211 files changed, 3001 insertions, 1033 deletions
diff --git a/.gitignore b/.gitignore
index 7e9932e55475..42fa0d5626a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,3 +92,6 @@ extra_certificates
 signing_key.priv
 signing_key.x509
 x509.genkey
+# Kconfig presets
+all.config
diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index 38f8444bdd0e..07de7e19b4ce 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -29,6 +29,8 @@ DMA-ISA-LPC.txt
        - How to do DMA with ISA (and LPC) devices.
 DMA-attributes.txt
        - listing of the various possible attributes a DMA region can have
+dmatest.txt
+        - how to compile, configure and use the dmatest system.
 DocBook/
        - directory with DocBook templates etc. for kernel documentation.
 EDID/
@@ -77,6 +79,8 @@ arm/
        - directory with info about Linux on the ARM architecture.
 arm64/
        - directory with info about Linux on the 64 bit ARM architecture.
+assoc_array.txt
+        - generic associative array intro.
 atomic_ops.txt
        - semantics and behavior of atomic and bitmask operations.
 auxdisplay/
@@ -87,6 +91,8 @@ bad_memory.txt
        - how to use kernel parameters to exclude bad RAM regions.
 basic_profiling.txt
        - basic instructions for those who wants to profile Linux kernel.
+bcache.txt
+        - Block-layer cache on fast SSDs to improve slow (raid) I/O performance.
 binfmt_misc.txt
        - info on the kernel support for extra binary formats.
 blackfin/
@@ -171,6 +177,8 @@ early-userspace/
        - info about initramfs, klibc, and userspace early during boot.
 edac.txt
        - information on EDAC - Error Detection And Correction
+efi-stub.txt
+        - How to use the EFI boot stub to bypass GRUB or elilo on EFI systems.
 eisa.txt
        - info on EISA bus support.
 email-clients.txt
@@ -195,8 +203,8 @@ futex-requeue-pi.txt
        - info on requeueing of tasks from a non-PI futex to a PI futex
 gcov.txt
        - use of GCC's coverage testing tool "gcov" with the Linux kernel
-gpio.txt
+gpio/
-        - overview of GPIO (General Purpose Input/Output) access conventions.
+        - gpio related documentation
 hid/
        - directory with information on human interface devices
 highuid.txt
@@ -255,6 +263,8 @@ kernel-docs.txt
        - listing of various WWW + books that document kernel internals.
 kernel-parameters.txt
        - summary listing of command line / boot prompt args for the kernel.
+kernel-per-CPU-kthreads.txt
+        - List of all per-CPU kthreads and how they introduce jitter.
 kmemcheck.txt
        - info on dynamic checker that detects uses of uninitialized memory.
 kmemleak.txt
@@ -299,8 +309,6 @@ memory-devices/
        - directory with info on parts like the Texas Instruments EMIF driver
 memory-hotplug.txt
        - Hotpluggable memory support, how to use and current status.
-memory.txt
-        - info on typical Linux memory problems.
 metag/
        - directory with info about Linux on Meta architecture.
 mips/
@@ -311,6 +319,8 @@ mmc/
        - directory with info about the MMC subsystem
 mn10300/
        - directory with info about the mn10300 architecture port
+module-signing.txt
+        - Kernel module signing for increased security when loading modules.
 mtd/
        - directory with info about memory technology devices (flash)
 mono.txt
@@ -343,6 +353,8 @@ pcmcia/
        - info on the Linux PCMCIA driver.
 percpu-rw-semaphore.txt
        - RCU based read-write semaphore optimized for locking for reading
+phy.txt
+        - Description of the generic PHY framework.
 pi-futex.txt
        - documentation on lightweight priority inheritance futexes.
 pinctrl.txt
@@ -431,6 +443,8 @@ sysrq.txt
        - info on the magic SysRq key.
 target/
        - directory with info on generating TCM v4 fabric .ko modules
+this_cpu_ops.txt
+        - List rationale behind and the way to use this_cpu operations.
 thermal/
        - directory with information on managing thermal issues (CPU/temp)
 trace/
@@ -469,6 +483,8 @@ wimax/
        - directory with info about Intel Wireless Wimax Connections
 workqueue.txt
        - information on the Concurrency Managed Workqueue implementation
+ww-mutex-design.txt
+        - Intro to Mutex wait/would deadlock handling.s
 x86/x86_64/
        - directory with info on Linux support for AMD x86-64 (Hammer) machines.
 xtensa/
diff --git a/Documentation/RCU/00-INDEX b/Documentation/RCU/00-INDEX
index 1d7a885761f5..fa57139f50bf 100644
--- a/Documentation/RCU/00-INDEX
+++ b/Documentation/RCU/00-INDEX
@@ -8,6 +8,8 @@ listRCU.txt
        - Using RCU to Protect Read-Mostly Linked Lists
 lockdep.txt
        - RCU and lockdep checking
+lockdep-splat.txt
+        - RCU Lockdep splats explained.
 NMI-RCU.txt
        - Using RCU to Protect Dynamic NMI Handlers
 rcubarrier.txt
diff --git a/Documentation/arm/00-INDEX b/Documentation/arm/00-INDEX
index 36420e116c90..a94090cc785d 100644
--- a/Documentation/arm/00-INDEX
+++ b/Documentation/arm/00-INDEX
@@ -4,6 +4,8 @@ Booting
        - requirements for booting
 Interrupts
        - ARM Interrupt subsystem documentation
+IXP4xx
+        - Intel IXP4xx Network processor.
 msm
        - MSM specific documentation
 Netwinder
@@ -24,8 +26,16 @@ SPEAr
        - ST SPEAr platform Linux Overview
 VFP/
        - Release notes for Linux Kernel Vector Floating Point support code
+cluster-pm-race-avoidance.txt
+        - Algorithm for CPU and Cluster setup/teardown
 empeg/
        - Ltd's Empeg MP3 Car Audio Player
+firmware.txt
+        - Secure firmware registration and calling.
+kernel_mode_neon.txt
+        - How to use NEON instructions in kernel mode
+kernel_user_helpers.txt
+        - Helper functions in kernel space made available for userspace.
 mem_alignment
        - alignment abort handler documentation
 memory.txt
@@ -34,3 +44,7 @@ nwfpe/
        - NWFPE floating point emulator documentation
 swp_emulation
        - SWP/SWPB emulation handler/logging description
+tcm.txt
+        - ARM Tightly Coupled Memory
+vlocks.txt
+        - Voting locks, low-level mechanism relying on memory system atomic writes.
diff --git a/Documentation/blackfin/00-INDEX b/Documentation/blackfin/00-INDEX
index 2df0365f2dff..c54fcdd4ae9f 100644
--- a/Documentation/blackfin/00-INDEX
+++ b/Documentation/blackfin/00-INDEX
@@ -1,8 +1,10 @@
 00-INDEX
        - This file
+Makefile
+        - Makefile for gptimers example file.
 bfin-gpio-notes.txt
        - Notes in developing/using bfin-gpio driver.
 bfin-spi-notes.txt
        - Notes for using bfin spi bus driver.
+gptimers-example.c
+        - gptimers example
diff --git a/Documentation/block/00-INDEX b/Documentation/block/00-INDEX
index 929d9904f74b..e840b47613f7 100644
--- a/Documentation/block/00-INDEX
+++ b/Documentation/block/00-INDEX
@@ -14,6 +14,8 @@ deadline-iosched.txt
        - Deadline IO scheduler tunables
 ioprio.txt
        - Block io priorities (in CFQ scheduler)
+null_blk.txt
+        - Null block for block-layer benchmarking.
 queue-sysfs.txt
        - Queue's sysfs entries
 request.txt
diff --git a/Documentation/devicetree/00-INDEX b/Documentation/devicetree/00-INDEX
index b78f691fd847..8c4102c6a5e7 100644
--- a/Documentation/devicetree/00-INDEX
+++ b/Documentation/devicetree/00-INDEX
@@ -8,3 +8,5 @@ https://lists.ozlabs.org/listinfo/devicetree-discuss
        - this file
 booting-without-of.txt
        - Booting Linux without Open Firmware, describes history and format of device trees.
+usage-model.txt
+        - How Linux uses DT and what DT aims to solve.
+\ No newline at end of file
diff --git a/Documentation/devicetree/bindings/net/allwinner,sun4i-emac.txt b/Documentation/devicetree/bindings/net/allwinner,sun4i-emac.txt
index b90bfcd138ff..863d5b8155c7 100644
--- a/Documentation/devicetree/bindings/net/allwinner,sun4i-emac.txt
+++ b/Documentation/devicetree/bindings/net/allwinner,sun4i-emac.txt
@@ -1,7 +1,8 @@
 * Allwinner EMAC ethernet controller
 Required properties:
- compatible: should be "allwinner,sun4i-emac".
+- compatible: should be "allwinner,sun4i-a10-emac" (Deprecated:
+              "allwinner,sun4i-emac")
 - reg: address and length of the register set for the device.
 - interrupts: interrupt for the device
 - phy: A phandle to a phy node defining the PHY address (as the reg
@@ -14,7 +15,7 @@ Optional properties:
 Example:
 emac: ethernet@01c0b000 {
-       compatible = "allwinner,sun4i-emac";
+       compatible = "allwinner,sun4i-a10-emac";
       reg = <0x01c0b000 0x1000>;
       interrupts = <55>;
       clocks = <&ahb_gates 17>;
diff --git a/Documentation/devicetree/bindings/net/allwinner,sun4i-mdio.txt b/Documentation/devicetree/bindings/net/allwinner,sun4i-mdio.txt
index 00b9f9a3ec1d..4ec56413779d 100644
--- a/Documentation/devicetree/bindings/net/allwinner,sun4i-mdio.txt
+++ b/Documentation/devicetree/bindings/net/allwinner,sun4i-mdio.txt
@@ -1,7 +1,8 @@
 * Allwinner A10 MDIO Ethernet Controller interface
 Required properties:
- compatible: should be "allwinner,sun4i-mdio".
+- compatible: should be "allwinner,sun4i-a10-mdio"
+              (Deprecated: "allwinner,sun4i-mdio").
 - reg: address and length of the register set for the device.
 Optional properties:
@@ -9,7 +10,7 @@ Optional properties:
 Example at the SoC level:
 mdio@01c0b080 {
-        compatible = "allwinner,sun4i-mdio";
+        compatible = "allwinner,sun4i-a10-mdio";
        reg = <0x01c0b080 0x14>;
        #address-cells = <1>;
        #size-cells = <0>;
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 3f900cd51bf0..40ce2df0e0e9 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -8,6 +8,7 @@ ad	Avionic Design GmbH
 adi     Analog Devices, Inc.
 aeroflexgaisler Aeroflex Gaisler AB
 ak      Asahi Kasei Corp.
+allwinner       Allwinner Technology Co., Ltd.
 altr    Altera Corp.
 amcc    Applied Micro Circuits Corporation (APM, formally AMCC)
 amstaos AMS-Taos Inc.
@@ -40,6 +41,7 @@ gmt	Global Mixed-mode Technology, Inc.
 gumstix Gumstix, Inc.
 haoyu   Haoyu Microelectronic Co. Ltd.
 hisilicon       Hisilicon Limited.
+honeywell       Honeywell
 hp      Hewlett Packard
 ibm     International Business Machines (IBM)
 idt     Integrated Device Technologies, Inc.
@@ -55,6 +57,7 @@ maxim	Maxim Integrated Products
 microchip       Microchip Technology Inc.
 mosaixtech      Mosaix Technologies, Inc.
 national        National Semiconductor
+neonode         Neonode Inc.
 nintendo        Nintendo
 nvidia  NVIDIA
 nxp     NXP Semiconductors
@@ -64,7 +67,7 @@ phytec	PHYTEC Messtechnik GmbH
 picochip        Picochip Ltd
 powervr PowerVR (deprecated, use img)
 qca     Qualcomm Atheros, Inc.
-qcom    Qualcomm, Inc.
+qcom    Qualcomm Technologies, Inc
 ralink  Mediatek/Ralink Technology Corp.
 ramtron Ramtron International
 realtek Realtek Semiconductor Corp.
@@ -78,6 +81,7 @@ silabs	Silicon Laboratories
 simtek
 sirf    SiRF Technology, Inc.
 snps    Synopsys, Inc.
+spansion        Spansion Inc.
 st      STMicroelectronics
 ste     ST-Ericsson
 stericsson      ST-Ericsson
diff --git a/Documentation/fb/00-INDEX b/Documentation/fb/00-INDEX
index 30a70542e823..fe85e7c5907a 100644
--- a/Documentation/fb/00-INDEX
+++ b/Documentation/fb/00-INDEX
@@ -5,6 +5,8 @@ please mail me.
 00-INDEX
        - this file.
+api.txt
+        - The frame buffer API between applications and buffer devices.
 arkfb.txt
        - info on the fbdev driver for ARK Logic chips.
 aty128fb.txt
@@ -51,12 +53,16 @@ sh7760fb.txt
        - info on the SH7760/SH7763 integrated LCDC Framebuffer driver.
 sisfb.txt
        - info on the framebuffer device driver for various SiS chips.
+sm501.txt
+        - info on the framebuffer device driver for sm501 videoframebuffer.
 sstfb.txt
        - info on the frame buffer driver for 3dfx' Voodoo Graphics boards.
 tgafb.txt
        - info on the TGA (DECChip 21030) frame buffer driver.
 tridentfb.txt
        info on the framebuffer driver for some Trident chip based cards.
+udlfb.txt
+        - Driver for DisplayLink USB 2.0 chips.
 uvesafb.txt
        - info on the userspace VESA (VBE2+ compliant) frame buffer device.
 vesafb.txt
diff --git a/Documentation/filesystems/00-INDEX b/Documentation/filesystems/00-INDEX
index 632211cbdd56..ac28149aede4 100644
--- a/Documentation/filesystems/00-INDEX
+++ b/Documentation/filesystems/00-INDEX
@@ -2,6 +2,8 @@
        - this file (info on some of the filesystems supported by linux).
 Locking
        - info on locking rules as they pertain to Linux VFS.
+Makefile
+        - Makefile for building the filsystems-part of DocBook.
 9p.txt
        - 9p (v9fs) is an implementation of the Plan 9 remote fs protocol.
 adfs.txt
diff --git a/Documentation/filesystems/nfs/00-INDEX b/Documentation/filesystems/nfs/00-INDEX
index 66eb6c8c5334..53f3b596ac0d 100644
--- a/Documentation/filesystems/nfs/00-INDEX
+++ b/Documentation/filesystems/nfs/00-INDEX
@@ -12,6 +12,8 @@ nfs41-server.txt
        - info on the Linux server implementation of NFSv4 minor version 1.
 nfs-rdma.txt
        - how to install and setup the Linux NFS/RDMA client and server software
+nfsd-admin-interfaces.txt
+        - Administrative interfaces for nfsd.
 nfsroot.txt
        - short guide on setting up a diskless box with NFS root filesystem.
 pnfs.txt
@@ -20,5 +22,5 @@ rpc-cache.txt
        - introduction to the caching mechanisms in the sunrpc layer.
 idmapper.txt
        - information for configuring request-keys to be used by idmapper
-knfsd-rpcgss.txt
+rpc-server-gss.txt
        - Information on GSS authentication support in the NFS Server
diff --git a/Documentation/ide/00-INDEX b/Documentation/ide/00-INDEX
index d6b778842b75..22f98ca79539 100644
--- a/Documentation/ide/00-INDEX
+++ b/Documentation/ide/00-INDEX
@@ -10,3 +10,5 @@ ide-tape.txt
        - info on the IDE ATAPI streaming tape driver
 ide.txt
        - important info for users of ATA devices (IDE/EIDE disks and CD-ROMS).
+warm-plug-howto.txt
+        - using sysfs to remove and add IDE devices.
+\ No newline at end of file
diff --git a/Documentation/laptops/00-INDEX b/Documentation/laptops/00-INDEX
index fa688538e757..d13b9a9a9e00 100644
--- a/Documentation/laptops/00-INDEX
+++ b/Documentation/laptops/00-INDEX
@@ -1,13 +1,15 @@
 00-INDEX
        - This file
-acer-wmi.txt
+Makefile
-        - information on the Acer Laptop WMI Extras driver.
+        - Makefile for building dslm example program.
 asus-laptop.txt
        - information on the Asus Laptop Extras driver.
 disk-shock-protection.txt
        - information on hard disk shock protection.
 dslm.c
        - Simple Disk Sleep Monitor program
+hpfall.c
+        - (HP) laptop accelerometer program for disk protection.
 laptop-mode.txt
        - how to conserve battery power using laptop-mode.
 sony-laptop.txt
diff --git a/Documentation/leds/00-INDEX b/Documentation/leds/00-INDEX
index 1ecd1596633e..b4ef1f34e25f 100644
--- a/Documentation/leds/00-INDEX
+++ b/Documentation/leds/00-INDEX
@@ -1,3 +1,7 @@
+00-INDEX
+        - This file
+leds-blinkm.txt
+        - Driver for BlinkM LED-devices.
 leds-class.txt
        - documents LED handling under Linux.
 leds-lp3944.txt
@@ -12,3 +16,7 @@ leds-lp55xx.txt
        - description about lp55xx common driver.
 leds-lm3556.txt
        - notes on how to use the leds-lm3556 driver.
+ledtrig-oneshot.txt
+        - One-shot LED trigger for both sporadic and dense events.
+ledtrig-transient.txt
+        - LED Transient Trigger, one shot timer activation.
diff --git a/Documentation/m68k/00-INDEX b/Documentation/m68k/00-INDEX
index a014e9f00765..2be8c6b00e74 100644
--- a/Documentation/m68k/00-INDEX
+++ b/Documentation/m68k/00-INDEX
@@ -1,5 +1,7 @@
 00-INDEX
        - this file
+README.buddha
+        - Amiga Buddha and Catweasel IDE Driver
 kernel-options.txt
        - command line options for Linux/m68k
diff --git a/Documentation/networking/00-INDEX b/Documentation/networking/00-INDEX
index f11580f8719a..557b6ef70c26 100644
--- a/Documentation/networking/00-INDEX
+++ b/Documentation/networking/00-INDEX
@@ -6,8 +6,14 @@
        - information on the 3Com Etherlink III Series Ethernet cards.
 6pack.txt
        - info on the 6pack protocol, an alternative to KISS for AX.25
-DLINK.txt
+LICENSE.qla3xxx
-        - info on the D-Link DE-600/DE-620 parallel port pocket adapters
+        - GPLv2 for QLogic Linux Networking HBA Driver
+LICENSE.qlge
+        - GPLv2 for QLogic Linux qlge NIC Driver
+LICENSE.qlcnic
+        - GPLv2 for QLogic Linux qlcnic NIC Driver
+Makefile
+        - Makefile for docsrc.
 PLIP.txt
        - PLIP: The Parallel Line Internet Protocol device driver
 README.ipw2100
@@ -17,7 +23,7 @@ README.ipw2200
 README.sb1000
        - info on General Instrument/NextLevel SURFboard1000 cable modem.
 alias.txt
-        - info on using alias network devices 
+        - info on using alias network devices.
 arcnet-hardware.txt
        - tons of info on ARCnet, hubs, jumper settings for ARCnet cards, etc.
 arcnet.txt
@@ -80,7 +86,7 @@ framerelay.txt
        - info on using Frame Relay/Data Link Connection Identifier (DLCI).
 gen_stats.txt
        - Generic networking statistics for netlink users.
-generic_hdlc.txt
+generic-hdlc.txt
        - The generic High Level Data Link Control (HDLC) layer.
 generic_netlink.txt
        - info on Generic Netlink
@@ -88,6 +94,8 @@ gianfar.txt
        - Gianfar Ethernet Driver.
 i40e.txt
        - README for the Intel Ethernet Controller XL710 Driver (i40e).
+i40evf.txt
+        - Short note on the Driver for the Intel(R) XL710 X710 Virtual Function
 ieee802154.txt
        - Linux IEEE 802.15.4 implementation, API and drivers
 igb.txt
@@ -102,6 +110,8 @@ ipddp.txt
        - AppleTalk-IP Decapsulation and AppleTalk-IP Encapsulation
 iphase.txt
        - Interphase PCI ATM (i)Chip IA Linux driver info.
+ipsec.txt
+        - Note on not compressing IPSec payload and resulting failed policy check.
 ipv6.txt
        - Options to the ipv6 kernel module.
 ipvs-sysctl.txt
@@ -120,6 +130,8 @@ lapb-module.txt
        - programming information of the LAPB module.
 ltpc.txt
        - the Apple or Farallon LocalTalk PC card driver
+mac80211-auth-assoc-deauth.txt
+        - authentication and association / deauth-disassoc with max80211
 mac80211-injection.txt
        - HOWTO use packet injection with mac80211
 multiqueue.txt
@@ -134,6 +146,10 @@ netdevices.txt
        - info on network device driver functions exported to the kernel.
 netif-msg.txt
        - Design of the network interface message level setting (NETIF_MSG_*).
+netlink_mmap.txt
+        - memory mapped I/O with netlink
+nf_conntrack-sysctl.txt
+        - list of netfilter-sysctl knobs.
 nfc.txt
        - The Linux Near Field Communication (NFS) subsystem.
 openvswitch.txt
@@ -176,7 +192,7 @@ skfp.txt
        - SysKonnect FDDI (SK-5xxx, Compaq Netelligent) driver info.
 smc9.txt
        - the driver for SMC's 9000 series of Ethernet cards
-spider-net.txt
+spider_net.txt
        - README for the Spidernet Driver (as found in PS3 / Cell BE).
 stmmac.txt
        - README for the STMicro Synopsys Ethernet driver.
@@ -188,6 +204,8 @@ tcp.txt
        - short blurb on how TCP output takes place.
 tcp-thin.txt
        - kernel tuning options for low rate 'thin' TCP streams.
+team.txt
+        - pointer to information for ethernet teaming devices.
 tlan.txt
        - ThunderLAN (Compaq Netelligent 10/100, Olicom OC-2xxx) driver info.
 tproxy.txt
@@ -200,6 +218,8 @@ vortex.txt
        - info on using 3Com Vortex (3c590, 3c592, 3c595, 3c597) Ethernet cards.
 vxge.txt
        - README for the Neterion X3100 PCIe Server Adapter.
+vxlan.txt
+        - Virtual extensible LAN overview
 x25.txt
        - general info on X.25 development.
 x25-iface.txt
diff --git a/Documentation/power/00-INDEX b/Documentation/power/00-INDEX
index a4d682f54231..ad04cc8097ed 100644
--- a/Documentation/power/00-INDEX
+++ b/Documentation/power/00-INDEX
@@ -4,6 +4,8 @@ apm-acpi.txt
        - basic info about the APM and ACPI support.
 basic-pm-debugging.txt
        - Debugging suspend and resume
+charger-manager.txt
+        - Battery charger management.
 devices.txt
        - How drivers interact with system-wide power management
 drivers-testing.txt
@@ -22,6 +24,8 @@ pm_qos_interface.txt
        - info on Linux PM Quality of Service interface
 power_supply_class.txt
        - Tells userspace about battery, UPS, AC or DC power supply properties
+runtime_pm.txt
+        - Power management framework for I/O devices.
 s2ram.txt
        - How to get suspend to ram working (and debug it when it isn't)
 states.txt
@@ -38,7 +42,5 @@ tricks.txt
        - How to trick software suspend (to disk) into working when it isn't
 userland-swsusp.txt
        - Experimental implementation of software suspend in userspace
-video_extension.txt
-        - ACPI video extensions
 video.txt
        - Video issues during resume from suspend
diff --git a/Documentation/ptp/testptp.c b/Documentation/ptp/testptp.c
index a74d0a84d329..4aba0436da65 100644
--- a/Documentation/ptp/testptp.c
+++ b/Documentation/ptp/testptp.c
@@ -117,6 +117,7 @@ static void usage(char *progname)
                " -f val     adjust the ptp clock frequency by 'val' ppb\n"
                " -g         get the ptp clock time\n"
                " -h         prints this message\n"
+                " -i val     index for event/trigger\n"
                " -k val     measure the time offset between system and phc clock\n"
                "            for 'val' times (Maximum 25)\n"
                " -p val     enable output with a period of 'val' nanoseconds\n"
@@ -154,6 +155,7 @@ int main(int argc, char *argv[])
        int capabilities = 0;
        int extts = 0;
        int gettime = 0;
+        int index = 0;
        int oneshot = 0;
        int pct_offset = 0;
        int n_samples = 0;
@@ -167,7 +169,7 @@ int main(int argc, char *argv[])
        progname = strrchr(argv[0], '/');
        progname = progname ? 1+progname : argv[0];
-        while (EOF != (c = getopt(argc, argv, "a:A:cd:e:f:ghk:p:P:sSt:v"))) {
+        while (EOF != (c = getopt(argc, argv, "a:A:cd:e:f:ghi:k:p:P:sSt:v"))) {
                switch (c) {
                case 'a':
                        oneshot = atoi(optarg);
@@ -190,6 +192,9 @@ int main(int argc, char *argv[])
                case 'g':
                        gettime = 1;
                        break;
+                case 'i':
+                        index = atoi(optarg);
+                        break;
                case 'k':
                        pct_offset = 1;
                        n_samples = atoi(optarg);
@@ -301,7 +306,7 @@ int main(int argc, char *argv[])
        if (extts) {
                memset(&extts_request, 0, sizeof(extts_request));
-                extts_request.index = 0;
+                extts_request.index = index;
                extts_request.flags = PTP_ENABLE_FEATURE;
                if (ioctl(fd, PTP_EXTTS_REQUEST, &extts_request)) {
                        perror("PTP_EXTTS_REQUEST");
@@ -375,7 +380,7 @@ int main(int argc, char *argv[])
                        return -1;
                }
                memset(&perout_request, 0, sizeof(perout_request));
-                perout_request.index = 0;
+                perout_request.index = index;
                perout_request.start.sec = ts.tv_sec + 2;
                perout_request.start.nsec = 0;
                perout_request.period.sec = 0;
diff --git a/Documentation/s390/00-INDEX b/Documentation/s390/00-INDEX
index 3a2b96302ecc..10c874ebdfe5 100644
--- a/Documentation/s390/00-INDEX
+++ b/Documentation/s390/00-INDEX
@@ -16,11 +16,13 @@ Debugging390.txt
        - hints for debugging on s390 systems.
 driver-model.txt
        - information on s390 devices and the driver model.
+kvm.txt
+        - ioctl calls to /dev/kvm on s390.
 monreader.txt
        - information on accessing the z/VM monitor stream from Linux.
+qeth.txt
+        - HiperSockets Bridge Port Support.
 s390dbf.txt
        - information on using the s390 debug feature.
-TAPE
+zfcpdump.txt
-        - information on the driver for channel-attached tapes.
-zfcpdump
        - information on the s390 SCSI dump tool.
diff --git a/Documentation/scheduler/00-INDEX b/Documentation/scheduler/00-INDEX
index 46702e4f89c9..eccf7ad2e7f9 100644
--- a/Documentation/scheduler/00-INDEX
+++ b/Documentation/scheduler/00-INDEX
@@ -2,6 +2,8 @@
        - this file.
 sched-arch.txt
        - CPU Scheduler implementation hints for architecture specific code.
+sched-bwc.txt
+        - CFS bandwidth control overview.
 sched-design-CFS.txt
        - goals, design and implementation of the Completely Fair Scheduler.
 sched-domains.txt
diff --git a/Documentation/scsi/00-INDEX b/Documentation/scsi/00-INDEX
index 2044be565d93..c4b978a72f78 100644
--- a/Documentation/scsi/00-INDEX
+++ b/Documentation/scsi/00-INDEX
@@ -36,6 +36,8 @@ NinjaSCSI.txt
        - info on WorkBiT NinjaSCSI-32/32Bi driver
 aacraid.txt
        - Driver supporting Adaptec RAID controllers
+advansys.txt
+        - List of Advansys Host Adapters
 aha152x.txt
        - info on driver for Adaptec AHA152x based adapters
 aic79xx.txt
@@ -44,6 +46,12 @@ aic7xxx.txt
        - info on driver for Adaptec controllers
 arcmsr_spec.txt
        - ARECA FIRMWARE SPEC (for IOP331 adapter)
+bfa.txt
+        - Brocade FC/FCOE adapter driver.
+bnx2fc.txt
+        - FCoE hardware offload for Broadcom network interfaces.
+cxgb3i.txt
+        - Chelsio iSCSI Linux Driver
 dc395x.txt
        - README file for the dc395x SCSI driver
 dpti.txt
@@ -52,18 +60,24 @@ dtc3x80.txt
        - info on driver for DTC 2x80 based adapters
 g_NCR5380.txt
        - info on driver for NCR5380 and NCR53c400 based adapters
+hpsa.txt
+        - HP Smart Array Controller SCSI driver.
 hptiop.txt
        - HIGHPOINT ROCKETRAID 3xxx RAID DRIVER
 in2000.txt
        - info on in2000 driver
 libsas.txt
        - Serial Attached SCSI management layer.
+link_power_management_policy.txt
+        - Link power management options.
 lpfc.txt
        - LPFC driver release notes
 megaraid.txt
        - Common Management Module, shared code handling ioctls for LSI drivers
 ncr53c8xx.txt
        - info on driver for NCR53c8xx based adapters
+osd.txt
+        Object-Based Storage Device, command set introduction.
 osst.txt
        - info on driver for OnStream SC-x0 SCSI tape
 ppa.txt
@@ -74,6 +88,8 @@ scsi-changer.txt
        - README for the SCSI media changer driver
 scsi-generic.txt
        - info on the sg driver for generic (non-disk/CD/tape) SCSI devices.
+scsi-parameters.txt
+        - List of SCSI-parameters to pass to the kernel at module load-time.
 scsi.txt
        - short blurb on using SCSI support as a module.
 scsi_mid_low_api.txt
diff --git a/Documentation/serial/00-INDEX b/Documentation/serial/00-INDEX
index 1f1b22fbd739..f9c6b5ed03e7 100644
--- a/Documentation/serial/00-INDEX
+++ b/Documentation/serial/00-INDEX
@@ -4,10 +4,12 @@ README.cycladesZ
        - info on Cyclades-Z firmware loading.
 digiepca.txt
        - info on Digi Intl. {PC,PCI,EISA}Xx and Xem series cards.
-hayes-esp.txt
+driver
-        - info on using the Hayes ESP serial driver.
+        - intro to the low level serial driver.
 moxa-smartio
        - file with info on installing/using Moxa multiport serial driver.
+n_gsm.txt
+        - GSM 0710 tty multiplexer howto.
 riscom8.txt
        - notes on using the RISCom/8 multi-port serial driver.
 rocket.txt
diff --git a/Documentation/spi/00-INDEX b/Documentation/spi/00-INDEX
new file mode 100644
index 000000000000..a128fa835512
--- /dev/null
+++ b/Documentation/spi/00-INDEX
@@ -0,0 +1,22 @@
+00-INDEX
+        - this file.
+Makefile
+        - Makefile for the example sourcefiles.
+butterfly
+        - AVR Butterfly SPI driver overview and pin configuration.
+ep93xx_spi
+        - Basic EP93xx SPI driver configuration.
+pxa2xx
+        - PXA2xx SPI master controller build by spi_message fifo wq
+spidev
+        - Intro to the userspace API for spi devices
+spidev_fdx.c
+        - spidev example file
+spi-lm70llp
+        - Connecting an LM70-LLP sensor to the kernel via the SPI subsys.
+spi-sc18is602
+        - NXP SC18IS602/603 I2C-bus to SPI bridge
+spi-summary
+        - (Linux) SPI overview. If unsure about SPI or SPI in Linux, start here.
+spidev_test.c
+        - SPI testing utility.
diff --git a/Documentation/timers/00-INDEX b/Documentation/timers/00-INDEX
index ef2ccbf77fa2..6d042dc1cce0 100644
--- a/Documentation/timers/00-INDEX
+++ b/Documentation/timers/00-INDEX
@@ -8,6 +8,8 @@ hpet_example.c
        - sample hpet timer test program
 hrtimers.txt
        - subsystem for high-resolution kernel timers
+Makefile
+        - Build and link hpet_example
 NO_HZ.txt
        - Summary of the different methods for the scheduler clock-interrupts management.
 timers-howto.txt
diff --git a/Documentation/virtual/kvm/00-INDEX b/Documentation/virtual/kvm/00-INDEX
index 641ec9220179..fee9f2bf9c64 100644
--- a/Documentation/virtual/kvm/00-INDEX
+++ b/Documentation/virtual/kvm/00-INDEX
@@ -20,5 +20,7 @@ ppc-pv.txt
        - the paravirtualization interface on PowerPC.
 review-checklist.txt
        - review checklist for KVM patches.
+s390-diag.txt
+        - Diagnose hypercall description (for IBM S/390)
 timekeeping.txt
        - timekeeping virtualization for x86-based architectures.
diff --git a/Documentation/vm/00-INDEX b/Documentation/vm/00-INDEX
index a39d06680e1c..081c49777abb 100644
--- a/Documentation/vm/00-INDEX
+++ b/Documentation/vm/00-INDEX
@@ -16,8 +16,6 @@ hwpoison.txt
        - explains what hwpoison is
 ksm.txt
        - how to use the Kernel Samepage Merging feature.
-locking
-        - info on how locking and synchronization is done in the Linux vm code.
 numa
        - information about NUMA specific code in the Linux vm.
 numa_memory_policy.txt
@@ -32,6 +30,8 @@ slub.txt
        - a short users guide for SLUB.
 soft-dirty.txt
        - short explanation for soft-dirty PTEs
+split_page_table_lock
+        - Separate per-table lock to improve scalability of the old page_table_lock.
 transhuge.txt
        - Transparent Hugepage Support, alternative way of using hugepages.
 unevictable-lru.txt
diff --git a/Documentation/w1/masters/00-INDEX b/Documentation/w1/masters/00-INDEX
index d63fa024ac05..8330cf9325f0 100644
--- a/Documentation/w1/masters/00-INDEX
+++ b/Documentation/w1/masters/00-INDEX
@@ -4,7 +4,9 @@ ds2482
        - The Maxim/Dallas Semiconductor DS2482 provides 1-wire busses.
 ds2490
        - The Maxim/Dallas Semiconductor DS2490 builds USB <-> W1 bridges.
-mxc_w1
+mxc-w1
        - W1 master controller driver found on Freescale MX2/MX3 SoCs
+omap-hdq
+        - HDQ/1-wire module of TI OMAP 2430/3430.
 w1-gpio
        - GPIO 1-wire bus master driver.
diff --git a/Documentation/w1/slaves/00-INDEX b/Documentation/w1/slaves/00-INDEX
index 75613c9ac4db..6e18c70c3474 100644
--- a/Documentation/w1/slaves/00-INDEX
+++ b/Documentation/w1/slaves/00-INDEX
@@ -4,3 +4,5 @@ w1_therm
        - The Maxim/Dallas Semiconductor ds18*20 temperature sensor.
 w1_ds2423
        - The Maxim/Dallas Semiconductor ds2423 counter device.
+w1_ds28e04
+        - The Maxim/Dallas Semiconductor ds28e04 eeprom.
diff --git a/Documentation/x86/00-INDEX b/Documentation/x86/00-INDEX
index f37b46d34861..692264456f0f 100644
--- a/Documentation/x86/00-INDEX
+++ b/Documentation/x86/00-INDEX
@@ -1,6 +1,20 @@
 00-INDEX
        - this file
-mtrr.txt
+boot.txt
-        - how to use x86 Memory Type Range Registers to increase performance
+        - List of boot protocol versions
+early-microcode.txt
+        - How to load microcode from an initrd-CPIO archive early to fix CPU issues.
+earlyprintk.txt
+        - Using earlyprintk with a USB2 debug port key.
+entry_64.txt
+        - Describe (some of the) kernel entry points for x86.
 exception-tables.txt
        - why and how Linux kernel uses exception tables on x86
+mtrr.txt
+        - how to use x86 Memory Type Range Registers to increase performance
+pat.txt
+        - Page Attribute Table intro and API
+usb-legacy-support.txt
+        - how to fix/avoid quirks when using emulated PS/2 mouse/keyboard.
