sock, skb, nlh, &c);
+                if (!family->parallel_ops) {
+                        struct netlink_dump_control c = {
+                                .module = family->module,
+                                .data = ops,
+                                .dump = genl_lock_dumpit,
+                                .done = genl_lock_done,
+                        };
+                        genl_unlock();
+                        rc = __netlink_dump_start(net->genl_sock, skb, nlh, &c);
+                        genl_lock();
+                } else {
+                        struct netlink_dump_control c = {
+                                .module = family->module,
+                                .dump = ops->dumpit,
+                                .done = ops->done,
+                        };
+                        rc = __netlink_dump_start(net->genl_sock, skb, nlh, &c);
+                }
+                return rc;
        }
        if (ops->doit == NULL)
@@ -789,10 +832,6 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
        struct net *net = sock_net(skb->sk);
        int chains_to_skip = cb->args[0];
        int fams_to_skip = cb->args[1];
-        bool need_locking = chains_to_skip || fams_to_skip;
-        if (need_locking)
-                genl_lock();
        for (i = chains_to_skip; i < GENL_FAM_TAB_SIZE; i++) {
                n = 0;
@@ -814,9 +853,6 @@ errout:
        cb->args[0] = i;
        cb->args[1] = n;
-        if (need_locking)
-                genl_unlock();
        return skb->len;
 }
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 4b66c752eae5..75c8bbf598c8 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3259,9 +3259,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
                if (po->tp_version == TPACKET_V3) {
                        lv = sizeof(struct tpacket_stats_v3);
+                        st.stats3.tp_packets += st.stats3.tp_drops;
                        data = &st.stats3;
                } else {
                        lv = sizeof(struct tpacket_stats);
+                        st.stats1.tp_packets += st.stats1.tp_drops;
                        data = &st.stats1;
                }
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 75edcfad6e26..1504bb11e4f3 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -207,10 +207,13 @@ _shift_data_right_pages(struct page **pages, size_t pgto_base,
                pgfrom_base -= copy;
                vto = kmap_atomic(*pgto);
-                vfrom = kmap_atomic(*pgfrom);
+                if (*pgto != *pgfrom) {
-                memmove(vto + pgto_base, vfrom + pgfrom_base, copy);
+                        vfrom = kmap_atomic(*pgfrom);
+                        memcpy(vto + pgto_base, vfrom + pgfrom_base, copy);
+                        kunmap_atomic(vfrom);
+                } else
+                        memmove(vto + pgto_base, vto + pgfrom_base, copy);
                flush_dcache_page(*pgto);
-                kunmap_atomic(vfrom);
                kunmap_atomic(vto);
        } while ((len -= copy) != 0);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index ce8249c76827..6cc7ddd2fb7c 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1257,7 +1257,7 @@ static u32 filter_connect(struct tipc_sock *tsock, struct sk_buff **buf)
                /* Accept only ACK or NACK message */
                if (unlikely(msg_errcode(msg))) {
                        sock->state = SS_DISCONNECTING;
-                        sk->sk_err = -ECONNREFUSED;
+                        sk->sk_err = ECONNREFUSED;
                        retval = TIPC_OK;
                        break;
                }
@@ -1268,7 +1268,7 @@ static u32 filter_connect(struct tipc_sock *tsock, struct sk_buff **buf)
                res = auto_connect(sock, msg);
                if (res) {
                        sock->state = SS_DISCONNECTING;
-                        sk->sk_err = res;
+                        sk->sk_err = -res;
                        retval = TIPC_OK;
                        break;
                }
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 3fcba69817e5..5f6e982cdcf4 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2622,8 +2622,8 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
        hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                             NL80211_CMD_NEW_KEY);
-        if (IS_ERR(hdr))
+        if (!hdr)
-                return PTR_ERR(hdr);
+                return -ENOBUFS;
        cookie.msg = msg;
        cookie.idx = key_idx;
@@ -6507,6 +6507,9 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
                                           NL80211_CMD_TESTMODE);
                struct nlattr *tmdata;
+                if (!hdr)
+                        break;
                if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
                        genlmsg_cancel(skb, hdr);
                        break;
@@ -6951,9 +6954,8 @@ static int nl80211_remain_on_channel(struct sk_buff *skb,
        hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                             NL80211_CMD_REMAIN_ON_CHANNEL);
+        if (!hdr) {
-        if (IS_ERR(hdr)) {
+                err = -ENOBUFS;
-                err = PTR_ERR(hdr);
                goto free_msg;
        }
@@ -7251,9 +7253,8 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
                hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                                     NL80211_CMD_FRAME);
+                if (!hdr) {
-                if (IS_ERR(hdr)) {
+                        err = -ENOBUFS;
-                        err = PTR_ERR(hdr);
                        goto free_msg;
                }
        }
@@ -8132,9 +8133,8 @@ static int nl80211_probe_client(struct sk_buff *skb,
        hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                             NL80211_CMD_PROBE_CLIENT);
+        if (!hdr) {
-        if (IS_ERR(hdr)) {
+                err = -ENOBUFS;
-                err = PTR_ERR(hdr);
                goto free_msg;
        }
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 81c8a10d743c..20e86a95dc4e 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -976,21 +976,19 @@ int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
                        struct net_device *dev, u16 reason, bool wextev)
 {
        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        int err;
+        int err = 0;
        ASSERT_WDEV_LOCK(wdev);
        kfree(wdev->connect_keys);
        wdev->connect_keys = NULL;
-        if (wdev->conn) {
+        if (wdev->conn)
                err = cfg80211_sme_disconnect(wdev, reason);
-        } else if (!rdev->ops->disconnect) {
+        else if (!rdev->ops->disconnect)
                cfg80211_mlme_down(rdev, dev);
-                err = 0;
+        else if (wdev->current_bss)
-        } else {
                err = rdev_disconnect(rdev, dev, reason);
-        }
        return err;
 }
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index eb4a84288648..3bb2cdc13b46 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -214,5 +214,26 @@ int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb)
        return inner_mode->afinfo->extract_output(x, skb);
 }
+void xfrm_local_error(struct sk_buff *skb, int mtu)
+{
+        unsigned int proto;
+        struct xfrm_state_afinfo *afinfo;
+        if (skb->protocol == htons(ETH_P_IP))
+                proto = AF_INET;
+        else if (skb->protocol == htons(ETH_P_IPV6))
+                proto = AF_INET6;
+        else
+                return;
+        afinfo = xfrm_state_get_afinfo(proto);
+        if (!afinfo)
+                return;
+        afinfo->local_error(skb, mtu);
+        xfrm_state_put_afinfo(afinfo);
+}
 EXPORT_SYMBOL_GPL(xfrm_output);
 EXPORT_SYMBOL_GPL(xfrm_inner_extract_output);
+EXPORT_SYMBOL_GPL(xfrm_local_error);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index e52cab3591dd..f77c371ea72b 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -320,10 +320,8 @@ static void xfrm_queue_purge(struct sk_buff_head *list)
 {
        struct sk_buff *skb;
-        while ((skb = skb_dequeue(list)) != NULL) {
+        while ((skb = skb_dequeue(list)) != NULL)
-                dev_put(skb->dev);
                kfree_skb(skb);
-        }
 }
 /* Rule must be locked. Release descentant resources, announce
@@ -1758,7 +1756,6 @@ static void xfrm_policy_queue_process(unsigned long arg)
        struct sk_buff *skb;
        struct sock *sk;
        struct dst_entry *dst;
-        struct net_device *dev;