+zero-page.txt
+        - layout of the first page of memory.
diff --git a/MAINTAINERS b/MAINTAINERS
index b2cf5cfb4d29..091b50edaf35 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -7196,7 +7196,7 @@ S:	Maintained
 F:      drivers/net/ethernet/rdc/r6040.c
 RDS - RELIABLE DATAGRAM SOCKETS
-M:      Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
+M:      Chien Yen <chien.yen@oracle.com>
 L:      rds-devel@oss.oracle.com (moderated for non-subscribers)
 S:      Supported
 F:      net/rds/
diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
index 040bb0eba152..10666ca8aee1 100644
--- a/arch/arm/boot/dts/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/sun4i-a10.dtsi
@@ -315,7 +315,7 @@
                ranges;
                emac: ethernet@01c0b000 {
-                        compatible = "allwinner,sun4i-emac";
+                        compatible = "allwinner,sun4i-a10-emac";
                        reg = <0x01c0b000 0x1000>;
                        interrupts = <55>;
                        clocks = <&ahb_gates 17>;
@@ -323,7 +323,7 @@
                };
                mdio@01c0b080 {
-                        compatible = "allwinner,sun4i-mdio";
+                        compatible = "allwinner,sun4i-a10-mdio";
                        reg = <0x01c0b080 0x14>;
                        status = "disabled";
                        #address-cells = <1>;
diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
index ea16054857a4..64961595e8d6 100644
--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
+++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
@@ -278,7 +278,7 @@
                ranges;
                emac: ethernet@01c0b000 {
-                        compatible = "allwinner,sun4i-emac";
+                        compatible = "allwinner,sun4i-a10-emac";
                        reg = <0x01c0b000 0x1000>;
                        interrupts = <55>;
                        clocks = <&ahb_gates 17>;
@@ -286,7 +286,7 @@
                };
                mdio@01c0b080 {
-                        compatible = "allwinner,sun4i-mdio";
+                        compatible = "allwinner,sun4i-a10-mdio";
                        reg = <0x01c0b080 0x14>;
                        status = "disabled";
                        #address-cells = <1>;
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index 119f066f0d98..9ff09484847b 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -340,7 +340,7 @@
                ranges;
                emac: ethernet@01c0b000 {
-                        compatible = "allwinner,sun4i-emac";
+                        compatible = "allwinner,sun4i-a10-emac";
                        reg = <0x01c0b000 0x1000>;
                        interrupts = <0 55 4>;
                        clocks = <&ahb_gates 17>;
@@ -348,7 +348,7 @@
                };
                mdio@01c0b080 {
-                        compatible = "allwinner,sun4i-mdio";
+                        compatible = "allwinner,sun4i-a10-mdio";
                        reg = <0x01c0b080 0x14>;
                        status = "disabled";
                        #address-cells = <1>;
diff --git a/arch/microblaze/include/asm/delay.h b/arch/microblaze/include/asm/delay.h
index 05b7d39e4391..66fc24c24238 100644
--- a/arch/microblaze/include/asm/delay.h
+++ b/arch/microblaze/include/asm/delay.h
@@ -13,6 +13,8 @@
 #ifndef _ASM_MICROBLAZE_DELAY_H
 #define _ASM_MICROBLAZE_DELAY_H
+#include <linux/param.h>
 extern inline void __delay(unsigned long loops)
 {
        asm volatile ("# __delay                \n\t"           \
diff --git a/arch/microblaze/include/asm/io.h b/arch/microblaze/include/asm/io.h
index a2cea7206077..3fbb7f1db3bc 100644
--- a/arch/microblaze/include/asm/io.h
+++ b/arch/microblaze/include/asm/io.h
@@ -89,6 +89,11 @@ static inline unsigned int readl(const volatile void __iomem *addr)
 {
        return le32_to_cpu(*(volatile unsigned int __force *)addr);
 }
+#define readq readq
+static inline u64 readq(const volatile void __iomem *addr)
+{
+        return le64_to_cpu(__raw_readq(addr));
+}
 static inline void writeb(unsigned char v, volatile void __iomem *addr)
 {
        *(volatile unsigned char __force *)addr = v;
@@ -101,6 +106,7 @@ static inline void writel(unsigned int v, volatile void __iomem *addr)
 {
        *(volatile unsigned int __force *)addr = cpu_to_le32(v);
 }
+#define writeq(b, addr) __raw_writeq(cpu_to_le64(b), addr)
 /* ioread and iowrite variants. thease are for now same as __raw_
 * variants of accessors. we might check for endianess in the feature
diff --git a/arch/microblaze/kernel/head.S b/arch/microblaze/kernel/head.S
index b7fb0438458c..17645b2e2f07 100644
--- a/arch/microblaze/kernel/head.S
+++ b/arch/microblaze/kernel/head.S
@@ -66,7 +66,7 @@ real_start:
        mts     rmsr, r0
 /* Disable stack protection from bootloader */
        mts     rslr, r0
-        addi    r8, r0, 0xFFFFFFF
+        addi    r8, r0, 0xFFFFFFFF
        mts     rshr, r8
 /*
 * According to Xilinx, msrclr instruction behaves like 'mfs rX,rpc'
diff --git a/arch/s390/appldata/appldata_base.c b/arch/s390/appldata/appldata_base.c
index 4c4a1cef5208..47c8630c93cd 100644
--- a/arch/s390/appldata/appldata_base.c
+++ b/arch/s390/appldata/appldata_base.c
@@ -529,6 +529,7 @@ static int __init appldata_init(void)
 {
        int rc;
+        init_virt_timer(&appldata_timer);
        appldata_timer.function = appldata_timer_function;
        appldata_timer.data = (unsigned long) &appldata_work;
diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S
index b9e25ae2579c..d7c00507568a 100644
--- a/arch/s390/kernel/head64.S
+++ b/arch/s390/kernel/head64.S
@@ -59,7 +59,7 @@ ENTRY(startup_continue)
        .quad   0                       # cr12: tracing off
        .quad   0                       # cr13: home space segment table
        .quad   0xc0000000              # cr14: machine check handling off
-        .quad   0                       # cr15: linkage stack operations
+        .quad   .Llinkage_stack         # cr15: linkage stack operations
 .Lpcmsk:.quad   0x0000000180000000
 .L4malign:.quad 0xffffffffffc00000
 .Lscan2g:.quad  0x80000000 + 0x20000 - 8        # 2GB + 128K - 8
@@ -67,12 +67,15 @@ ENTRY(startup_continue)
 .Lparmaddr:
        .quad   PARMAREA
        .align  64
-.Lduct: .long   0,0,0,0,.Lduald,0,0,0
+.Lduct: .long   0,.Laste,.Laste,0,.Lduald,0,0,0
        .long   0,0,0,0,0,0,0,0
+.Laste: .quad   0,0xffffffffffffffff,0,0,0,0,0,0
        .align  128
 .Lduald:.rept   8
        .long   0x80000000,0,0,0        # invalid access-list entries
        .endr
+.Llinkage_stack:
+        .long   0,0,0x89000000,0,0,0,0x8a000000,0
 ENTRY(_ehead)
diff --git a/arch/s390/mm/page-states.c b/arch/s390/mm/page-states.c
index a90d45e9dfb0..27c50f4d90cb 100644
--- a/arch/s390/mm/page-states.c
+++ b/arch/s390/mm/page-states.c
@@ -12,6 +12,8 @@
 #include <linux/mm.h>
 #include <linux/gfp.h>
 #include <linux/init.h>
+#include <asm/setup.h>
+#include <asm/ipl.h>
 #define ESSA_SET_STABLE         1
 #define ESSA_SET_UNUSED         2
@@ -41,6 +43,14 @@ void __init cmma_init(void)
        if (!cmma_flag)
                return;
+        /*
+         * Disable CMM for dump, otherwise  the tprot based memory
+         * detection can fail because of unstable pages.
+         */
+        if (OLDMEM_BASE || ipl_info.type == IPL_TYPE_FCP_DUMP) {
+                cmma_flag = 0;
+                return;
+        }
        asm volatile(
                "       .insn rrf,0xb9ab0000,%1,%1,0,0\n"
                "0:     la      %0,0\n"
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index bbc8b12fa443..5ad38ad07890 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -445,10 +445,20 @@ static inline int pte_same(pte_t a, pte_t b)
        return a.pte == b.pte;
 }
+static inline int pteval_present(pteval_t pteval)
+{
+        /*
+         * Yes Linus, _PAGE_PROTNONE == _PAGE_NUMA. Expressing it this
+         * way clearly states that the intent is that protnone and numa
+         * hinting ptes are considered present for the purposes of
+         * pagetable operations like zapping, protection changes, gup etc.
+         */
+        return pteval & (_PAGE_PRESENT | _PAGE_PROTNONE | _PAGE_NUMA);
+}
 static inline int pte_present(pte_t a)
 {
-        return pte_flags(a) & (_PAGE_PRESENT | _PAGE_PROTNONE |
+        return pteval_present(pte_flags(a));
-                               _PAGE_NUMA);
 }
 #define pte_accessible pte_accessible
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 2423ef04ffea..256282e7888b 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -365,7 +365,7 @@ void xen_ptep_modify_prot_commit(struct mm_struct *mm, unsigned long addr,
 /* Assume pteval_t is equivalent to all the other *val_t types. */
 static pteval_t pte_mfn_to_pfn(pteval_t val)
 {
-        if (val & _PAGE_PRESENT) {
+        if (pteval_present(val)) {
                unsigned long mfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
                unsigned long pfn = mfn_to_pfn(mfn);
@@ -381,7 +381,7 @@ static pteval_t pte_mfn_to_pfn(pteval_t val)
 static pteval_t pte_pfn_to_mfn(pteval_t val)
 {
-        if (val & _PAGE_PRESENT) {
+        if (pteval_present(val)) {
                unsigned long pfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
                pteval_t flags = val & PTE_FLAGS_MASK;
                unsigned long mfn;
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index 51c0362acf5c..8ec1747b1c39 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -61,7 +61,7 @@ static int edac_set_poll_msec(const char *val, struct kernel_param *kp)
        ret = kstrtol(val, 0, &l);
        if (ret)
                return ret;
-        if ((int)l != l)
+        if (!l || ((int)l != l))
                return -EINVAL;
        *((int *)kp->arg) = l;
diff --git a/drivers/isdn/hisax/q931.c b/drivers/isdn/hisax/q931.c
index af1b020a81f1..b420f8bd862e 100644
--- a/drivers/isdn/hisax/q931.c
+++ b/drivers/isdn/hisax/q931.c
@@ -810,7 +810,7 @@ prfeatureind(char *dest, u_char *p)
        dp += sprintf(dp, "    octet 3  ");
        dp += prbits(dp, *p, 8, 8);
        *dp++ = '\n';
-        if (!(*p++ & 80)) {
+        if (!(*p++ & 0x80)) {
                dp += sprintf(dp, "    octet 4  ");
                dp += prbits(dp, *p++, 8, 8);
                *dp++ = '\n';
diff --git a/drivers/md/bcache/extents.c b/drivers/md/bcache/extents.c
index c3ead586dc27..416d1a3e028e 100644
--- a/drivers/md/bcache/extents.c
+++ b/drivers/md/bcache/extents.c
@@ -194,7 +194,7 @@ err:
        mutex_unlock(&b->c->bucket_lock);
        bch_extent_to_text(buf, sizeof(buf), k);
        btree_bug(b,
-"inconsistent btree pointer %s: bucket %li pin %i prio %i gen %i last_gc %i mark %llu gc_gen %i",
+"inconsistent btree pointer %s: bucket %zi pin %i prio %i gen %i last_gc %i mark %llu gc_gen %i",
                  buf, PTR_BUCKET_NR(b->c, k, i), atomic_read(&g->pin),
                  g->prio, g->gen, g->last_gc, GC_MARK(g), g->gc_gen);
        return true;
diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
index a60c188c2bd9..04bd3b6de401 100644
--- a/drivers/message/i2o/i2o_config.c
+++ b/drivers/message/i2o/i2o_config.c
@@ -754,19 +754,19 @@ static long i2o_cfg_compat_ioctl(struct file *file, unsigned cmd,
                                 unsigned long arg)
 {
        int ret;
-        mutex_lock(&i2o_cfg_mutex);
        switch (cmd) {
        case I2OGETIOPS:
                ret = i2o_cfg_ioctl(file, cmd, arg);
                break;
        case I2OPASSTHRU32:
+                mutex_lock(&i2o_cfg_mutex);
                ret = i2o_cfg_passthru32(file, cmd, arg);
+                mutex_unlock(&i2o_cfg_mutex);
                break;
        default:
                ret = -ENOIOCTLCMD;
                break;
        }
-        mutex_unlock(&i2o_cfg_mutex);
        return ret;
 }
diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c
index 9b2062d17327..2bef3f76032a 100644
--- a/drivers/misc/sgi-gru/grukdump.c
+++ b/drivers/misc/sgi-gru/grukdump.c
@@ -139,8 +139,11 @@ static int gru_dump_context(struct gru_state *gru, int ctxnum,
        ubuf += sizeof(hdr);
        ubufcch = ubuf;
-        if (gru_user_copy_handle(&ubuf, cch))
+        if (gru_user_copy_handle(&ubuf, cch)) {
-                goto fail;
+                if (cch_locked)
+                        unlock_cch_handle(cch);
+                return -EFAULT;
+        }
        if (cch_locked)
                ubufcch->delresp = 0;
        bytes = sizeof(hdr) + GRU_CACHE_LINE_BYTES;
@@ -179,10 +182,6 @@ static int gru_dump_context(struct gru_state *gru, int ctxnum,
                ret = -EFAULT;
        return ret ? ret : bytes;
-fail:
-        unlock_cch_handle(cch);
-        return -EFAULT;
 }
 int gru_dump_chiplet_request(unsigned long arg)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 4c08018d7333..71ba18efa15b 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1270,9 +1270,13 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        if (slave_ops->ndo_set_mac_address == NULL) {
                if (!bond_has_slaves(bond)) {
-                        pr_warning("%s: Warning: The first slave device specified does not support setting the MAC address. Setting fail_over_mac to active.",
+                        pr_warn("%s: Warning: The first slave device specified does not support setting the MAC address.\n",
-                                   bond_dev->name);
+                                bond_dev->name);
-                        bond->params.fail_over_mac = BOND_FOM_ACTIVE;
+                        if (bond->params.mode == BOND_MODE_ACTIVEBACKUP) {
+                                bond->params.fail_over_mac = BOND_FOM_ACTIVE;
+                                pr_warn("%s: Setting fail_over_mac to active for active-backup mode.\n",
+                                        bond_dev->name);
+                        }
                } else if (bond->params.fail_over_mac != BOND_FOM_ACTIVE) {
                        pr_err("%s: Error: The slave device specified does not support setting the MAC address, but fail_over_mac is not set to active.\n",
                               bond_dev->name);
@@ -1315,7 +1319,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         */
        memcpy(new_slave->perm_hwaddr, slave_dev->dev_addr, ETH_ALEN);
-        if (!bond->params.fail_over_mac) {
+        if (!bond->params.fail_over_mac ||
+            bond->params.mode != BOND_MODE_ACTIVEBACKUP) {
                /*
                 * Set slave to master's mac address.  The application already
                 * set the master's mac address to that of the first slave
@@ -1505,7 +1510,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        slave_dev->npinfo = bond->dev->npinfo;
        if (slave_dev->npinfo) {
                if (slave_enable_netpoll(new_slave)) {
-                        read_unlock(&bond->lock);
                        pr_info("Error, %s: master_dev is using netpoll, "
                                 "but new slave device does not support netpoll.\n",
                                 bond_dev->name);
@@ -1579,7 +1583,8 @@ err_close:
        dev_close(slave_dev);
 err_restore_mac:
-        if (!bond->params.fail_over_mac) {
+        if (!bond->params.fail_over_mac ||
+            bond->params.mode != BOND_MODE_ACTIVEBACKUP) {
                /* XXX TODO - fom follow mode needs to change master's
                 * MAC if this slave's MAC is in use by the bond, or at
                 * least print a warning.
@@ -1672,7 +1677,8 @@ static int __bond_release_one(struct net_device *bond_dev,
        bond->current_arp_slave = NULL;
-        if (!all && !bond->params.fail_over_mac) {
+        if (!all && (!bond->params.fail_over_mac ||
+                     bond->params.mode != BOND_MODE_ACTIVEBACKUP)) {
                if (ether_addr_equal_64bits(bond_dev->dev_addr, slave->perm_hwaddr) &&
                    bond_has_slaves(bond))
                        pr_warn("%s: Warning: the permanent HWaddr of %s - %pM - is still in use by %s. Set the HWaddr of %s to a different address to avoid conflicts.\n",
@@ -1769,7 +1775,8 @@ static int __bond_release_one(struct net_device *bond_dev,
        /* close slave before restoring its mac address */
        dev_close(slave_dev);
-        if (bond->params.fail_over_mac != BOND_FOM_ACTIVE) {
+        if (bond->params.fail_over_mac != BOND_FOM_ACTIVE ||
+            bond->params.mode != BOND_MODE_ACTIVEBACKUP) {
                /* restore original ("permanent") mac address */
                memcpy(addr.sa_data, slave->perm_hwaddr, ETH_ALEN);
                addr.sa_family = slave_dev->type;
@@ -3431,7 +3438,8 @@ static int bond_set_mac_address(struct net_device *bond_dev, void *addr)
        /* If fail_over_mac is enabled, do nothing and return success.
         * Returning an error causes ifenslave to fail.
         */
-        if (bond->params.fail_over_mac)
+        if (bond->params.fail_over_mac &&
+            bond->params.mode == BOND_MODE_ACTIVEBACKUP)
                return 0;
        if (!is_valid_ether_addr(sa->sa_data))
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index d447b881bbde..9e7d95dae2c7 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -104,7 +104,7 @@ config CAN_JANZ_ICAN3
 config CAN_FLEXCAN
        tristate "Support for Freescale FLEXCAN based chips"
-        depends on (ARM && CPU_LITTLE_ENDIAN) || PPC
+        depends on ARM || PPC
        ---help---
          Say Y here if you want to support for Freescale FlexCAN.
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 13a909822e25..fc59bc6f040b 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -323,19 +323,10 @@ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
        }
        if (!priv->echo_skb[idx]) {
-                struct sock *srcsk = skb->sk;
-                if (atomic_read(&skb->users) != 1) {
+                skb = can_create_echo_skb(skb);
-                        struct sk_buff *old_skb = skb;
+                if (!skb)
+                        return;
-                        skb = skb_clone(old_skb, GFP_ATOMIC);
-                        kfree_skb(old_skb);
-                        if (!skb)
-                                return;
-                } else
-                        skb_orphan(skb);
-                skb->sk = srcsk;
                /* make settings for echo to reduce code in irq context */
                skb->protocol = htons(ETH_P_CAN);
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index aaed97bee471..320bef2dba42 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -235,9 +235,12 @@ static const struct can_bittiming_const flexcan_bittiming_const = {
 };
 /*
- * Abstract off the read/write for arm versus ppc.
+ * Abstract off the read/write for arm versus ppc. This
+ * assumes that PPC uses big-endian registers and everything
+ * else uses little-endian registers, independent of CPU
+ * endianess.
 */
-#if defined(__BIG_ENDIAN)
+#if defined(CONFIG_PPC)
 static inline u32 flexcan_read(void __iomem *addr)
 {
        return in_be32(addr);
diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
index e24e6690d672..71594e5676fd 100644
--- a/drivers/net/can/janz-ican3.c
+++ b/drivers/net/can/janz-ican3.c
@@ -18,6 +18,7 @@
 #include <linux/netdevice.h>
 #include <linux/can.h>
 #include <linux/can/dev.h>
+#include <linux/can/skb.h>
 #include <linux/can/error.h>
 #include <linux/mfd/janz.h>
@@ -1133,20 +1134,9 @@ static void ican3_handle_message(struct ican3_dev *mod, struct ican3_msg *msg)
 */
 static void ican3_put_echo_skb(struct ican3_dev *mod, struct sk_buff *skb)
 {
-        struct sock *srcsk = skb->sk;
+        skb = can_create_echo_skb(skb);
+        if (!skb)
-        if (atomic_read(&skb->users) != 1) {
+                return;
-                struct sk_buff *old_skb = skb;
-                skb = skb_clone(old_skb, GFP_ATOMIC);
-                kfree_skb(old_skb);
-                if (!skb)
-                        return;
-        } else {
-                skb_orphan(skb);
-        }
-        skb->sk = srcsk;
        /* save this skb for tx interrupt echo handling */
        skb_queue_tail(&mod->echoq, skb);
@@ -1322,7 +1312,7 @@ static int ican3_napi(struct napi_struct *napi, int budget)
        /* process all communication messages */
        while (true) {
-                struct ican3_msg msg;
+                struct ican3_msg uninitialized_var(msg);
                ret = ican3_recv_msg(mod, &msg);
                if (ret)
                        break;
diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
index 0a2a5ee79a17..4e94057ef5cf 100644
--- a/drivers/net/can/vcan.c
+++ b/drivers/net/can/vcan.c
@@ -46,6 +46,7 @@
 #include <linux/if_ether.h>
 #include <linux/can.h>
 #include <linux/can/dev.h>
+#include <linux/can/skb.h>
 #include <linux/slab.h>
 #include <net/rtnetlink.h>
@@ -109,25 +110,23 @@ static netdev_tx_t vcan_tx(struct sk_buff *skb, struct net_device *dev)
                        stats->rx_packets++;
                        stats->rx_bytes += cfd->len;
                }
-                kfree_skb(skb);
+                consume_skb(skb);
                return NETDEV_TX_OK;
        }
        /* perform standard echo handling for CAN network interfaces */
        if (loop) {
-                struct sock *srcsk = skb->sk;
-                skb = skb_share_check(skb, GFP_ATOMIC);
+                skb = can_create_echo_skb(skb);
                if (!skb)
                        return NETDEV_TX_OK;
                /* receive with packet counting */
-                skb->sk = srcsk;
                vcan_rx(skb, dev);
        } else {
                /* no looped packets => no counting */
-                kfree_skb(skb);
+                consume_skb(skb);
        }
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index 0f4241c6e97e..238ccea965c8 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -3294,7 +3294,6 @@ static int __init vortex_init(void)
 static void __exit vortex_eisa_cleanup(void)
 {
-        struct vortex_private *vp;
        void __iomem *ioaddr;
 #ifdef CONFIG_EISA
@@ -3303,7 +3302,6 @@ static void __exit vortex_eisa_cleanup(void)
 #endif
        if (compaq_net_device) {
-                vp = netdev_priv(compaq_net_device);
                ioaddr = ioport_map(compaq_net_device->base_addr,
                                    VORTEX_TOTAL_SIZE);
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 0cc21437478c..511f6eecd58b 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -929,6 +929,9 @@ static int emac_resume(struct platform_device *dev)
 }
 static const struct of_device_id emac_of_match[] = {
+        {.compatible = "allwinner,sun4i-a10-emac",},
+        /* Deprecated */
        {.compatible = "allwinner,sun4i-emac",},
        {},
 };
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index e92ffd6e1c15..2e45f6ec1bf0 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1292,6 +1292,7 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        alx = netdev_priv(netdev);
        spin_lock_init(&alx->hw.mdio_lock);
        spin_lock_init(&alx->irq_lock);
+        spin_lock_init(&alx->stats_lock);
        alx->dev = netdev;
        alx->hw.pdev = pdev;
        alx->msg_enable = NETIF_MSG_LINK | NETIF_MSG_HW | NETIF_MSG_IFUP |
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 9d2dedadf2df..cda25ac45b47 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -85,7 +85,7 @@ MODULE_FIRMWARE(FW_RV2P_FILE_09_Ax);
 static int disable_msi = 0;
-module_param(disable_msi, int, 0);
+module_param(disable_msi, int, S_IRUGO);
 MODULE_PARM_DESC(disable_msi, "Disable Message Signaled Interrupt (MSI)");
 typedef enum {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index 17d1689aec6b..bfc58d488bb5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -936,7 +936,7 @@ static inline int bnx2x_func_start(struct bnx2x *bp)
        else /* CHIP_IS_E1X */
                start_params->network_cos_mode = FW_WRR;
-        start_params->gre_tunnel_mode = IPGRE_TUNNEL;
+        start_params->gre_tunnel_mode = L2GRE_TUNNEL;
        start_params->gre_tunnel_rss = GRE_INNER_HEADERS_RSS;
        return bnx2x_func_state_change(bp, &func_params);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index c9c445e7b4a5..7d4382286457 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -95,29 +95,29 @@ MODULE_FIRMWARE(FW_FILE_NAME_E1H);
 MODULE_FIRMWARE(FW_FILE_NAME_E2);
 int bnx2x_num_queues;
-module_param_named(num_queues, bnx2x_num_queues, int, 0);
+module_param_named(num_queues, bnx2x_num_queues, int, S_IRUGO);
 MODULE_PARM_DESC(num_queues,
                 " Set number of queues (default is as a number of CPUs)");
 static int disable_tpa;
-module_param(disable_tpa, int, 0);
+module_param(disable_tpa, int, S_IRUGO);
 MODULE_PARM_DESC(disable_tpa, " Disable the TPA (LRO) feature");
 static int int_mode;
-module_param(int_mode, int, 0);
+module_param(int_mode, int, S_IRUGO);
 MODULE_PARM_DESC(int_mode, " Force interrupt mode other than MSI-X "
                                "(1 INT#x; 2 MSI)");
 static int dropless_fc;
-module_param(dropless_fc, int, 0);
+module_param(dropless_fc, int, S_IRUGO);
 MODULE_PARM_DESC(dropless_fc, " Pause on exhausted host ring");
 static int mrrs = -1;
-module_param(mrrs, int, 0);
+module_param(mrrs, int, S_IRUGO);
 MODULE_PARM_DESC(mrrs, " Force Max Read Req Size (0..3) (for debug)");
 static int debug;
-module_param(debug, int, 0);
+module_param(debug, int, S_IRUGO);
 MODULE_PARM_DESC(debug, " Default debug msglevel");
 struct workqueue_struct *bnx2x_wq;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index aec5ef2ed7ce..e42f48df6e94 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1446,12 +1446,12 @@ static void bnx2x_vf_igu_reset(struct bnx2x *bp, struct bnx2x_virtf *vf)
        if (vf->cfg_flags & VF_CFG_INT_SIMD)
                val |= IGU_VF_CONF_SINGLE_ISR_EN;
        val &= ~IGU_VF_CONF_PARENT_MASK;
-        val |= BP_FUNC(bp) << IGU_VF_CONF_PARENT_SHIFT; /* parent PF */
+        val |= (BP_ABS_FUNC(bp) >> 1) << IGU_VF_CONF_PARENT_SHIFT;
        REG_WR(bp, IGU_REG_VF_CONFIGURATION, val);
        DP(BNX2X_MSG_IOV,
-           "value in IGU_REG_VF_CONFIGURATION of vf %d after write %x\n",
+           "value in IGU_REG_VF_CONFIGURATION of vf %d after write is 0x%08x\n",
-           vf->abs_vfid, REG_RD(bp, IGU_REG_VF_CONFIGURATION));
+           vf->abs_vfid, val);
        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index e2ca03e23dc1..3167ed6593b0 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -2609,13 +2609,14 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
        tg3_writephy(tp, MII_CTRL1000, phy9_orig);
-        if (!tg3_readphy(tp, MII_TG3_EXT_CTRL, &reg32)) {
+        err = tg3_readphy(tp, MII_TG3_EXT_CTRL, &reg32);
-                reg32 &= ~0x3000;
+        if (err)
-                tg3_writephy(tp, MII_TG3_EXT_CTRL, reg32);
+                return err;
-        } else if (!err)
-                err = -EBUSY;
-        return err;
+        reg32 &= ~0x3000;
+        tg3_writephy(tp, MII_TG3_EXT_CTRL, reg32);
+        return 0;
 }
 static void tg3_carrier_off(struct tg3 *tp)
@@ -14113,12 +14114,12 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
        tg3_netif_stop(tp);
+        tg3_set_mtu(dev, tp, new_mtu);
        tg3_full_lock(tp, 1);
        tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-        tg3_set_mtu(dev, tp, new_mtu);
        /* Reset PHY, otherwise the read DMA engine will be in a mode that
         * breaks all requests to 256 bytes.
         */
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index 4de8cfd149cf..55e0fa03dc90 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -13,6 +13,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/etherdevice.h>
+#include <linux/clk.h>
 #include <linux/crc32.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
@@ -51,6 +52,7 @@ MODULE_PARM_DESC(buffer_size, "DMA buffer allocation size");
 #define ETH_HASH0       0x48
 #define ETH_HASH1       0x4c
 #define ETH_TXCTRL      0x50
+#define ETH_END         0x54
 /* mode register */
 #define MODER_RXEN      (1 <<  0) /* receive enable */
@@ -179,6 +181,7 @@ MODULE_PARM_DESC(buffer_size, "DMA buffer allocation size");
 * @membase:    pointer to buffer memory region
 * @dma_alloc:  dma allocated buffer size
 * @io_region_size:     I/O memory region size
+ * @num_bd:     number of buffer descriptors
 * @num_tx:     number of send buffers
 * @cur_tx:     last send buffer written
 * @dty_tx:     last buffer actually sent
@@ -199,6 +202,7 @@ struct ethoc {
        int dma_alloc;
        resource_size_t io_region_size;
+        unsigned int num_bd;
        unsigned int num_tx;
        unsigned int cur_tx;
        unsigned int dty_tx;
@@ -216,6 +220,7 @@ struct ethoc {
        struct phy_device *phy;
        struct mii_bus *mdio;
+        struct clk *clk;
        s8 phy_id;
 };
@@ -688,6 +693,11 @@ static int ethoc_mdio_probe(struct net_device *dev)
        }
        priv->phy = phy;
+        phy->advertising &= ~(ADVERTISED_1000baseT_Full |
+                              ADVERTISED_1000baseT_Half);
+        phy->supported &= ~(SUPPORTED_1000baseT_Full |
+                            SUPPORTED_1000baseT_Half);
        return 0;
 }
@@ -890,6 +900,102 @@ out:
        return NETDEV_TX_OK;
 }
+static int ethoc_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        struct phy_device *phydev = priv->phy;
+        if (!phydev)
+                return -EOPNOTSUPP;
+        return phy_ethtool_gset(phydev, cmd);
+}
+static int ethoc_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        struct phy_device *phydev = priv->phy;
+        if (!phydev)
+                return -EOPNOTSUPP;
+        return phy_ethtool_sset(phydev, cmd);
+}
+static int ethoc_get_regs_len(struct net_device *netdev)
+{
+        return ETH_END;
+}
+static void ethoc_get_regs(struct net_device *dev, struct ethtool_regs *regs,
+                           void *p)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        u32 *regs_buff = p;
+        unsigned i;
+        regs->version = 0;
+        for (i = 0; i < ETH_END / sizeof(u32); ++i)
+                regs_buff[i] = ethoc_read(priv, i * sizeof(u32));
+}
+static void ethoc_get_ringparam(struct net_device *dev,
+                                struct ethtool_ringparam *ring)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        ring->rx_max_pending = priv->num_bd - 1;
+        ring->rx_mini_max_pending = 0;
+        ring->rx_jumbo_max_pending = 0;
+        ring->tx_max_pending = priv->num_bd - 1;
+        ring->rx_pending = priv->num_rx;
+        ring->rx_mini_pending = 0;
+        ring->rx_jumbo_pending = 0;
+        ring->tx_pending = priv->num_tx;
+}
+static int ethoc_set_ringparam(struct net_device *dev,
+                               struct ethtool_ringparam *ring)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        if (ring->tx_pending < 1 || ring->rx_pending < 1 ||
+            ring->tx_pending + ring->rx_pending > priv->num_bd)
+                return -EINVAL;
+        if (ring->rx_mini_pending || ring->rx_jumbo_pending)
+                return -EINVAL;
+        if (netif_running(dev)) {
+                netif_tx_disable(dev);
+                ethoc_disable_rx_and_tx(priv);
+                ethoc_disable_irq(priv, INT_MASK_TX | INT_MASK_RX);
+                synchronize_irq(dev->irq);
+        }
+        priv->num_tx = rounddown_pow_of_two(ring->tx_pending);
+        priv->num_rx = ring->rx_pending;
+        ethoc_init_ring(priv, dev->mem_start);
+        if (netif_running(dev)) {
+                ethoc_enable_irq(priv, INT_MASK_TX | INT_MASK_RX);
+                ethoc_enable_rx_and_tx(priv);
+                netif_wake_queue(dev);
+        }
+        return 0;
+}
+const struct ethtool_ops ethoc_ethtool_ops = {
+        .get_settings = ethoc_get_settings,
+        .set_settings = ethoc_set_settings,
+        .get_regs_len = ethoc_get_regs_len,
+        .get_regs = ethoc_get_regs,
+        .get_link = ethtool_op_get_link,
+        .get_ringparam = ethoc_get_ringparam,
+        .set_ringparam = ethoc_set_ringparam,
+        .get_ts_info = ethtool_op_get_ts_info,
+};
 static const struct net_device_ops ethoc_netdev_ops = {
        .ndo_open = ethoc_open,
        .ndo_stop = ethoc_stop,
@@ -917,6 +1023,8 @@ static int ethoc_probe(struct platform_device *pdev)
        int num_bd;
        int ret = 0;
        bool random_mac = false;
+        struct ethoc_platform_data *pdata = dev_get_platdata(&pdev->dev);
+        u32 eth_clkfreq = pdata ? pdata->eth_clkfreq : 0;
        /* allocate networking device */
        netdev = alloc_etherdev(sizeof(struct ethoc));
@@ -1016,6 +1124,7 @@ static int ethoc_probe(struct platform_device *pdev)
                ret = -ENODEV;
                goto error;
        }
+        priv->num_bd = num_bd;
        /* num_tx must be a power of two */
        priv->num_tx = rounddown_pow_of_two(num_bd >> 1);
        priv->num_rx = num_bd - priv->num_tx;
@@ -1030,8 +1139,7 @@ static int ethoc_probe(struct platform_device *pdev)
        }
        /* Allow the platform setup code to pass in a MAC address. */
-        if (dev_get_platdata(&pdev->dev)) {
+        if (pdata) {
-                struct ethoc_platform_data *pdata = dev_get_platdata(&pdev->dev);
                memcpy(netdev->dev_addr, pdata->hwaddr, IFHWADDRLEN);
                priv->phy_id = pdata->phy_id;
        } else {
@@ -1069,6 +1177,27 @@ static int ethoc_probe(struct platform_device *pdev)
        if (random_mac)
                netdev->addr_assign_type = NET_ADDR_RANDOM;
+        /* Allow the platform setup code to adjust MII management bus clock. */
+        if (!eth_clkfreq) {
+                struct clk *clk = devm_clk_get(&pdev->dev, NULL);
+                if (!IS_ERR(clk)) {
+                        priv->clk = clk;
+                        clk_prepare_enable(clk);
+                        eth_clkfreq = clk_get_rate(clk);
+                }
+        }
+        if (eth_clkfreq) {
+                u32 clkdiv = MIIMODER_CLKDIV(eth_clkfreq / 2500000 + 1);
+                if (!clkdiv)
+                        clkdiv = 2;
+                dev_dbg(&pdev->dev, "setting MII clkdiv to %u\n", clkdiv);
+                ethoc_write(priv, MIIMODER,
+                            (ethoc_read(priv, MIIMODER) & MIIMODER_NOPRE) |
+                            clkdiv);
+        }
        /* register MII bus */
        priv->mdio = mdiobus_alloc();
        if (!priv->mdio) {
@@ -1111,6 +1240,7 @@ static int ethoc_probe(struct platform_device *pdev)
        netdev->netdev_ops = &ethoc_netdev_ops;
        netdev->watchdog_timeo = ETHOC_TIMEOUT;
        netdev->features |= 0;
+        netdev->ethtool_ops = &ethoc_ethtool_ops;
        /* setup NAPI */
        netif_napi_add(netdev, &priv->napi, ethoc_poll, 64);
@@ -1133,6 +1263,8 @@ free_mdio:
        kfree(priv->mdio->irq);
        mdiobus_free(priv->mdio);
 free:
+        if (priv->clk)
+                clk_disable_unprepare(priv->clk);
        free_netdev(netdev);
 out:
        return ret;
@@ -1157,6 +1289,8 @@ static int ethoc_remove(struct platform_device *pdev)
                        kfree(priv->mdio->irq);
                        mdiobus_free(priv->mdio);
                }
+                if (priv->clk)
+                        clk_disable_unprepare(priv->clk);
                unregister_netdev(netdev);
                free_netdev(netdev);
        }
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index cbaba4442d4b..bf7a01ef9a57 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -3034,7 +3034,7 @@ static void __e100_shutdown(struct pci_dev *pdev, bool *enable_wake)
                *enable_wake = false;
        }
-        pci_disable_device(pdev);
+        pci_clear_master(pdev);
 }
 static int __e100_power_off(struct pci_dev *pdev, bool wake)
diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c b/drivers/net/ethernet/neterion/vxge/vxge-main.c
index 1ded50ca1600..e46e8698e630 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c
@@ -726,9 +726,6 @@ static int vxge_learn_mac(struct vxgedev *vdev, u8 *mac_header)
        int vpath_idx = 0;
        enum vxge_hw_status status = VXGE_HW_OK;
        struct vxge_vpath *vpath = NULL;
-        struct __vxge_hw_device *hldev;
-        hldev = pci_get_drvdata(vdev->pdev);
        mac_address = (u8 *)&mac_addr;
        memcpy(mac_address, mac_header, ETH_ALEN);
@@ -2443,9 +2440,6 @@ static void vxge_rem_msix_isr(struct vxgedev *vdev)
 static void vxge_rem_isr(struct vxgedev *vdev)
 {
-        struct __vxge_hw_device *hldev;
-        hldev = pci_get_drvdata(vdev->pdev);
 #ifdef CONFIG_PCI_MSI
        if (vdev->config.intr_type == MSI_X) {
                vxge_rem_msix_isr(vdev);
diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index c49d1fb16965..75d11fa4eb0a 100644
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -429,7 +429,9 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
        }
        /* Transfer ownership of the skb to the final buffer */
+#ifdef EFX_USE_PIO
 finish_packet:
+#endif
        buffer->skb = skb;
        buffer->flags = EFX_TX_BUF_SKB | dma_flags;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index bde63e3af96f..1d860ce914ed 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1878,8 +1878,18 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                mdio_node = of_find_node_by_phandle(be32_to_cpup(parp));
                phyid = be32_to_cpup(parp+1);
                mdio = of_find_device_by_node(mdio_node);
-                snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
-                         PHY_ID_FMT, mdio->name, phyid);
+                if (strncmp(mdio->name, "gpio", 4) == 0) {
+                        /* GPIO bitbang MDIO driver attached */
+                        struct mii_bus *bus = dev_get_drvdata(&mdio->dev);
+                        snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
+                                 PHY_ID_FMT, bus->id, phyid);
+                } else {
+                        /* davinci MDIO driver attached */
+                        snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
+                                 PHY_ID_FMT, mdio->name, phyid);
+                }
                mac_addr = of_get_mac_address(slave_node);
                if (mac_addr)
diff --git a/drivers/net/irda/Kconfig b/drivers/net/irda/Kconfig
index 2dc82f1d2e70..3da44d5d9149 100644
--- a/drivers/net/irda/Kconfig
+++ b/drivers/net/irda/Kconfig
@@ -210,13 +210,6 @@ config KINGSUN_DONGLE
          To compile it as a module, choose M here: the module will be called
          kingsun-sir.
-config EP7211_DONGLE
-        tristate "Cirrus Logic clps711x I/R support"
-        depends on IRTTY_SIR && ARCH_CLPS711X && IRDA
-        help
-          Say Y here if you want to build support for the Cirrus logic
-          EP7211 chipset's infrared module.
 config KSDAZZLE_DONGLE
        tristate "KingSun Dazzle IrDA-USB dongle"
        depends on IRDA && USB
diff --git a/drivers/net/irda/Makefile b/drivers/net/irda/Makefile
index dfc64537f62f..be8ab5b9a4a2 100644
--- a/drivers/net/irda/Makefile
+++ b/drivers/net/irda/Makefile
@@ -35,7 +35,6 @@ obj-$(CONFIG_MCP2120_DONGLE)	+= mcp2120-sir.o
 obj-$(CONFIG_ACT200L_DONGLE)    += act200l-sir.o
 obj-$(CONFIG_MA600_DONGLE)      += ma600-sir.o
 obj-$(CONFIG_TOIM3232_DONGLE)   += toim3232-sir.o
-obj-$(CONFIG_EP7211_DONGLE)     += ep7211-sir.o
 obj-$(CONFIG_KINGSUN_DONGLE)    += kingsun-sir.o
 obj-$(CONFIG_KSDAZZLE_DONGLE)   += ksdazzle-sir.o
 obj-$(CONFIG_KS959_DONGLE)      += ks959-sir.o
diff --git a/drivers/net/irda/ep7211-sir.c b/drivers/net/irda/ep7211-sir.c
deleted file mode 100644
index 5fe1f4dd3369..000000000000
--- a/drivers/net/irda/ep7211-sir.c
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * IR port driver for the Cirrus Logic CLPS711X processors
- *
- * Copyright 2001, Blue Mug Inc.  All rights reserved.
- * Copyright 2007, Samuel Ortiz <samuel@sortiz.org>
- */
-#include <linux/module.h>
-#include <linux/platform_device.h>
-#include <mach/hardware.h>
-#include "sir-dev.h"
-static int clps711x_dongle_open(struct sir_dev *dev)
-{
-        unsigned int syscon;
-        /* Turn on the SIR encoder. */
-        syscon = clps_readl(SYSCON1);
-        syscon |= SYSCON1_SIREN;
-        clps_writel(syscon, SYSCON1);
-        return 0;
-}
-static int clps711x_dongle_close(struct sir_dev *dev)
-{
-        unsigned int syscon;
-        /* Turn off the SIR encoder. */
-        syscon = clps_readl(SYSCON1);
-        syscon &= ~SYSCON1_SIREN;
-        clps_writel(syscon, SYSCON1);
-        return 0;
-}
-static struct dongle_driver clps711x_dongle = {
-        .owner          = THIS_MODULE,
-        .driver_name    = "EP7211 IR driver",
-        .type           = IRDA_EP7211_DONGLE,
-        .open           = clps711x_dongle_open,
-        .close          = clps711x_dongle_close,
-};
-static int clps711x_sir_probe(struct platform_device *pdev)
-{
-        return irda_register_dongle(&clps711x_dongle);
-}
-static int clps711x_sir_remove(struct platform_device *pdev)
-{
-        return irda_unregister_dongle(&clps711x_dongle);
-}
-static struct platform_driver clps711x_sir_driver = {
-        .driver = {
-                .name   = "sir-clps711x",
-                .owner  = THIS_MODULE,
-        },
-        .probe  = clps711x_sir_probe,
-        .remove = clps711x_sir_remove,
-};
-module_platform_driver(clps711x_sir_driver);
-MODULE_AUTHOR("Samuel Ortiz <samuel@sortiz.org>");
-MODULE_DESCRIPTION("EP7211 IR dongle driver");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("irda-dongle-13"); /* IRDA_EP7211_DONGLE */
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 547725fa8671..9414fa272160 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -437,7 +437,10 @@ static int ptp_dp83640_enable(struct ptp_clock_info *ptp,
                if (on) {
                        gpio_num = gpio_tab[EXTTS0_GPIO + index];
                        evnt |= (gpio_num & EVNT_GPIO_MASK) << EVNT_GPIO_SHIFT;
-                        evnt |= EVNT_RISE;
+                        if (rq->extts.flags & PTP_FALLING_EDGE)
+                                evnt |= EVNT_FALL;
+                        else
+                                evnt |= EVNT_RISE;
                }
                ext_write(0, phydev, PAGE5, PTP_EVNT, evnt);
                return 0;
@@ -1058,6 +1061,13 @@ static void dp83640_remove(struct phy_device *phydev)
        kfree(dp83640);
 }
+static int dp83640_config_init(struct phy_device *phydev)
+{
+        enable_status_frames(phydev, true);
+        ext_write(0, phydev, PAGE4, PTP_CTL, PTP_ENABLE);
+        return 0;
+}
 static int dp83640_ack_interrupt(struct phy_device *phydev)
 {
        int err = phy_read(phydev, MII_DP83640_MISR);
@@ -1195,11 +1205,6 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
        mutex_lock(&dp83640->clock->extreg_lock);
-        if (dp83640->hwts_tx_en || dp83640->hwts_rx_en) {
-                enable_status_frames(phydev, true);
-                ext_write(0, phydev, PAGE4, PTP_CTL, PTP_ENABLE);
-        }
        ext_write(0, phydev, PAGE5, PTP_TXCFG0, txcfg0);
        ext_write(0, phydev, PAGE5, PTP_RXCFG0, rxcfg0);
@@ -1281,6 +1286,7 @@ static void dp83640_txtstamp(struct phy_device *phydev,
                }
                /* fall through */
        case HWTSTAMP_TX_ON:
+                skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
                skb_queue_tail(&dp83640->tx_queue, skb);
                schedule_work(&dp83640->ts_work);
                break;
@@ -1330,6 +1336,7 @@ static struct phy_driver dp83640_driver = {
        .flags          = PHY_HAS_INTERRUPT,
        .probe          = dp83640_probe,
        .remove         = dp83640_remove,
+        .config_init    = dp83640_config_init,
        .config_aneg    = genphy_config_aneg,
        .read_status    = genphy_read_status,
        .ack_interrupt  = dp83640_ack_interrupt,
diff --git a/drivers/net/phy/mdio-sun4i.c b/drivers/net/phy/mdio-sun4i.c
index bb88bc7d81fb..9367acc84fbb 100644
--- a/drivers/net/phy/mdio-sun4i.c
+++ b/drivers/net/phy/mdio-sun4i.c
@@ -170,6 +170,9 @@ static int sun4i_mdio_remove(struct platform_device *pdev)
 }
 static const struct of_device_id sun4i_mdio_dt_ids[] = {
+        { .compatible = "allwinner,sun4i-a10-mdio" },
+        /* Deprecated */
        { .compatible = "allwinner,sun4i-mdio" },
        { }
 };
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 4b03e63639b7..82514e72b3d8 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -719,7 +719,7 @@ int phy_resume(struct phy_device *phydev)
 static int genphy_config_advert(struct phy_device *phydev)
 {
        u32 advertise;
-        int oldadv, adv;
+        int oldadv, adv, bmsr;
        int err, changed = 0;
        /* Only allow advertising what this PHY supports */
@@ -744,26 +744,36 @@ static int genphy_config_advert(struct phy_device *phydev)
                changed = 1;
        }
+        bmsr = phy_read(phydev, MII_BMSR);
+        if (bmsr < 0)
+                return bmsr;
+        /* Per 802.3-2008, Section 22.2.4.2.16 Extended status all
+         * 1000Mbits/sec capable PHYs shall have the BMSR_ESTATEN bit set to a
+         * logical 1.
+         */
+        if (!(bmsr & BMSR_ESTATEN))
+                return changed;
        /* Configure gigabit if it's supported */
+        adv = phy_read(phydev, MII_CTRL1000);
+        if (adv < 0)
+                return adv;
+        oldadv = adv;
+        adv &= ~(ADVERTISE_1000FULL | ADVERTISE_1000HALF);
        if (phydev->supported & (SUPPORTED_1000baseT_Half |
                                 SUPPORTED_1000baseT_Full)) {
-                adv = phy_read(phydev, MII_CTRL1000);
-                if (adv < 0)
-                        return adv;
-                oldadv = adv;
-                adv &= ~(ADVERTISE_1000FULL | ADVERTISE_1000HALF);
                adv |= ethtool_adv_to_mii_ctrl1000_t(advertise);
+                if (adv != oldadv)
-                if (adv != oldadv) {
-                        err = phy_write(phydev, MII_CTRL1000, adv);
-                        if (err < 0)
-                                return err;
                        changed = 1;
-                }
        }
+        err = phy_write(phydev, MII_CTRL1000, adv);
+        if (err < 0)
+                return err;
        return changed;
 }
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 6b638a066c1d..409499fdb157 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -292,6 +292,22 @@ config USB_NET_SR9700
          This option adds support for CoreChip-sz SR9700 based USB 1.1
          10/100 Ethernet adapters.
+config USB_NET_SR9800
+        tristate "CoreChip-sz SR9800 based USB 2.0 10/100 ethernet devices"
+        depends on USB_USBNET
+        select CRC32
+        default y
+        ---help---
+          Say Y if you want to use one of the following 100Mbps USB Ethernet
+          device based on the CoreChip-sz SR9800 chip.
+          This driver makes the adapter appear as a normal Ethernet interface,
+          typically on eth0, if it is the only ethernet device, or perhaps on
+          eth1, if you have a PCI or ISA ethernet card installed.
+          To compile this driver as a module, choose M here: the
+          module will be called sr9800.
 config USB_NET_SMSC75XX
        tristate "SMSC LAN75XX based USB 2.0 gigabit ethernet devices"
        depends on USB_USBNET
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index b17b5e88bbaf..433f0a00c683 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -15,6 +15,7 @@ obj-$(CONFIG_USB_NET_CDCETHER)	+= cdc_ether.o r815x.o
 obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
 obj-$(CONFIG_USB_NET_SR9700)    += sr9700.o
+obj-$(CONFIG_USB_NET_SR9800)    += sr9800.o
 obj-$(CONFIG_USB_NET_SMSC75XX)  += smsc75xx.o
 obj-$(CONFIG_USB_NET_SMSC95XX)  += smsc95xx.o
 obj-$(CONFIG_USB_NET_GL620A)    += gl620a.o
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 1a482344b3f5..660bd5ea9fc0 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1201,16 +1201,18 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
        struct hso_serial *serial = urb->context;
        int status = urb->status;
+        D4("\n--- Got serial_read_bulk callback %02x ---", status);
        /* sanity check */
        if (!serial) {
                D1("serial == NULL");
                return;
-        } else if (status) {
+        }
+        if (status) {
                handle_usb_error(status, __func__, serial->parent);
                return;
        }
-        D4("\n--- Got serial_read_bulk callback %02x ---", status);
        D1("Actual length = %d\n", urb->actual_length);
        DUMP1(urb->transfer_buffer, urb->actual_length);
@@ -1218,25 +1220,13 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
        if (serial->port.count == 0)
                return;
-        if (status == 0) {
+        if (serial->parent->port_spec & HSO_INFO_CRC_BUG)
-                if (serial->parent->port_spec & HSO_INFO_CRC_BUG)
+                fix_crc_bug(urb, serial->in_endp->wMaxPacketSize);
-                        fix_crc_bug(urb, serial->in_endp->wMaxPacketSize);
+        /* Valid data, handle RX data */
-                /* Valid data, handle RX data */
+        spin_lock(&serial->serial_lock);
-                spin_lock(&serial->serial_lock);
+        serial->rx_urb_filled[hso_urb_to_index(serial, urb)] = 1;
-                serial->rx_urb_filled[hso_urb_to_index(serial, urb)] = 1;
+        put_rxbuf_data_and_resubmit_bulk_urb(serial);
-                put_rxbuf_data_and_resubmit_bulk_urb(serial);
+        spin_unlock(&serial->serial_lock);
-                spin_unlock(&serial->serial_lock);
-        } else if (status == -ENOENT || status == -ECONNRESET) {
-                /* Unlinked - check for throttled port. */
-                D2("Port %d, successfully unlinked urb", serial->minor);
-                spin_lock(&serial->serial_lock);
-                serial->rx_urb_filled[hso_urb_to_index(serial, urb)] = 0;
-                hso_resubmit_rx_bulk_urb(serial, urb);
-                spin_unlock(&serial->serial_lock);
-        } else {
-                D2("Port %d, status = %d for read urb", serial->minor, status);
-                return;
-        }
 }
 /*
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 23bdd5b9274d..ff5c87128ffe 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -712,6 +712,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x19d2, 0x1255, 3)},
        {QMI_FIXED_INTF(0x19d2, 0x1255, 4)},
        {QMI_FIXED_INTF(0x19d2, 0x1256, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1270, 5)},    /* ZTE MF667 */
        {QMI_FIXED_INTF(0x19d2, 0x1401, 2)},
        {QMI_FIXED_INTF(0x19d2, 0x1402, 2)},    /* ZTE MF60 */
        {QMI_FIXED_INTF(0x19d2, 0x1424, 2)},
@@ -723,6 +724,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x1199, 0x68a2, 8)},    /* Sierra Wireless MC7710 in QMI mode */
        {QMI_FIXED_INTF(0x1199, 0x68a2, 19)},   /* Sierra Wireless MC7710 in QMI mode */
        {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
+        {QMI_FIXED_INTF(0x1199, 0x9051, 8)},    /* Netgear AirCard 340U */
        {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
        {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index e8fac732c6f1..d89dbe395ad2 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -2273,22 +2273,21 @@ static int rtl8152_open(struct net_device *netdev)
        struct r8152 *tp = netdev_priv(netdev);
        int res = 0;
+        rtl8152_set_speed(tp, AUTONEG_ENABLE,
+                          tp->mii.supports_gmii ? SPEED_1000 : SPEED_100,
+                          DUPLEX_FULL);
+        tp->speed = 0;
+        netif_carrier_off(netdev);
+        netif_start_queue(netdev);
+        set_bit(WORK_ENABLE, &tp->flags);
        res = usb_submit_urb(tp->intr_urb, GFP_KERNEL);
        if (res) {
                if (res == -ENODEV)
                        netif_device_detach(tp->netdev);
                netif_warn(tp, ifup, netdev, "intr_urb submit failed: %d\n",
                           res);
-                return res;
        }
-        rtl8152_set_speed(tp, AUTONEG_ENABLE,
-                          tp->mii.supports_gmii ? SPEED_1000 : SPEED_100,
-                          DUPLEX_FULL);
-        tp->speed = 0;
-        netif_carrier_off(netdev);
-        netif_start_queue(netdev);
-        set_bit(WORK_ENABLE, &tp->flags);
        return res;
 }
@@ -2298,8 +2297,8 @@ static int rtl8152_close(struct net_device *netdev)
        struct r8152 *tp = netdev_priv(netdev);
        int res = 0;
-        usb_kill_urb(tp->intr_urb);
        clear_bit(WORK_ENABLE, &tp->flags);
+        usb_kill_urb(tp->intr_urb);
        cancel_delayed_work_sync(&tp->schedule);
        netif_stop_queue(netdev);
        tasklet_disable(&tp->tl);
diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
new file mode 100644
index 000000000000..4175eb9fdeca
--- /dev/null
+++ b/drivers/net/usb/sr9800.c
@@ -0,0 +1,870 @@
+/* CoreChip-sz SR9800 one chip USB 2.0 Ethernet Devices
+ *
+ * Author : Liu Junliang <liujunliang_ljl@163.com>
+ *
+ * Based on asix_common.c, asix_devices.c
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2.  This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.*
+ */
+#include <linux/module.h>
+#include <linux/kmod.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/workqueue.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/usbnet.h>
+#include <linux/slab.h>
+#include <linux/if_vlan.h>
+#include "sr9800.h"
+static int sr_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                            u16 size, void *data)
+{
+        int err;
+        err = usbnet_read_cmd(dev, cmd, SR_REQ_RD_REG, value, index,
+                              data, size);
+        if ((err != size) && (err >= 0))
+                err = -EINVAL;
+        return err;
+}
+static int sr_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                             u16 size, void *data)
+{
+        int err;
+        err = usbnet_write_cmd(dev, cmd, SR_REQ_WR_REG, value, index,
+                              data, size);
+        if ((err != size) && (err >= 0))
+                err = -EINVAL;
+        return err;
+}
+static void
+sr_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                   u16 size, void *data)
+{
+        usbnet_write_cmd_async(dev, cmd, SR_REQ_WR_REG, value, index, data,
+                               size);
+}
+static int sr_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        int offset = 0;
+        while (offset + sizeof(u32) < skb->len) {
+                struct sk_buff *sr_skb;
+                u16 size;
+                u32 header = get_unaligned_le32(skb->data + offset);
+                offset += sizeof(u32);
+                /* get the packet length */
+                size = (u16) (header & 0x7ff);
+                if (size != ((~header >> 16) & 0x07ff)) {
+                        netdev_err(dev->net, "%s : Bad Header Length\n",
+                                   __func__);
+                        return 0;
+                }
+                if ((size > dev->net->mtu + ETH_HLEN + VLAN_HLEN) ||
+                    (size + offset > skb->len)) {
+                        netdev_err(dev->net, "%s : Bad RX Length %d\n",
+                                   __func__, size);
+                        return 0;
+                }
+                sr_skb = netdev_alloc_skb_ip_align(dev->net, size);
+                if (!sr_skb)
+                        return 0;
+                skb_put(sr_skb, size);
+                memcpy(sr_skb->data, skb->data + offset, size);
+                usbnet_skb_return(dev, sr_skb);
+                offset += (size + 1) & 0xfffe;
+        }
+        if (skb->len != offset) {
+                netdev_err(dev->net, "%s : Bad SKB Length %d\n", __func__,
+                           skb->len);
+                return 0;
+        }
+        return 1;
+}
+static struct sk_buff *sr_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                                        gfp_t flags)
+{
+        int headroom = skb_headroom(skb);
+        int tailroom = skb_tailroom(skb);
+        u32 padbytes = 0xffff0000;
+        u32 packet_len;
+        int padlen;
+        padlen = ((skb->len + 4) % (dev->maxpacket - 1)) ? 0 : 4;
+        if ((!skb_cloned(skb)) && ((headroom + tailroom) >= (4 + padlen))) {
+                if ((headroom < 4) || (tailroom < padlen)) {
+                        skb->data = memmove(skb->head + 4, skb->data,
+                                            skb->len);
+                        skb_set_tail_pointer(skb, skb->len);
+                }
+        } else {
+                struct sk_buff *skb2;
+                skb2 = skb_copy_expand(skb, 4, padlen, flags);
+                dev_kfree_skb_any(skb);
+                skb = skb2;
+                if (!skb)
+                        return NULL;
+        }
+        skb_push(skb, 4);
+        packet_len = (((skb->len - 4) ^ 0x0000ffff) << 16) + (skb->len - 4);
+        cpu_to_le32s(&packet_len);
+        skb_copy_to_linear_data(skb, &packet_len, sizeof(packet_len));
+        if (padlen) {
+                cpu_to_le32s(&padbytes);
+                memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
+                skb_put(skb, sizeof(padbytes));
+        }
+        return skb;
+}
+static void sr_status(struct usbnet *dev, struct urb *urb)
+{
+        struct sr9800_int_data *event;
+        int link;
+        if (urb->actual_length < 8)
+                return;
+        event = urb->transfer_buffer;
+        link = event->link & 0x01;
+        if (netif_carrier_ok(dev->net) != link) {
+                usbnet_link_change(dev, link, 1);
+                netdev_dbg(dev->net, "Link Status is: %d\n", link);
+        }
+        return;
+}
+static inline int sr_set_sw_mii(struct usbnet *dev)
+{
+        int ret;
+        ret = sr_write_cmd(dev, SR_CMD_SET_SW_MII, 0x0000, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net, "Failed to enable software MII access\n");
+        return ret;
+}
+static inline int sr_set_hw_mii(struct usbnet *dev)
+{
+        int ret;
+        ret = sr_write_cmd(dev, SR_CMD_SET_HW_MII, 0x0000, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net, "Failed to enable hardware MII access\n");
+        return ret;
+}
+static inline int sr_get_phy_addr(struct usbnet *dev)
+{
+        u8 buf[2];
+        int ret;
+        ret = sr_read_cmd(dev, SR_CMD_READ_PHY_ID, 0, 0, 2, buf);
+        if (ret < 0) {
+                netdev_err(dev->net, "%s : Error reading PHYID register:%02x\n",
+                           __func__, ret);
+                goto out;
+        }
+        netdev_dbg(dev->net, "%s : returning 0x%04x\n", __func__,
+                   *((__le16 *)buf));
+        ret = buf[1];
+out:
+        return ret;
+}
+static int sr_sw_reset(struct usbnet *dev, u8 flags)
+{
+        int ret;
+        ret = sr_write_cmd(dev, SR_CMD_SW_RESET, flags, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net, "Failed to send software reset:%02x\n",
+                           ret);
+        return ret;
+}
+static u16 sr_read_rx_ctl(struct usbnet *dev)
+{
+        __le16 v;
+        int ret;
+        ret = sr_read_cmd(dev, SR_CMD_READ_RX_CTL, 0, 0, 2, &v);
+        if (ret < 0) {
+                netdev_err(dev->net, "Error reading RX_CTL register:%02x\n",
+                           ret);
+                goto out;
+        }
+        ret = le16_to_cpu(v);
+out:
+        return ret;
+}
+static int sr_write_rx_ctl(struct usbnet *dev, u16 mode)
+{
+        int ret;
+        netdev_dbg(dev->net, "%s : mode = 0x%04x\n", __func__, mode);
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_RX_CTL, mode, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net,
+                           "Failed to write RX_CTL mode to 0x%04x:%02x\n",
+                           mode, ret);
+        return ret;
+}
+static u16 sr_read_medium_status(struct usbnet *dev)
+{
+        __le16 v;
+        int ret;
+        ret = sr_read_cmd(dev, SR_CMD_READ_MEDIUM_STATUS, 0, 0, 2, &v);
+        if (ret < 0) {
+                netdev_err(dev->net,
+                           "Error reading Medium Status register:%02x\n", ret);
+                return ret;     /* TODO: callers not checking for error ret */
+        }
+        return le16_to_cpu(v);
+}
+static int sr_write_medium_mode(struct usbnet *dev, u16 mode)
+{
+        int ret;
+        netdev_dbg(dev->net, "%s : mode = 0x%04x\n", __func__, mode);
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_MEDIUM_MODE, mode, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net,
+                           "Failed to write Medium Mode mode to 0x%04x:%02x\n",
+                           mode, ret);
+        return ret;
+}
+static int sr_write_gpio(struct usbnet *dev, u16 value, int sleep)
+{
+        int ret;
+        netdev_dbg(dev->net, "%s : value = 0x%04x\n", __func__, value);
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_GPIOS, value, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net, "Failed to write GPIO value 0x%04x:%02x\n",
+                           value, ret);
+        if (sleep)
+                msleep(sleep);
+        return ret;
+}
+/* SR9800 have a 16-bit RX_CTL value */
+static void sr_set_multicast(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        u16 rx_ctl = SR_DEFAULT_RX_CTL;
+        if (net->flags & IFF_PROMISC) {
+                rx_ctl |= SR_RX_CTL_PRO;
+        } else if (net->flags & IFF_ALLMULTI ||
+                   netdev_mc_count(net) > SR_MAX_MCAST) {
+                rx_ctl |= SR_RX_CTL_AMALL;
+        } else if (netdev_mc_empty(net)) {
+                /* just broadcast and directed */
+        } else {
+                /* We use the 20 byte dev->data
+                 * for our 8 byte filter buffer
+                 * to avoid allocating memory that
+                 * is tricky to free later
+                 */
+                struct netdev_hw_addr *ha;
+                u32 crc_bits;
+                memset(data->multi_filter, 0, SR_MCAST_FILTER_SIZE);
+                /* Build the multicast hash filter. */
+                netdev_for_each_mc_addr(ha, net) {
+                        crc_bits = ether_crc(ETH_ALEN, ha->addr) >> 26;
+                        data->multi_filter[crc_bits >> 3] |=
+                            1 << (crc_bits & 7);
+                }
+                sr_write_cmd_async(dev, SR_CMD_WRITE_MULTI_FILTER, 0, 0,
+                                   SR_MCAST_FILTER_SIZE, data->multi_filter);
+                rx_ctl |= SR_RX_CTL_AM;
+        }
+        sr_write_cmd_async(dev, SR_CMD_WRITE_RX_CTL, rx_ctl, 0, 0, NULL);
+}
+static int sr_mdio_read(struct net_device *net, int phy_id, int loc)
+{
+        struct usbnet *dev = netdev_priv(net);
+        __le16 res;
+        mutex_lock(&dev->phy_mutex);
+        sr_set_sw_mii(dev);
+        sr_read_cmd(dev, SR_CMD_READ_MII_REG, phy_id, (__u16)loc, 2, &res);
+        sr_set_hw_mii(dev);
+        mutex_unlock(&dev->phy_mutex);
+        netdev_dbg(dev->net,
+                   "%s : phy_id=0x%02x, loc=0x%02x, returns=0x%04x\n", __func__,
+                   phy_id, loc, le16_to_cpu(res));
+        return le16_to_cpu(res);
+}
+static void
+sr_mdio_write(struct net_device *net, int phy_id, int loc, int val)
+{
+        struct usbnet *dev = netdev_priv(net);
+        __le16 res = cpu_to_le16(val);
+        netdev_dbg(dev->net,
+                   "%s : phy_id=0x%02x, loc=0x%02x, val=0x%04x\n", __func__,
+                   phy_id, loc, val);
+        mutex_lock(&dev->phy_mutex);
+        sr_set_sw_mii(dev);
+        sr_write_cmd(dev, SR_CMD_WRITE_MII_REG, phy_id, (__u16)loc, 2, &res);
+        sr_set_hw_mii(dev);
+        mutex_unlock(&dev->phy_mutex);
+}
+/* Get the PHY Identifier from the PHYSID1 & PHYSID2 MII registers */
+static u32 sr_get_phyid(struct usbnet *dev)
+{
+        int phy_reg;
+        u32 phy_id;
+        int i;
+        /* Poll for the rare case the FW or phy isn't ready yet.  */
+        for (i = 0; i < 100; i++) {
+                phy_reg = sr_mdio_read(dev->net, dev->mii.phy_id, MII_PHYSID1);
+                if (phy_reg != 0 && phy_reg != 0xFFFF)
+                        break;
+                mdelay(1);
+        }
+        if (phy_reg <= 0 || phy_reg == 0xFFFF)
+                return 0;
+        phy_id = (phy_reg & 0xffff) << 16;
+        phy_reg = sr_mdio_read(dev->net, dev->mii.phy_id, MII_PHYSID2);
+        if (phy_reg < 0)
+                return 0;
+        phy_id |= (phy_reg & 0xffff);
+        return phy_id;
+}
+static void
+sr_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u8 opt;
+        if (sr_read_cmd(dev, SR_CMD_READ_MONITOR_MODE, 0, 0, 1, &opt) < 0) {
+                wolinfo->supported = 0;
+                wolinfo->wolopts = 0;
+                return;
+        }
+        wolinfo->supported = WAKE_PHY | WAKE_MAGIC;
+        wolinfo->wolopts = 0;
+        if (opt & SR_MONITOR_LINK)
+                wolinfo->wolopts |= WAKE_PHY;
+        if (opt & SR_MONITOR_MAGIC)
+                wolinfo->wolopts |= WAKE_MAGIC;
+}
+static int
+sr_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u8 opt = 0;
+        if (wolinfo->wolopts & WAKE_PHY)
+                opt |= SR_MONITOR_LINK;
+        if (wolinfo->wolopts & WAKE_MAGIC)
+                opt |= SR_MONITOR_MAGIC;
+        if (sr_write_cmd(dev, SR_CMD_WRITE_MONITOR_MODE,
+                         opt, 0, 0, NULL) < 0)
+                return -EINVAL;
+        return 0;
+}
+static int sr_get_eeprom_len(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        return data->eeprom_len;
+}
+static int sr_get_eeprom(struct net_device *net,
+                              struct ethtool_eeprom *eeprom, u8 *data)
+{
+        struct usbnet *dev = netdev_priv(net);
+        __le16 *ebuf = (__le16 *)data;
+        int ret;
+        int i;
+        /* Crude hack to ensure that we don't overwrite memory
+         * if an odd length is supplied
+         */
+        if (eeprom->len % 2)
+                return -EINVAL;
+        eeprom->magic = SR_EEPROM_MAGIC;
+        /* sr9800 returns 2 bytes from eeprom on read */
+        for (i = 0; i < eeprom->len / 2; i++) {
+                ret = sr_read_cmd(dev, SR_CMD_READ_EEPROM, eeprom->offset + i,
+                                  0, 2, &ebuf[i]);
+                if (ret < 0)
+                        return -EINVAL;
+        }
+        return 0;
+}
+static void sr_get_drvinfo(struct net_device *net,
+                                 struct ethtool_drvinfo *info)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        /* Inherit standard device info */
+        usbnet_get_drvinfo(net, info);
+        strncpy(info->driver, DRIVER_NAME, sizeof(info->driver));
+        strncpy(info->version, DRIVER_VERSION, sizeof(info->version));
+        info->eedump_len = data->eeprom_len;
+}
+static u32 sr_get_link(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return mii_link_ok(&dev->mii);
+}
+static int sr_ioctl(struct net_device *net, struct ifreq *rq, int cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return generic_mii_ioctl(&dev->mii, if_mii(rq), cmd, NULL);
+}
+static int sr_set_mac_address(struct net_device *net, void *p)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        struct sockaddr *addr = p;
+        if (netif_running(net))
+                return -EBUSY;
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+        memcpy(net->dev_addr, addr->sa_data, ETH_ALEN);
+        /* We use the 20 byte dev->data
+         * for our 6 byte mac buffer
+         * to avoid allocating memory that
+         * is tricky to free later
+         */
+        memcpy(data->mac_addr, addr->sa_data, ETH_ALEN);
+        sr_write_cmd_async(dev, SR_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
+                           data->mac_addr);
+        return 0;
+}
+static const struct ethtool_ops sr9800_ethtool_ops = {
+        .get_drvinfo    = sr_get_drvinfo,
+        .get_link       = sr_get_link,
+        .get_msglevel   = usbnet_get_msglevel,
+        .set_msglevel   = usbnet_set_msglevel,
+        .get_wol        = sr_get_wol,
+        .set_wol        = sr_set_wol,
+        .get_eeprom_len = sr_get_eeprom_len,
+        .get_eeprom     = sr_get_eeprom,
+        .get_settings   = usbnet_get_settings,
+        .set_settings   = usbnet_set_settings,
+        .nway_reset     = usbnet_nway_reset,
+};
+static int sr9800_link_reset(struct usbnet *dev)
+{
+        struct ethtool_cmd ecmd = { .cmd = ETHTOOL_GSET };
+        u16 mode;
+        mii_check_media(&dev->mii, 1, 1);
+        mii_ethtool_gset(&dev->mii, &ecmd);
+        mode = SR9800_MEDIUM_DEFAULT;
+        if (ethtool_cmd_speed(&ecmd) != SPEED_100)
+                mode &= ~SR_MEDIUM_PS;
+        if (ecmd.duplex != DUPLEX_FULL)
+                mode &= ~SR_MEDIUM_FD;
+        netdev_dbg(dev->net, "%s : speed: %u duplex: %d mode: 0x%04x\n",
+                   __func__, ethtool_cmd_speed(&ecmd), ecmd.duplex, mode);
+        sr_write_medium_mode(dev, mode);
+        return 0;
+}
+static int sr9800_set_default_mode(struct usbnet *dev)
+{
+        u16 rx_ctl;
+        int ret;
+        sr_mdio_write(dev->net, dev->mii.phy_id, MII_BMCR, BMCR_RESET);
+        sr_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
+                      ADVERTISE_ALL | ADVERTISE_CSMA);
+        mii_nway_restart(&dev->mii);
+        ret = sr_write_medium_mode(dev, SR9800_MEDIUM_DEFAULT);
+        if (ret < 0)
+                goto out;
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_IPG012,
+                                SR9800_IPG0_DEFAULT | SR9800_IPG1_DEFAULT,
+                                SR9800_IPG2_DEFAULT, 0, NULL);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Write IPG,IPG1,IPG2 failed: %d\n", ret);
+                goto out;
+        }
+        /* Set RX_CTL to default values with 2k buffer, and enable cactus */
+        ret = sr_write_rx_ctl(dev, SR_DEFAULT_RX_CTL);
+        if (ret < 0)
+                goto out;
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x after all initializations\n",
+                   rx_ctl);
+        rx_ctl = sr_read_medium_status(dev);
+        netdev_dbg(dev->net, "Medium Status:0x%04x after all initializations\n",
+                   rx_ctl);
+        return 0;
+out:
+        return ret;
+}
+static int sr9800_reset(struct usbnet *dev)
+{
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        int ret, embd_phy;
+        u16 rx_ctl;
+        ret = sr_write_gpio(dev,
+                        SR_GPIO_RSE | SR_GPIO_GPO_2 | SR_GPIO_GPO2EN, 5);
+        if (ret < 0)
+                goto out;
+        embd_phy = ((sr_get_phy_addr(dev) & 0x1f) == 0x10 ? 1 : 0);
+        ret = sr_write_cmd(dev, SR_CMD_SW_PHY_SELECT, embd_phy, 0, 0, NULL);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Select PHY #1 failed: %d\n", ret);
+                goto out;
+        }
+        ret = sr_sw_reset(dev, SR_SWRESET_IPPD | SR_SWRESET_PRL);
+        if (ret < 0)
+                goto out;
+        msleep(150);
+        ret = sr_sw_reset(dev, SR_SWRESET_CLEAR);
+        if (ret < 0)
+                goto out;
+        msleep(150);
+        if (embd_phy) {
+                ret = sr_sw_reset(dev, SR_SWRESET_IPRL);
+                if (ret < 0)
+                        goto out;
+        } else {
+                ret = sr_sw_reset(dev, SR_SWRESET_PRTE);
+                if (ret < 0)
+                        goto out;
+        }
+        msleep(150);
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x after software reset\n", rx_ctl);
+        ret = sr_write_rx_ctl(dev, 0x0000);
+        if (ret < 0)
+                goto out;
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x setting to 0x0000\n", rx_ctl);
+        ret = sr_sw_reset(dev, SR_SWRESET_PRL);
+        if (ret < 0)
+                goto out;
+        msleep(150);
+        ret = sr_sw_reset(dev, SR_SWRESET_IPRL | SR_SWRESET_PRL);
+        if (ret < 0)
+                goto out;
+        msleep(150);
+        ret = sr9800_set_default_mode(dev);
+        if (ret < 0)
+                goto out;
+        /* Rewrite MAC address */
+        memcpy(data->mac_addr, dev->net->dev_addr, ETH_ALEN);
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
+                                                        data->mac_addr);
+        if (ret < 0)
+                goto out;
+        return 0;
+out:
+        return ret;
+}
+static const struct net_device_ops sr9800_netdev_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = usbnet_change_mtu,
+        .ndo_set_mac_address    = sr_set_mac_address,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_do_ioctl           = sr_ioctl,
+        .ndo_set_rx_mode        = sr_set_multicast,
+};
+static int sr9800_phy_powerup(struct usbnet *dev)
+{
+        int ret;
+        /* set the embedded Ethernet PHY in power-down state */
+        ret = sr_sw_reset(dev, SR_SWRESET_IPPD | SR_SWRESET_IPRL);
+        if (ret < 0) {
+                netdev_err(dev->net, "Failed to power down PHY : %d\n", ret);
+                return ret;
+        }
+        msleep(20);
+        /* set the embedded Ethernet PHY in power-up state */
+        ret = sr_sw_reset(dev, SR_SWRESET_IPRL);
+        if (ret < 0) {
+                netdev_err(dev->net, "Failed to reset PHY: %d\n", ret);
+                return ret;
+        }
+        msleep(600);
+        /* set the embedded Ethernet PHY in reset state */
+        ret = sr_sw_reset(dev, SR_SWRESET_CLEAR);
+        if (ret < 0) {
+                netdev_err(dev->net, "Failed to power up PHY: %d\n", ret);
+                return ret;
+        }
+        msleep(20);
+        /* set the embedded Ethernet PHY in power-up state */
+        ret = sr_sw_reset(dev, SR_SWRESET_IPRL);
+        if (ret < 0) {
+                netdev_err(dev->net, "Failed to reset PHY: %d\n", ret);
+                return ret;
+        }
+        return 0;
+}
+static int sr9800_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        u16 led01_mux, led23_mux;
+        int ret, embd_phy;
+        u32 phyid;
+        u16 rx_ctl;
+        data->eeprom_len = SR9800_EEPROM_LEN;
+        usbnet_get_endpoints(dev, intf);
+        /* LED Setting Rule :
+         * AABB:CCDD
+         * AA : MFA0(LED0)
+         * BB : MFA1(LED1)
+         * CC : MFA2(LED2), Reserved for SR9800
+         * DD : MFA3(LED3), Reserved for SR9800
+         */
+        led01_mux = (SR_LED_MUX_LINK_ACTIVE << 8) | SR_LED_MUX_LINK;
+        led23_mux = (SR_LED_MUX_LINK_ACTIVE << 8) | SR_LED_MUX_TX_ACTIVE;
+        ret = sr_write_cmd(dev, SR_CMD_LED_MUX, led01_mux, led23_mux, 0, NULL);
+        if (ret < 0) {
+                        netdev_err(dev->net, "set LINK LED failed : %d\n", ret);
+                        goto out;
+        }
+        /* Get the MAC address */
+        ret = sr_read_cmd(dev, SR_CMD_READ_NODE_ID, 0, 0, ETH_ALEN,
+                          dev->net->dev_addr);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Failed to read MAC address: %d\n", ret);
+                return ret;
+        }
+        netdev_dbg(dev->net, "mac addr : %pM\n", dev->net->dev_addr);
+        /* Initialize MII structure */
+        dev->mii.dev = dev->net;
+        dev->mii.mdio_read = sr_mdio_read;
+        dev->mii.mdio_write = sr_mdio_write;
+        dev->mii.phy_id_mask = 0x1f;
+        dev->mii.reg_num_mask = 0x1f;
+        dev->mii.phy_id = sr_get_phy_addr(dev);
+        dev->net->netdev_ops = &sr9800_netdev_ops;
+        dev->net->ethtool_ops = &sr9800_ethtool_ops;
+        embd_phy = ((dev->mii.phy_id & 0x1f) == 0x10 ? 1 : 0);
+        /* Reset the PHY to normal operation mode */
+        ret = sr_write_cmd(dev, SR_CMD_SW_PHY_SELECT, embd_phy, 0, 0, NULL);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Select PHY #1 failed: %d\n", ret);
+                return ret;
+        }
+        /* Init PHY routine */
+        ret = sr9800_phy_powerup(dev);
+        if (ret < 0)
+                goto out;
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x after software reset\n", rx_ctl);
+        ret = sr_write_rx_ctl(dev, 0x0000);
+        if (ret < 0)
+                goto out;
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x setting to 0x0000\n", rx_ctl);
+        /* Read PHYID register *AFTER* the PHY was reset properly */
+        phyid = sr_get_phyid(dev);
+        netdev_dbg(dev->net, "PHYID=0x%08x\n", phyid);
+        /* medium mode setting */
+        ret = sr9800_set_default_mode(dev);
+        if (ret < 0)
+                goto out;
+        if (dev->udev->speed == USB_SPEED_HIGH) {
+                ret = sr_write_cmd(dev, SR_CMD_BULKIN_SIZE,
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_4K].byte_cnt,
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_4K].threshold,
+                        0, NULL);
+                if (ret < 0) {
+                        netdev_err(dev->net, "Reset RX_CTL failed: %d\n", ret);
+                        goto out;
+                }
+                dev->rx_urb_size =
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_4K].size;
+        } else {
+                ret = sr_write_cmd(dev, SR_CMD_BULKIN_SIZE,
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_2K].byte_cnt,
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_2K].threshold,
+                        0, NULL);
+                if (ret < 0) {
+                        netdev_err(dev->net, "Reset RX_CTL failed: %d\n", ret);
+                        goto out;
+                }
+                dev->rx_urb_size =
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_2K].size;
+        }
+        netdev_dbg(dev->net, "%s : setting rx_urb_size with : %ld\n", __func__,
+                   dev->rx_urb_size);
+        return 0;
+out:
+        return ret;
+}
+static const struct driver_info sr9800_driver_info = {
+        .description    = "CoreChip SR9800 USB 2.0 Ethernet",
+        .bind           = sr9800_bind,
+        .status         = sr_status,
+        .link_reset     = sr9800_link_reset,
+        .reset          = sr9800_reset,
+        .flags          = DRIVER_FLAG,
+        .rx_fixup       = sr_rx_fixup,
+        .tx_fixup       = sr_tx_fixup,
+};
+static const struct usb_device_id       products[] = {
+        {
+                USB_DEVICE(0x0fe6, 0x9800),     /* SR9800 Device  */
+                .driver_info = (unsigned long) &sr9800_driver_info,
+        },
+        {},             /* END */
+};
+MODULE_DEVICE_TABLE(usb, products);
+static struct usb_driver sr_driver = {
+        .name           = DRIVER_NAME,
+        .id_table       = products,
+        .probe          = usbnet_probe,
+        .suspend        = usbnet_suspend,
+        .resume         = usbnet_resume,
+        .disconnect     = usbnet_disconnect,
+        .supports_autosuspend = 1,
+};
+module_usb_driver(sr_driver);
+MODULE_AUTHOR("Liu Junliang <liujunliang_ljl@163.com");
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_DESCRIPTION("SR9800 USB 2.0 USB2NET Dev : http://www.corechip-sz.com");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/sr9800.h b/drivers/net/usb/sr9800.h
new file mode 100644
index 000000000000..18f670251275
--- /dev/null
+++ b/drivers/net/usb/sr9800.h
@@ -0,0 +1,202 @@
+/* CoreChip-sz SR9800 one chip USB 2.0 Ethernet Devices
+ *
+ * Author : Liu Junliang <liujunliang_ljl@163.com>
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2.  This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+#ifndef _SR9800_H
+#define _SR9800_H
+/* SR9800 spec. command table on Linux Platform */
+/* command : Software Station Management Control Reg */
+#define SR_CMD_SET_SW_MII               0x06
+/* command : PHY Read Reg */
+#define SR_CMD_READ_MII_REG             0x07
+/* command : PHY Write Reg */
+#define SR_CMD_WRITE_MII_REG            0x08
+/* command : Hardware Station Management Control Reg */
+#define SR_CMD_SET_HW_MII               0x0a
+/* command : SROM Read Reg */
+#define SR_CMD_READ_EEPROM              0x0b
+/* command : SROM Write Reg */
+#define SR_CMD_WRITE_EEPROM             0x0c
+/* command : SROM Write Enable Reg */
+#define SR_CMD_WRITE_ENABLE             0x0d
+/* command : SROM Write Disable Reg */
+#define SR_CMD_WRITE_DISABLE            0x0e
+/* command : RX Control Read Reg */
+#define SR_CMD_READ_RX_CTL              0x0f
+#define         SR_RX_CTL_PRO                   (1 << 0)
+#define         SR_RX_CTL_AMALL                 (1 << 1)
+#define         SR_RX_CTL_SEP                   (1 << 2)
+#define         SR_RX_CTL_AB                    (1 << 3)
+#define         SR_RX_CTL_AM                    (1 << 4)
+#define         SR_RX_CTL_AP                    (1 << 5)
+#define         SR_RX_CTL_ARP                   (1 << 6)
+#define         SR_RX_CTL_SO                    (1 << 7)
+#define         SR_RX_CTL_RH1M                  (1 << 8)
+#define         SR_RX_CTL_RH2M                  (1 << 9)
+#define         SR_RX_CTL_RH3M                  (1 << 10)
+/* command : RX Control Write Reg */
+#define SR_CMD_WRITE_RX_CTL             0x10
+/* command : IPG0/IPG1/IPG2 Control Read Reg */
+#define SR_CMD_READ_IPG012              0x11
+/* command : IPG0/IPG1/IPG2 Control Write Reg */
+#define SR_CMD_WRITE_IPG012             0x12
+/* command : Node ID Read Reg */
+#define SR_CMD_READ_NODE_ID             0x13
+/* command : Node ID Write Reg */
+#define SR_CMD_WRITE_NODE_ID            0x14
+/* command : Multicast Filter Array Read Reg */
+#define SR_CMD_READ_MULTI_FILTER        0x15
+/* command : Multicast Filter Array Write Reg */
+#define SR_CMD_WRITE_MULTI_FILTER       0x16
+/* command : Eth/HomePNA PHY Address Reg */
+#define SR_CMD_READ_PHY_ID              0x19
+/* command : Medium Status Read Reg */
+#define SR_CMD_READ_MEDIUM_STATUS       0x1a
+#define         SR_MONITOR_LINK                 (1 << 1)
+#define         SR_MONITOR_MAGIC                (1 << 2)
+#define         SR_MONITOR_HSFS                 (1 << 4)
+/* command : Medium Status Write Reg */
+#define SR_CMD_WRITE_MEDIUM_MODE        0x1b
+#define         SR_MEDIUM_GM                    (1 << 0)
+#define         SR_MEDIUM_FD                    (1 << 1)
+#define         SR_MEDIUM_AC                    (1 << 2)
+#define         SR_MEDIUM_ENCK                  (1 << 3)
+#define         SR_MEDIUM_RFC                   (1 << 4)
+#define         SR_MEDIUM_TFC                   (1 << 5)
+#define         SR_MEDIUM_JFE                   (1 << 6)
+#define         SR_MEDIUM_PF                    (1 << 7)
+#define         SR_MEDIUM_RE                    (1 << 8)
+#define         SR_MEDIUM_PS                    (1 << 9)
+#define         SR_MEDIUM_RSV                   (1 << 10)
+#define         SR_MEDIUM_SBP                   (1 << 11)
+#define         SR_MEDIUM_SM                    (1 << 12)
+/* command : Monitor Mode Status Read Reg */
+#define SR_CMD_READ_MONITOR_MODE        0x1c
+/* command : Monitor Mode Status Write Reg */
+#define SR_CMD_WRITE_MONITOR_MODE       0x1d
+/* command : GPIO Status Read Reg */
+#define SR_CMD_READ_GPIOS               0x1e
+#define         SR_GPIO_GPO0EN          (1 << 0) /* GPIO0 Output enable */
+#define         SR_GPIO_GPO_0           (1 << 1) /* GPIO0 Output value */
+#define         SR_GPIO_GPO1EN          (1 << 2) /* GPIO1 Output enable */
+#define         SR_GPIO_GPO_1           (1 << 3) /* GPIO1 Output value */
+#define         SR_GPIO_GPO2EN          (1 << 4) /* GPIO2 Output enable */
+#define         SR_GPIO_GPO_2           (1 << 5) /* GPIO2 Output value */
+#define         SR_GPIO_RESERVED        (1 << 6) /* Reserved */
+#define         SR_GPIO_RSE             (1 << 7) /* Reload serial EEPROM */
+/* command : GPIO Status Write Reg */
+#define SR_CMD_WRITE_GPIOS              0x1f
+/* command : Eth PHY Power and Reset Control Reg */
+#define SR_CMD_SW_RESET                 0x20
+#define         SR_SWRESET_CLEAR                0x00
+#define         SR_SWRESET_RR                   (1 << 0)
+#define         SR_SWRESET_RT                   (1 << 1)
+#define         SR_SWRESET_PRTE                 (1 << 2)
+#define         SR_SWRESET_PRL                  (1 << 3)
+#define         SR_SWRESET_BZ                   (1 << 4)
+#define         SR_SWRESET_IPRL                 (1 << 5)
+#define         SR_SWRESET_IPPD                 (1 << 6)
+/* command : Software Interface Selection Status Read Reg */
+#define SR_CMD_SW_PHY_STATUS            0x21
+/* command : Software Interface Selection Status Write Reg */
+#define SR_CMD_SW_PHY_SELECT            0x22
+/* command : BULK in Buffer Size Reg */
+#define SR_CMD_BULKIN_SIZE              0x2A
+/* command : LED_MUX Control Reg */
+#define SR_CMD_LED_MUX                  0x70
+#define         SR_LED_MUX_TX_ACTIVE            (1 << 0)
+#define         SR_LED_MUX_RX_ACTIVE            (1 << 1)
+#define         SR_LED_MUX_COLLISION            (1 << 2)
+#define         SR_LED_MUX_DUP_COL              (1 << 3)
+#define         SR_LED_MUX_DUP                  (1 << 4)
+#define         SR_LED_MUX_SPEED                (1 << 5)
+#define         SR_LED_MUX_LINK_ACTIVE          (1 << 6)
+#define         SR_LED_MUX_LINK                 (1 << 7)
+/* Register Access Flags */
+#define SR_REQ_RD_REG   (USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE)
+#define SR_REQ_WR_REG   (USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE)
+/* Multicast Filter Array size & Max Number */
+#define SR_MCAST_FILTER_SIZE            8
+#define SR_MAX_MCAST                    64
+/* IPG0/1/2 Default Value */
+#define SR9800_IPG0_DEFAULT             0x15
+#define SR9800_IPG1_DEFAULT             0x0c
+#define SR9800_IPG2_DEFAULT             0x12
+/* Medium Status Default Mode */
+#define SR9800_MEDIUM_DEFAULT   \
+        (SR_MEDIUM_FD | SR_MEDIUM_RFC | \
+         SR_MEDIUM_TFC | SR_MEDIUM_PS | \
+         SR_MEDIUM_AC | SR_MEDIUM_RE)
+/* RX Control Default Setting */
+#define SR_DEFAULT_RX_CTL       \
+        (SR_RX_CTL_SO | SR_RX_CTL_AB | SR_RX_CTL_RH1M)
+/* EEPROM Magic Number & EEPROM Size */
+#define SR_EEPROM_MAGIC                 0xdeadbeef
+#define SR9800_EEPROM_LEN               0xff
+/* SR9800 Driver Version and Driver Name */
+#define DRIVER_VERSION                  "11-Nov-2013"
+#define DRIVER_NAME                     "CoreChips"
+#define DRIVER_FLAG             \
+        (FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |  FLAG_MULTI_PACKET)
+/* SR9800 BULKIN Buffer Size */
+#define SR9800_MAX_BULKIN_2K            0
+#define SR9800_MAX_BULKIN_4K            1
+#define SR9800_MAX_BULKIN_6K            2
+#define SR9800_MAX_BULKIN_8K            3
+#define SR9800_MAX_BULKIN_16K           4
+#define SR9800_MAX_BULKIN_20K           5
+#define SR9800_MAX_BULKIN_24K           6
+#define SR9800_MAX_BULKIN_32K           7
+struct {unsigned short size, byte_cnt, threshold; } SR9800_BULKIN_SIZE[] = {
+        /* 2k */
+        {2048, 0x8000, 0x8001},
+        /* 4k */
+        {4096, 0x8100, 0x8147},
+        /* 6k */
+        {6144, 0x8200, 0x81EB},
+        /* 8k */
+        {8192, 0x8300, 0x83D7},
+        /* 16 */
+        {16384, 0x8400, 0x851E},
+        /* 20k */
+        {20480, 0x8500, 0x8666},
+        /* 24k */
+        {24576, 0x8600, 0x87AE},
+        /* 32k */
+        {32768, 0x8700, 0x8A3D},
+};
+/* This structure cannot exceed sizeof(unsigned long [5]) AKA 20 bytes */
+struct sr_data {
+        u8 multi_filter[SR_MCAST_FILTER_SIZE];
+        u8 mac_addr[ETH_ALEN];
+        u8 phymode;
+        u8 ledmode;
+        u8 eeprom_len;
+};
+struct sr9800_int_data {
+        __le16 res1;
+        u8 link;
+        __le16 res2;
+        u8 status;
+        __le16 res3;
+} __packed;
+#endif  /* _SR9800_H */
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 026a313c2d2d..b0f705c2378f 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -469,7 +469,6 @@ static inline struct hlist_head *vxlan_fdb_head(struct vxlan_dev *vxlan,
 /* Look up Ethernet address in forwarding table */
 static struct vxlan_fdb *__vxlan_find_mac(struct vxlan_dev *vxlan,
                                        const u8 *mac)
 {
        struct hlist_head *head = vxlan_fdb_head(vxlan, mac);
        struct vxlan_fdb *f;
@@ -596,10 +595,8 @@ static struct sk_buff **vxlan_gro_receive(struct sk_buff **head, struct sk_buff
                        NAPI_GRO_CB(p)->same_flow = 0;
                        continue;
                }
-                goto found;
        }
-found:
        type = eh->h_proto;
        rcu_read_lock();
diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
index 0d1c7592efa0..19f7cb2cdef3 100644
--- a/drivers/net/wan/dlci.c
+++ b/drivers/net/wan/dlci.c
@@ -71,12 +71,9 @@ static int dlci_header(struct sk_buff *skb, struct net_device *dev,
                       const void *saddr, unsigned len)
 {
        struct frhdr            hdr;
-        struct dlci_local       *dlp;
        unsigned int            hlen;
        char                    *dest;
-        dlp = netdev_priv(dev);
        hdr.control = FRAD_I_UI;
        switch (type)
        {
@@ -107,11 +104,9 @@ static int dlci_header(struct sk_buff *skb, struct net_device *dev,
 static void dlci_receive(struct sk_buff *skb, struct net_device *dev)
 {
-        struct dlci_local *dlp;
        struct frhdr            *hdr;
        int                                     process, header;
-        dlp = netdev_priv(dev);
        if (!pskb_may_pull(skb, sizeof(*hdr))) {
                netdev_notice(dev, "invalid data no header\n");
                dev->stats.rx_errors++;
diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index 8aa20df55e50..507d9a9ee69a 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -1764,7 +1764,7 @@ static struct usb_device_id ar5523_id_table[] = {
        AR5523_DEVICE_UG(0x07d1, 0x3a07),       /* D-Link / WUA-2340 rev A1 */
        AR5523_DEVICE_UG(0x1690, 0x0712),       /* Gigaset / AR5523 */
        AR5523_DEVICE_UG(0x1690, 0x0710),       /* Gigaset / SMCWUSBTG */
-        AR5523_DEVICE_UG(0x129b, 0x160c),       /* Gigaset / USB stick 108
+        AR5523_DEVICE_UG(0x129b, 0x160b),       /* Gigaset / USB stick 108
                                                   (CyberTAN Technology) */
        AR5523_DEVICE_UG(0x16ab, 0x7801),       /* Globalsun / AR5523_1 */
        AR5523_DEVICE_UX(0x16ab, 0x7811),       /* Globalsun / AR5523_2 */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 25243cbc07f0..b8daff78b9d1 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -5065,6 +5065,10 @@ static u16 ar9003_hw_get_max_edge_power(struct ar9300_eeprom *eep,
                        break;
                }
        }
+        if (is2GHz && !twiceMaxEdgePower)
+                twiceMaxEdgePower = 60;
        return twiceMaxEdgePower;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 58da3468d1f0..99a203174f45 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -262,6 +262,8 @@ enum tid_aggr_state {
 struct ath9k_htc_sta {
        u8 index;
        enum tid_aggr_state tid_state[ATH9K_HTC_MAX_TID];
+        struct work_struct rc_update_work;
+        struct ath9k_htc_priv *htc_priv;
 };
 #define ATH9K_HTC_RXBUF 256
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index f4e1de20d99c..c57d6b859c04 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -34,6 +34,10 @@ static int ath9k_htc_btcoex_enable;
 module_param_named(btcoex_enable, ath9k_htc_btcoex_enable, int, 0444);
 MODULE_PARM_DESC(btcoex_enable, "Enable wifi-BT coexistence");
+static int ath9k_ps_enable;
+module_param_named(ps_enable, ath9k_ps_enable, int, 0444);
+MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave");
 #define CHAN2G(_freq, _idx)  { \
        .center_freq = (_freq), \
        .hw_value = (_idx), \
@@ -725,12 +729,14 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
                IEEE80211_HW_SPECTRUM_MGMT |
                IEEE80211_HW_HAS_RATE_CONTROL |
                IEEE80211_HW_RX_INCLUDES_FCS |
-                IEEE80211_HW_SUPPORTS_PS |
                IEEE80211_HW_PS_NULLFUNC_STACK |
                IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                IEEE80211_HW_MFP_CAPABLE |
                IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING;
+        if (ath9k_ps_enable)
+                hw->flags |= IEEE80211_HW_SUPPORTS_PS;
        hw->wiphy->interface_modes =
                BIT(NL80211_IFTYPE_STATION) |
                BIT(NL80211_IFTYPE_ADHOC) |
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 608d739d1378..c9254a61ca52 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -1270,18 +1270,50 @@ static void ath9k_htc_configure_filter(struct ieee80211_hw *hw,
        mutex_unlock(&priv->mutex);
 }
+static void ath9k_htc_sta_rc_update_work(struct work_struct *work)
+{
+        struct ath9k_htc_sta *ista =
+            container_of(work, struct ath9k_htc_sta, rc_update_work);
+        struct ieee80211_sta *sta =
+            container_of((void *)ista, struct ieee80211_sta, drv_priv);
+        struct ath9k_htc_priv *priv = ista->htc_priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_target_rate trate;
+        mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
+        memset(&trate, 0, sizeof(struct ath9k_htc_target_rate));
+        ath9k_htc_setup_rate(priv, sta, &trate);
+        if (!ath9k_htc_send_rate_cmd(priv, &trate))
+                ath_dbg(common, CONFIG,
+                        "Supported rates for sta: %pM updated, rate caps: 0x%X\n",
+                        sta->addr, be32_to_cpu(trate.capflags));
+        else
+                ath_dbg(common, CONFIG,
+                        "Unable to update supported rates for sta: %pM\n",
+                        sta->addr);
+        ath9k_htc_ps_restore(priv);
+        mutex_unlock(&priv->mutex);
+}
 static int ath9k_htc_sta_add(struct ieee80211_hw *hw,
                             struct ieee80211_vif *vif,
                             struct ieee80211_sta *sta)
 {
        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath9k_htc_sta *ista = (struct ath9k_htc_sta *) sta->drv_priv;
        int ret;
        mutex_lock(&priv->mutex);
        ath9k_htc_ps_wakeup(priv);
        ret = ath9k_htc_add_station(priv, vif, sta);
-        if (!ret)
+        if (!ret) {
+                INIT_WORK(&ista->rc_update_work, ath9k_htc_sta_rc_update_work);
+                ista->htc_priv = priv;
                ath9k_htc_init_rate(priv, sta);
+        }
        ath9k_htc_ps_restore(priv);
        mutex_unlock(&priv->mutex);
@@ -1293,12 +1325,13 @@ static int ath9k_htc_sta_remove(struct ieee80211_hw *hw,
                                struct ieee80211_sta *sta)
 {
        struct ath9k_htc_priv *priv = hw->priv;
-        struct ath9k_htc_sta *ista;
+        struct ath9k_htc_sta *ista = (struct ath9k_htc_sta *) sta->drv_priv;
        int ret;
+        cancel_work_sync(&ista->rc_update_work);
        mutex_lock(&priv->mutex);
        ath9k_htc_ps_wakeup(priv);
-        ista = (struct ath9k_htc_sta *) sta->drv_priv;
        htc_sta_drain(priv->htc, ista->index);
        ret = ath9k_htc_remove_station(priv, vif, sta);
        ath9k_htc_ps_restore(priv);
@@ -1311,28 +1344,12 @@ static void ath9k_htc_sta_rc_update(struct ieee80211_hw *hw,
                                    struct ieee80211_vif *vif,
                                    struct ieee80211_sta *sta, u32 changed)
 {
-        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath9k_htc_sta *ista = (struct ath9k_htc_sta *) sta->drv_priv;
-        struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct ath9k_htc_target_rate trate;
-        mutex_lock(&priv->mutex);
-        ath9k_htc_ps_wakeup(priv);
-        if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
+        if (!(changed & IEEE80211_RC_SUPP_RATES_CHANGED))
-                memset(&trate, 0, sizeof(struct ath9k_htc_target_rate));
+                return;
-                ath9k_htc_setup_rate(priv, sta, &trate);
-                if (!ath9k_htc_send_rate_cmd(priv, &trate))
-                        ath_dbg(common, CONFIG,
-                                "Supported rates for sta: %pM updated, rate caps: 0x%X\n",
-                                sta->addr, be32_to_cpu(trate.capflags));
-                else
-                        ath_dbg(common, CONFIG,
-                                "Unable to update supported rates for sta: %pM\n",
-                                sta->addr);
-        }
-        ath9k_htc_ps_restore(priv);
+        schedule_work(&ista->rc_update_work);
-        mutex_unlock(&priv->mutex);
 }
 static int ath9k_htc_conf_tx(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index fbf43c05713f..11eab9f01fd8 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1316,7 +1316,7 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
        if (AR_SREV_9300_20_OR_LATER(ah))
                udelay(50);
        else if (AR_SREV_9100(ah))
-                udelay(10000);
+                mdelay(10);
        else
                udelay(100);
@@ -2051,9 +2051,8 @@ static bool ath9k_hw_set_power_awake(struct ath_hw *ah)
        REG_SET_BIT(ah, AR_RTC_FORCE_WAKE,
                    AR_RTC_FORCE_WAKE_EN);
        if (AR_SREV_9100(ah))
-                udelay(10000);
+                mdelay(10);
        else
                udelay(50);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index c36de303c8f3..1fc2e5a26b52 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -57,6 +57,10 @@ static int ath9k_bt_ant_diversity;
 module_param_named(bt_ant_diversity, ath9k_bt_ant_diversity, int, 0444);
 MODULE_PARM_DESC(bt_ant_diversity, "Enable WLAN/BT RX antenna diversity");
+static int ath9k_ps_enable;
+module_param_named(ps_enable, ath9k_ps_enable, int, 0444);
+MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave");
 bool is_ath9k_unloaded;
 /* We use the hw_value as an index into our private channel structure */
@@ -903,13 +907,15 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
                IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
                IEEE80211_HW_SIGNAL_DBM |
-                IEEE80211_HW_SUPPORTS_PS |
                IEEE80211_HW_PS_NULLFUNC_STACK |
                IEEE80211_HW_SPECTRUM_MGMT |
                IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                IEEE80211_HW_SUPPORTS_RC_TABLE |
                IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
+        if (ath9k_ps_enable)
+                hw->flags |= IEEE80211_HW_SUPPORTS_PS;
        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
                hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index f06f4cbe1317..725e954d8475 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -182,6 +182,11 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
        for (ch_idx = 0; ch_idx < IWL_NUM_CHANNELS; ch_idx++) {
                ch_flags = __le16_to_cpup(nvm_ch_flags + ch_idx);
+                if (ch_idx >= NUM_2GHZ_CHANNELS &&
+                    !data->sku_cap_band_52GHz_enable)
+                        ch_flags &= ~NVM_CHANNEL_VALID;
                if (!(ch_flags & NVM_CHANNEL_VALID)) {
                        IWL_DEBUG_EEPROM(dev,
                                         "Ch. %d Flags %x [%sGHz] - No traffic\n",
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 73cbba7424f2..9426905de6b2 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -504,6 +504,7 @@ struct iwl_scan_offload_profile {
 * @match_notify:       clients waiting for match found notification
 * @pass_match:         clients waiting for the results
 * @active_clients:     active clients bitmap - enum scan_framework_client
+ * @any_beacon_notify:  clients waiting for match notification without match
 */
 struct iwl_scan_offload_profile_cfg {
        struct iwl_scan_offload_profile profiles[IWL_SCAN_MAX_PROFILES];
@@ -512,7 +513,8 @@ struct iwl_scan_offload_profile_cfg {
        u8 match_notify;
        u8 pass_match;
        u8 active_clients;
-        u8 reserved[3];
+        u8 any_beacon_notify;
+        u8 reserved[2];
 } __packed;
 /**
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index c49b5073c251..6bf9766e5982 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -246,7 +246,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
        else
                hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SCHED_SCAN) {
+        if (0 && mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SCHED_SCAN) {
                hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
                hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
                hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 0e0007960612..742afc429c94 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -344,7 +344,8 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
        iwl_mvm_scan_fill_ssids(cmd, req, basic_ssid ? 1 : 0);
-        cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL);
+        cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
+                                           TX_CMD_FLG_BT_DIS);
        cmd->tx_cmd.sta_id = mvm->aux_sta.sta_id;
        cmd->tx_cmd.life_time = cpu_to_le32(TX_CMD_LIFE_TIME_INFINITE);
        cmd->tx_cmd.rate_n_flags =
@@ -807,6 +808,8 @@ int iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
        profile_cfg->active_clients = SCAN_CLIENT_SCHED_SCAN;
        profile_cfg->pass_match = SCAN_CLIENT_SCHED_SCAN;
        profile_cfg->match_notify = SCAN_CLIENT_SCHED_SCAN;
+        if (!req->n_match_sets || !req->match_sets[0].ssid.ssid_len)
+                profile_cfg->any_beacon_notify = SCAN_CLIENT_SCHED_SCAN;
        for (i = 0; i < req->n_match_sets; i++) {
                profile = &profile_cfg->profiles[i];
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index ec1812133235..3397f59cd4e4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -652,7 +652,7 @@ int iwl_mvm_send_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 {
        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
        static const u8 _baddr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
-        static const u8 *baddr = _baddr;
+        const u8 *baddr = _baddr;
        lockdep_assert_held(&mvm->mutex);
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 90378c217bc7..4df12fa9d336 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -659,8 +659,14 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
        rcu_read_lock();
        sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
+        /*
+         * sta can't be NULL otherwise it'd mean that the sta has been freed in
+         * the firmware while we still have packets for it in the Tx queues.
+         */
+        if (WARN_ON_ONCE(!sta))
+                goto out;
-        if (!IS_ERR_OR_NULL(sta)) {
+        if (!IS_ERR(sta)) {
                mvmsta = iwl_mvm_sta_from_mac80211(sta);
                if (tid != IWL_TID_NON_QOS) {
@@ -675,7 +681,6 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                        spin_unlock_bh(&mvmsta->lock);
                }
        } else {
-                sta = NULL;
                mvmsta = NULL;
        }
@@ -683,42 +688,38 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
         * If the txq is not an AMPDU queue, there is no chance we freed
         * several skbs. Check that out...
         */
-        if (txq_id < mvm->first_agg_queue && !WARN_ON(skb_freed > 1) &&
+        if (txq_id >= mvm->first_agg_queue)
-            atomic_sub_and_test(skb_freed, &mvm->pending_frames[sta_id])) {
+                goto out;
-                if (mvmsta) {
-                        /*
+        /* We can't free more than one frame at once on a shared queue */
-                         * If there are no pending frames for this STA, notify
+        WARN_ON(skb_freed > 1);
-                         * mac80211 that this station can go to sleep in its
-                         * STA table.
+        /* If we have still frames from this STA nothing to do here */
-                         */
+        if (!atomic_sub_and_test(skb_freed, &mvm->pending_frames[sta_id]))
-                        if (mvmsta->vif->type == NL80211_IFTYPE_AP)
+                goto out;
-                                ieee80211_sta_block_awake(mvm->hw, sta, false);
-                        /*
+        if (mvmsta && mvmsta->vif->type == NL80211_IFTYPE_AP) {
-                         * We might very well have taken mvmsta pointer while
+                /*
-                         * the station was being removed. The remove flow might
+                 * If there are no pending frames for this STA, notify
-                         * have seen a pending_frame (because we didn't take
+                 * mac80211 that this station can go to sleep in its
-                         * the lock) even if now the queues are drained. So make
+                 * STA table.
-                         * really sure now that this the station is not being
+                 * If mvmsta is not NULL, sta is valid.
-                         * removed. If it is, run the drain worker to remove it.
+                 */
-                         */
+                ieee80211_sta_block_awake(mvm->hw, sta, false);
-                        spin_lock_bh(&mvmsta->lock);
+        }
-                        sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
-                        if (!sta || PTR_ERR(sta) == -EBUSY) {
+        if (PTR_ERR(sta) == -EBUSY || PTR_ERR(sta) == -ENOENT) {
-                                /*
+                /*
-                                 * Station disappeared in the meantime:
+                 * We are draining and this was the last packet - pre_rcu_remove
-                                 * so we are draining.
+                 * has been called already. We might be after the
-                                 */
+                 * synchronize_net already.
-                                set_bit(sta_id, mvm->sta_drained);
+                 * Don't rely on iwl_mvm_rm_sta to see the empty Tx queues.
-                                schedule_work(&mvm->sta_drained_wk);
+                 */
-                        }
+                set_bit(sta_id, mvm->sta_drained);
-                        spin_unlock_bh(&mvmsta->lock);
+                schedule_work(&mvm->sta_drained_wk);
-                } else if (!mvmsta && PTR_ERR(sta) == -EBUSY) {
-                        /* Tx response without STA, so we are draining */
-                        set_bit(sta_id, mvm->sta_drained);
-                        schedule_work(&mvm->sta_drained_wk);
-                }
        }
+out:
        rcu_read_unlock();
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index a4a5e25623c3..86989df69356 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -411,6 +411,8 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
                        mvm->status, table.valid);
        }
+        IWL_ERR(mvm, "Loaded firmware version: %s\n", mvm->fw->fw_version);
        trace_iwlwifi_dev_ucode_error(trans->dev, table.error_id, table.tsf_low,
                                      table.data1, table.data2, table.data3,
                                      table.blink1, table.blink2, table.ilink1,
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 3040924f5f3c..f47bcbe2945a 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -359,20 +359,25 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 /* 7265 Series */
        {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5110, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5112, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5100, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x510A, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095A, 0x500A, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5400, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5000, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x500A, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5200, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5002, iwl7265_n_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5202, iwl7265_n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9012, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9112, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index abc5f56f29fe..2f1cd929c6f6 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1877,6 +1877,11 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                                                   EEPROM_MAC_ADDR_0));
        /*
+         * Disable powersaving as default.
+         */
+        rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+        /*
         * Initialize hw_mode information.
         */
        spec->supported_bands = SUPPORT_BAND_2GHZ;
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 9f16824cd1bc..d849d590de25 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1706,6 +1706,11 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
            IEEE80211_HW_SUPPORTS_PS |
            IEEE80211_HW_PS_NULLFUNC_STACK;
+        /*
+         * Disable powersaving as default.
+         */
+        rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
        SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
        SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
                                rt2x00_eeprom_addr(rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index b8f5b06006c4..7f8b5d156c8c 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -7458,10 +7458,9 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
        u32 reg;
        /*
-         * Disable powersaving as default on PCI devices.
+         * Disable powersaving as default.
         */
-        if (rt2x00_is_pci(rt2x00dev) || rt2x00_is_soc(rt2x00dev))
+        rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
-                rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
        /*
         * Initialize all hw fields.
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index 8ec17aad0e52..3867d1470b36 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -107,6 +107,7 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
        struct rtl8180_priv *priv = dev->priv;
        unsigned int count = 32;
        u8 signal, agc, sq;
+        dma_addr_t mapping;
        while (count--) {
                struct rtl8180_rx_desc *entry = &priv->rx_ring[priv->rx_idx];
@@ -128,6 +129,17 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
                        if (unlikely(!new_skb))
                                goto done;
+                        mapping = pci_map_single(priv->pdev,
+                                               skb_tail_pointer(new_skb),
+                                               MAX_RX_SIZE, PCI_DMA_FROMDEVICE);
+                        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                                kfree_skb(new_skb);
+                                dev_err(&priv->pdev->dev, "RX DMA map error\n");
+                                goto done;
+                        }
                        pci_unmap_single(priv->pdev,
                                         *((dma_addr_t *)skb->cb),
                                         MAX_RX_SIZE, PCI_DMA_FROMDEVICE);
@@ -158,9 +170,7 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
                        skb = new_skb;
                        priv->rx_buf[priv->rx_idx] = skb;
-                        *((dma_addr_t *) skb->cb) =
+                        *((dma_addr_t *) skb->cb) = mapping;
-                                pci_map_single(priv->pdev, skb_tail_pointer(skb),
-                                               MAX_RX_SIZE, PCI_DMA_FROMDEVICE);
                }
        done:
@@ -266,6 +276,13 @@ static void rtl8180_tx(struct ieee80211_hw *dev,
        mapping = pci_map_single(priv->pdev, skb->data,
                                 skb->len, PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                kfree_skb(skb);
+                dev_err(&priv->pdev->dev, "TX DMA mapping error\n");
+                return;
+        }
        tx_flags = RTL818X_TX_DESC_FLAG_OWN | RTL818X_TX_DESC_FLAG_FS |
                   RTL818X_TX_DESC_FLAG_LS |
                   (ieee80211_get_tx_rate(dev, info)->hw_value << 24) |
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 4c76bcb9a879..ae413a2cbee7 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -143,11 +143,7 @@ struct xenvif {
        char rx_irq_name[IFNAMSIZ+4]; /* DEVNAME-rx */
        struct xen_netif_rx_back_ring rx;
        struct sk_buff_head rx_queue;
-        bool rx_queue_stopped;
+        RING_IDX rx_last_skb_slots;
-        /* Set when the RX interrupt is triggered by the frontend.
-         * The worker thread may need to wake the queue.
-         */
-        bool rx_event;
        /* This array is allocated seperately as it is large */
        struct gnttab_copy *grant_copy_op;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index b9de31ea7fc4..7669d49a67e2 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -100,7 +100,6 @@ static irqreturn_t xenvif_rx_interrupt(int irq, void *dev_id)
 {
        struct xenvif *vif = dev_id;
-        vif->rx_event = true;
        xenvif_kick_thread(vif);
        return IRQ_HANDLED;
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 6b62c3eb8e18..e5284bca2d90 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -476,7 +476,6 @@ static void xenvif_rx_action(struct xenvif *vif)
        unsigned long offset;
        struct skb_cb_overlay *sco;
        bool need_to_notify = false;
-        bool ring_full = false;
        struct netrx_pending_operations npo = {
                .copy  = vif->grant_copy_op,
@@ -486,7 +485,7 @@ static void xenvif_rx_action(struct xenvif *vif)
        skb_queue_head_init(&rxq);
        while ((skb = skb_dequeue(&vif->rx_queue)) != NULL) {
-                int max_slots_needed;
+                RING_IDX max_slots_needed;
                int i;
                /* We need a cheap worse case estimate for the number of
@@ -509,9 +508,10 @@ static void xenvif_rx_action(struct xenvif *vif)
                if (!xenvif_rx_ring_slots_available(vif, max_slots_needed)) {
                        skb_queue_head(&vif->rx_queue, skb);
                        need_to_notify = true;
-                        ring_full = true;
+                        vif->rx_last_skb_slots = max_slots_needed;
                        break;
-                }
+                } else
+                        vif->rx_last_skb_slots = 0;
                sco = (struct skb_cb_overlay *)skb->cb;
                sco->meta_slots_used = xenvif_gop_skb(skb, &npo);
@@ -522,8 +522,6 @@ static void xenvif_rx_action(struct xenvif *vif)
        BUG_ON(npo.meta_prod > ARRAY_SIZE(vif->meta));
-        vif->rx_queue_stopped = !npo.copy_prod && ring_full;
        if (!npo.copy_prod)
                goto done;
@@ -1473,8 +1471,8 @@ static struct xen_netif_rx_response *make_rx_response(struct xenvif *vif,
 static inline int rx_work_todo(struct xenvif *vif)
 {
-        return (!skb_queue_empty(&vif->rx_queue) && !vif->rx_queue_stopped) ||
+        return !skb_queue_empty(&vif->rx_queue) &&
-                vif->rx_event;
+               xenvif_rx_ring_slots_available(vif, vif->rx_last_skb_slots);
 }
 static inline int tx_work_todo(struct xenvif *vif)
@@ -1560,8 +1558,6 @@ int xenvif_kthread(void *data)
                if (!skb_queue_empty(&vif->rx_queue))
                        xenvif_rx_action(vif);
-                vif->rx_event = false;
                if (skb_queue_empty(&vif->rx_queue) &&
                    netif_queue_stopped(vif->dev))
                        xenvif_start_queue(vif);
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index ff04d4f95baa..f9daa9e183f2 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1832,7 +1832,6 @@ static void netback_changed(struct xenbus_device *dev,
        case XenbusStateReconfiguring:
        case XenbusStateReconfigured:
        case XenbusStateUnknown:
-        case XenbusStateClosed:
                break;
        case XenbusStateInitWait:
@@ -1847,6 +1846,10 @@ static void netback_changed(struct xenbus_device *dev,
                netdev_notify_peers(netdev);
                break;
+        case XenbusStateClosed:
+                if (dev->state == XenbusStateClosed)
+                        break;
+                /* Missed the backend's CLOSING state -- fallthrough */
        case XenbusStateClosing:
                xenbus_frontend_closed(dev);
                break;
diff --git a/drivers/of/address.c b/drivers/of/address.c
index d3dd41c840f1..1a54f1ffaadb 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -99,11 +99,12 @@ static unsigned int of_bus_default_get_flags(const __be32 *addr)
 static int of_bus_pci_match(struct device_node *np)
 {
        /*
+         * "pciex" is PCI Express
         * "vci" is for the /chaos bridge on 1st-gen PCI powermacs
         * "ht" is hypertransport
         */
-        return !strcmp(np->type, "pci") || !strcmp(np->type, "vci") ||
+        return !strcmp(np->type, "pci") || !strcmp(np->type, "pciex") ||
-                !strcmp(np->type, "ht");
+                !strcmp(np->type, "vci") || !strcmp(np->type, "ht");
 }
 static void of_bus_pci_count_cells(struct device_node *np,
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 88e35d85d205..8ee88c4ebd83 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -342,8 +342,9 @@ static int cio_check_config(struct subchannel *sch, struct schib *schib)
 */
 int cio_commit_config(struct subchannel *sch)
 {
-        struct schib schib;
        int ccode, retry, ret = 0;
+        struct schib schib;
+        struct irb irb;
        if (stsch_err(sch->schid, &schib) || !css_sch_is_valid(&schib))
                return -ENODEV;
@@ -367,7 +368,10 @@ int cio_commit_config(struct subchannel *sch)
                        ret = -EAGAIN;
                        break;
                case 1: /* status pending */
-                        return -EBUSY;
+                        ret = -EBUSY;
+                        if (tsch(sch->schid, &irb))
+                                return ret;
+                        break;
                case 2: /* busy */
                        udelay(100); /* allow for recovery */
                        ret = -EBUSY;
@@ -403,7 +407,6 @@ EXPORT_SYMBOL_GPL(cio_update_schib);
 */
 int cio_enable_subchannel(struct subchannel *sch, u32 intparm)
 {
-        int retry;
        int ret;
        CIO_TRACE_EVENT(2, "ensch");
@@ -418,20 +421,14 @@ int cio_enable_subchannel(struct subchannel *sch, u32 intparm)
        sch->config.isc = sch->isc;
        sch->config.intparm = intparm;
-        for (retry = 0; retry < 3; retry++) {
+        ret = cio_commit_config(sch);
+        if (ret == -EIO) {
+                /*
+                 * Got a program check in msch. Try without
+                 * the concurrent sense bit the next time.
+                 */
+                sch->config.csense = 0;
                ret = cio_commit_config(sch);
-                if (ret == -EIO) {
-                        /*
-                         * Got a program check in msch. Try without
-                         * the concurrent sense bit the next time.
-                         */
-                        sch->config.csense = 0;
-                } else if (ret == -EBUSY) {
-                        struct irb irb;
-                        if (tsch(sch->schid, &irb) != 0)
-                                break;
-                } else
-                        break;
        }
        CIO_HEX_EVENT(2, &ret, sizeof(ret));
        return ret;
@@ -444,7 +441,6 @@ EXPORT_SYMBOL_GPL(cio_enable_subchannel);
 */
 int cio_disable_subchannel(struct subchannel *sch)
 {
-        int retry;
        int ret;
        CIO_TRACE_EVENT(2, "dissch");
@@ -456,16 +452,8 @@ int cio_disable_subchannel(struct subchannel *sch)
                return -ENODEV;
        sch->config.ena = 0;
+        ret = cio_commit_config(sch);
-        for (retry = 0; retry < 3; retry++) {
-                ret = cio_commit_config(sch);
-                if (ret == -EBUSY) {
-                        struct irb irb;
-                        if (tsch(sch->schid, &irb) != 0)
-                                break;
-                } else
-                        break;
-        }
        CIO_HEX_EVENT(2, &ret, sizeof(ret));
        return ret;
 }
diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
index 8acaae18bd11..a563e4c00590 100644
--- a/drivers/s390/cio/qdio.h
+++ b/drivers/s390/cio/qdio.h
@@ -359,14 +359,12 @@ static inline int multicast_outbound(struct qdio_q *q)
 #define need_siga_sync_out_after_pci(q) \
        (unlikely(q->irq_ptr->siga_flag.sync_out_after_pci))
-#define for_each_input_queue(irq_ptr, q, i)     \
+#define for_each_input_queue(irq_ptr, q, i)             \
-        for (i = 0, q = irq_ptr->input_qs[0];   \
+        for (i = 0; i < irq_ptr->nr_input_qs &&         \
-                i < irq_ptr->nr_input_qs;       \
+                ({ q = irq_ptr->input_qs[i]; 1; }); i++)
-                q = irq_ptr->input_qs[++i])
+#define for_each_output_queue(irq_ptr, q, i)            \
-#define for_each_output_queue(irq_ptr, q, i)    \
+        for (i = 0; i < irq_ptr->nr_output_qs &&        \
-        for (i = 0, q = irq_ptr->output_qs[0];  \
+                ({ q = irq_ptr->output_qs[i]; 1; }); i++)
-                i < irq_ptr->nr_output_qs;      \
-                q = irq_ptr->output_qs[++i])
 #define prev_buf(bufnr) \
        ((bufnr + QDIO_MAX_BUFFERS_MASK) & QDIO_MAX_BUFFERS_MASK)
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index c883a085c059..77466c4faabb 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -996,7 +996,7 @@ static void qdio_int_handler_pci(struct qdio_irq *irq_ptr)
                }
        }
-        if (!pci_out_supported(q))
+        if (!(irq_ptr->qib.ac & QIB_AC_OUTBOUND_PCI_SUPPORTED))
                return;
        for_each_output_queue(irq_ptr, q, i) {
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 8f9b4f710d4a..c819b0bd491a 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -1043,15 +1043,30 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode,
        __u32 secdesclen = 0;
        struct cifs_ntsd *pntsd = NULL; /* acl obtained from server */
        struct cifs_ntsd *pnntsd = NULL; /* modified acl to be sent to server */
+        struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+        struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
+        struct cifs_tcon *tcon;
+        if (IS_ERR(tlink))
+                return PTR_ERR(tlink);
+        tcon = tlink_tcon(tlink);
        cifs_dbg(NOISY, "set ACL from mode for %s\n", path);
        /* Get the security descriptor */
-        pntsd = get_cifs_acl(CIFS_SB(inode->i_sb), inode, path, &secdesclen);
+        if (tcon->ses->server->ops->get_acl == NULL) {
+                cifs_put_tlink(tlink);
+                return -EOPNOTSUPP;
+        }
+        pntsd = tcon->ses->server->ops->get_acl(cifs_sb, inode, path,
+                                                &secdesclen);
        if (IS_ERR(pntsd)) {
                rc = PTR_ERR(pntsd);
                cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc);
-                goto out;
+                cifs_put_tlink(tlink);
+                return rc;
        }
        /*
@@ -1064,6 +1079,7 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode,
        pnntsd = kmalloc(secdesclen, GFP_KERNEL);
        if (!pnntsd) {
                kfree(pntsd);
+                cifs_put_tlink(tlink);
                return -ENOMEM;
        }
@@ -1072,14 +1088,18 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode,
        cifs_dbg(NOISY, "build_sec_desc rc: %d\n", rc);
+        if (tcon->ses->server->ops->set_acl == NULL)
+                rc = -EOPNOTSUPP;
        if (!rc) {
                /* Set the security descriptor */
-                rc = set_cifs_acl(pnntsd, secdesclen, inode, path, aclflag);
+                rc = tcon->ses->server->ops->set_acl(pnntsd, secdesclen, inode,
+                                                     path, aclflag);
                cifs_dbg(NOISY, "set_cifs_acl rc: %d\n", rc);
        }
+        cifs_put_tlink(tlink);
        kfree(pnntsd);
        kfree(pntsd);
-out:
        return rc;
 }
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index a245d1809ed8..86dc28c7aa5c 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -323,7 +323,8 @@ struct smb_version_operations {
        /* async read from the server */
        int (*async_readv)(struct cifs_readdata *);
        /* async write to the server */
-        int (*async_writev)(struct cifs_writedata *);
+        int (*async_writev)(struct cifs_writedata *,
+                            void (*release)(struct kref *));
        /* sync read from the server */
        int (*sync_read)(const unsigned int, struct cifsFileInfo *,
                         struct cifs_io_parms *, unsigned int *, char **,
@@ -395,6 +396,10 @@ struct smb_version_operations {
        int (*set_EA)(const unsigned int, struct cifs_tcon *, const char *,
                        const char *, const void *, const __u16,
                        const struct nls_table *, int);
+        struct cifs_ntsd * (*get_acl)(struct cifs_sb_info *, struct inode *,
+                        const char *, u32 *);
+        int (*set_acl)(struct cifs_ntsd *, __u32, struct inode *, const char *,
+                        int);
 };
 struct smb_version_values {
@@ -1064,7 +1069,7 @@ struct cifs_writedata {
        unsigned int                    pagesz;
        unsigned int                    tailsz;
        unsigned int                    nr_pages;
-        struct page                     *pages[1];
+        struct page                     *pages[];
 };
 /*
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 79e6e9a93a8c..d00e09dfc452 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -488,7 +488,8 @@ void cifs_readdata_release(struct kref *refcount);
 int cifs_async_readv(struct cifs_readdata *rdata);
 int cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid);
-int cifs_async_writev(struct cifs_writedata *wdata);
+int cifs_async_writev(struct cifs_writedata *wdata,
+                      void (*release)(struct kref *kref));
 void cifs_writev_complete(struct work_struct *work);
 struct cifs_writedata *cifs_writedata_alloc(unsigned int nr_pages,
                                                work_func_t complete);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 4d881c35eeca..f3264bd7a83d 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1910,7 +1910,7 @@ cifs_writev_requeue(struct cifs_writedata *wdata)
        do {
                server = tlink_tcon(wdata->cfile->tlink)->ses->server;
-                rc = server->ops->async_writev(wdata);
+                rc = server->ops->async_writev(wdata, cifs_writedata_release);
        } while (rc == -EAGAIN);
        for (i = 0; i < wdata->nr_pages; i++) {
@@ -1962,15 +1962,9 @@ cifs_writedata_alloc(unsigned int nr_pages, work_func_t complete)
 {
        struct cifs_writedata *wdata;
-        /* this would overflow */
-        if (nr_pages == 0) {
-                cifs_dbg(VFS, "%s: called with nr_pages == 0!\n", __func__);
-                return NULL;
-        }
        /* writedata + number of page pointers */
        wdata = kzalloc(sizeof(*wdata) +
-                        sizeof(struct page *) * (nr_pages - 1), GFP_NOFS);
+                        sizeof(struct page *) * nr_pages, GFP_NOFS);
        if (wdata != NULL) {
                kref_init(&wdata->refcount);
                INIT_LIST_HEAD(&wdata->list);
@@ -2031,7 +2025,8 @@ cifs_writev_callback(struct mid_q_entry *mid)
 /* cifs_async_writev - send an async write, and set up mid to handle result */
 int
-cifs_async_writev(struct cifs_writedata *wdata)
+cifs_async_writev(struct cifs_writedata *wdata,
+                  void (*release)(struct kref *kref))
 {
        int rc = -EACCES;
        WRITE_REQ *smb = NULL;
@@ -2105,7 +2100,7 @@ cifs_async_writev(struct cifs_writedata *wdata)
        if (rc == 0)
                cifs_stats_inc(&tcon->stats.cifs_stats.num_writes);
        else
-                kref_put(&wdata->refcount, cifs_writedata_release);
+                kref_put(&wdata->refcount, release);
 async_writev_out:
        cifs_small_buf_release(smb);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index a7eda8ebfacc..755584684f6c 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2043,7 +2043,8 @@ retry:
                        }
                        wdata->pid = wdata->cfile->pid;
                        server = tlink_tcon(wdata->cfile->tlink)->ses->server;
-                        rc = server->ops->async_writev(wdata);
+                        rc = server->ops->async_writev(wdata,
+                                                        cifs_writedata_release);
                } while (wbc->sync_mode == WB_SYNC_ALL && rc == -EAGAIN);
                for (i = 0; i < nr_pages; ++i)
@@ -2331,9 +2332,20 @@ size_t get_numpages(const size_t wsize, const size_t len, size_t *cur_len)
 }
 static void
-cifs_uncached_writev_complete(struct work_struct *work)
+cifs_uncached_writedata_release(struct kref *refcount)
 {
        int i;
+        struct cifs_writedata *wdata = container_of(refcount,
+                                        struct cifs_writedata, refcount);
+        for (i = 0; i < wdata->nr_pages; i++)
+                put_page(wdata->pages[i]);
+        cifs_writedata_release(refcount);
+}
+static void
+cifs_uncached_writev_complete(struct work_struct *work)
+{
        struct cifs_writedata *wdata = container_of(work,
                                        struct cifs_writedata, work);
        struct inode *inode = wdata->cfile->dentry->d_inode;
@@ -2347,12 +2359,7 @@ cifs_uncached_writev_complete(struct work_struct *work)
        complete(&wdata->done);
-        if (wdata->result != -EAGAIN) {
+        kref_put(&wdata->refcount, cifs_uncached_writedata_release);
-                for (i = 0; i < wdata->nr_pages; i++)
-                        put_page(wdata->pages[i]);
-        }
-        kref_put(&wdata->refcount, cifs_writedata_release);
 }
 /* attempt to send write to server, retry on any -EAGAIN errors */
@@ -2370,7 +2377,8 @@ cifs_uncached_retry_writev(struct cifs_writedata *wdata)
                        if (rc != 0)
                                continue;
                }
-                rc = server->ops->async_writev(wdata);
+                rc = server->ops->async_writev(wdata,
+                                               cifs_uncached_writedata_release);
        } while (rc == -EAGAIN);
        return rc;
@@ -2454,7 +2462,8 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
                wdata->tailsz = cur_len - ((nr_pages - 1) * PAGE_SIZE);
                rc = cifs_uncached_retry_writev(wdata);
                if (rc) {
-                        kref_put(&wdata->refcount, cifs_writedata_release);
+                        kref_put(&wdata->refcount,
+                                 cifs_uncached_writedata_release);
                        break;
                }
@@ -2496,7 +2505,7 @@ restart_loop:
                        }
                }
                list_del_init(&wdata->list);
-                kref_put(&wdata->refcount, cifs_writedata_release);
+                kref_put(&wdata->refcount, cifs_uncached_writedata_release);
        }
        if (total_written > 0)
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 9cb9679d7357..be58b8fcdb3c 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -527,10 +527,15 @@ static int cifs_sfu_mode(struct cifs_fattr *fattr, const unsigned char *path,
                return PTR_ERR(tlink);
        tcon = tlink_tcon(tlink);
-        rc = CIFSSMBQAllEAs(xid, tcon, path, "SETFILEBITS",
+        if (tcon->ses->server->ops->query_all_EAs == NULL) {
-                            ea_value, 4 /* size of buf */, cifs_sb->local_nls,
+                cifs_put_tlink(tlink);
-                            cifs_sb->mnt_cifs_flags &
+                return -EOPNOTSUPP;
-                                CIFS_MOUNT_MAP_SPECIAL_CHR);
+        }
+        rc = tcon->ses->server->ops->query_all_EAs(xid, tcon, path,
+                        "SETFILEBITS", ea_value, 4 /* size of buf */,
+                        cifs_sb->local_nls,
+                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
        cifs_put_tlink(tlink);
        if (rc < 0)
                return (int)rc;
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index 9ac5bfc9cc56..bfd66d84831e 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -1067,6 +1067,14 @@ struct smb_version_operations smb1_operations = {
        .query_mf_symlink = cifs_query_mf_symlink,
        .create_mf_symlink = cifs_create_mf_symlink,
        .is_read_op = cifs_is_read_op,
+#ifdef CONFIG_CIFS_XATTR
+        .query_all_EAs = CIFSSMBQAllEAs,
+        .set_EA = CIFSSMBSetEA,
+#endif /* CIFS_XATTR */
+#ifdef CONFIG_CIFS_ACL
+        .get_acl = get_cifs_acl,
+        .set_acl = set_cifs_acl,
+#endif /* CIFS_ACL */
 };
 struct smb_version_values smb1_values = {
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 2013234b73ad..a3f7a9c3cc69 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1890,7 +1890,8 @@ smb2_writev_callback(struct mid_q_entry *mid)
 /* smb2_async_writev - send an async write, and set up mid to handle result */
 int
-smb2_async_writev(struct cifs_writedata *wdata)
+smb2_async_writev(struct cifs_writedata *wdata,
+                  void (*release)(struct kref *kref))
 {
        int rc = -EACCES;
        struct smb2_write_req *req = NULL;
@@ -1938,7 +1939,7 @@ smb2_async_writev(struct cifs_writedata *wdata)
                                smb2_writev_callback, wdata, 0);
        if (rc) {
-                kref_put(&wdata->refcount, cifs_writedata_release);
+                kref_put(&wdata->refcount, release);
                cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
        }
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index 93adc64666f3..0ce48db20a65 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -123,7 +123,8 @@ extern int SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon,
 extern int smb2_async_readv(struct cifs_readdata *rdata);
 extern int SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
                     unsigned int *nbytes, char **buf, int *buf_type);
-extern int smb2_async_writev(struct cifs_writedata *wdata);
+extern int smb2_async_writev(struct cifs_writedata *wdata,
+                             void (*release)(struct kref *kref));
 extern int SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
                      unsigned int *nbytes, struct kvec *iov, int n_vec);
 extern int SMB2_echo(struct TCP_Server_Info *server);
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index 95c43bb20335..5ac836a86b18 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -176,8 +176,12 @@ int cifs_setxattr(struct dentry *direntry, const char *ea_name,
                        rc = -ENOMEM;
                } else {
                        memcpy(pacl, ea_value, value_size);
-                        rc = set_cifs_acl(pacl, value_size,
+                        if (pTcon->ses->server->ops->set_acl)
-                                direntry->d_inode, full_path, CIFS_ACL_DACL);
+                                rc = pTcon->ses->server->ops->set_acl(pacl,
+                                                value_size, direntry->d_inode,
+                                                full_path, CIFS_ACL_DACL);
+                        else
+                                rc = -EOPNOTSUPP;
                        if (rc == 0) /* force revalidate of the inode */
                                CIFS_I(direntry->d_inode)->time = 0;
                        kfree(pacl);
@@ -323,8 +327,11 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
                        u32 acllen;
                        struct cifs_ntsd *pacl;
-                        pacl = get_cifs_acl(cifs_sb, direntry->d_inode,
+                        if (pTcon->ses->server->ops->get_acl == NULL)
-                                                full_path, &acllen);
+                                goto get_ea_exit; /* rc already EOPNOTSUPP */
+                        pacl = pTcon->ses->server->ops->get_acl(cifs_sb,
+                                        direntry->d_inode, full_path, &acllen);
                        if (IS_ERR(pacl)) {
                                rc = PTR_ERR(pacl);
                                cifs_dbg(VFS, "%s: error %zd getting sec desc\n",
diff --git a/fs/file.c b/fs/file.c
index 771578b33fb6..db25c2bdfe46 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -34,7 +34,7 @@ static void *alloc_fdmem(size_t size)
         * vmalloc() if the allocation size will be considered "large" by the VM.
         */
        if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
-                void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
+                void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY);
                if (data != NULL)
                        return data;
        }
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index be38b573495a..4a48fe4b84b6 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1846,6 +1846,11 @@ int nfs_symlink(struct inode *dir, struct dentry *dentry, const char *symname)
                                                        GFP_KERNEL)) {
                SetPageUptodate(page);
                unlock_page(page);
+                /*
+                 * add_to_page_cache_lru() grabs an extra page refcount.
+                 * Drop it here to avoid leaking this page later.
+                 */
+                page_cache_release(page);
        } else
                __free_page(page);
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index aada5801567a..e2edff38be52 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -7158,7 +7158,7 @@ int ocfs2_truncate_inline(struct inode *inode, struct buffer_head *di_bh,
        if (end > i_size_read(inode))
                end = i_size_read(inode);
-        BUG_ON(start >= end);
+        BUG_ON(start > end);
        if (!(OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) ||
            !(le16_to_cpu(di->i_dyn_features) & OCFS2_INLINE_DATA_FL) ||
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index d77d71ead8d1..8450262bcf2a 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -185,6 +185,9 @@ static int ocfs2_sync_file(struct file *file, loff_t start, loff_t end,
                              file->f_path.dentry->d_name.name,
                              (unsigned long long)datasync);
+        if (ocfs2_is_hard_readonly(osb) || ocfs2_is_soft_readonly(osb))
+                return -EROFS;
        err = filemap_write_and_wait_range(inode->i_mapping, start, end);
        if (err)
                return err;
@@ -474,11 +477,6 @@ static int ocfs2_truncate_file(struct inode *inode,
                goto bail;
        }
-        /* lets handle the simple truncate cases before doing any more
-         * cluster locking. */
-        if (new_i_size == le64_to_cpu(fe->i_size))
-                goto bail;
        down_write(&OCFS2_I(inode)->ip_alloc_sem);
        ocfs2_resv_discard(&osb->osb_la_resmap,
@@ -718,7 +716,8 @@ leave:
 * While a write will already be ordering the data, a truncate will not.
 * Thus, we need to explicitly order the zeroed pages.
 */
-static handle_t *ocfs2_zero_start_ordered_transaction(struct inode *inode)
+static handle_t *ocfs2_zero_start_ordered_transaction(struct inode *inode,
+                                                struct buffer_head *di_bh)
 {
        struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
        handle_t *handle = NULL;
@@ -735,7 +734,14 @@ static handle_t *ocfs2_zero_start_ordered_transaction(struct inode *inode)
        }
        ret = ocfs2_jbd2_file_inode(handle, inode);
-        if (ret < 0)
+        if (ret < 0) {
+                mlog_errno(ret);
+                goto out;
+        }
+        ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), di_bh,
+                                      OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret)
                mlog_errno(ret);
 out:
@@ -751,7 +757,7 @@ out:
 * to be too fragile to do exactly what we need without us having to
 * worry about recursive locking in ->write_begin() and ->write_end(). */
 static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from,
-                                 u64 abs_to)
+                                 u64 abs_to, struct buffer_head *di_bh)
 {
        struct address_space *mapping = inode->i_mapping;
        struct page *page;
@@ -759,6 +765,7 @@ static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from,
        handle_t *handle = NULL;
        int ret = 0;
        unsigned zero_from, zero_to, block_start, block_end;
+        struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
        BUG_ON(abs_from >= abs_to);
        BUG_ON(abs_to > (((u64)index + 1) << PAGE_CACHE_SHIFT));
@@ -801,7 +808,8 @@ static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from,
                }
                if (!handle) {
-                        handle = ocfs2_zero_start_ordered_transaction(inode);
+                        handle = ocfs2_zero_start_ordered_transaction(inode,
+                                                                      di_bh);
                        if (IS_ERR(handle)) {
                                ret = PTR_ERR(handle);
                                handle = NULL;
@@ -818,8 +826,22 @@ static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from,
                        ret = 0;
        }
-        if (handle)
+        if (handle) {
+                /*
+                 * fs-writeback will release the dirty pages without page lock
+                 * whose offset are over inode size, the release happens at
+                 * block_write_full_page_endio().
+                 */
+                i_size_write(inode, abs_to);
+                inode->i_blocks = ocfs2_inode_sector_count(inode);
+                di->i_size = cpu_to_le64((u64)i_size_read(inode));
+                inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+                di->i_mtime = di->i_ctime = cpu_to_le64(inode->i_mtime.tv_sec);
+                di->i_ctime_nsec = cpu_to_le32(inode->i_mtime.tv_nsec);
+                di->i_mtime_nsec = di->i_ctime_nsec;
+                ocfs2_journal_dirty(handle, di_bh);
                ocfs2_commit_trans(OCFS2_SB(inode->i_sb), handle);
+        }
 out_unlock:
        unlock_page(page);
@@ -915,7 +937,7 @@ out:
 * has made sure that the entire range needs zeroing.
 */
 static int ocfs2_zero_extend_range(struct inode *inode, u64 range_start,
-                                   u64 range_end)
+                                   u64 range_end, struct buffer_head *di_bh)
 {
        int rc = 0;
        u64 next_pos;
@@ -931,7 +953,7 @@ static int ocfs2_zero_extend_range(struct inode *inode, u64 range_start,
                next_pos = (zero_pos & PAGE_CACHE_MASK) + PAGE_CACHE_SIZE;
                if (next_pos > range_end)
                        next_pos = range_end;
-                rc = ocfs2_write_zero_page(inode, zero_pos, next_pos);
+                rc = ocfs2_write_zero_page(inode, zero_pos, next_pos, di_bh);
                if (rc < 0) {
                        mlog_errno(rc);
                        break;
@@ -977,7 +999,7 @@ int ocfs2_zero_extend(struct inode *inode, struct buffer_head *di_bh,
                        range_end = zero_to_size;
                ret = ocfs2_zero_extend_range(inode, range_start,
-                                              range_end);
+                                              range_end, di_bh);
                if (ret) {
                        mlog_errno(ret);
                        break;
@@ -1145,14 +1167,14 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr)
                goto bail_unlock_rw;
        }
-        if (size_change && attr->ia_size != i_size_read(inode)) {
+        if (size_change) {
                status = inode_newsize_ok(inode, attr->ia_size);
                if (status)
                        goto bail_unlock;
                inode_dio_wait(inode);
-                if (i_size_read(inode) > attr->ia_size) {
+                if (i_size_read(inode) >= attr->ia_size) {
                        if (ocfs2_should_order_data(inode)) {
                                status = ocfs2_begin_ordered_truncate(inode,
                                                                      attr->ia_size);
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index f4d609be9400..3683643f3f0e 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -664,6 +664,7 @@ static int ocfs2_link(struct dentry *old_dentry,
        struct ocfs2_super *osb = OCFS2_SB(dir->i_sb);
        struct ocfs2_dir_lookup_result lookup = { NULL, };
        sigset_t oldset;
+        u64 old_de_ino;
        trace_ocfs2_link((unsigned long long)OCFS2_I(inode)->ip_blkno,
                         old_dentry->d_name.len, old_dentry->d_name.name,
@@ -686,6 +687,22 @@ static int ocfs2_link(struct dentry *old_dentry,
                goto out;
        }
+        err = ocfs2_lookup_ino_from_name(dir, old_dentry->d_name.name,
+                        old_dentry->d_name.len, &old_de_ino);
+        if (err) {
+                err = -ENOENT;
+                goto out;
+        }
+        /*
+         * Check whether another node removed the source inode while we
+         * were in the vfs.
+         */
+        if (old_de_ino != OCFS2_I(inode)->ip_blkno) {
+                err = -ENOENT;
+                goto out;
+        }
        err = ocfs2_check_dir_for_entry(dir, dentry->d_name.name,
                                        dentry->d_name.len);
        if (err)
diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
index 2ca7ba047f04..88d4585b30f1 100644
--- a/fs/proc/vmcore.c
+++ b/fs/proc/vmcore.c
@@ -468,17 +468,24 @@ static int __init update_note_header_size_elf64(const Elf64_Ehdr *ehdr_ptr)
                        return rc;
                }
                nhdr_ptr = notes_section;
-                while (real_sz < max_sz) {
+                while (nhdr_ptr->n_namesz != 0) {
-                        if (nhdr_ptr->n_namesz == 0)
-                                break;
                        sz = sizeof(Elf64_Nhdr) +
                                ((nhdr_ptr->n_namesz + 3) & ~3) +
                                ((nhdr_ptr->n_descsz + 3) & ~3);
+                        if ((real_sz + sz) > max_sz) {
+                                pr_warn("Warning: Exceeded p_memsz, dropping PT_NOTE entry n_namesz=0x%x, n_descsz=0x%x\n",
+                                        nhdr_ptr->n_namesz, nhdr_ptr->n_descsz);
+                                break;
+                        }
                        real_sz += sz;
                        nhdr_ptr = (Elf64_Nhdr*)((char*)nhdr_ptr + sz);
                }
                kfree(notes_section);
                phdr_ptr->p_memsz = real_sz;
+                if (real_sz == 0) {
+                        pr_warn("Warning: Zero PT_NOTE entries found\n");
+                        return -EINVAL;
+                }
        }
        return 0;
@@ -648,17 +655,24 @@ static int __init update_note_header_size_elf32(const Elf32_Ehdr *ehdr_ptr)
                        return rc;
                }
                nhdr_ptr = notes_section;
-                while (real_sz < max_sz) {
+                while (nhdr_ptr->n_namesz != 0) {
-                        if (nhdr_ptr->n_namesz == 0)
-                                break;
                        sz = sizeof(Elf32_Nhdr) +
                                ((nhdr_ptr->n_namesz + 3) & ~3) +
                                ((nhdr_ptr->n_descsz + 3) & ~3);
+                        if ((real_sz + sz) > max_sz) {
+                                pr_warn("Warning: Exceeded p_memsz, dropping PT_NOTE entry n_namesz=0x%x, n_descsz=0x%x\n",
+                                        nhdr_ptr->n_namesz, nhdr_ptr->n_descsz);
+                                break;
+                        }
                        real_sz += sz;
                        nhdr_ptr = (Elf32_Nhdr*)((char*)nhdr_ptr + sz);
                }
                kfree(notes_section);
                phdr_ptr->p_memsz = real_sz;
+                if (real_sz == 0) {
+                        pr_warn("Warning: Zero PT_NOTE entries found\n");
+                        return -EINVAL;
+                }
        }
        return 0;
diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h
index 2f0543f7510c..f9bbbb472663 100644
--- a/include/linux/can/skb.h
+++ b/include/linux/can/skb.h
@@ -11,7 +11,9 @@
 #define CAN_SKB_H
 #include <linux/types.h>
+#include <linux/skbuff.h>
 #include <linux/can.h>
+#include <net/sock.h>
 /*
 * The struct can_skb_priv is used to transport additional information along
@@ -42,4 +44,40 @@ static inline void can_skb_reserve(struct sk_buff *skb)
        skb_reserve(skb, sizeof(struct can_skb_priv));
 }
+static inline void can_skb_destructor(struct sk_buff *skb)
+{
+        sock_put(skb->sk);
+}
+static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk)
+{
+        if (sk) {
+                sock_hold(sk);
+                skb->destructor = can_skb_destructor;
+                skb->sk = sk;
+        }
+}
+/*
+ * returns an unshared skb owned by the original sock to be echo'ed back
+ */
+static inline struct sk_buff *can_create_echo_skb(struct sk_buff *skb)
+{
+        if (skb_shared(skb)) {
+                struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
+                if (likely(nskb)) {
+                        can_skb_set_owner(nskb, skb->sk);
+                        consume_skb(skb);
+                        return nskb;
+                } else {
+                        kfree_skb(skb);
+                        return NULL;
+                }
+        }
+        /* we can assume to have an unshared skb with proper owner */
+        return skb;
+}
 #endif /* CAN_SKB_H */
diff --git a/include/linux/of.h b/include/linux/of.h
index 70c64ba17fa5..435cb995904d 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -169,35 +169,15 @@ static inline const char *of_node_full_name(const struct device_node *np)
 extern struct device_node *of_find_node_by_name(struct device_node *from,
        const char *name);
-#define for_each_node_by_name(dn, name) \
-        for (dn = of_find_node_by_name(NULL, name); dn; \
-             dn = of_find_node_by_name(dn, name))
 extern struct device_node *of_find_node_by_type(struct device_node *from,
        const char *type);
-#define for_each_node_by_type(dn, type) \
-        for (dn = of_find_node_by_type(NULL, type); dn; \
-             dn = of_find_node_by_type(dn, type))
 extern struct device_node *of_find_compatible_node(struct device_node *from,
        const char *type, const char *compat);
-#define for_each_compatible_node(dn, type, compatible) \
-        for (dn = of_find_compatible_node(NULL, type, compatible); dn; \
-             dn = of_find_compatible_node(dn, type, compatible))
 extern struct device_node *of_find_matching_node_and_match(
        struct device_node *from,
        const struct of_device_id *matches,
        const struct of_device_id **match);
-static inline struct device_node *of_find_matching_node(
-        struct device_node *from,
-        const struct of_device_id *matches)
-{
-        return of_find_matching_node_and_match(from, matches, NULL);
-}
-#define for_each_matching_node(dn, matches) \
-        for (dn = of_find_matching_node(NULL, matches); dn; \
-             dn = of_find_matching_node(dn, matches))
-#define for_each_matching_node_and_match(dn, matches, match) \
-        for (dn = of_find_matching_node_and_match(NULL, matches, match); \
-             dn; dn = of_find_matching_node_and_match(dn, matches, match))
 extern struct device_node *of_find_node_by_path(const char *path);
 extern struct device_node *of_find_node_by_phandle(phandle handle);
 extern struct device_node *of_get_parent(const struct device_node *node);
@@ -209,43 +189,11 @@ extern struct device_node *of_get_next_available_child(
 extern struct device_node *of_get_child_by_name(const struct device_node *node,
                                        const char *name);
-#define for_each_child_of_node(parent, child) \
-        for (child = of_get_next_child(parent, NULL); child != NULL; \
-             child = of_get_next_child(parent, child))
-#define for_each_available_child_of_node(parent, child) \
-        for (child = of_get_next_available_child(parent, NULL); child != NULL; \
-             child = of_get_next_available_child(parent, child))
-static inline int of_get_child_count(const struct device_node *np)
-{
-        struct device_node *child;
-        int num = 0;
-        for_each_child_of_node(np, child)
-                num++;
-        return num;
-}
-static inline int of_get_available_child_count(const struct device_node *np)
-{
-        struct device_node *child;
-        int num = 0;
-        for_each_available_child_of_node(np, child)
-                num++;
-        return num;
-}
 /* cache lookup */
 extern struct device_node *of_find_next_cache_node(const struct device_node *);
 extern struct device_node *of_find_node_with_property(
        struct device_node *from, const char *prop_name);
-#define for_each_node_with_property(dn, prop_name) \
-        for (dn = of_find_node_with_property(NULL, prop_name); dn; \
-             dn = of_find_node_with_property(dn, prop_name))
 extern struct property *of_find_property(const struct device_node *np,
                                         const char *name,
@@ -367,42 +315,53 @@ static inline struct device_node *of_find_node_by_name(struct device_node *from,
        return NULL;
 }
-static inline struct device_node *of_get_parent(const struct device_node *node)
+static inline struct device_node *of_find_node_by_type(struct device_node *from,
+        const char *type)
 {
        return NULL;
 }
-static inline bool of_have_populated_dt(void)
+static inline struct device_node *of_find_matching_node_and_match(
+        struct device_node *from,
+        const struct of_device_id *matches,
+        const struct of_device_id **match)
 {
-        return false;
+        return NULL;
 }
-/* Kill an unused variable warning on a device_node pointer */
+static inline struct device_node *of_get_parent(const struct device_node *node)
-static inline void __of_use_dn(const struct device_node *np)
 {
+        return NULL;
 }
-#define for_each_child_of_node(parent, child) \
+static inline struct device_node *of_get_next_child(
-        while (__of_use_dn(parent), __of_use_dn(child), 0)
+        const struct device_node *node, struct device_node *prev)
+{
+        return NULL;
+}
-#define for_each_available_child_of_node(parent, child) \
+static inline struct device_node *of_get_next_available_child(
-        while (0)
+        const struct device_node *node, struct device_node *prev)
+{
+        return NULL;
+}
-static inline struct device_node *of_get_child_by_name(
+static inline struct device_node *of_find_node_with_property(
-                                        const struct device_node *node,
+        struct device_node *from, const char *prop_name)
-                                        const char *name)
 {
        return NULL;
 }
-static inline int of_get_child_count(const struct device_node *np)
+static inline bool of_have_populated_dt(void)
 {
-        return 0;
+        return false;
 }
-static inline int of_get_available_child_count(const struct device_node *np)
+static inline struct device_node *of_get_child_by_name(
+                                        const struct device_node *node,
+                                        const char *name)
 {
-        return 0;
+        return NULL;
 }
 static inline int of_device_is_compatible(const struct device_node *device,
@@ -569,6 +528,13 @@ extern int of_node_to_nid(struct device_node *np);
 static inline int of_node_to_nid(struct device_node *device) { return 0; }
 #endif
+static inline struct device_node *of_find_matching_node(
+        struct device_node *from,
+        const struct of_device_id *matches)
+{
+        return of_find_matching_node_and_match(from, matches, NULL);
+}
 /**
 * of_property_read_bool - Findfrom a property
 * @np:         device node from which the property value is to be read.
@@ -618,6 +584,55 @@ static inline int of_property_read_u32(const struct device_node *np,
                s;                                              \
                s = of_prop_next_string(prop, s))
+#define for_each_node_by_name(dn, name) \
+        for (dn = of_find_node_by_name(NULL, name); dn; \
+             dn = of_find_node_by_name(dn, name))
+#define for_each_node_by_type(dn, type) \
+        for (dn = of_find_node_by_type(NULL, type); dn; \
+             dn = of_find_node_by_type(dn, type))
+#define for_each_compatible_node(dn, type, compatible) \
+        for (dn = of_find_compatible_node(NULL, type, compatible); dn; \
+             dn = of_find_compatible_node(dn, type, compatible))
+#define for_each_matching_node(dn, matches) \
+        for (dn = of_find_matching_node(NULL, matches); dn; \
+             dn = of_find_matching_node(dn, matches))
+#define for_each_matching_node_and_match(dn, matches, match) \
+        for (dn = of_find_matching_node_and_match(NULL, matches, match); \
+             dn; dn = of_find_matching_node_and_match(dn, matches, match))
+#define for_each_child_of_node(parent, child) \
+        for (child = of_get_next_child(parent, NULL); child != NULL; \
+             child = of_get_next_child(parent, child))
+#define for_each_available_child_of_node(parent, child) \
+        for (child = of_get_next_available_child(parent, NULL); child != NULL; \
+             child = of_get_next_available_child(parent, child))
+#define for_each_node_with_property(dn, prop_name) \
+        for (dn = of_find_node_with_property(NULL, prop_name); dn; \
+             dn = of_find_node_with_property(dn, prop_name))
+static inline int of_get_child_count(const struct device_node *np)
+{
+        struct device_node *child;
+        int num = 0;
+        for_each_child_of_node(np, child)
+                num++;
+        return num;
+}
+static inline int of_get_available_child_count(const struct device_node *np)
+{
+        struct device_node *child;
+        int num = 0;
+        for_each_available_child_of_node(np, child)
+                num++;
+        return num;
+}
 #if defined(CONFIG_PROC_FS) && defined(CONFIG_PROC_DEVICETREE)
 extern void proc_device_tree_add_node(struct device_node *, struct proc_dir_entry *);
 extern void proc_device_tree_add_prop(struct proc_dir_entry *pde, struct property *prop);
diff --git a/include/linux/of_device.h b/include/linux/of_device.h
index 8d7dd6768cb7..ef370210ffb2 100644
--- a/include/linux/of_device.h
+++ b/include/linux/of_device.h
@@ -78,11 +78,13 @@ static inline int of_device_uevent_modalias(struct device *dev,
 static inline void of_device_node_put(struct device *dev) { }
-static inline const struct of_device_id *of_match_device(
+static inline const struct of_device_id *__of_match_device(
                const struct of_device_id *matches, const struct device *dev)
 {
        return NULL;
 }
+#define of_match_device(matches, dev)   \
+        __of_match_device(of_match_ptr(matches), (dev))
 static inline struct device_node *of_cpu_device_node_get(int cpu)
 {
diff --git a/include/linux/smp.h b/include/linux/smp.h
index 3834f43f9993..6ae004e437ea 100644
--- a/include/linux/smp.h
+++ b/include/linux/smp.h
@@ -188,6 +188,9 @@ static inline void kick_all_cpus_sync(void) {  }
 */
 extern void arch_disable_smp_support(void);
+extern void arch_enable_nonboot_cpus_begin(void);
+extern void arch_enable_nonboot_cpus_end(void);
 void smp_setup_processor_id(void);
 #endif /* __LINUX_SMP_H */
diff --git a/include/net/datalink.h b/include/net/datalink.h
index deb7ca75db48..93cb18f729b5 100644
--- a/include/net/datalink.h
+++ b/include/net/datalink.h
@@ -15,4 +15,6 @@ struct datalink_proto {
        struct list_head node;
 };
+struct datalink_proto *make_EII_client(void);
+void destroy_EII_client(struct datalink_proto *dl);
 #endif
diff --git a/include/net/dn.h b/include/net/dn.h
index ccc15588d108..913b73d239f5 100644
--- a/include/net/dn.h
+++ b/include/net/dn.h
@@ -200,6 +200,8 @@ static inline void dn_sk_ports_copy(struct flowidn *fld, struct dn_scp *scp)
 }
 unsigned int dn_mss_from_pmtu(struct net_device *dev, int mtu);
+void dn_register_sysctl(void);
+void dn_unregister_sysctl(void);
 #define DN_MENUVER_ACC 0x01
 #define DN_MENUVER_USR 0x02
diff --git a/include/net/dn_route.h b/include/net/dn_route.h
index b409ad6b8d7a..55df9939bca2 100644
--- a/include/net/dn_route.h
+++ b/include/net/dn_route.h
@@ -20,6 +20,8 @@ int dn_route_output_sock(struct dst_entry __rcu **pprt, struct flowidn *,
                         struct sock *sk, int flags);
 int dn_cache_dump(struct sk_buff *skb, struct netlink_callback *cb);
 void dn_rt_cache_flush(int delay);
+int dn_route_rcv(struct sk_buff *skb, struct net_device *dev,
+                 struct packet_type *pt, struct net_device *orig_dev);
 /* Masks for flags field */
 #define DN_RT_F_PID 0x07 /* Mask for packet type                      */
diff --git a/include/net/ethoc.h b/include/net/ethoc.h
index 96f3789b27bc..2a2d6bb34eb8 100644
--- a/include/net/ethoc.h
+++ b/include/net/ethoc.h
@@ -16,6 +16,7 @@
 struct ethoc_platform_data {
        u8 hwaddr[IFHWADDRLEN];
        s8 phy_id;
+        u32 eth_clkfreq;
 };
 #endif /* !LINUX_NET_ETHOC_H */
diff --git a/include/net/ipx.h b/include/net/ipx.h
index 9e9e35465baf..0143180fecc9 100644
--- a/include/net/ipx.h
+++ b/include/net/ipx.h
@@ -140,6 +140,17 @@ static __inline__ void ipxitf_hold(struct ipx_interface *intrfc)
 }
 void ipxitf_down(struct ipx_interface *intrfc);
+struct ipx_interface *ipxitf_find_using_net(__be32 net);
+int ipxitf_send(struct ipx_interface *intrfc, struct sk_buff *skb, char *node);
+__be16 ipx_cksum(struct ipxhdr *packet, int length);
+int ipxrtr_add_route(__be32 network, struct ipx_interface *intrfc,
+                     unsigned char *node);
+void ipxrtr_del_routes(struct ipx_interface *intrfc);
+int ipxrtr_route_packet(struct sock *sk, struct sockaddr_ipx *usipx,
+                        struct iovec *iov, size_t len, int noblock);
+int ipxrtr_route_skb(struct sk_buff *skb);
+struct ipx_route *ipxrtr_lookup(__be32 net);
+int ipxrtr_ioctl(unsigned int cmd, void __user *arg);
 static __inline__ void ipxitf_put(struct ipx_interface *intrfc)
 {
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index da68c9a90ac5..991dcd94cbbf 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -162,6 +162,14 @@ extern struct list_head net_namespace_list;
 struct net *get_net_ns_by_pid(pid_t pid);
 struct net *get_net_ns_by_fd(int pid);
+#ifdef CONFIG_SYSCTL
+void ipx_register_sysctl(void);
+void ipx_unregister_sysctl(void);
+#else
+#define ipx_register_sysctl()
+#define ipx_unregister_sysctl()
+#endif
 #ifdef CONFIG_NET_NS
 void __put_net(struct net *net);
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 01ea6eed1bb1..b2ac6246b7e0 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -284,6 +284,8 @@ extern unsigned int nf_conntrack_max;
 extern unsigned int nf_conntrack_hash_rnd;
 void init_nf_conntrack_hash_rnd(void);
+void nf_conntrack_tmpl_insert(struct net *net, struct nf_conn *tmpl);
 #define NF_CT_STAT_INC(net, count)        __this_cpu_inc((net)->ct.stat->count)
 #define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count)
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 57c8ff7955df..e7e14ffe0f6a 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -252,6 +252,7 @@ void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
 *      @owner: module reference
 *      @policy: netlink attribute policy
 *      @maxattr: highest netlink attribute number
+ *      @family: address family for AF-specific types
 */
 struct nft_expr_type {
        const struct nft_expr_ops       *(*select_ops)(const struct nft_ctx *,
@@ -262,6 +263,7 @@ struct nft_expr_type {
        struct module                   *owner;
        const struct nla_policy         *policy;
        unsigned int                    maxattr;
+        u8                              family;
 };
 /**
@@ -320,7 +322,6 @@ static inline void *nft_expr_priv(const struct nft_expr *expr)
 *      struct nft_rule - nf_tables rule
 *
 *      @list: used internally
- *      @rcu_head: used internally for rcu
 *      @handle: rule handle
 *      @genmask: generation mask
 *      @dlen: length of expression data
@@ -328,7 +329,6 @@ static inline void *nft_expr_priv(const struct nft_expr *expr)
 */
 struct nft_rule {
        struct list_head                list;
-        struct rcu_head                 rcu_head;
        u64                             handle:46,
                                        genmask:2,
                                        dlen:16;
@@ -389,7 +389,6 @@ enum nft_chain_flags {
 *
 *      @rules: list of rules in the chain
 *      @list: used internally
- *      @rcu_head: used internally
 *      @net: net namespace that this chain belongs to
 *      @table: table that this chain belongs to
 *      @handle: chain handle
@@ -401,7 +400,6 @@ enum nft_chain_flags {
 struct nft_chain {
        struct list_head                rules;
        struct list_head                list;
-        struct rcu_head                 rcu_head;
        struct net                      *net;
        struct nft_table                *table;
        u64                             handle;
@@ -529,6 +527,9 @@ void nft_unregister_expr(struct nft_expr_type *);
 #define MODULE_ALIAS_NFT_CHAIN(family, name) \
        MODULE_ALIAS("nft-chain-" __stringify(family) "-" name)
+#define MODULE_ALIAS_NFT_AF_EXPR(family, name) \
+        MODULE_ALIAS("nft-expr-" __stringify(family) "-" name)
 #define MODULE_ALIAS_NFT_EXPR(name) \
        MODULE_ALIAS("nft-expr-" name)
diff --git a/include/net/netfilter/nft_reject.h b/include/net/netfilter/nft_reject.h
new file mode 100644
index 000000000000..36b0da2d55bb
--- /dev/null
+++ b/include/net/netfilter/nft_reject.h
@@ -0,0 +1,25 @@
+#ifndef _NFT_REJECT_H_
+#define _NFT_REJECT_H_
+struct nft_reject {
+        enum nft_reject_types   type:8;
+        u8                      icmp_code;
+};
+extern const struct nla_policy nft_reject_policy[];
+int nft_reject_init(const struct nft_ctx *ctx,
+                    const struct nft_expr *expr,
+                    const struct nlattr * const tb[]);
+int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr);
+void nft_reject_ipv4_eval(const struct nft_expr *expr,
+                          struct nft_data data[NFT_REG_MAX + 1],
+                          const struct nft_pktinfo *pkt);
+void nft_reject_ipv6_eval(const struct nft_expr *expr,
+                          struct nft_data data[NFT_REG_MAX + 1],
+                          const struct nft_pktinfo *pkt);
+#endif
diff --git a/include/uapi/linux/in6.h b/include/uapi/linux/in6.h
index 633b93cac1ed..e9a1d2d973b6 100644
--- a/include/uapi/linux/in6.h
+++ b/include/uapi/linux/in6.h
@@ -128,22 +128,13 @@ struct in6_flowlabel_req {
 *      IPV6 extension headers
 */
 #if __UAPI_DEF_IPPROTO_V6
-enum {
+#define IPPROTO_HOPOPTS         0       /* IPv6 hop-by-hop options      */
-  IPPROTO_HOPOPTS = 0,          /* IPv6 hop-by-hop options      */
+#define IPPROTO_ROUTING         43      /* IPv6 routing header          */
-#define IPPROTO_HOPOPTS         IPPROTO_HOPOPTS
+#define IPPROTO_FRAGMENT        44      /* IPv6 fragmentation header    */
-  IPPROTO_ROUTING = 43,         /* IPv6 routing header          */
+#define IPPROTO_ICMPV6          58      /* ICMPv6                       */
-#define IPPROTO_ROUTING         IPPROTO_ROUTING
+#define IPPROTO_NONE            59      /* IPv6 no next header          */
-  IPPROTO_FRAGMENT = 44,        /* IPv6 fragmentation header    */
+#define IPPROTO_DSTOPTS         60      /* IPv6 destination options     */
-#define IPPROTO_FRAGMENT        IPPROTO_FRAGMENT
+#define IPPROTO_MH              135     /* IPv6 mobility header         */
-  IPPROTO_ICMPV6 = 58,          /* ICMPv6                       */
-#define IPPROTO_ICMPV6          IPPROTO_ICMPV6
-  IPPROTO_NONE = 59,            /* IPv6 no next header          */
-#define IPPROTO_NONE            IPPROTO_NONE
-  IPPROTO_DSTOPTS = 60,         /* IPv6 destination options     */
-#define IPPROTO_DSTOPTS         IPPROTO_DSTOPTS
-  IPPROTO_MH = 135,             /* IPv6 mobility header         */
-#define IPPROTO_MH              IPPROTO_MH
-};
 #endif /* __UAPI_DEF_IPPROTO_V6 */
 /*
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 4f08a2d61487..2f2f34a4e77d 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -945,8 +945,10 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
                         * to it. Similarly, page lock is shifted.
                         */
                        if (hpage != p) {
-                                put_page(hpage);
+                                if (!(flags & MF_COUNT_INCREASED)) {
-                                get_page(p);
+                                        put_page(hpage);
+                                        get_page(p);
+                                }
                                lock_page(p);
                                unlock_page(hpage);
                                *hpagep = p;
diff --git a/mm/slub.c b/mm/slub.c
index 7e3e0458bce4..25f14ad8f817 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1004,21 +1004,19 @@ static inline void slab_free_hook(struct kmem_cache *s, void *x)
 static void add_full(struct kmem_cache *s,
        struct kmem_cache_node *n, struct page *page)
 {
-        lockdep_assert_held(&n->list_lock);
        if (!(s->flags & SLAB_STORE_USER))
                return;
+        lockdep_assert_held(&n->list_lock);
        list_add(&page->lru, &n->full);
 }
 static void remove_full(struct kmem_cache *s, struct kmem_cache_node *n, struct page *page)
 {
-        lockdep_assert_held(&n->list_lock);
        if (!(s->flags & SLAB_STORE_USER))
                return;
+        lockdep_assert_held(&n->list_lock);
        list_del(&page->lru);
 }
@@ -1520,11 +1518,9 @@ static void discard_slab(struct kmem_cache *s, struct page *page)
 /*
 * Management of partially allocated slabs.
 */
-static inline void add_partial(struct kmem_cache_node *n,
+static inline void
-                                struct page *page, int tail)
+__add_partial(struct kmem_cache_node *n, struct page *page, int tail)
 {
-        lockdep_assert_held(&n->list_lock);
        n->nr_partial++;
        if (tail == DEACTIVATE_TO_TAIL)
                list_add_tail(&page->lru, &n->partial);
@@ -1532,15 +1528,27 @@ static inline void add_partial(struct kmem_cache_node *n,
                list_add(&page->lru, &n->partial);
 }
-static inline void remove_partial(struct kmem_cache_node *n,
+static inline void add_partial(struct kmem_cache_node *n,
-                                        struct page *page)
+                                struct page *page, int tail)
 {
        lockdep_assert_held(&n->list_lock);
+        __add_partial(n, page, tail);
+}
+static inline void
+__remove_partial(struct kmem_cache_node *n, struct page *page)
+{
        list_del(&page->lru);
        n->nr_partial--;
 }
+static inline void remove_partial(struct kmem_cache_node *n,
+                                        struct page *page)
+{
+        lockdep_assert_held(&n->list_lock);
+        __remove_partial(n, page);
+}
 /*
 * Remove slab from the partial list, freeze it and
 * return the pointer to the freelist.
@@ -2906,12 +2914,10 @@ static void early_kmem_cache_node_alloc(int node)
        inc_slabs_node(kmem_cache_node, node, page->objects);
        /*
-         * the lock is for lockdep's sake, not for any actual
+         * No locks need to be taken here as it has just been
-         * race protection
+         * initialized and there is no concurrent access.
         */
-        spin_lock(&n->list_lock);
+        __add_partial(n, page, DEACTIVATE_TO_HEAD);
-        add_partial(n, page, DEACTIVATE_TO_HEAD);
-        spin_unlock(&n->list_lock);
 }
 static void free_kmem_cache_nodes(struct kmem_cache *s)
@@ -3197,7 +3203,7 @@ static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
        list_for_each_entry_safe(page, h, &n->partial, lru) {
                if (!page->inuse) {
-                        remove_partial(n, page);
+                        __remove_partial(n, page);
                        discard_slab(s, page);
                } else {
                        list_slab_objects(s, page,
diff --git a/net/9p/client.c b/net/9p/client.c
index a5e4d2dcb03e..9186550d77a6 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -204,7 +204,7 @@ free_and_return:
        return ret;
 }
-struct p9_fcall *p9_fcall_alloc(int alloc_msize)
+static struct p9_fcall *p9_fcall_alloc(int alloc_msize)
 {
        struct p9_fcall *fc;
        fc = kmalloc(sizeof(struct p9_fcall) + alloc_msize, GFP_NOFS);
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index cd1e1ede73a4..ac2666c1d011 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -340,7 +340,10 @@ static int p9_get_mapped_pages(struct virtio_chan *chan,
                int count = nr_pages;
                while (nr_pages) {
                        s = rest_of_page(data);
-                        pages[index++] = kmap_to_page(data);
+                        if (is_vmalloc_addr(data))
+                                pages[index++] = vmalloc_to_page(data);
+                        else
+                                pages[index++] = kmap_to_page(data);
                        data += s;
                        nr_pages--;
                }
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index e4401a531afb..63f0455c0bc3 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -187,8 +187,7 @@ static int br_set_mac_address(struct net_device *dev, void *p)
        spin_lock_bh(&br->lock);
        if (!ether_addr_equal(dev->dev_addr, addr->sa_data)) {
-                memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
+                /* Mac address will be changed in br_stp_change_bridge_id(). */
-                br_fdb_change_mac_address(br, addr->sa_data);
                br_stp_change_bridge_id(br, addr->sa_data);
        }
        spin_unlock_bh(&br->lock);
@@ -226,6 +225,33 @@ static void br_netpoll_cleanup(struct net_device *dev)
                br_netpoll_disable(p);
 }
+static int __br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
+{
+        struct netpoll *np;
+        int err;
+        np = kzalloc(sizeof(*p->np), gfp);
+        if (!np)
+                return -ENOMEM;
+        err = __netpoll_setup(np, p->dev, gfp);
+        if (err) {
+                kfree(np);
+                return err;
+        }
+        p->np = np;
+        return err;
+}
+int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
+{
+        if (!p->br->dev->npinfo)
+                return 0;
+        return __br_netpoll_enable(p, gfp);
+}
 static int br_netpoll_setup(struct net_device *dev, struct netpoll_info *ni,
                            gfp_t gfp)
 {
@@ -236,7 +262,7 @@ static int br_netpoll_setup(struct net_device *dev, struct netpoll_info *ni,
        list_for_each_entry(p, &br->port_list, list) {
                if (!p->dev)
                        continue;
-                err = br_netpoll_enable(p, gfp);
+                err = __br_netpoll_enable(p, gfp);
                if (err)
                        goto fail;
        }
@@ -249,28 +275,6 @@ fail:
        goto out;
 }
-int br_netpoll_enable(struct net_bridge_port *p, gfp_t gfp)
-{
-        struct netpoll *np;
-        int err;
-        if (!p->br->dev->npinfo)
-                return 0;
-        np = kzalloc(sizeof(*p->np), gfp);
-        if (!np)
-                return -ENOMEM;
-        err = __netpoll_setup(np, p->dev, gfp);
-        if (err) {
-                kfree(np);
-                return err;
-        }
-        p->np = np;
-        return err;
-}
 void br_netpoll_disable(struct net_bridge_port *p)
 {
        struct netpoll *np = p->np;
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index c5f5a4a933f4..9203d5a1943f 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -27,6 +27,9 @@
 #include "br_private.h"
 static struct kmem_cache *br_fdb_cache __read_mostly;
+static struct net_bridge_fdb_entry *fdb_find(struct hlist_head *head,
+                                             const unsigned char *addr,
+                                             __u16 vid);
 static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                      const unsigned char *addr, u16 vid);
 static void fdb_notify(struct net_bridge *br,
@@ -89,11 +92,57 @@ static void fdb_delete(struct net_bridge *br, struct net_bridge_fdb_entry *f)
        call_rcu(&f->rcu, fdb_rcu_free);
 }
+/* Delete a local entry if no other port had the same address. */
+static void fdb_delete_local(struct net_bridge *br,
+                             const struct net_bridge_port *p,
+                             struct net_bridge_fdb_entry *f)
+{
+        const unsigned char *addr = f->addr.addr;
+        u16 vid = f->vlan_id;
+        struct net_bridge_port *op;
+        /* Maybe another port has same hw addr? */
+        list_for_each_entry(op, &br->port_list, list) {
+                if (op != p && ether_addr_equal(op->dev->dev_addr, addr) &&
+                    (!vid || nbp_vlan_find(op, vid))) {
+                        f->dst = op;
+                        f->added_by_user = 0;
+                        return;
+                }
+        }
+        /* Maybe bridge device has same hw addr? */
+        if (p && ether_addr_equal(br->dev->dev_addr, addr) &&
+            (!vid || br_vlan_find(br, vid))) {
+                f->dst = NULL;
+                f->added_by_user = 0;
+                return;
+        }
+        fdb_delete(br, f);
+}
+void br_fdb_find_delete_local(struct net_bridge *br,
+                              const struct net_bridge_port *p,
+                              const unsigned char *addr, u16 vid)
+{
+        struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
+        struct net_bridge_fdb_entry *f;
+        spin_lock_bh(&br->hash_lock);
+        f = fdb_find(head, addr, vid);
+        if (f && f->is_local && !f->added_by_user && f->dst == p)
+                fdb_delete_local(br, p, f);
+        spin_unlock_bh(&br->hash_lock);
+}
 void br_fdb_changeaddr(struct net_bridge_port *p, const unsigned char *newaddr)
 {
        struct net_bridge *br = p->br;
-        bool no_vlan = (nbp_get_vlan_info(p) == NULL) ? true : false;
+        struct net_port_vlans *pv = nbp_get_vlan_info(p);
+        bool no_vlan = !pv;
        int i;
+        u16 vid;
        spin_lock_bh(&br->hash_lock);
@@ -104,38 +153,34 @@ void br_fdb_changeaddr(struct net_bridge_port *p, const unsigned char *newaddr)
                        struct net_bridge_fdb_entry *f;
                        f = hlist_entry(h, struct net_bridge_fdb_entry, hlist);
-                        if (f->dst == p && f->is_local) {
+                        if (f->dst == p && f->is_local && !f->added_by_user) {
-                                /* maybe another port has same hw addr? */
-                                struct net_bridge_port *op;
-                                u16 vid = f->vlan_id;
-                                list_for_each_entry(op, &br->port_list, list) {
-                                        if (op != p &&
-                                            ether_addr_equal(op->dev->dev_addr,
-                                                             f->addr.addr) &&
-                                            nbp_vlan_find(op, vid)) {
-                                                f->dst = op;
-                                                goto insert;
-                                        }
-                                }
                                /* delete old one */
-                                fdb_delete(br, f);
+                                fdb_delete_local(br, p, f);
-insert:
-                                /* insert new address,  may fail if invalid
-                                 * address or dup.
-                                 */
-                                fdb_insert(br, p, newaddr, vid);
                                /* if this port has no vlan information
                                 * configured, we can safely be done at
                                 * this point.
                                 */
                                if (no_vlan)
-                                        goto done;
+                                        goto insert;
                        }
                }
        }
+insert:
+        /* insert new address,  may fail if invalid address or dup. */
+        fdb_insert(br, p, newaddr, 0);
+        if (no_vlan)
+                goto done;
+        /* Now add entries for every VLAN configured on the port.
+         * This function runs under RTNL so the bitmap will not change
+         * from under us.
+         */
+        for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID)
+                fdb_insert(br, p, newaddr, vid);
 done:
        spin_unlock_bh(&br->hash_lock);
 }
@@ -146,10 +191,12 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
        struct net_port_vlans *pv;
        u16 vid = 0;
+        spin_lock_bh(&br->hash_lock);
        /* If old entry was unassociated with any port, then delete it. */
        f = __br_fdb_get(br, br->dev->dev_addr, 0);
        if (f && f->is_local && !f->dst)
-                fdb_delete(br, f);
+                fdb_delete_local(br, NULL, f);
        fdb_insert(br, NULL, newaddr, 0);
@@ -159,14 +206,16 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
         */
        pv = br_get_vlan_info(br);
        if (!pv)
-                return;
+                goto out;
        for_each_set_bit_from(vid, pv->vlan_bitmap, VLAN_N_VID) {
                f = __br_fdb_get(br, br->dev->dev_addr, vid);
                if (f && f->is_local && !f->dst)
-                        fdb_delete(br, f);
+                        fdb_delete_local(br, NULL, f);
                fdb_insert(br, NULL, newaddr, vid);
        }
+out:
+        spin_unlock_bh(&br->hash_lock);
 }
 void br_fdb_cleanup(unsigned long _data)
@@ -235,25 +284,11 @@ void br_fdb_delete_by_port(struct net_bridge *br,
                        if (f->is_static && !do_all)
                                continue;
-                        /*
-                         * if multiple ports all have the same device address
-                         * then when one port is deleted, assign
-                         * the local entry to other port
-                         */
-                        if (f->is_local) {
-                                struct net_bridge_port *op;
-                                list_for_each_entry(op, &br->port_list, list) {
-                                        if (op != p &&
-                                            ether_addr_equal(op->dev->dev_addr,
-                                                             f->addr.addr)) {
-                                                f->dst = op;
-                                                goto skip_delete;
-                                        }
-                                }
-                        }
-                        fdb_delete(br, f);
+                        if (f->is_local)
-                skip_delete: ;
+                                fdb_delete_local(br, p, f);
+                        else
+                                fdb_delete(br, f);
                }
        }
        spin_unlock_bh(&br->hash_lock);
@@ -397,6 +432,7 @@ static struct net_bridge_fdb_entry *fdb_create(struct hlist_head *head,
                fdb->vlan_id = vid;
                fdb->is_local = 0;
                fdb->is_static = 0;
+                fdb->added_by_user = 0;
                fdb->updated = fdb->used = jiffies;
                hlist_add_head_rcu(&fdb->hlist, head);
        }
@@ -447,7 +483,7 @@ int br_fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
 }
 void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
-                   const unsigned char *addr, u16 vid)
+                   const unsigned char *addr, u16 vid, bool added_by_user)
 {
        struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
        struct net_bridge_fdb_entry *fdb;
@@ -473,13 +509,18 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
                        /* fastpath: update of existing entry */
                        fdb->dst = source;
                        fdb->updated = jiffies;
+                        if (unlikely(added_by_user))
+                                fdb->added_by_user = 1;
                }
        } else {
                spin_lock(&br->hash_lock);
                if (likely(!fdb_find(head, addr, vid))) {
                        fdb = fdb_create(head, source, addr, vid);
-                        if (fdb)
+                        if (fdb) {
+                                if (unlikely(added_by_user))
+                                        fdb->added_by_user = 1;
                                fdb_notify(br, fdb, RTM_NEWNEIGH);
+                        }
                }
                /* else  we lose race and someone else inserts
                 * it first, don't bother updating
@@ -647,6 +688,7 @@ static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
                modified = true;
        }
+        fdb->added_by_user = 1;
        fdb->used = jiffies;
        if (modified) {
@@ -664,7 +706,7 @@ static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge_port *p,
        if (ndm->ndm_flags & NTF_USE) {
                rcu_read_lock();
-                br_fdb_update(p->br, p, addr, vid);
+                br_fdb_update(p->br, p, addr, vid, true);
                rcu_read_unlock();
        } else {
                spin_lock_bh(&p->br->hash_lock);
@@ -749,8 +791,7 @@ out:
        return err;
 }
-int fdb_delete_by_addr(struct net_bridge *br, const u8 *addr,
+static int fdb_delete_by_addr(struct net_bridge *br, const u8 *addr, u16 vlan)
-                       u16 vlan)
 {
        struct hlist_head *head = &br->hash[br_mac_hash(addr, vlan)];
        struct net_bridge_fdb_entry *fdb;
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index cffe1d666ba1..54d207d3a31c 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -389,6 +389,9 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
        if (br->dev->needed_headroom < dev->needed_headroom)
                br->dev->needed_headroom = dev->needed_headroom;
+        if (br_fdb_insert(br, p, dev->dev_addr, 0))
+                netdev_err(dev, "failed insert local address bridge forwarding table\n");
        spin_lock_bh(&br->lock);
        changed_addr = br_stp_recalculate_bridge_id(br);
@@ -404,9 +407,6 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
        dev_set_mtu(br->dev, br_min_mtu(br));
-        if (br_fdb_insert(br, p, dev->dev_addr, 0))
-                netdev_err(dev, "failed insert local address bridge forwarding table\n");
        kobject_uevent(&p->kobj, KOBJ_ADD);
        return 0;
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index bf8dc7d308d6..28d544627422 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -77,7 +77,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
        /* insert into forwarding database after filtering to avoid spoofing */
        br = p->br;
        if (p->flags & BR_LEARNING)
-                br_fdb_update(br, p, eth_hdr(skb)->h_source, vid);
+                br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, false);
        if (!is_broadcast_ether_addr(dest) && is_multicast_ether_addr(dest) &&
            br_multicast_rcv(br, p, skb, vid))
@@ -148,7 +148,7 @@ static int br_handle_local_finish(struct sk_buff *skb)
        br_vlan_get_tag(skb, &vid);
        if (p->flags & BR_LEARNING)
-                br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid);
+                br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, false);
        return 0;        /* process further */
 }
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index fcd12333c59b..3ba11bc99b65 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -104,6 +104,7 @@ struct net_bridge_fdb_entry
        mac_addr                        addr;
        unsigned char                   is_local;
        unsigned char                   is_static;
+        unsigned char                   added_by_user;
        __u16                           vlan_id;
 };
@@ -370,6 +371,9 @@ static inline void br_netpoll_disable(struct net_bridge_port *p)
 int br_fdb_init(void);
 void br_fdb_fini(void);
 void br_fdb_flush(struct net_bridge *br);
+void br_fdb_find_delete_local(struct net_bridge *br,
+                              const struct net_bridge_port *p,
+                              const unsigned char *addr, u16 vid);
 void br_fdb_changeaddr(struct net_bridge_port *p, const unsigned char *newaddr);
 void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr);
 void br_fdb_cleanup(unsigned long arg);
@@ -383,8 +387,7 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf, unsigned long count,
 int br_fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                  const unsigned char *addr, u16 vid);
 void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
-                   const unsigned char *addr, u16 vid);
+                   const unsigned char *addr, u16 vid, bool added_by_user);
-int fdb_delete_by_addr(struct net_bridge *br, const u8 *addr, u16 vid);
 int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
                  struct net_device *dev, const unsigned char *addr);
@@ -584,6 +587,7 @@ struct sk_buff *br_handle_vlan(struct net_bridge *br,
 int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags);
 int br_vlan_delete(struct net_bridge *br, u16 vid);
 void br_vlan_flush(struct net_bridge *br);
+bool br_vlan_find(struct net_bridge *br, u16 vid);
 int br_vlan_filter_toggle(struct net_bridge *br, unsigned long val);
 int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags);
 int nbp_vlan_delete(struct net_bridge_port *port, u16 vid);
@@ -665,6 +669,11 @@ static inline void br_vlan_flush(struct net_bridge *br)
 {
 }
+static inline bool br_vlan_find(struct net_bridge *br, u16 vid)
+{
+        return false;
+}
 static inline int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags)
 {
        return -EOPNOTSUPP;
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 656a6f3e40de..189ba1e7d851 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -194,6 +194,8 @@ void br_stp_change_bridge_id(struct net_bridge *br, const unsigned char *addr)
        wasroot = br_is_root_bridge(br);
+        br_fdb_change_mac_address(br, addr);
        memcpy(oldaddr, br->bridge_id.addr, ETH_ALEN);
        memcpy(br->bridge_id.addr, addr, ETH_ALEN);
        memcpy(br->dev->dev_addr, addr, ETH_ALEN);
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 4ca4d0a0151c..8249ca764c79 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -275,9 +275,7 @@ int br_vlan_delete(struct net_bridge *br, u16 vid)
        if (!pv)
                return -EINVAL;
-        spin_lock_bh(&br->hash_lock);
+        br_fdb_find_delete_local(br, NULL, br->dev->dev_addr, vid);
-        fdb_delete_by_addr(br, br->dev->dev_addr, vid);
-        spin_unlock_bh(&br->hash_lock);
        __vlan_del(pv, vid);
        return 0;
@@ -295,6 +293,25 @@ void br_vlan_flush(struct net_bridge *br)
        __vlan_flush(pv);
 }
+bool br_vlan_find(struct net_bridge *br, u16 vid)
+{
+        struct net_port_vlans *pv;
+        bool found = false;
+        rcu_read_lock();
+        pv = rcu_dereference(br->vlan_info);
+        if (!pv)
+                goto out;
+        if (test_bit(vid, pv->vlan_bitmap))
+                found = true;
+out:
+        rcu_read_unlock();
+        return found;
+}
 int br_vlan_filter_toggle(struct net_bridge *br, unsigned long val)
 {
        if (!rtnl_trylock())
@@ -359,9 +376,7 @@ int nbp_vlan_delete(struct net_bridge_port *port, u16 vid)
        if (!pv)
                return -EINVAL;
-        spin_lock_bh(&port->br->hash_lock);
+        br_fdb_find_delete_local(port->br, port, port->dev->dev_addr, vid);
-        fdb_delete_by_addr(port->br, port->dev->dev_addr, vid);
-        spin_unlock_bh(&port->br->hash_lock);
        return __vlan_del(pv, vid);
 }
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 4dca159435cf..edbca468fa73 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -22,6 +22,7 @@
 #include <net/pkt_sched.h>
 #include <net/caif/caif_device.h>
 #include <net/caif/caif_layer.h>
+#include <net/caif/caif_dev.h>
 #include <net/caif/cfpkt.h>
 #include <net/caif/cfcnfg.h>
 #include <net/caif/cfserl.h>
diff --git a/net/caif/cfsrvl.c b/net/caif/cfsrvl.c
index 353f793d1b3b..a6e115463052 100644
--- a/net/caif/cfsrvl.c
+++ b/net/caif/cfsrvl.c
@@ -15,6 +15,7 @@
 #include <net/caif/caif_layer.h>
 #include <net/caif/cfsrvl.h>
 #include <net/caif/cfpkt.h>
+#include <net/caif/caif_dev.h>
 #define SRVL_CTRL_PKT_SIZE 1
 #define SRVL_FLOW_OFF 0x81
diff --git a/net/can/af_can.c b/net/can/af_can.c
index d249874a366d..a27f8aad9e99 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -57,6 +57,7 @@
 #include <linux/skbuff.h>
 #include <linux/can.h>
 #include <linux/can/core.h>
+#include <linux/can/skb.h>
 #include <linux/ratelimit.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -290,7 +291,7 @@ int can_send(struct sk_buff *skb, int loop)
                                return -ENOMEM;
                        }
-                        newskb->sk = skb->sk;
+                        can_skb_set_owner(newskb, skb->sk);
                        newskb->ip_summed = CHECKSUM_UNNECESSARY;
                        newskb->pkt_type = PACKET_BROADCAST;
                }
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 3fc737b214c7..dcb75c0e66c1 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -268,7 +268,7 @@ static void bcm_can_tx(struct bcm_op *op)
        /* send with loopback */
        skb->dev = dev;
-        skb->sk = op->sk;
+        can_skb_set_owner(skb, op->sk);
        can_send(skb, 1);
        /* update statistics */
@@ -1223,7 +1223,7 @@ static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk)
        can_skb_prv(skb)->ifindex = dev->ifindex;
        skb->dev = dev;
-        skb->sk  = sk;
+        can_skb_set_owner(skb, sk);
        err = can_send(skb, 1); /* send with loopback */
        dev_put(dev);
diff --git a/net/can/raw.c b/net/can/raw.c
index 07d72d852324..8be757cca2ec 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -715,6 +715,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct socket *sock,
        skb->dev = dev;
        skb->sk  = sk;
+        skb->priority = sk->sk_priority;
        err = can_send(skb, ro->loopback);
diff --git a/net/core/dev.c b/net/core/dev.c
index 3721db716350..4ad1b78c9c77 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2803,7 +2803,7 @@ EXPORT_SYMBOL(dev_loopback_xmit);
 *      the BH enable code must have IRQs enabled so that it will not deadlock.
 *          --BLG
 */
-int __dev_queue_xmit(struct sk_buff *skb, void *accel_priv)
+static int __dev_queue_xmit(struct sk_buff *skb, void *accel_priv)
 {
        struct net_device *dev = skb->dev;
        struct netdev_queue *txq;
@@ -4637,7 +4637,7 @@ struct net_device *netdev_master_upper_dev_get_rcu(struct net_device *dev)
 }
 EXPORT_SYMBOL(netdev_master_upper_dev_get_rcu);
-int netdev_adjacent_sysfs_add(struct net_device *dev,
+static int netdev_adjacent_sysfs_add(struct net_device *dev,
                              struct net_device *adj_dev,
                              struct list_head *dev_list)
 {
@@ -4647,7 +4647,7 @@ int netdev_adjacent_sysfs_add(struct net_device *dev,
        return sysfs_create_link(&(dev->dev.kobj), &(adj_dev->dev.kobj),
                                 linkname);
 }
-void netdev_adjacent_sysfs_del(struct net_device *dev,
+static void netdev_adjacent_sysfs_del(struct net_device *dev,
                               char *name,
                               struct list_head *dev_list)
 {
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index f409e0bd35c0..185c341fafbd 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -745,6 +745,13 @@ static int fib_rules_event(struct notifier_block *this, unsigned long event,
                        attach_rules(&ops->rules_list, dev);
                break;
+        case NETDEV_CHANGENAME:
+                list_for_each_entry(ops, &net->rules_ops, list) {
+                        detach_rules(&ops->rules_list, dev);
+                        attach_rules(&ops->rules_list, dev);
+                }
+                break;
        case NETDEV_UNREGISTER:
                list_for_each_entry(ops, &net->rules_ops, list)
                        detach_rules(&ops->rules_list, dev);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index c03f3dec4763..a664f7829a6d 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -948,6 +948,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
 {
        char *cur=opt, *delim;
        int ipv6;
+        bool ipversion_set = false;
        if (*cur != '@') {
                if ((delim = strchr(cur, '@')) == NULL)
@@ -960,6 +961,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
        cur++;
        if (*cur != '/') {
+                ipversion_set = true;
                if ((delim = strchr(cur, '/')) == NULL)
                        goto parse_failed;
                *delim = 0;
@@ -1002,7 +1004,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
        ipv6 = netpoll_parse_ip_addr(cur, &np->remote_ip);
        if (ipv6 < 0)
                goto parse_failed;
-        else if (np->ipv6 != (bool)ipv6)
+        else if (ipversion_set && np->ipv6 != (bool)ipv6)
                goto parse_failed;
        else
                np->ipv6 = (bool)ipv6;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 393b1bc9a618..048dc8d183aa 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -374,7 +374,7 @@ static size_t rtnl_link_get_slave_info_data_size(const struct net_device *dev)
        if (!master_dev)
                return 0;
        ops = master_dev->rtnl_link_ops;
-        if (!ops->get_slave_size)
+        if (!ops || !ops->get_slave_size)
                return 0;
        /* IFLA_INFO_SLAVE_DATA + nested data */
        return nla_total_size(sizeof(struct nlattr)) +
diff --git a/net/core/sock.c b/net/core/sock.c
index 0c127dcdf6a8..5b6a9431b017 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1775,7 +1775,9 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
                        while (order) {
                                if (npages >= 1 << order) {
                                        page = alloc_pages(sk->sk_allocation |
-                                                           __GFP_COMP | __GFP_NOWARN,
+                                                           __GFP_COMP |
+                                                           __GFP_NOWARN |
+                                                           __GFP_NORETRY,
                                                           order);
                                        if (page)
                                                goto fill_page;
@@ -1845,7 +1847,7 @@ bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t prio)
                gfp_t gfp = prio;
                if (order)
-                        gfp |= __GFP_COMP | __GFP_NOWARN;
+                        gfp |= __GFP_COMP | __GFP_NOWARN | __GFP_NORETRY;
                pfrag->page = alloc_pages(gfp, order);
                if (likely(pfrag->page)) {
                        pfrag->offset = 0;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 2954dcbca832..4c04848953bd 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -2104,8 +2104,6 @@ static struct notifier_block dn_dev_notifier = {
        .notifier_call = dn_device_event,
 };
-extern int dn_route_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
 static struct packet_type dn_dix_packet_type __read_mostly = {
        .type =         cpu_to_be16(ETH_P_DNA_RT),
        .func =         dn_route_rcv,
@@ -2353,9 +2351,6 @@ static const struct proto_ops dn_proto_ops = {
        .sendpage =     sock_no_sendpage,
 };
-void dn_register_sysctl(void);
-void dn_unregister_sysctl(void);
 MODULE_DESCRIPTION("The Linux DECnet Network Protocol");
 MODULE_AUTHOR("Linux DECnet Project Team");
 MODULE_LICENSE("GPL");
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 48b25c0af4d0..8edfea5da572 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -106,7 +106,6 @@ static int lowpan_header_create(struct sk_buff *skb,
                           unsigned short type, const void *_daddr,
                           const void *_saddr, unsigned int len)
 {
-        struct ipv6hdr *hdr;
        const u8 *saddr = _saddr;
        const u8 *daddr = _daddr;
        struct ieee802154_addr sa, da;
@@ -117,8 +116,6 @@ static int lowpan_header_create(struct sk_buff *skb,
        if (type != ETH_P_IPV6)
                return 0;
-        hdr = ipv6_hdr(skb);
        if (!saddr)
                saddr = dev->dev_addr;
@@ -533,7 +530,27 @@ static struct header_ops lowpan_header_ops = {
        .create = lowpan_header_create,
 };
+static struct lock_class_key lowpan_tx_busylock;
+static struct lock_class_key lowpan_netdev_xmit_lock_key;
+static void lowpan_set_lockdep_class_one(struct net_device *dev,
+                                         struct netdev_queue *txq,
+                                         void *_unused)
+{
+        lockdep_set_class(&txq->_xmit_lock,
+                          &lowpan_netdev_xmit_lock_key);
+}
+static int lowpan_dev_init(struct net_device *dev)
+{
+        netdev_for_each_tx_queue(dev, lowpan_set_lockdep_class_one, NULL);
+        dev->qdisc_tx_busylock = &lowpan_tx_busylock;
+        return 0;
+}
 static const struct net_device_ops lowpan_netdev_ops = {
+        .ndo_init               = lowpan_dev_init,
        .ndo_start_xmit         = lowpan_xmit,
        .ndo_set_mac_address    = lowpan_set_address,
 };
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index ac2dff3c2c1c..bdbf68bb2e2d 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1443,7 +1443,8 @@ static size_t inet_nlmsg_size(void)
               + nla_total_size(4) /* IFA_LOCAL */
               + nla_total_size(4) /* IFA_BROADCAST */
               + nla_total_size(IFNAMSIZ) /* IFA_LABEL */
-               + nla_total_size(4);  /* IFA_FLAGS */
+               + nla_total_size(4)  /* IFA_FLAGS */
+               + nla_total_size(sizeof(struct ifa_cacheinfo)); /* IFA_CACHEINFO */
 }
 static inline u32 cstamp_delta(unsigned long cstamp)
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index bd28f386bd02..50228be5c17b 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -101,28 +101,22 @@ static void tunnel_dst_reset_all(struct ip_tunnel *t)
                __tunnel_dst_set(per_cpu_ptr(t->dst_cache, i), NULL);
 }
-static struct dst_entry *tunnel_dst_get(struct ip_tunnel *t)
+static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, u32 cookie)
 {
        struct dst_entry *dst;
        rcu_read_lock();
        dst = rcu_dereference(this_cpu_ptr(t->dst_cache)->dst);
-        if (dst)
+        if (dst) {
+                if (dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
+                        rcu_read_unlock();
+                        tunnel_dst_reset(t);
+                        return NULL;
+                }
                dst_hold(dst);
-        rcu_read_unlock();
-        return dst;
-}
-static struct dst_entry *tunnel_dst_check(struct ip_tunnel *t, u32 cookie)
-{
-        struct dst_entry *dst = tunnel_dst_get(t);
-        if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
-                tunnel_dst_reset(t);
-                return NULL;
        }
+        rcu_read_unlock();
-        return dst;
+        return (struct rtable *)dst;
 }
 /* Often modified stats are per cpu, other are shared (netdev->stats) */
@@ -584,7 +578,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
        struct flowi4 fl4;
        u8     tos, ttl;
        __be16 df;
-        struct rtable *rt = NULL;       /* Route to the other host */
+        struct rtable *rt;              /* Route to the other host */
        unsigned int max_headroom;      /* The extra header space needed */
        __be32 dst;
        int err;
@@ -657,8 +651,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
        init_tunnel_flow(&fl4, protocol, dst, tnl_params->saddr,
                         tunnel->parms.o_key, RT_TOS(tos), tunnel->parms.link);
-        if (connected)
+        rt = connected ? tunnel_rtable_get(tunnel, 0) : NULL;
-                rt = (struct rtable *)tunnel_dst_check(tunnel, 0);
        if (!rt) {
                rt = ip_route_output_key(tunnel->net, &fl4);
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 81c6910cfa92..a26ce035e3fa 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -61,6 +61,11 @@ config NFT_CHAIN_NAT_IPV4
          packet transformations such as the source, destination address and
          source and destination ports.
+config NFT_REJECT_IPV4
+        depends on NF_TABLES_IPV4
+        default NFT_REJECT
+        tristate
 config NF_TABLES_ARP
        depends on NF_TABLES
        tristate "ARP nf_tables support"
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index c16be9d58420..90b82405331e 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -30,6 +30,7 @@ obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o
 obj-$(CONFIG_NF_TABLES_IPV4) += nf_tables_ipv4.o
 obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o
 obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o
+obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o
 obj-$(CONFIG_NF_TABLES_ARP) += nf_tables_arp.o
 # generic IP tables 
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index 9eea059dd621..574f7ebba0b6 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -229,7 +229,10 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
                        ret = nf_ct_expect_related(rtcp_exp);
                        if (ret == 0)
                                break;
-                        else if (ret != -EBUSY) {
+                        else if (ret == -EBUSY) {
+                                nf_ct_unexpect_related(rtp_exp);
+                                continue;
+                        } else if (ret < 0) {
                                nf_ct_unexpect_related(rtp_exp);
                                nated_port = 0;
                                break;
diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
new file mode 100644
index 000000000000..e79718a382f2
--- /dev/null
+++ b/net/ipv4/netfilter/nft_reject_ipv4.c
@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
+ * Copyright (c) 2013 Eric Leblond <eric@regit.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Development of this code funded by Astaro AG (http://www.astaro.com/)
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/icmp.h>
+#include <net/netfilter/ipv4/nf_reject.h>
+#include <net/netfilter/nft_reject.h>
+void nft_reject_ipv4_eval(const struct nft_expr *expr,
+                          struct nft_data data[NFT_REG_MAX + 1],
+                          const struct nft_pktinfo *pkt)
+{
+        struct nft_reject *priv = nft_expr_priv(expr);
+        switch (priv->type) {
+        case NFT_REJECT_ICMP_UNREACH:
+                nf_send_unreach(pkt->skb, priv->icmp_code);
+                break;
+        case NFT_REJECT_TCP_RST:
+                nf_send_reset(pkt->skb, pkt->ops->hooknum);
+                break;
+        }
+        data[NFT_REG_VERDICT].verdict = NF_DROP;
+}
+EXPORT_SYMBOL_GPL(nft_reject_ipv4_eval);
+static struct nft_expr_type nft_reject_ipv4_type;
+static const struct nft_expr_ops nft_reject_ipv4_ops = {
+        .type           = &nft_reject_ipv4_type,
+        .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
+        .eval           = nft_reject_ipv4_eval,
+        .init           = nft_reject_init,
+        .dump           = nft_reject_dump,
+};
+static struct nft_expr_type nft_reject_ipv4_type __read_mostly = {
+        .family         = NFPROTO_IPV4,
+        .name           = "reject",
+        .ops            = &nft_reject_ipv4_ops,
+        .policy         = nft_reject_policy,
+        .maxattr        = NFTA_REJECT_MAX,
+        .owner          = THIS_MODULE,
+};
+static int __init nft_reject_ipv4_module_init(void)
+{
+        return nft_register_expr(&nft_reject_ipv4_type);
+}
+static void __exit nft_reject_ipv4_module_exit(void)
+{
+        nft_unregister_expr(&nft_reject_ipv4_type);
+}
+module_init(nft_reject_ipv4_module_init);
+module_exit(nft_reject_ipv4_module_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_ALIAS_NFT_AF_EXPR(AF_INET, "reject");
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 4475b3bb494d..9f3a2db9109e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2229,7 +2229,7 @@ adjudge_to_death:
        /*      This is a (useful) BSD violating of the RFC. There is a
         *      problem with TCP as specified in that the other end could
         *      keep a socket open forever with no application left this end.
-         *      We use a 3 minute timeout (about the same as BSD) then kill
+         *      We use a 1 minute timeout (about the same as BSD) then kill
         *      our end. If they send after that then tough - BUT: long enough
         *      that we won't make the old 4*rto = almost no time - whoops
         *      reset mistake.
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 65cf90e063d5..227cba79fa6b 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -671,6 +671,7 @@ static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        long m = mrtt; /* RTT */
+        u32 srtt = tp->srtt;
        /*      The following amusing code comes from Jacobson's
         *      article in SIGCOMM '88.  Note that rtt and mdev
@@ -688,11 +689,9 @@ static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt)
         * does not matter how to _calculate_ it. Seems, it was trap
         * that VJ failed to avoid. 8)
         */
-        if (m == 0)
+        if (srtt != 0) {
-                m = 1;
+                m -= (srtt >> 3);       /* m is now error in rtt est */
-        if (tp->srtt != 0) {
+                srtt += m;              /* rtt = 7/8 rtt + 1/8 new */
-                m -= (tp->srtt >> 3);   /* m is now error in rtt est */
-                tp->srtt += m;          /* rtt = 7/8 rtt + 1/8 new */
                if (m < 0) {
                        m = -m;         /* m is now abs(error) */
                        m -= (tp->mdev >> 2);   /* similar update on mdev */
@@ -723,11 +722,12 @@ static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt)
                }
        } else {
                /* no previous measure. */
-                tp->srtt = m << 3;      /* take the measured time to be rtt */
+                srtt = m << 3;          /* take the measured time to be rtt */
                tp->mdev = m << 1;      /* make sure rto = 3*rtt */
                tp->mdev_max = tp->rttvar = max(tp->mdev, tcp_rto_min(sk));
                tp->rtt_seq = tp->snd_nxt;
        }
+        tp->srtt = max(1U, srtt);
 }
 /* Set the sk_pacing_rate to allow proper sizing of TSO packets.
@@ -746,8 +746,10 @@ static void tcp_update_pacing_rate(struct sock *sk)
        rate *= max(tp->snd_cwnd, tp->packets_out);
-        /* Correction for small srtt : minimum srtt being 8 (1 jiffy << 3),
+        /* Correction for small srtt and scheduling constraints.
-         * be conservative and assume srtt = 1 (125 us instead of 1.25 ms)
+         * For small rtt, consider noise is too high, and use
+         * the minimal value (srtt = 1 -> 125 us for HZ=1000)
+         *
         * We probably need usec resolution in the future.
         * Note: This also takes care of possible srtt=0 case,
         * when tcp_rtt_estimator() was not yet called.
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 03d26b85eab8..3be16727f058 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -698,7 +698,8 @@ static void tcp_tsq_handler(struct sock *sk)
        if ((1 << sk->sk_state) &
            (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_CLOSING |
             TCPF_CLOSE_WAIT  | TCPF_LAST_ACK))
-                tcp_write_xmit(sk, tcp_current_mss(sk), 0, 0, GFP_ATOMIC);
+                tcp_write_xmit(sk, tcp_current_mss(sk), tcp_sk(sk)->nonagle,
+                               0, GFP_ATOMIC);
 }
 /*
 * One tasklet per cpu tries to send more skbs.
@@ -1904,7 +1905,15 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                if (atomic_read(&sk->sk_wmem_alloc) > limit) {
                        set_bit(TSQ_THROTTLED, &tp->tsq_flags);
-                        break;
+                        /* It is possible TX completion already happened
+                         * before we set TSQ_THROTTLED, so we must
+                         * test again the condition.
+                         * We abuse smp_mb__after_clear_bit() because
+                         * there is no smp_mb__after_set_bit() yet
+                         */
+                        smp_mb__after_clear_bit();
+                        if (atomic_read(&sk->sk_wmem_alloc) > limit)
+                                break;
                }
                limit = mss_now;
@@ -1977,7 +1986,7 @@ bool tcp_schedule_loss_probe(struct sock *sk)
        /* Schedule a loss probe in 2*RTT for SACK capable connections
         * in Open state, that are either limited by cwnd or application.
         */
-        if (sysctl_tcp_early_retrans < 3 || !rtt || !tp->packets_out ||
+        if (sysctl_tcp_early_retrans < 3 || !tp->srtt || !tp->packets_out ||
            !tcp_is_sack(tp) || inet_csk(sk)->icsk_ca_state != TCP_CA_Open)
                return false;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 25f5cee3a08a..88b4023ecfcf 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -17,6 +17,8 @@
 static DEFINE_SPINLOCK(udp_offload_lock);
 static struct udp_offload_priv __rcu *udp_offload_base __read_mostly;
+#define udp_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&udp_offload_lock))
 struct udp_offload_priv {
        struct udp_offload      *offload;
        struct rcu_head         rcu;
@@ -100,8 +102,7 @@ out:
 int udp_add_offload(struct udp_offload *uo)
 {
-        struct udp_offload_priv __rcu **head = &udp_offload_base;
+        struct udp_offload_priv *new_offload = kzalloc(sizeof(*new_offload), GFP_ATOMIC);
-        struct udp_offload_priv *new_offload = kzalloc(sizeof(*new_offload), GFP_KERNEL);
        if (!new_offload)
                return -ENOMEM;
@@ -109,8 +110,8 @@ int udp_add_offload(struct udp_offload *uo)
        new_offload->offload = uo;
        spin_lock(&udp_offload_lock);
-        rcu_assign_pointer(new_offload->next, rcu_dereference(*head));
+        new_offload->next = udp_offload_base;
-        rcu_assign_pointer(*head, new_offload);
+        rcu_assign_pointer(udp_offload_base, new_offload);
        spin_unlock(&udp_offload_lock);
        return 0;
@@ -130,12 +131,12 @@ void udp_del_offload(struct udp_offload *uo)
        spin_lock(&udp_offload_lock);
-        uo_priv = rcu_dereference(*head);
+        uo_priv = udp_deref_protected(*head);
        for (; uo_priv != NULL;
-                uo_priv = rcu_dereference(*head)) {
+             uo_priv = udp_deref_protected(*head)) {
                if (uo_priv->offload == uo) {
-                        rcu_assign_pointer(*head, rcu_dereference(uo_priv->next));
+                        rcu_assign_pointer(*head,
+                                           udp_deref_protected(uo_priv->next));
                        goto unlock;
                }
                head = &uo_priv->next;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index f81f59686f21..f2610e157660 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -414,7 +414,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
        addr_type = ipv6_addr_type(&hdr->daddr);
        if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) ||
-            ipv6_anycast_destination(skb))
+            ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr))
                saddr = &hdr->daddr;
        /*
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 35750df744dc..4bff1f297e39 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -50,6 +50,11 @@ config NFT_CHAIN_NAT_IPV6
          packet transformations such as the source, destination address and
          source and destination ports.
+config NFT_REJECT_IPV6
+        depends on NF_TABLES_IPV6
+        default NFT_REJECT
+        tristate
 config IP6_NF_IPTABLES
        tristate "IP6 tables support (required for filtering)"
        depends on INET && IPV6
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index d1b4928f34f7..70d3dd66f2cd 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -27,6 +27,7 @@ obj-$(CONFIG_NF_DEFRAG_IPV6) += nf_defrag_ipv6.o
 obj-$(CONFIG_NF_TABLES_IPV6) += nf_tables_ipv6.o
 obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV6) += nft_chain_route_ipv6.o
 obj-$(CONFIG_NFT_CHAIN_NAT_IPV6) += nft_chain_nat_ipv6.o
+obj-$(CONFIG_NFT_REJECT_IPV6) += nft_reject_ipv6.o
 # matches
 obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o
diff --git a/net/ipv6/netfilter/nft_reject_ipv6.c b/net/ipv6/netfilter/nft_reject_ipv6.c
new file mode 100644
index 000000000000..0bc19fa87821
--- /dev/null
+++ b/net/ipv6/netfilter/nft_reject_ipv6.c
@@ -0,0 +1,76 @@
+/*
+ * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
+ * Copyright (c) 2013 Eric Leblond <eric@regit.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Development of this code funded by Astaro AG (http://www.astaro.com/)
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nft_reject.h>
+#include <net/netfilter/ipv6/nf_reject.h>
+void nft_reject_ipv6_eval(const struct nft_expr *expr,
+                          struct nft_data data[NFT_REG_MAX + 1],
+                          const struct nft_pktinfo *pkt)
+{
+        struct nft_reject *priv = nft_expr_priv(expr);
+        struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
+        switch (priv->type) {
+        case NFT_REJECT_ICMP_UNREACH:
+                nf_send_unreach6(net, pkt->skb, priv->icmp_code,
+                                 pkt->ops->hooknum);
+                break;
+        case NFT_REJECT_TCP_RST:
+                nf_send_reset6(net, pkt->skb, pkt->ops->hooknum);
+                break;
+        }
+        data[NFT_REG_VERDICT].verdict = NF_DROP;
+}
+EXPORT_SYMBOL_GPL(nft_reject_ipv6_eval);
+static struct nft_expr_type nft_reject_ipv6_type;
+static const struct nft_expr_ops nft_reject_ipv6_ops = {
+        .type           = &nft_reject_ipv6_type,
+        .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
+        .eval           = nft_reject_ipv6_eval,
+        .init           = nft_reject_init,
+        .dump           = nft_reject_dump,
+};
+static struct nft_expr_type nft_reject_ipv6_type __read_mostly = {
+        .family         = NFPROTO_IPV6,
+        .name           = "reject",
+        .ops            = &nft_reject_ipv6_ops,
+        .policy         = nft_reject_policy,
+        .maxattr        = NFTA_REJECT_MAX,
+        .owner          = THIS_MODULE,
+};
+static int __init nft_reject_ipv6_module_init(void)
+{
+        return nft_register_expr(&nft_reject_ipv6_type);
+}
+static void __exit nft_reject_ipv6_module_exit(void)
+{
+        nft_unregister_expr(&nft_reject_ipv6_type);
+}
+module_init(nft_reject_ipv6_module_init);
+module_exit(nft_reject_ipv6_module_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_ALIAS_NFT_AF_EXPR(AF_INET6, "reject");
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 994e28bfb32e..00b2a6d1c009 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -52,18 +52,12 @@
 #include <net/p8022.h>
 #include <net/psnap.h>
 #include <net/sock.h>
+#include <net/datalink.h>
 #include <net/tcp_states.h>
+#include <net/net_namespace.h>
 #include <asm/uaccess.h>
-#ifdef CONFIG_SYSCTL
-extern void ipx_register_sysctl(void);
-extern void ipx_unregister_sysctl(void);
-#else
-#define ipx_register_sysctl()
-#define ipx_unregister_sysctl()
-#endif
 /* Configuration Variables */
 static unsigned char ipxcfg_max_hops = 16;
 static char ipxcfg_auto_select_primary;
@@ -84,15 +78,6 @@ DEFINE_SPINLOCK(ipx_interfaces_lock);
 struct ipx_interface *ipx_primary_net;
 struct ipx_interface *ipx_internal_net;
-extern int ipxrtr_add_route(__be32 network, struct ipx_interface *intrfc,
-                            unsigned char *node);
-extern void ipxrtr_del_routes(struct ipx_interface *intrfc);
-extern int ipxrtr_route_packet(struct sock *sk, struct sockaddr_ipx *usipx,
-                               struct iovec *iov, size_t len, int noblock);
-extern int ipxrtr_route_skb(struct sk_buff *skb);
-extern struct ipx_route *ipxrtr_lookup(__be32 net);
-extern int ipxrtr_ioctl(unsigned int cmd, void __user *arg);
 struct ipx_interface *ipx_interfaces_head(void)
 {
        struct ipx_interface *rc = NULL;
@@ -1986,9 +1971,6 @@ static struct notifier_block ipx_dev_notifier = {
        .notifier_call  = ipxitf_device_event,
 };
-extern struct datalink_proto *make_EII_client(void);
-extern void destroy_EII_client(struct datalink_proto *);
 static const unsigned char ipx_8022_type = 0xE0;
 static const unsigned char ipx_snap_id[5] = { 0x0, 0x0, 0x0, 0x81, 0x37 };
 static const char ipx_EII_err_msg[] __initconst =
diff --git a/net/ipx/ipx_route.c b/net/ipx/ipx_route.c
index 30f4519b092f..c1f03185c5e1 100644
--- a/net/ipx/ipx_route.c
+++ b/net/ipx/ipx_route.c
@@ -20,15 +20,11 @@ DEFINE_RWLOCK(ipx_routes_lock);
 extern struct ipx_interface *ipx_internal_net;
-extern __be16 ipx_cksum(struct ipxhdr *packet, int length);
 extern struct ipx_interface *ipxitf_find_using_net(__be32 net);
 extern int ipxitf_demux_socket(struct ipx_interface *intrfc,
                               struct sk_buff *skb, int copy);
 extern int ipxitf_demux_socket(struct ipx_interface *intrfc,
                               struct sk_buff *skb, int copy);
-extern int ipxitf_send(struct ipx_interface *intrfc, struct sk_buff *skb,
-                       char *node);
-extern struct ipx_interface *ipxitf_find_using_net(__be32 net);
 struct ipx_route *ipxrtr_lookup(__be32 net)
 {
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index f9ae9b85d4c1..453e974287d1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1021,8 +1021,10 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
                                        IEEE80211_P2P_OPPPS_ENABLE_BIT;
        err = ieee80211_assign_beacon(sdata, &params->beacon);
-        if (err < 0)
+        if (err < 0) {
+                ieee80211_vif_release_channel(sdata);
                return err;
+        }
        changed |= err;
        err = drv_start_ap(sdata->local, sdata);
@@ -1032,6 +1034,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
                if (old)
                        kfree_rcu(old, rcu_head);
                RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
+                ieee80211_vif_release_channel(sdata);
                return err;
        }
@@ -1090,8 +1093,6 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
        kfree(sdata->u.ap.next_beacon);
        sdata->u.ap.next_beacon = NULL;
-        cancel_work_sync(&sdata->u.ap.request_smps_work);
        /* turn off carrier for this interface and dependent VLANs */
        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
                netif_carrier_off(vlan->dev);
@@ -1103,6 +1104,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
        kfree_rcu(old_beacon, rcu_head);
        if (old_probe_resp)
                kfree_rcu(old_probe_resp, rcu_head);
+        sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
        __sta_info_flush(sdata, true);
        ieee80211_free_keys(sdata, true);
@@ -2638,6 +2640,24 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
        INIT_DELAYED_WORK(&roc->work, ieee80211_sw_roc_work);
        INIT_LIST_HEAD(&roc->dependents);
+        /*
+         * cookie is either the roc cookie (for normal roc)
+         * or the SKB (for mgmt TX)
+         */
+        if (!txskb) {
+                /* local->mtx protects this */
+                local->roc_cookie_counter++;
+                roc->cookie = local->roc_cookie_counter;
+                /* wow, you wrapped 64 bits ... more likely a bug */
+                if (WARN_ON(roc->cookie == 0)) {
+                        roc->cookie = 1;
+                        local->roc_cookie_counter++;
+                }
+                *cookie = roc->cookie;
+        } else {
+                *cookie = (unsigned long)txskb;
+        }
        /* if there's one pending or we're scanning, queue this one */
        if (!list_empty(&local->roc_list) ||
            local->scanning || local->radar_detect_enabled)
@@ -2772,24 +2792,6 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
        if (!queued)
                list_add_tail(&roc->list, &local->roc_list);
-        /*
-         * cookie is either the roc cookie (for normal roc)
-         * or the SKB (for mgmt TX)
-         */
-        if (!txskb) {
-                /* local->mtx protects this */
-                local->roc_cookie_counter++;
-                roc->cookie = local->roc_cookie_counter;
-                /* wow, you wrapped 64 bits ... more likely a bug */
-                if (WARN_ON(roc->cookie == 0)) {
-                        roc->cookie = 1;
-                        local->roc_cookie_counter++;
-                }
-                *cookie = roc->cookie;
-        } else {
-                *cookie = (unsigned long)txskb;
-        }
        return 0;
 }
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index fab7b91923e0..70dd013de836 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -466,7 +466,9 @@ void ieee80211_request_smps_ap_work(struct work_struct *work)
                             u.ap.request_smps_work);
        sdata_lock(sdata);
-        __ieee80211_request_smps_ap(sdata, sdata->u.ap.driver_smps_mode);
+        if (sdata_dereference(sdata->u.ap.beacon, sdata))
+                __ieee80211_request_smps_ap(sdata,
+                                            sdata->u.ap.driver_smps_mode);
        sdata_unlock(sdata);
 }
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 771080ec7212..2796a198728f 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -695,12 +695,9 @@ static void ieee80211_ibss_disconnect(struct ieee80211_sub_if_data *sdata)
        struct cfg80211_bss *cbss;
        struct beacon_data *presp;
        struct sta_info *sta;
-        int active_ibss;
        u16 capability;
-        active_ibss = ieee80211_sta_active_ibss(sdata);
+        if (!is_zero_ether_addr(ifibss->bssid)) {
-        if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
                capability = WLAN_CAPABILITY_IBSS;
                if (ifibss->privacy)
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 3dfd20a453ab..d6d1f1df9119 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -418,20 +418,24 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
                return ret;
        }
+        mutex_lock(&local->iflist_mtx);
+        rcu_assign_pointer(local->monitor_sdata, sdata);
+        mutex_unlock(&local->iflist_mtx);
        mutex_lock(&local->mtx);
        ret = ieee80211_vif_use_channel(sdata, &local->monitor_chandef,
                                        IEEE80211_CHANCTX_EXCLUSIVE);
        mutex_unlock(&local->mtx);
        if (ret) {
+                mutex_lock(&local->iflist_mtx);
+                rcu_assign_pointer(local->monitor_sdata, NULL);
+                mutex_unlock(&local->iflist_mtx);
+                synchronize_net();
                drv_remove_interface(local, sdata);
                kfree(sdata);
                return ret;
        }
-        mutex_lock(&local->iflist_mtx);
-        rcu_assign_pointer(local->monitor_sdata, sdata);
-        mutex_unlock(&local->iflist_mtx);
        return 0;
 }
@@ -770,12 +774,19 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
        ieee80211_roc_purge(local, sdata);
-        if (sdata->vif.type == NL80211_IFTYPE_STATION)
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_STATION:
                ieee80211_mgd_stop(sdata);
+                break;
-        if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+        case NL80211_IFTYPE_ADHOC:
                ieee80211_ibss_stop(sdata);
+                break;
+        case NL80211_IFTYPE_AP:
+                cancel_work_sync(&sdata->u.ap.request_smps_work);
+                break;
+        default:
+                break;
+        }
        /*
         * Remove all stations associated with this interface.
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 27c990bf2320..97a02d3f7d87 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -878,7 +878,7 @@ static int ieee80211_fragment(struct ieee80211_tx_data *tx,
        }
        /* adjust first fragment's length */
-        skb->len = hdrlen + per_fragm;
+        skb_trim(skb, hdrlen + per_fragm);
        return 0;
 }
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index c37467562fd0..e9410d17619d 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -513,7 +513,6 @@ config NFT_QUEUE
 config NFT_REJECT
        depends on NF_TABLES
-        depends on NF_TABLES_IPV6 || !NF_TABLES_IPV6
        default m if NETFILTER_ADVANCED=n
        tristate "Netfilter nf_tables reject support"
        help
@@ -521,6 +520,11 @@ config NFT_REJECT
          explicitly deny and notify via TCP reset/ICMP informational errors
          unallowed traffic.
+config NFT_REJECT_INET
+        depends on NF_TABLES_INET
+        default NFT_REJECT
+        tristate
 config NFT_COMPAT
        depends on NF_TABLES
        depends on NETFILTER_XTABLES
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index ee9c4de5f8ed..bffdad774da7 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -79,6 +79,7 @@ obj-$(CONFIG_NFT_LIMIT)		+= nft_limit.o
 obj-$(CONFIG_NFT_NAT)           += nft_nat.o
 obj-$(CONFIG_NFT_QUEUE)         += nft_queue.o
 obj-$(CONFIG_NFT_REJECT)        += nft_reject.o
+obj-$(CONFIG_NFT_REJECT_INET)   += nft_reject_inet.o
 obj-$(CONFIG_NFT_RBTREE)        += nft_rbtree.o
 obj-$(CONFIG_NFT_HASH)          += nft_hash.o
 obj-$(CONFIG_NFT_COUNTER)       += nft_counter.o
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 59a1a85bcb3e..a8eb0a89326a 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -871,11 +871,11 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p,
        cp->protocol       = p->protocol;
        ip_vs_addr_set(p->af, &cp->caddr, p->caddr);
        cp->cport          = p->cport;
-        ip_vs_addr_set(p->af, &cp->vaddr, p->vaddr);
+        /* proto should only be IPPROTO_IP if p->vaddr is a fwmark */
-        cp->vport          = p->vport;
-        /* proto should only be IPPROTO_IP if d_addr is a fwmark */
        ip_vs_addr_set(p->protocol == IPPROTO_IP ? AF_UNSPEC : p->af,
-                       &cp->daddr, daddr);
+                       &cp->vaddr, p->vaddr);
+        cp->vport          = p->vport;
+        ip_vs_addr_set(p->af, &cp->daddr, daddr);
        cp->dport          = dport;
        cp->flags          = flags;
        cp->fwmark         = fwmark;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 8824ed0ccc9c..356bef519fe5 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -312,6 +312,21 @@ static void death_by_timeout(unsigned long ul_conntrack)
        nf_ct_delete((struct nf_conn *)ul_conntrack, 0, 0);
 }
+static inline bool
+nf_ct_key_equal(struct nf_conntrack_tuple_hash *h,
+                        const struct nf_conntrack_tuple *tuple,
+                        u16 zone)
+{
+        struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
+        /* A conntrack can be recreated with the equal tuple,
+         * so we need to check that the conntrack is confirmed
+         */
+        return nf_ct_tuple_equal(tuple, &h->tuple) &&
+                nf_ct_zone(ct) == zone &&
+                nf_ct_is_confirmed(ct);
+}
 /*
 * Warning :
 * - Caller must take a reference on returned object
@@ -333,8 +348,7 @@ ____nf_conntrack_find(struct net *net, u16 zone,
        local_bh_disable();
 begin:
        hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[bucket], hnnode) {
-                if (nf_ct_tuple_equal(tuple, &h->tuple) &&
+                if (nf_ct_key_equal(h, tuple, zone)) {
-                    nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)) == zone) {
                        NF_CT_STAT_INC(net, found);
                        local_bh_enable();
                        return h;
@@ -372,8 +386,7 @@ begin:
                             !atomic_inc_not_zero(&ct->ct_general.use)))
                        h = NULL;
                else {
-                        if (unlikely(!nf_ct_tuple_equal(tuple, &h->tuple) ||
+                        if (unlikely(!nf_ct_key_equal(h, tuple, zone))) {
-                                     nf_ct_zone(ct) != zone)) {
                                nf_ct_put(ct);
                                goto begin;
                        }
@@ -435,7 +448,9 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)
                        goto out;
        add_timer(&ct->timeout);
-        nf_conntrack_get(&ct->ct_general);
+        smp_wmb();
+        /* The caller holds a reference to this object */
+        atomic_set(&ct->ct_general.use, 2);
        __nf_conntrack_hash_insert(ct, hash, repl_hash);
        NF_CT_STAT_INC(net, insert);
        spin_unlock_bh(&nf_conntrack_lock);
@@ -449,6 +464,21 @@ out:
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
+/* deletion from this larval template list happens via nf_ct_put() */
+void nf_conntrack_tmpl_insert(struct net *net, struct nf_conn *tmpl)
+{
+        __set_bit(IPS_TEMPLATE_BIT, &tmpl->status);
+        __set_bit(IPS_CONFIRMED_BIT, &tmpl->status);
+        nf_conntrack_get(&tmpl->ct_general);
+        spin_lock_bh(&nf_conntrack_lock);
+        /* Overload tuple linked list to put us in template list. */
+        hlist_nulls_add_head_rcu(&tmpl->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
+                                 &net->ct.tmpl);
+        spin_unlock_bh(&nf_conntrack_lock);
+}
+EXPORT_SYMBOL_GPL(nf_conntrack_tmpl_insert);
 /* Confirm a connection given skb; places it in hash table */
 int
 __nf_conntrack_confirm(struct sk_buff *skb)
@@ -720,11 +750,10 @@ __nf_conntrack_alloc(struct net *net, u16 zone,
                nf_ct_zone->id = zone;
        }
 #endif
-        /*
+        /* Because we use RCU lookups, we set ct_general.use to zero before
-         * changes to lookup keys must be done before setting refcnt to 1
+         * this is inserted in any list.
         */
-        smp_wmb();
+        atomic_set(&ct->ct_general.use, 0);
-        atomic_set(&ct->ct_general.use, 1);
        return ct;
 #ifdef CONFIG_NF_CONNTRACK_ZONES
@@ -748,6 +777,11 @@ void nf_conntrack_free(struct nf_conn *ct)
 {
        struct net *net = nf_ct_net(ct);
+        /* A freed object has refcnt == 0, that's
+         * the golden rule for SLAB_DESTROY_BY_RCU
+         */
+        NF_CT_ASSERT(atomic_read(&ct->ct_general.use) == 0);
        nf_ct_ext_destroy(ct);
        nf_ct_ext_free(ct);
        kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
@@ -843,6 +877,9 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
                NF_CT_STAT_INC(net, new);
        }
+        /* Now it is inserted into the unconfirmed list, bump refcount */
+        nf_conntrack_get(&ct->ct_general);
        /* Overload tuple linked list to put us in unconfirmed list. */
        hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
                       &net->ct.unconfirmed);
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index 9858e3e51a3a..52e20c9a46a5 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -363,9 +363,8 @@ static int __net_init synproxy_net_init(struct net *net)
                goto err2;
        if (!nfct_synproxy_ext_add(ct))
                goto err2;
-        __set_bit(IPS_TEMPLATE_BIT, &ct->status);
-        __set_bit(IPS_CONFIRMED_BIT, &ct->status);
+        nf_conntrack_tmpl_insert(net, ct);
        snet->tmpl = ct;
        snet->stats = alloc_percpu(struct synproxy_stats);
@@ -390,7 +389,7 @@ static void __net_exit synproxy_net_exit(struct net *net)
 {
        struct synproxy_net *snet = synproxy_pernet(net);
-        nf_conntrack_free(snet->tmpl);
+        nf_ct_put(snet->tmpl);
        synproxy_proc_exit(net);
        free_percpu(snet->stats);
 }
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 117bbaaddde6..adce01e8bb57 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1008,10 +1008,8 @@ notify:
        return 0;
 }
-static void nf_tables_rcu_chain_destroy(struct rcu_head *head)
+static void nf_tables_chain_destroy(struct nft_chain *chain)
 {
-        struct nft_chain *chain = container_of(head, struct nft_chain, rcu_head);
        BUG_ON(chain->use > 0);
        if (chain->flags & NFT_BASE_CHAIN) {
@@ -1045,7 +1043,7 @@ static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
        if (IS_ERR(chain))
                return PTR_ERR(chain);
-        if (!list_empty(&chain->rules))
+        if (!list_empty(&chain->rules) || chain->use > 0)
                return -EBUSY;
        list_del(&chain->list);
@@ -1059,7 +1057,9 @@ static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
                               family);
        /* Make sure all rule references are gone before this is released */
-        call_rcu(&chain->rcu_head, nf_tables_rcu_chain_destroy);
+        synchronize_rcu();
+        nf_tables_chain_destroy(chain);
        return 0;
 }
@@ -1114,35 +1114,45 @@ void nft_unregister_expr(struct nft_expr_type *type)
 }
 EXPORT_SYMBOL_GPL(nft_unregister_expr);
-static const struct nft_expr_type *__nft_expr_type_get(struct nlattr *nla)
+static const struct nft_expr_type *__nft_expr_type_get(u8 family,
+                                                       struct nlattr *nla)
 {
        const struct nft_expr_type *type;
        list_for_each_entry(type, &nf_tables_expressions, list) {
-                if (!nla_strcmp(nla, type->name))
+                if (!nla_strcmp(nla, type->name) &&
+                    (!type->family || type->family == family))
                        return type;
        }
        return NULL;
 }
-static const struct nft_expr_type *nft_expr_type_get(struct nlattr *nla)
+static const struct nft_expr_type *nft_expr_type_get(u8 family,
+                                                     struct nlattr *nla)
 {
        const struct nft_expr_type *type;
        if (nla == NULL)
                return ERR_PTR(-EINVAL);
-        type = __nft_expr_type_get(nla);
+        type = __nft_expr_type_get(family, nla);
        if (type != NULL && try_module_get(type->owner))
                return type;
 #ifdef CONFIG_MODULES
        if (type == NULL) {
                nfnl_unlock(NFNL_SUBSYS_NFTABLES);
+                request_module("nft-expr-%u-%.*s", family,
+                               nla_len(nla), (char *)nla_data(nla));
+                nfnl_lock(NFNL_SUBSYS_NFTABLES);
+                if (__nft_expr_type_get(family, nla))
+                        return ERR_PTR(-EAGAIN);
+                nfnl_unlock(NFNL_SUBSYS_NFTABLES);
                request_module("nft-expr-%.*s",
                               nla_len(nla), (char *)nla_data(nla));
                nfnl_lock(NFNL_SUBSYS_NFTABLES);
-                if (__nft_expr_type_get(nla))
+                if (__nft_expr_type_get(family, nla))
                        return ERR_PTR(-EAGAIN);
        }
 #endif
@@ -1193,7 +1203,7 @@ static int nf_tables_expr_parse(const struct nft_ctx *ctx,
        if (err < 0)
                return err;
-        type = nft_expr_type_get(tb[NFTA_EXPR_NAME]);
+        type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]);
        if (IS_ERR(type))
                return PTR_ERR(type);
@@ -1521,9 +1531,8 @@ err:
        return err;
 }
-static void nf_tables_rcu_rule_destroy(struct rcu_head *head)
+static void nf_tables_rule_destroy(struct nft_rule *rule)
 {
-        struct nft_rule *rule = container_of(head, struct nft_rule, rcu_head);
        struct nft_expr *expr;
        /*
@@ -1538,11 +1547,6 @@ static void nf_tables_rcu_rule_destroy(struct rcu_head *head)
        kfree(rule);
 }
-static void nf_tables_rule_destroy(struct nft_rule *rule)
-{
-        call_rcu(&rule->rcu_head, nf_tables_rcu_rule_destroy);
-}
 #define NFT_RULE_MAXEXPRS       128
 static struct nft_expr_info *info;
@@ -1809,9 +1813,6 @@ static int nf_tables_commit(struct sk_buff *skb)
        synchronize_rcu();
        list_for_each_entry_safe(rupd, tmp, &net->nft.commit_list, list) {
-                /* Delete this rule from the dirty list */
-                list_del(&rupd->list);
                /* This rule was inactive in the past and just became active.
                 * Clear the next bit of the genmask since its meaning has
                 * changed, now it is the future.
@@ -1822,6 +1823,7 @@ static int nf_tables_commit(struct sk_buff *skb)
                                              rupd->chain, rupd->rule,
                                              NFT_MSG_NEWRULE, 0,
                                              rupd->family);
+                        list_del(&rupd->list);
                        kfree(rupd);
                        continue;
                }
@@ -1831,7 +1833,15 @@ static int nf_tables_commit(struct sk_buff *skb)
                nf_tables_rule_notify(skb, rupd->nlh, rupd->table, rupd->chain,
                                      rupd->rule, NFT_MSG_DELRULE, 0,
                                      rupd->family);
+        }
+        /* Make sure we don't see any packet traversing old rules */
+        synchronize_rcu();
+        /* Now we can safely release unused old rules */
+        list_for_each_entry_safe(rupd, tmp, &net->nft.commit_list, list) {
                nf_tables_rule_destroy(rupd->rule);
+                list_del(&rupd->list);
                kfree(rupd);
        }
@@ -1844,20 +1854,26 @@ static int nf_tables_abort(struct sk_buff *skb)
        struct nft_rule_trans *rupd, *tmp;
        list_for_each_entry_safe(rupd, tmp, &net->nft.commit_list, list) {
-                /* Delete all rules from the dirty list */
-                list_del(&rupd->list);
                if (!nft_rule_is_active_next(net, rupd->rule)) {
                        nft_rule_clear(net, rupd->rule);
+                        list_del(&rupd->list);
                        kfree(rupd);
                        continue;
                }
                /* This rule is inactive, get rid of it */
                list_del_rcu(&rupd->rule->list);
+        }
+        /* Make sure we don't see any packet accessing aborted rules */
+        synchronize_rcu();
+        list_for_each_entry_safe(rupd, tmp, &net->nft.commit_list, list) {
                nf_tables_rule_destroy(rupd->rule);
+                list_del(&rupd->list);
                kfree(rupd);
        }
        return 0;
 }
@@ -1943,6 +1959,9 @@ static int nft_ctx_init_from_setattr(struct nft_ctx *ctx,
        }
        if (nla[NFTA_SET_TABLE] != NULL) {
+                if (afi == NULL)
+                        return -EAFNOSUPPORT;
                table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE]);
                if (IS_ERR(table))
                        return PTR_ERR(table);
@@ -1989,13 +2008,13 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
                        if (!sscanf(i->name, name, &tmp))
                                continue;
-                        if (tmp < 0 || tmp > BITS_PER_LONG * PAGE_SIZE)
+                        if (tmp < 0 || tmp >= BITS_PER_BYTE * PAGE_SIZE)
                                continue;
                        set_bit(tmp, inuse);
                }
-                n = find_first_zero_bit(inuse, BITS_PER_LONG * PAGE_SIZE);
+                n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
                free_page((unsigned long)inuse);
        }
@@ -2428,6 +2447,8 @@ static int nf_tables_delset(struct sock *nlsk, struct sk_buff *skb,
        struct nft_ctx ctx;
        int err;
+        if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
+                return -EAFNOSUPPORT;
        if (nla[NFTA_SET_TABLE] == NULL)
                return -EINVAL;
@@ -2435,9 +2456,6 @@ static int nf_tables_delset(struct sock *nlsk, struct sk_buff *skb,
        if (err < 0)
                return err;
-        if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
-                return -EAFNOSUPPORT;
        set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
        if (IS_ERR(set))
                return PTR_ERR(set);
@@ -2723,6 +2741,9 @@ static int nft_add_set_elem(const struct nft_ctx *ctx, struct nft_set *set,
                if (nla[NFTA_SET_ELEM_DATA] == NULL &&
                    !(elem.flags & NFT_SET_ELEM_INTERVAL_END))
                        return -EINVAL;
+                if (nla[NFTA_SET_ELEM_DATA] != NULL &&
+                    elem.flags & NFT_SET_ELEM_INTERVAL_END)
+                        return -EINVAL;
        } else {
                if (nla[NFTA_SET_ELEM_DATA] != NULL)
                        return -EINVAL;
@@ -2977,6 +2998,9 @@ static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
                                        const struct nft_set_iter *iter,
                                        const struct nft_set_elem *elem)
 {
+        if (elem->flags & NFT_SET_ELEM_INTERVAL_END)
+                return 0;
        switch (elem->data.verdict) {
        case NFT_JUMP:
        case NFT_GOTO:
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 0d879fcb8763..90998a6ff8b9 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -103,9 +103,9 @@ static struct nf_loginfo trace_loginfo = {
        },
 };
-static inline void nft_trace_packet(const struct nft_pktinfo *pkt,
+static void nft_trace_packet(const struct nft_pktinfo *pkt,
-                                    const struct nft_chain *chain,
+                             const struct nft_chain *chain,
-                                    int rulenum, enum nft_trace type)
+                             int rulenum, enum nft_trace type)
 {
        struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 917052e20602..46e275403838 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -226,6 +226,7 @@ static int nft_ct_init_validate_get(const struct nft_expr *expr,
                if (tb[NFTA_CT_DIRECTION] != NULL)
                        return -EINVAL;
                break;
+        case NFT_CT_L3PROTOCOL:
        case NFT_CT_PROTOCOL:
        case NFT_CT_SRC:
        case NFT_CT_DST:
@@ -311,8 +312,19 @@ static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
                goto nla_put_failure;
        if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
                goto nla_put_failure;
-        if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
-                goto nla_put_failure;
+        switch (priv->key) {
+        case NFT_CT_PROTOCOL:
+        case NFT_CT_SRC:
+        case NFT_CT_DST:
+        case NFT_CT_PROTO_SRC:
+        case NFT_CT_PROTO_DST:
+                if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
+                        goto nla_put_failure;
+        default:
+                break;
+        }
        return 0;
 nla_put_failure:
diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c
index 5af790123ad8..26c5154e05f3 100644
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -23,7 +23,6 @@ static const char *nft_log_null_prefix = "";
 struct nft_log {
        struct nf_loginfo       loginfo;
        char                    *prefix;
-        int                     family;
 };
 static void nft_log_eval(const struct nft_expr *expr,
@@ -33,7 +32,7 @@ static void nft_log_eval(const struct nft_expr *expr,
        const struct nft_log *priv = nft_expr_priv(expr);
        struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
-        nf_log_packet(net, priv->family, pkt->ops->hooknum, pkt->skb, pkt->in,
+        nf_log_packet(net, pkt->ops->pf, pkt->ops->hooknum, pkt->skb, pkt->in,
                      pkt->out, &priv->loginfo, "%s", priv->prefix);
 }
@@ -52,8 +51,6 @@ static int nft_log_init(const struct nft_ctx *ctx,
        struct nf_loginfo *li = &priv->loginfo;
        const struct nlattr *nla;
-        priv->family = ctx->afi->family;
        nla = tb[NFTA_LOG_PREFIX];
        if (nla != NULL) {
                priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL);
diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index 8a6116b75b5a..bb4ef4cccb6e 100644
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -16,6 +16,7 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables_core.h>
 struct nft_lookup {
        struct nft_set                  *set;
diff --git a/net/netfilter/nft_queue.c b/net/netfilter/nft_queue.c
index cbea473d69e9..e8ae2f6bf232 100644
--- a/net/netfilter/nft_queue.c
+++ b/net/netfilter/nft_queue.c
@@ -25,7 +25,6 @@ struct nft_queue {
        u16     queuenum;
        u16     queues_total;
        u16     flags;
-        u8      family;
 };
 static void nft_queue_eval(const struct nft_expr *expr,
@@ -43,7 +42,7 @@ static void nft_queue_eval(const struct nft_expr *expr,
                        queue = priv->queuenum + cpu % priv->queues_total;
                } else {
                        queue = nfqueue_hash(pkt->skb, queue,
-                                             priv->queues_total, priv->family,
+                                             priv->queues_total, pkt->ops->pf,
                                             jhash_initval);
                }
        }
@@ -71,7 +70,6 @@ static int nft_queue_init(const struct nft_ctx *ctx,
                return -EINVAL;
        init_hashrandom(&jhash_initval);
-        priv->family = ctx->afi->family;
        priv->queuenum = ntohs(nla_get_be16(tb[NFTA_QUEUE_NUM]));
        if (tb[NFTA_QUEUE_TOTAL] != NULL)
diff --git a/net/netfilter/nft_rbtree.c b/net/netfilter/nft_rbtree.c
index ca0c1b231bfe..e21d69d13506 100644
--- a/net/netfilter/nft_rbtree.c
+++ b/net/netfilter/nft_rbtree.c
@@ -69,8 +69,10 @@ static void nft_rbtree_elem_destroy(const struct nft_set *set,
                                    struct nft_rbtree_elem *rbe)
 {
        nft_data_uninit(&rbe->key, NFT_DATA_VALUE);
-        if (set->flags & NFT_SET_MAP)
+        if (set->flags & NFT_SET_MAP &&
+            !(rbe->flags & NFT_SET_ELEM_INTERVAL_END))
                nft_data_uninit(rbe->data, set->dtype);
        kfree(rbe);
 }
@@ -108,7 +110,8 @@ static int nft_rbtree_insert(const struct nft_set *set,
        int err;
        size = sizeof(*rbe);
-        if (set->flags & NFT_SET_MAP)
+        if (set->flags & NFT_SET_MAP &&
+            !(elem->flags & NFT_SET_ELEM_INTERVAL_END))
                size += sizeof(rbe->data[0]);
        rbe = kzalloc(size, GFP_KERNEL);
@@ -117,7 +120,8 @@ static int nft_rbtree_insert(const struct nft_set *set,
        rbe->flags = elem->flags;
        nft_data_copy(&rbe->key, &elem->key);
-        if (set->flags & NFT_SET_MAP)
+        if (set->flags & NFT_SET_MAP &&
+            !(rbe->flags & NFT_SET_ELEM_INTERVAL_END))
                nft_data_copy(rbe->data, &elem->data);
        err = __nft_rbtree_insert(set, rbe);
@@ -153,7 +157,8 @@ static int nft_rbtree_get(const struct nft_set *set, struct nft_set_elem *elem)
                        parent = parent->rb_right;
                else {
                        elem->cookie = rbe;
-                        if (set->flags & NFT_SET_MAP)
+                        if (set->flags & NFT_SET_MAP &&
+                            !(rbe->flags & NFT_SET_ELEM_INTERVAL_END))
                                nft_data_copy(&elem->data, rbe->data);
                        elem->flags = rbe->flags;
                        return 0;
@@ -177,7 +182,8 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx,
                rbe = rb_entry(node, struct nft_rbtree_elem, node);
                nft_data_copy(&elem.key, &rbe->key);
-                if (set->flags & NFT_SET_MAP)
+                if (set->flags & NFT_SET_MAP &&
+                    !(rbe->flags & NFT_SET_ELEM_INTERVAL_END))
                        nft_data_copy(&elem.data, rbe->data);
                elem.flags = rbe->flags;
diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c
index 5e204711d704..f3448c296446 100644
--- a/net/netfilter/nft_reject.c
+++ b/net/netfilter/nft_reject.c
@@ -16,65 +16,23 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables.h>
-#include <net/icmp.h>
+#include <net/netfilter/nft_reject.h>
-#include <net/netfilter/ipv4/nf_reject.h>
-#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
+const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
-#include <net/netfilter/ipv6/nf_reject.h>
-#endif
-struct nft_reject {
-        enum nft_reject_types   type:8;
-        u8                      icmp_code;
-        u8                      family;
-};
-static void nft_reject_eval(const struct nft_expr *expr,
-                              struct nft_data data[NFT_REG_MAX + 1],
-                              const struct nft_pktinfo *pkt)
-{
-        struct nft_reject *priv = nft_expr_priv(expr);
-#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
-        struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out);
-#endif
-        switch (priv->type) {
-        case NFT_REJECT_ICMP_UNREACH:
-                if (priv->family == NFPROTO_IPV4)
-                        nf_send_unreach(pkt->skb, priv->icmp_code);
-#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
-                else if (priv->family == NFPROTO_IPV6)
-                        nf_send_unreach6(net, pkt->skb, priv->icmp_code,
-                                      pkt->ops->hooknum);
-#endif
-                break;
-        case NFT_REJECT_TCP_RST:
-                if (priv->family == NFPROTO_IPV4)
-                        nf_send_reset(pkt->skb, pkt->ops->hooknum);
-#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
-                else if (priv->family == NFPROTO_IPV6)
-                        nf_send_reset6(net, pkt->skb, pkt->ops->hooknum);
-#endif
-                break;
-        }
-        data[NFT_REG_VERDICT].verdict = NF_DROP;
-}
-static const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
        [NFTA_REJECT_TYPE]              = { .type = NLA_U32 },
        [NFTA_REJECT_ICMP_CODE]         = { .type = NLA_U8 },
 };
+EXPORT_SYMBOL_GPL(nft_reject_policy);
-static int nft_reject_init(const struct nft_ctx *ctx,
+int nft_reject_init(const struct nft_ctx *ctx,
-                           const struct nft_expr *expr,
+                    const struct nft_expr *expr,
-                           const struct nlattr * const tb[])
+                    const struct nlattr * const tb[])
 {
        struct nft_reject *priv = nft_expr_priv(expr);
        if (tb[NFTA_REJECT_TYPE] == NULL)
                return -EINVAL;
-        priv->family = ctx->afi->family;
        priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
        switch (priv->type) {
        case NFT_REJECT_ICMP_UNREACH:
@@ -89,8 +47,9 @@ static int nft_reject_init(const struct nft_ctx *ctx,
        return 0;
 }
+EXPORT_SYMBOL_GPL(nft_reject_init);
-static int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
+int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
        const struct nft_reject *priv = nft_expr_priv(expr);
@@ -109,37 +68,7 @@ static int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
 nla_put_failure:
        return -1;
 }
+EXPORT_SYMBOL_GPL(nft_reject_dump);
-static struct nft_expr_type nft_reject_type;
-static const struct nft_expr_ops nft_reject_ops = {
-        .type           = &nft_reject_type,
-        .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
-        .eval           = nft_reject_eval,
-        .init           = nft_reject_init,
-        .dump           = nft_reject_dump,
-};
-static struct nft_expr_type nft_reject_type __read_mostly = {
-        .name           = "reject",
-        .ops            = &nft_reject_ops,
-        .policy         = nft_reject_policy,
-        .maxattr        = NFTA_REJECT_MAX,
-        .owner          = THIS_MODULE,
-};
-static int __init nft_reject_module_init(void)
-{
-        return nft_register_expr(&nft_reject_type);
-}
-static void __exit nft_reject_module_exit(void)
-{
-        nft_unregister_expr(&nft_reject_type);
-}
-module_init(nft_reject_module_init);
-module_exit(nft_reject_module_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_ALIAS_NFT_EXPR("reject");
diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c
new file mode 100644
index 000000000000..8a310f239c93
--- /dev/null
+++ b/net/netfilter/nft_reject_inet.c
@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2014 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nft_reject.h>
+static void nft_reject_inet_eval(const struct nft_expr *expr,
+                                 struct nft_data data[NFT_REG_MAX + 1],
+                                 const struct nft_pktinfo *pkt)
+{
+        switch (pkt->ops->pf) {
+        case NFPROTO_IPV4:
+                nft_reject_ipv4_eval(expr, data, pkt);
+        case NFPROTO_IPV6:
+                nft_reject_ipv6_eval(expr, data, pkt);
+        }
+}
+static struct nft_expr_type nft_reject_inet_type;
+static const struct nft_expr_ops nft_reject_inet_ops = {
+        .type           = &nft_reject_inet_type,
+        .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
+        .eval           = nft_reject_inet_eval,
+        .init           = nft_reject_init,
+        .dump           = nft_reject_dump,
+};
+static struct nft_expr_type nft_reject_inet_type __read_mostly = {
+        .family         = NFPROTO_INET,
+        .name           = "reject",
+        .ops            = &nft_reject_inet_ops,
+        .policy         = nft_reject_policy,
+        .maxattr        = NFTA_REJECT_MAX,
+        .owner          = THIS_MODULE,
+};
+static int __init nft_reject_inet_module_init(void)
+{
+        return nft_register_expr(&nft_reject_inet_type);
+}
+static void __exit nft_reject_inet_module_exit(void)
+{
+        nft_unregister_expr(&nft_reject_inet_type);
+}
+module_init(nft_reject_inet_module_init);
+module_exit(nft_reject_inet_module_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_ALIAS_NFT_AF_EXPR(1, "reject");
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 5929be622c5c..75747aecdebe 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -228,12 +228,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
                        goto err3;
        }
-        __set_bit(IPS_TEMPLATE_BIT, &ct->status);
+        nf_conntrack_tmpl_insert(par->net, ct);
-        __set_bit(IPS_CONFIRMED_BIT, &ct->status);
-        /* Overload tuple linked list to put us in template list. */
-        hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
-                                 &par->net->ct.tmpl);
 out:
        info->ct = ct;
        return 0;
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index df4692826ead..e9a48baf8551 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -55,6 +55,7 @@
 #include "datapath.h"
 #include "flow.h"
+#include "flow_table.h"
 #include "flow_netlink.h"
 #include "vport-internal_dev.h"
 #include "vport-netdev.h"
@@ -160,7 +161,6 @@ static void destroy_dp_rcu(struct rcu_head *rcu)
 {
        struct datapath *dp = container_of(rcu, struct datapath, rcu);
-        ovs_flow_tbl_destroy(&dp->table);
        free_percpu(dp->stats_percpu);
        release_net(ovs_dp_get_net(dp));
        kfree(dp->ports);
@@ -466,6 +466,14 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
        skb_zerocopy(user_skb, skb, skb->len, hlen);
+        /* Pad OVS_PACKET_ATTR_PACKET if linear copy was performed */
+        if (!(dp->user_features & OVS_DP_F_UNALIGNED)) {
+                size_t plen = NLA_ALIGN(user_skb->len) - user_skb->len;
+                if (plen > 0)
+                        memset(skb_put(user_skb, plen), 0, plen);
+        }
        ((struct nlmsghdr *) user_skb->data)->nlmsg_len = user_skb->len;
        err = genlmsg_unicast(ovs_dp_get_net(dp), user_skb, upcall_info->portid);
@@ -852,11 +860,8 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff *skb, struct genl_info *info)
                        goto err_unlock_ovs;
                /* The unmasked key has to be the same for flow updates. */
-                error = -EINVAL;
+                if (!ovs_flow_cmp_unmasked_key(flow, &match))
-                if (!ovs_flow_cmp_unmasked_key(flow, &match)) {
-                        OVS_NLERR("Flow modification message rejected, unmasked key does not match.\n");
                        goto err_unlock_ovs;
-                }
                /* Update actions. */
                old_acts = ovsl_dereference(flow->sf_acts);
@@ -1079,6 +1084,7 @@ static size_t ovs_dp_cmd_msg_size(void)
        msgsize += nla_total_size(IFNAMSIZ);
        msgsize += nla_total_size(sizeof(struct ovs_dp_stats));
        msgsize += nla_total_size(sizeof(struct ovs_dp_megaflow_stats));
+        msgsize += nla_total_size(sizeof(u32)); /* OVS_DP_ATTR_USER_FEATURES */
        return msgsize;
 }
@@ -1279,7 +1285,7 @@ err_destroy_ports_array:
 err_destroy_percpu:
        free_percpu(dp->stats_percpu);
 err_destroy_table:
-        ovs_flow_tbl_destroy(&dp->table);
+        ovs_flow_tbl_destroy(&dp->table, false);
 err_free_dp:
        release_net(ovs_dp_get_net(dp));
        kfree(dp);
@@ -1306,10 +1312,13 @@ static void __dp_destroy(struct datapath *dp)
        list_del_rcu(&dp->list_node);
        /* OVSP_LOCAL is datapath internal port. We need to make sure that
-         * all port in datapath are destroyed first before freeing datapath.
+         * all ports in datapath are destroyed first before freeing datapath.
         */
        ovs_dp_detach_port(ovs_vport_ovsl(dp, OVSP_LOCAL));
+        /* RCU destroy the flow table */
+        ovs_flow_tbl_destroy(&dp->table, true);
        call_rcu(&dp->rcu, destroy_dp_rcu);
 }
diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
index c58a0fe3c889..3c268b3d71c3 100644
--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
@@ -153,29 +153,29 @@ static void rcu_free_flow_callback(struct rcu_head *rcu)
        flow_free(flow);
 }
-static void flow_mask_del_ref(struct sw_flow_mask *mask, bool deferred)
-{
-        if (!mask)
-                return;
-        BUG_ON(!mask->ref_count);
-        mask->ref_count--;
-        if (!mask->ref_count) {
-                list_del_rcu(&mask->list);
-                if (deferred)
-                        kfree_rcu(mask, rcu);
-                else
-                        kfree(mask);
-        }
-}
 void ovs_flow_free(struct sw_flow *flow, bool deferred)
 {
        if (!flow)
                return;
-        flow_mask_del_ref(flow->mask, deferred);
+        if (flow->mask) {
+                struct sw_flow_mask *mask = flow->mask;
+                /* ovs-lock is required to protect mask-refcount and
+                 * mask list.
+                 */
+                ASSERT_OVSL();
+                BUG_ON(!mask->ref_count);
+                mask->ref_count--;
+                if (!mask->ref_count) {
+                        list_del_rcu(&mask->list);
+                        if (deferred)
+                                kfree_rcu(mask, rcu);
+                        else
+                                kfree(mask);
+                }
+        }
        if (deferred)
                call_rcu(&flow->rcu, rcu_free_flow_callback);
@@ -188,26 +188,9 @@ static void free_buckets(struct flex_array *buckets)
        flex_array_free(buckets);
 }
 static void __table_instance_destroy(struct table_instance *ti)
 {
-        int i;
-        if (ti->keep_flows)
-                goto skip_flows;
-        for (i = 0; i < ti->n_buckets; i++) {
-                struct sw_flow *flow;
-                struct hlist_head *head = flex_array_get(ti->buckets, i);
-                struct hlist_node *n;
-                int ver = ti->node_ver;
-                hlist_for_each_entry_safe(flow, n, head, hash_node[ver]) {
-                        hlist_del(&flow->hash_node[ver]);
-                        ovs_flow_free(flow, false);
-                }
-        }
-skip_flows:
        free_buckets(ti->buckets);
        kfree(ti);
 }
@@ -258,20 +241,38 @@ static void flow_tbl_destroy_rcu_cb(struct rcu_head *rcu)
 static void table_instance_destroy(struct table_instance *ti, bool deferred)
 {
+        int i;
        if (!ti)
                return;
+        if (ti->keep_flows)
+                goto skip_flows;
+        for (i = 0; i < ti->n_buckets; i++) {
+                struct sw_flow *flow;
+                struct hlist_head *head = flex_array_get(ti->buckets, i);
+                struct hlist_node *n;
+                int ver = ti->node_ver;
+                hlist_for_each_entry_safe(flow, n, head, hash_node[ver]) {
+                        hlist_del_rcu(&flow->hash_node[ver]);
+                        ovs_flow_free(flow, deferred);
+                }
+        }
+skip_flows:
        if (deferred)
                call_rcu(&ti->rcu, flow_tbl_destroy_rcu_cb);
        else
                __table_instance_destroy(ti);
 }
-void ovs_flow_tbl_destroy(struct flow_table *table)
+void ovs_flow_tbl_destroy(struct flow_table *table, bool deferred)
 {
        struct table_instance *ti = ovsl_dereference(table->ti);
-        table_instance_destroy(ti, false);
+        table_instance_destroy(ti, deferred);
 }
 struct sw_flow *ovs_flow_tbl_dump_next(struct table_instance *ti,
@@ -504,16 +505,11 @@ static struct sw_flow_mask *mask_alloc(void)
        mask = kmalloc(sizeof(*mask), GFP_KERNEL);
        if (mask)
-                mask->ref_count = 0;
+                mask->ref_count = 1;
        return mask;
 }
-static void mask_add_ref(struct sw_flow_mask *mask)
-{
-        mask->ref_count++;
-}
 static bool mask_equal(const struct sw_flow_mask *a,
                       const struct sw_flow_mask *b)
 {
@@ -554,9 +550,11 @@ static int flow_mask_insert(struct flow_table *tbl, struct sw_flow *flow,
                mask->key = new->key;
                mask->range = new->range;
                list_add_rcu(&mask->list, &tbl->mask_list);
+        } else {
+                BUG_ON(!mask->ref_count);
+                mask->ref_count++;
        }
-        mask_add_ref(mask);
        flow->mask = mask;
        return 0;
 }
diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h
index 1996e34c0fd8..baaeb101924d 100644
--- a/net/openvswitch/flow_table.h
+++ b/net/openvswitch/flow_table.h
@@ -60,7 +60,7 @@ void ovs_flow_free(struct sw_flow *, bool deferred);
 int ovs_flow_tbl_init(struct flow_table *);
 int ovs_flow_tbl_count(struct flow_table *table);
-void ovs_flow_tbl_destroy(struct flow_table *table);
+void ovs_flow_tbl_destroy(struct flow_table *table, bool deferred);
 int ovs_flow_tbl_flush(struct flow_table *flow_table);
 int ovs_flow_tbl_insert(struct flow_table *table, struct sw_flow *flow,
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 0f6259a6a932..2b1738ef9394 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -662,6 +662,8 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
         */
        sctp_v6_to_sk_daddr(&asoc->peer.primary_addr, newsk);
+        newsk->sk_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
        sk_refcnt_debug_inc(newsk);
        if (newsk->sk_prot->init(newsk)) {
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 80a6640f329b..06c6ff0cb911 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -571,7 +571,7 @@ static void svc_check_conn_limits(struct svc_serv *serv)
        }
 }
-int svc_alloc_arg(struct svc_rqst *rqstp)
+static int svc_alloc_arg(struct svc_rqst *rqstp)
 {
        struct svc_serv *serv = rqstp->rq_server;
        struct xdr_buf *arg;
@@ -612,7 +612,7 @@ int svc_alloc_arg(struct svc_rqst *rqstp)
        return 0;
 }
-struct svc_xprt *svc_get_next_xprt(struct svc_rqst *rqstp, long timeout)
+static struct svc_xprt *svc_get_next_xprt(struct svc_rqst *rqstp, long timeout)
 {
        struct svc_xprt *xprt;
        struct svc_pool         *pool = rqstp->rq_pool;
@@ -691,7 +691,7 @@ struct svc_xprt *svc_get_next_xprt(struct svc_rqst *rqstp, long timeout)
        return xprt;
 }
-void svc_add_new_temp_xprt(struct svc_serv *serv, struct svc_xprt *newxpt)
+static void svc_add_new_temp_xprt(struct svc_serv *serv, struct svc_xprt *newxpt)
 {
        spin_lock_bh(&serv->sv_lock);
        set_bit(XPT_TEMP, &newxpt->xpt_flags);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index d89dee2259b5..010892b81a06 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -203,8 +203,11 @@ void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
        rdev->opencount--;
-        WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev &&
+        if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
-                !rdev->scan_req->notified);
+                if (WARN_ON(!rdev->scan_req->notified))
+                        rdev->scan_req->aborted = true;
+                ___cfg80211_scan_done(rdev, false);
+        }
 }
 static int cfg80211_rfkill_set_block(void *data, bool blocked)
@@ -440,9 +443,6 @@ int wiphy_register(struct wiphy *wiphy)
        int i;
        u16 ifmodes = wiphy->interface_modes;
-        /* support for 5/10 MHz is broken due to nl80211 API mess - disable */
-        wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_5_10_MHZ;
        /*
         * There are major locking problems in nl80211/mac80211 for CSA,
         * disable for all drivers until this has been reworked.
@@ -859,8 +859,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                break;
        case NETDEV_DOWN:
                cfg80211_update_iface_num(rdev, wdev->iftype, -1);
-                WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev &&
+                if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
-                        !rdev->scan_req->notified);
+                        if (WARN_ON(!rdev->scan_req->notified))
+                                rdev->scan_req->aborted = true;
+                        ___cfg80211_scan_done(rdev, false);
+                }
                if (WARN_ON(rdev->sched_scan_req &&
                            rdev->sched_scan_req->dev == wdev->netdev)) {
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 37ec16d7bb1a..f1d193b557b6 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -62,6 +62,7 @@ struct cfg80211_registered_device {
        struct rb_root bss_tree;
        u32 bss_generation;
        struct cfg80211_scan_request *scan_req; /* protected by RTNL */
+        struct sk_buff *scan_msg;
        struct cfg80211_sched_scan_request *sched_scan_req;
        unsigned long suspend_at;
        struct work_struct scan_done_wk;
@@ -361,7 +362,8 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
                                   struct key_params *params, int key_idx,
                                   bool pairwise, const u8 *mac_addr);
 void __cfg80211_scan_done(struct work_struct *wk);
-void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev);
+void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
+                           bool send_message);
 void __cfg80211_sched_scan_results(struct work_struct *wk);
 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
                               bool driver_initiated);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 7a742594916e..4fe2e6e2bc76 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1719,9 +1719,10 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
                                 * We can then retry with the larger buffer.
                                 */
                                if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
-                                    !skb->len &&
+                                    !skb->len && !state->split &&
                                    cb->min_dump_alloc < 4096) {
                                        cb->min_dump_alloc = 4096;
+                                        state->split_start = 0;
                                        rtnl_unlock();
                                        return 1;
                                }
@@ -5244,7 +5245,7 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
        if (!rdev->ops->scan)
                return -EOPNOTSUPP;
-        if (rdev->scan_req) {
+        if (rdev->scan_req || rdev->scan_msg) {
                err = -EBUSY;
                goto unlock;
        }
@@ -10011,40 +10012,31 @@ void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
-void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
+struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
-                            struct wireless_dev *wdev)
+                                       struct wireless_dev *wdev, bool aborted)
 {
        struct sk_buff *msg;
        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!msg)
-                return;
+                return NULL;
        if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
-                                  NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
+                                  aborted ? NL80211_CMD_SCAN_ABORTED :
+                                            NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
                nlmsg_free(msg);
-                return;
+                return NULL;
        }
-        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
+        return msg;
-                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
-void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
+void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
-                               struct wireless_dev *wdev)
+                              struct sk_buff *msg)
 {
-        struct sk_buff *msg;
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!msg)
                return;
-        if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
-                                  NL80211_CMD_SCAN_ABORTED) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index b1b231324e10..75799746d845 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -8,10 +8,10 @@ void nl80211_exit(void);
 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev);
 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
                             struct wireless_dev *wdev);
-void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
+struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
-                            struct wireless_dev *wdev);
+                                       struct wireless_dev *wdev, bool aborted);
-void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
+void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
-                               struct wireless_dev *wdev);
+                              struct sk_buff *msg);
 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
                             struct net_device *netdev, u32 cmd);
 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index b528e31da2cf..d1ed4aebbbb7 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -161,18 +161,25 @@ static void __cfg80211_bss_expire(struct cfg80211_registered_device *dev,
                dev->bss_generation++;
 }
-void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev)
+void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
+                           bool send_message)
 {
        struct cfg80211_scan_request *request;
        struct wireless_dev *wdev;
+        struct sk_buff *msg;
 #ifdef CONFIG_CFG80211_WEXT
        union iwreq_data wrqu;
 #endif
        ASSERT_RTNL();
-        request = rdev->scan_req;
+        if (rdev->scan_msg) {
+                nl80211_send_scan_result(rdev, rdev->scan_msg);
+                rdev->scan_msg = NULL;
+                return;
+        }
+        request = rdev->scan_req;
        if (!request)
                return;
@@ -186,18 +193,16 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev)
        if (wdev->netdev)
                cfg80211_sme_scan_done(wdev->netdev);
-        if (request->aborted) {
+        if (!request->aborted &&
-                nl80211_send_scan_aborted(rdev, wdev);
+            request->flags & NL80211_SCAN_FLAG_FLUSH) {
-        } else {
+                /* flush entries from previous scans */
-                if (request->flags & NL80211_SCAN_FLAG_FLUSH) {
+                spin_lock_bh(&rdev->bss_lock);
-                        /* flush entries from previous scans */
+                __cfg80211_bss_expire(rdev, request->scan_start);
-                        spin_lock_bh(&rdev->bss_lock);
+                spin_unlock_bh(&rdev->bss_lock);
-                        __cfg80211_bss_expire(rdev, request->scan_start);
-                        spin_unlock_bh(&rdev->bss_lock);
-                }
-                nl80211_send_scan_done(rdev, wdev);
        }
+        msg = nl80211_build_scan_msg(rdev, wdev, request->aborted);
 #ifdef CONFIG_CFG80211_WEXT
        if (wdev->netdev && !request->aborted) {
                memset(&wrqu, 0, sizeof(wrqu));
@@ -211,6 +216,11 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev)
        rdev->scan_req = NULL;
        kfree(request);
+        if (!send_message)
+                rdev->scan_msg = msg;
+        else
+                nl80211_send_scan_result(rdev, msg);
 }
 void __cfg80211_scan_done(struct work_struct *wk)
@@ -221,7 +231,7 @@ void __cfg80211_scan_done(struct work_struct *wk)
                            scan_done_wk);
        rtnl_lock();
-        ___cfg80211_scan_done(rdev);
+        ___cfg80211_scan_done(rdev, true);
        rtnl_unlock();
 }
@@ -1079,7 +1089,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
        if (IS_ERR(rdev))
                return PTR_ERR(rdev);
-        if (rdev->scan_req) {
+        if (rdev->scan_req || rdev->scan_msg) {
                err = -EBUSY;
                goto out;
        }
@@ -1481,7 +1491,7 @@ int cfg80211_wext_giwscan(struct net_device *dev,
        if (IS_ERR(rdev))
                return PTR_ERR(rdev);
-        if (rdev->scan_req)
+        if (rdev->scan_req || rdev->scan_msg)
                return -EAGAIN;
        res = ieee80211_scan_results(rdev, info, extra, data->length);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index a63509118508..f04d4c32e96e 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -67,7 +67,7 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
        ASSERT_RDEV_LOCK(rdev);
        ASSERT_WDEV_LOCK(wdev);
-        if (rdev->scan_req)
+        if (rdev->scan_req || rdev->scan_msg)
                return -EBUSY;
        if (wdev->conn->params.channel)
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 0ea2a1e24ade..464dcef79b35 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -471,7 +471,7 @@ sub seed_camelcase_includes {
        $camelcase_seeded = 1;
-        if (-d ".git") {
+        if (-e ".git") {
                my $git_last_include_commit = `git log --no-merges --pretty=format:"%h%n" -1 -- include`;
                chomp $git_last_include_commit;
                $camelcase_cache = ".checkpatch-camelcase.git.$git_last_include_commit";
@@ -499,7 +499,7 @@ sub seed_camelcase_includes {
                return;
        }
-        if (-d ".git") {
+        if (-e ".git") {
                $files = `git ls-files "include/*.h"`;
                @include_files = split('\n', $files);
        }
diff --git a/scripts/get_maintainer.pl b/scripts/get_maintainer.pl
index 9c3986f4140c..41987885bd31 100755
--- a/scripts/get_maintainer.pl
+++ b/scripts/get_maintainer.pl
@@ -95,7 +95,7 @@ my %VCS_cmds;
 my %VCS_cmds_git = (
    "execute_cmd" => \&git_execute_cmd,
-    "available" => '(which("git") ne "") && (-d ".git")',
+    "available" => '(which("git") ne "") && (-e ".git")',
    "find_signers_cmd" =>
        "git log --no-color --follow --since=\$email_git_since " .
            '--numstat --no-merges ' .