        struct xfrm_policy *pol = (struct xfrm_policy *)arg;
        struct xfrm_policy_queue *pq = &pol->polq;
        struct flowi fl;
@@ -1805,7 +1802,6 @@ static void xfrm_policy_queue_process(unsigned long arg)
                dst = xfrm_lookup(xp_net(pol), skb_dst(skb)->path,
                                  &fl, skb->sk, 0);
                if (IS_ERR(dst)) {
-                        dev_put(skb->dev);
                        kfree_skb(skb);
                        continue;
                }
@@ -1814,9 +1810,7 @@ static void xfrm_policy_queue_process(unsigned long arg)
                skb_dst_drop(skb);
                skb_dst_set(skb, dst);
-                dev = skb->dev;
                err = dst_output(skb);
-                dev_put(dev);
        }
        return;
@@ -1839,7 +1833,6 @@ static int xdst_queue_output(struct sk_buff *skb)
        }
        skb_dst_force(skb);
-        dev_hold(skb->dev);
        spin_lock_bh(&pq->hold_queue.lock);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 78f66fa92449..54c0acd29468 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -39,9 +39,6 @@ static DEFINE_SPINLOCK(xfrm_state_lock);
 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
-static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
-static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
 static inline unsigned int xfrm_dst_hash(struct net *net,
                                         const xfrm_address_t *daddr,
                                         const xfrm_address_t *saddr,
@@ -1860,7 +1857,7 @@ int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo)
 }
 EXPORT_SYMBOL(xfrm_state_unregister_afinfo);
-static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
+struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
 {
        struct xfrm_state_afinfo *afinfo;
        if (unlikely(family >= NPROTO))
@@ -1872,7 +1869,7 @@ static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family)
        return afinfo;
 }
-static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
+void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo)
 {
        rcu_read_unlock();
 }
diff --git a/sound/isa/opti9xx/opti92x-ad1848.c b/sound/isa/opti9xx/opti92x-ad1848.c
index 103b33373fd4..6effe99bbb9c 100644
--- a/sound/isa/opti9xx/opti92x-ad1848.c
+++ b/sound/isa/opti9xx/opti92x-ad1848.c
@@ -173,11 +173,7 @@ MODULE_DEVICE_TABLE(pnp_card, snd_opti9xx_pnpids);
 #endif  /* CONFIG_PNP */
-#ifdef OPTi93X
+#define DEV_NAME KBUILD_MODNAME
-#define DEV_NAME "opti93x"
-#else
-#define DEV_NAME "opti92x"
-#endif
 static char * snd_opti9xx_names[] = {
        "unknown",
@@ -1167,7 +1163,7 @@ static int snd_opti9xx_pnp_resume(struct pnp_card_link *pcard)
 static struct pnp_card_driver opti9xx_pnpc_driver = {
        .flags          = PNP_DRIVER_RES_DISABLE,
-        .name           = "opti9xx",
+        .name           = DEV_NAME,
        .id_table       = snd_opti9xx_pnpids,
        .probe          = snd_opti9xx_pnp_probe,
        .remove         = snd_opti9xx_pnp_remove,
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 030ca8652a1c..9f3586276871 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1781,6 +1781,9 @@ static int generic_hdmi_build_controls(struct hda_codec *codec)
                struct snd_pcm_chmap *chmap;
                struct snd_kcontrol *kctl;
                int i;
+                if (!codec->pcm_info[pin_idx].pcm)
+                        break;
                err = snd_pcm_add_chmap_ctls(codec->pcm_info[pin_idx].pcm,
                                             SNDRV_PCM_STREAM_PLAYBACK,
                                             NULL, 0, pin_idx, &chmap);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index f303cd898515..389db4c2801b 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4336,6 +4336,7 @@ static const struct hda_fixup alc662_fixups[] = {
 static const struct snd_pci_quirk alc662_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1019, 0x9087, "ECS", ALC662_FIXUP_ASUS_MODE2),
+        SND_PCI_QUIRK(0x1025, 0x022f, "Acer Aspire One", ALC662_FIXUP_INV_DMIC),
        SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
        SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE),
        SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC),