379 files changed, 3300 insertions, 2178 deletions
diff --git a/Documentation/connector/ucon.c b/Documentation/connector/ucon.c
index 4848db8c71ff..8a4da64e02a8 100644
--- a/Documentation/connector/ucon.c
+++ b/Documentation/connector/ucon.c
@@ -71,7 +71,7 @@ static int netlink_send(int s, struct cn_msg *msg)
        nlh->nlmsg_seq = seq++;
        nlh->nlmsg_pid = getpid();
        nlh->nlmsg_type = NLMSG_DONE;
-        nlh->nlmsg_len = NLMSG_LENGTH(size - sizeof(*nlh));
+        nlh->nlmsg_len = size;
        nlh->nlmsg_flags = 0;
        m = NLMSG_DATA(nlh);
diff --git a/Documentation/lockstat.txt b/Documentation/lockstat.txt
index dd2f7b26ca30..72d010689751 100644
--- a/Documentation/lockstat.txt
+++ b/Documentation/lockstat.txt
@@ -46,16 +46,14 @@ With these hooks we provide the following statistics:
 contentions       - number of lock acquisitions that had to wait
 wait time min     - shortest (non-0) time we ever had to wait for a lock
           max     - longest time we ever had to wait for a lock
-           total   - total time we spend waiting on this lock
+           total   - total time we spend waiting on this lock
+           avg     - average time spent waiting on this lock
 acq-bounces       - number of lock acquisitions that involved x-cpu data
 acquisitions      - number of times we took the lock
 hold time min     - shortest (non-0) time we ever held the lock
-           max     - longest time we ever held the lock
+           max     - longest time we ever held the lock
-           total   - total time this lock was held
+           total   - total time this lock was held
+           avg     - average time this lock was held
-From these number various other statistics can be derived, such as:
- hold time average = hold time total / acquisitions
 These numbers are gathered per lock class, per read/write state (when
 applicable).
@@ -84,37 +82,38 @@ Look at the current lock statistics:
 # less /proc/lock_stat
-01 lock_stat version 0.3
+01 lock_stat version 0.4
-02 -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+02-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
-03                               class name    con-bounces    contentions   waittime-min   waittime-max waittime-total    acq-bounces   acquisitions   holdtime-min   holdtime-max holdtime-total
+03                              class name    con-bounces    contentions   waittime-min   waittime-max waittime-total   waittime-avg    acq-bounces   acquisitions   holdtime-min   holdtime-max holdtime-total   holdtime-avg
-04 -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+04-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 05
-06                          &mm->mmap_sem-W:           233            538 18446744073708       22924.27      607243.51           1342          45806           1.71        8595.89     1180582.34
+06                         &mm->mmap_sem-W:            46             84           0.26         939.10       16371.53         194.90          47291        2922365           0.16     2220301.69 17464026916.32        5975.99
-07                          &mm->mmap_sem-R:           205            587 18446744073708       28403.36      731975.00           1940         412426           0.58      187825.45     6307502.88
+07                         &mm->mmap_sem-R:            37            100           1.31      299502.61      325629.52        3256.30         212344       34316685           0.10        7744.91    95016910.20           2.77
-08                          ---------------
+08                         ---------------
-09                            &mm->mmap_sem            487          [<ffffffff8053491f>] do_page_fault+0x466/0x928
+09                           &mm->mmap_sem              1          [<ffffffff811502a7>] khugepaged_scan_mm_slot+0x57/0x280
-10                            &mm->mmap_sem            179          [<ffffffff802a6200>] sys_mprotect+0xcd/0x21d
+19                           &mm->mmap_sem             96          [<ffffffff815351c4>] __do_page_fault+0x1d4/0x510
-11                            &mm->mmap_sem            279          [<ffffffff80210a57>] sys_mmap+0x75/0xce
+11                           &mm->mmap_sem             34          [<ffffffff81113d77>] vm_mmap_pgoff+0x87/0xd0
-12                            &mm->mmap_sem             76          [<ffffffff802a490b>] sys_munmap+0x32/0x59
+12                           &mm->mmap_sem             17          [<ffffffff81127e71>] vm_munmap+0x41/0x80
-13                          ---------------
+13                         ---------------
-14                            &mm->mmap_sem            270          [<ffffffff80210a57>] sys_mmap+0x75/0xce
+14                           &mm->mmap_sem              1          [<ffffffff81046fda>] dup_mmap+0x2a/0x3f0
-15                            &mm->mmap_sem            431          [<ffffffff8053491f>] do_page_fault+0x466/0x928
+15                           &mm->mmap_sem             60          [<ffffffff81129e29>] SyS_mprotect+0xe9/0x250
-16                            &mm->mmap_sem            138          [<ffffffff802a490b>] sys_munmap+0x32/0x59
+16                           &mm->mmap_sem             41          [<ffffffff815351c4>] __do_page_fault+0x1d4/0x510
-17                            &mm->mmap_sem            145          [<ffffffff802a6200>] sys_mprotect+0xcd/0x21d
+17                           &mm->mmap_sem             68          [<ffffffff81113d77>] vm_mmap_pgoff+0x87/0xd0
 18
-19 ...............................................................................................................................................................................................
+19.............................................................................................................................................................................................................................
 20
-21                              dcache_lock:           621            623           0.52         118.26        1053.02           6745          91930           0.29         316.29      118423.41
+21                         unix_table_lock:           110            112           0.21          49.24         163.91           1.46          21094          66312           0.12         624.42       31589.81           0.48
-22                              -----------
+22                         ---------------
-23                              dcache_lock            179          [<ffffffff80378274>] _atomic_dec_and_lock+0x34/0x54
+23                         unix_table_lock             45          [<ffffffff8150ad8e>] unix_create1+0x16e/0x1b0
-24                              dcache_lock            113          [<ffffffff802cc17b>] d_alloc+0x19a/0x1eb
+24                         unix_table_lock             47          [<ffffffff8150b111>] unix_release_sock+0x31/0x250
-25                              dcache_lock             99          [<ffffffff802ca0dc>] d_rehash+0x1b/0x44
+25                         unix_table_lock             15          [<ffffffff8150ca37>] unix_find_other+0x117/0x230
-26                              dcache_lock            104          [<ffffffff802cbca0>] d_instantiate+0x36/0x8a
+26                         unix_table_lock              5          [<ffffffff8150a09f>] unix_autobind+0x11f/0x1b0
-27                              -----------
+27                         ---------------
-28                              dcache_lock            192          [<ffffffff80378274>] _atomic_dec_and_lock+0x34/0x54
+28                         unix_table_lock             39          [<ffffffff8150b111>] unix_release_sock+0x31/0x250
-29                              dcache_lock             98          [<ffffffff802ca0dc>] d_rehash+0x1b/0x44
+29                         unix_table_lock             49          [<ffffffff8150ad8e>] unix_create1+0x16e/0x1b0
-30                              dcache_lock             72          [<ffffffff802cc17b>] d_alloc+0x19a/0x1eb
+30                         unix_table_lock             20          [<ffffffff8150ca37>] unix_find_other+0x117/0x230
-31                              dcache_lock            112          [<ffffffff802cbca0>] d_instantiate+0x36/0x8a
+31                         unix_table_lock              4          [<ffffffff8150a09f>] unix_autobind+0x11f/0x1b0
 This excerpt shows the first two lock class statistics. Line 01 shows the
 output version - each time the format changes this will be updated. Line 02-04
@@ -131,30 +130,30 @@ The integer part of the time values is in us.
 Dealing with nested locks, subclasses may appear:
-32...............................................................................................................................................................................................
+32...........................................................................................................................................................................................................................
 33
-34                               &rq->lock:         13128          13128           0.43         190.53      103881.26          97454        3453404           0.00         401.11    13224683.11
+34                               &rq->lock:       13128          13128           0.43         190.53      103881.26           7.91          97454        3453404           0.00         401.11    13224683.11           3.82
 35                               ---------
-36                               &rq->lock            645          [<ffffffff8103bfc4>] task_rq_lock+0x43/0x75
+36                               &rq->lock          645          [<ffffffff8103bfc4>] task_rq_lock+0x43/0x75
-37                               &rq->lock            297          [<ffffffff8104ba65>] try_to_wake_up+0x127/0x25a
+37                               &rq->lock          297          [<ffffffff8104ba65>] try_to_wake_up+0x127/0x25a
-38                               &rq->lock            360          [<ffffffff8103c4c5>] select_task_rq_fair+0x1f0/0x74a
+38                               &rq->lock          360          [<ffffffff8103c4c5>] select_task_rq_fair+0x1f0/0x74a
-39                               &rq->lock            428          [<ffffffff81045f98>] scheduler_tick+0x46/0x1fb
+39                               &rq->lock          428          [<ffffffff81045f98>] scheduler_tick+0x46/0x1fb
 40                               ---------
-41                               &rq->lock             77          [<ffffffff8103bfc4>] task_rq_lock+0x43/0x75
+41                               &rq->lock           77          [<ffffffff8103bfc4>] task_rq_lock+0x43/0x75
-42                               &rq->lock            174          [<ffffffff8104ba65>] try_to_wake_up+0x127/0x25a
+42                               &rq->lock          174          [<ffffffff8104ba65>] try_to_wake_up+0x127/0x25a
-43                               &rq->lock           4715          [<ffffffff8103ed4b>] double_rq_lock+0x42/0x54
+43                               &rq->lock         4715          [<ffffffff8103ed4b>] double_rq_lock+0x42/0x54
-44                               &rq->lock            893          [<ffffffff81340524>] schedule+0x157/0x7b8
+44                               &rq->lock          893          [<ffffffff81340524>] schedule+0x157/0x7b8
 45
-46...............................................................................................................................................................................................
+46...........................................................................................................................................................................................................................
 47
-48                             &rq->lock/1:         11526          11488           0.33         388.73      136294.31          21461          38404           0.00          37.93      109388.53
+48                             &rq->lock/1:        1526          11488           0.33         388.73      136294.31          11.86          21461          38404           0.00          37.93      109388.53           2.84
 49                             -----------
-50                             &rq->lock/1          11526          [<ffffffff8103ed58>] double_rq_lock+0x4f/0x54
+50                             &rq->lock/1        11526          [<ffffffff8103ed58>] double_rq_lock+0x4f/0x54
 51                             -----------
-52                             &rq->lock/1           5645          [<ffffffff8103ed4b>] double_rq_lock+0x42/0x54
+52                             &rq->lock/1         5645          [<ffffffff8103ed4b>] double_rq_lock+0x42/0x54
-53                             &rq->lock/1           1224          [<ffffffff81340524>] schedule+0x157/0x7b8
+53                             &rq->lock/1         1224          [<ffffffff81340524>] schedule+0x157/0x7b8
-54                             &rq->lock/1           4336          [<ffffffff8103ed58>] double_rq_lock+0x4f/0x54
+54                             &rq->lock/1         4336          [<ffffffff8103ed58>] double_rq_lock+0x4f/0x54
-55                             &rq->lock/1            181          [<ffffffff8104ba65>] try_to_wake_up+0x127/0x25a
+55                             &rq->lock/1          181          [<ffffffff8104ba65>] try_to_wake_up+0x127/0x25a
 Line 48 shows statistics for the second subclass (/1) of &rq->lock class
 (subclass starts from 0), since in this case, as line 50 suggests,
@@ -163,16 +162,16 @@ double_rq_lock actually acquires a nested lock of two spinlocks.
 View the top contending locks:
 # grep : /proc/lock_stat | head
-              &inode->i_data.tree_lock-W:            15          21657           0.18     1093295.30 11547131054.85             58          10415           0.16          87.51        6387.60
+                        clockevents_lock:       2926159        2947636           0.15       46882.81  1784540466.34         605.41        3381345        3879161           0.00        2260.97    53178395.68          13.71
-              &inode->i_data.tree_lock-R:             0              0           0.00           0.00           0.00          23302         231198           0.25           8.45       98023.38
+                     tick_broadcast_lock:        346460         346717           0.18        2257.43    39364622.71         113.54        3642919        4242696           0.00        2263.79    49173646.60          11.59
-                             dcache_lock:          1037           1161           0.38          45.32         774.51           6611         243371           0.15         306.48       77387.24
+                  &mapping->i_mmap_mutex:        203896         203899           3.36      645530.05 31767507988.39      155800.21        3361776        8893984           0.17        2254.15    14110121.02           1.59
-                         &inode->i_mutex:           161            286 18446744073709       62882.54     1244614.55           3653          20598 18446744073709       62318.60     1693822.74
+                               &rq->lock:        135014         136909           0.18         606.09      842160.68           6.15        1540728       10436146           0.00         728.72    17606683.41           1.69
-                         &zone->lru_lock:            94             94           0.53           7.33          92.10           4366          32690           0.29          59.81       16350.06
+               &(&zone->lru_lock)->rlock:         93000          94934           0.16          59.18      188253.78           1.98        1199912        3809894           0.15         391.40     3559518.81           0.93
-              &inode->i_data.i_mmap_mutex:            79             79           0.40           3.77          53.03          11779          87755           0.28         116.93       29898.44
+                         tasklist_lock-W:         40667          41130           0.23        1189.42      428980.51          10.43         270278         510106           0.16         653.51     3939674.91           7.72
-                        &q->__queue_lock:            48             50           0.52          31.62          86.31            774          13131           0.17         113.08       12277.52
+                         tasklist_lock-R:         21298          21305           0.20        1310.05      215511.12          10.12         186204         241258           0.14        1162.33     1179779.23           4.89
-                        &rq->rq_lock_key:            43             47           0.74          68.50         170.63           3706          33929           0.22         107.99       17460.62
+                              rcu_node_1:         47656          49022           0.16         635.41      193616.41           3.95         844888        1865423           0.00         764.26     1656226.96           0.89
-                      &rq->rq_lock_key#2:            39             46           0.75           6.68          49.03           2979          32292           0.17         125.17       17137.63
+       &(&dentry->d_lockref.lock)->rlock:         39791          40179           0.15        1302.08       88851.96           2.21        2790851       12527025           0.10        1910.75     3379714.27           0.27
-                         tasklist_lock-W:            15             15           1.45          10.87          32.70           1201           7390           0.58          62.55       13648.47
+                              rcu_node_0:         29203          30064           0.16         786.55     1555573.00          51.74          88963         244254           0.00         398.87      428872.51           1.76
 Clear the statistics:
diff --git a/MAINTAINERS b/MAINTAINERS
index a97694dbf06f..4d07f0955942 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1009,6 +1009,7 @@ ARM/Marvell Armada 370 and Armada XP SOC support
 M:      Jason Cooper <jason@lakedaemon.net>
 M:      Andrew Lunn <andrew@lunn.ch>
 M:      Gregory Clement <gregory.clement@free-electrons.com>
+M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-mvebu/
@@ -1016,6 +1017,7 @@ F:	arch/arm/mach-mvebu/
 ARM/Marvell Dove/Kirkwood/MV78xx0/Orion SOC support
 M:      Jason Cooper <jason@lakedaemon.net>
 M:      Andrew Lunn <andrew@lunn.ch>
+M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-dove/
@@ -1148,6 +1150,13 @@ F:	drivers/net/ethernet/i825xx/ether1*
 F:      drivers/net/ethernet/seeq/ether3*
 F:      drivers/scsi/arm/
+ARM/Rockchip SoC support
+M:      Heiko Stuebner <heiko@sntech.de>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/mach-rockchip/
+F:      drivers/*/*rockchip*
 ARM/SHARK MACHINE SUPPORT
 M:      Alexander Schulz <alex@shark-linux.de>
 W:      http://www.shark-linux.de/shark.html
@@ -1791,6 +1800,7 @@ F:	include/net/bluetooth/
 BONDING DRIVER
 M:      Jay Vosburgh <fubar@us.ibm.com>
+M:      Veaceslav Falico <vfalico@redhat.com>
 M:      Andy Gospodarek <andy@greyhouse.net>
 L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/bonding/
@@ -2718,6 +2728,8 @@ T:	git git://git.linaro.org/people/sumitsemwal/linux-dma-buf.git
 DMA GENERIC OFFLOAD ENGINE SUBSYSTEM
 M:      Vinod Koul <vinod.koul@intel.com>
 M:      Dan Williams <dan.j.williams@intel.com>
+L:      dmaengine@vger.kernel.org
+Q:      https://patchwork.kernel.org/project/linux-dmaengine/list/
 S:      Supported
 F:      drivers/dma/
 F:      include/linux/dma*
@@ -2821,7 +2833,7 @@ M:	Terje Bergström <tbergstrom@nvidia.com>
 L:      dri-devel@lists.freedesktop.org
 L:      linux-tegra@vger.kernel.org
 T:      git git://anongit.freedesktop.org/tegra/linux.git
-S:      Maintained
+S:      Supported
 F:      drivers/gpu/host1x/
 F:      include/uapi/drm/tegra_drm.h
 F:      Documentation/devicetree/bindings/gpu/nvidia,tegra20-host1x.txt
@@ -4357,7 +4369,10 @@ F:	arch/x86/kernel/microcode_intel.c
 INTEL I/OAT DMA DRIVER
 M:      Dan Williams <dan.j.williams@intel.com>
-S:      Maintained
+M:      Dave Jiang <dave.jiang@intel.com>
+L:      dmaengine@vger.kernel.org
+Q:      https://patchwork.kernel.org/project/linux-dmaengine/list/
+S:      Supported
 F:      drivers/dma/ioat*
 INTEL IOMMU (VT-d)
@@ -7823,6 +7838,13 @@ F:	Documentation/sound/alsa/soc/
 F:      sound/soc/
 F:      include/sound/soc*
+SOUND - DMAENGINE HELPERS
+M:      Lars-Peter Clausen <lars@metafoo.de>
+S:      Supported
+F:      include/sound/dmaengine_pcm.h
+F:      sound/core/pcm_dmaengine.c
+F:      sound/soc/soc-generic-dmaengine-pcm.c
 SPARC + UltraSPARC (sparc/sparc64)
 M:      "David S. Miller" <davem@davemloft.net>
 L:      sparclinux@vger.kernel.org
@@ -8295,14 +8317,72 @@ L:	linux-media@vger.kernel.org
 S:      Maintained
 F:      drivers/media/rc/ttusbir.c
-TEGRA SUPPORT
+TEGRA ARCHITECTURE SUPPORT
 M:      Stephen Warren <swarren@wwwdotorg.org>
+M:      Thierry Reding <thierry.reding@gmail.com>
 L:      linux-tegra@vger.kernel.org
 Q:      http://patchwork.ozlabs.org/project/linux-tegra/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/swarren/linux-tegra.git
 S:      Supported
 N:      [^a-z]tegra
+TEGRA ASOC DRIVER
+M:      Stephen Warren <swarren@wwwdotorg.org>
+S:      Supported
+F:      sound/soc/tegra/
+TEGRA CLOCK DRIVER
+M:      Peter De Schrijver <pdeschrijver@nvidia.com>
+M:      Prashant Gaikwad <pgaikwad@nvidia.com>
+S:      Supported
+F:      drivers/clk/tegra/
+TEGRA DMA DRIVER
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/dma/tegra20-apb-dma.c
+TEGRA GPIO DRIVER
+M:      Stephen Warren <swarren@wwwdotorg.org>
+S:      Supported
+F:      drivers/gpio/gpio-tegra.c
+TEGRA I2C DRIVER
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/i2c/busses/i2c-tegra.c
+TEGRA IOMMU DRIVERS
+M:      Hiroshi Doyu <hdoyu@nvidia.com>
+S:      Supported
+F:      drivers/iommu/tegra*
+TEGRA KBC DRIVER
+M:      Rakesh Iyer <riyer@nvidia.com>
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/input/keyboard/tegra-kbc.c
+TEGRA PINCTRL DRIVER
+M:      Stephen Warren <swarren@wwwdotorg.org>
+S:      Supported
+F:      drivers/pinctrl/pinctrl-tegra*
+TEGRA PWM DRIVER
+M:      Thierry Reding <thierry.reding@gmail.com>
+S:      Supported
+F:      drivers/pwm/pwm-tegra.c
+TEGRA SERIAL DRIVER
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/tty/serial/serial-tegra.c
+TEGRA SPI DRIVER
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/spi/spi-tegra*
 TEHUTI ETHERNET DRIVER
 M:      Andy Gospodarek <andy@greyhouse.net>
 L:      netdev@vger.kernel.org
@@ -8838,61 +8918,14 @@ W:	http://pegasus2.sourceforge.net/
 S:      Maintained
 F:      drivers/net/usb/rtl8150.c
-USB SERIAL BELKIN F5U103 DRIVER
+USB SERIAL SUBSYSTEM
-M:      William Greathouse <wgreathouse@smva.com>
+M:      Johan Hovold <jhovold@gmail.com>
-L:      linux-usb@vger.kernel.org
-S:      Maintained
-F:      drivers/usb/serial/belkin_sa.*
-USB SERIAL CYPRESS M8 DRIVER
-M:      Lonnie Mendez <dignome@gmail.com>
-L:      linux-usb@vger.kernel.org
-S:      Maintained
-W:      http://geocities.com/i0xox0i
-W:      http://firstlight.net/cvs
-F:      drivers/usb/serial/cypress_m8.*
-USB SERIAL CYBERJACK DRIVER
-M:      Matthias Bruestle and Harald Welte <support@reiner-sct.com>
-W:      http://www.reiner-sct.de/support/treiber_cyberjack.php
-S:      Maintained
-F:      drivers/usb/serial/cyberjack.c
-USB SERIAL DIGI ACCELEPORT DRIVER
-M:      Peter Berger <pberger@brimson.com>
-M:      Al Borchers <alborchers@steinerpoint.com>
 L:      linux-usb@vger.kernel.org
 S:      Maintained
-F:      drivers/usb/serial/digi_acceleport.c
-USB SERIAL DRIVER
-M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-L:      linux-usb@vger.kernel.org
-S:      Supported
 F:      Documentation/usb/usb-serial.txt
-F:      drivers/usb/serial/generic.c
+F:      drivers/usb/serial/
-F:      drivers/usb/serial/usb-serial.c
 F:      include/linux/usb/serial.h
-USB SERIAL EMPEG EMPEG-CAR MARK I/II DRIVER
-M:      Gary Brubaker <xavyer@ix.netcom.com>
-L:      linux-usb@vger.kernel.org
-S:      Maintained
-F:      drivers/usb/serial/empeg.c
-USB SERIAL KEYSPAN DRIVER
-M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-L:      linux-usb@vger.kernel.org
-S:      Maintained
-F:      drivers/usb/serial/*keyspan*
-USB SERIAL WHITEHEAT DRIVER
-M:      Support Department <support@connecttech.com>
-L:      linux-usb@vger.kernel.org
-W:      http://www.connecttech.com
-S:      Supported
-F:      drivers/usb/serial/whiteheat*
 USB SMSC75XX ETHERNET DRIVER
 M:      Steve Glendinning <steve.glendinning@shawell.net>
 L:      netdev@vger.kernel.org
diff --git a/Makefile b/Makefile
index deec08b7612b..67077ad6edbb 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 12
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION =
 NAME = One Giant Leap for Frogkind
 # *DOCUMENTATION*
diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
index d63f3de0cd5b..0c14d8a52683 100644
--- a/arch/arc/mm/fault.c
+++ b/arch/arc/mm/fault.c
@@ -17,7 +17,7 @@
 #include <asm/pgalloc.h>
 #include <asm/mmu.h>
-static int handle_vmalloc_fault(struct mm_struct *mm, unsigned long address)
+static int handle_vmalloc_fault(unsigned long address)
 {
        /*
         * Synchronize this task's top level page-table
@@ -27,7 +27,7 @@ static int handle_vmalloc_fault(struct mm_struct *mm, unsigned long address)
        pud_t *pud, *pud_k;
        pmd_t *pmd, *pmd_k;
-        pgd = pgd_offset_fast(mm, address);
+        pgd = pgd_offset_fast(current->active_mm, address);
        pgd_k = pgd_offset_k(address);
        if (!pgd_present(*pgd_k))
@@ -72,7 +72,7 @@ void do_page_fault(struct pt_regs *regs, unsigned long address)
         * nothing more.
         */
        if (address >= VMALLOC_START && address <= VMALLOC_END) {
-                ret = handle_vmalloc_fault(mm, address);
+                ret = handle_vmalloc_fault(address);
                if (unlikely(ret))
                        goto bad_area_nosemaphore;
                else
diff --git a/arch/arm/boot/dts/integratorcp.dts b/arch/arm/boot/dts/integratorcp.dts
index ff1aea0ee043..72693a69f830 100644
--- a/arch/arm/boot/dts/integratorcp.dts
+++ b/arch/arm/boot/dts/integratorcp.dts
@@ -9,11 +9,6 @@
        model = "ARM Integrator/CP";
        compatible = "arm,integrator-cp";
-        aliases {
-                arm,timer-primary = &timer2;
-                arm,timer-secondary = &timer1;
-        };
        chosen {
                bootargs = "root=/dev/ram0 console=ttyAMA0,38400n8 earlyprintk";
        };
@@ -24,14 +19,18 @@
        };
        timer0: timer@13000000 {
+                /* TIMER0 runs @ 25MHz */
                compatible = "arm,integrator-cp-timer";
+                status = "disabled";
        };
        timer1: timer@13000100 {
+                /* TIMER1 runs @ 1MHz */
                compatible = "arm,integrator-cp-timer";
        };
        timer2: timer@13000200 {
+                /* TIMER2 runs @ 1MHz */
                compatible = "arm,integrator-cp-timer";
        };
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index f50d223a0bd3..99b44e0e8d86 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -930,4 +930,5 @@ void bpf_jit_free(struct sk_filter *fp)
 {
        if (fp->bpf_func != sk_run_filter)
                module_free(NULL, fp->bpf_func);
+        kfree(fp);
 }
diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
index 45f1ffcf1a4b..24cdf64789c3 100644
--- a/arch/mips/kernel/perf_event_mipsxx.c
+++ b/arch/mips/kernel/perf_event_mipsxx.c
@@ -971,11 +971,11 @@ static const struct mips_perf_event mipsxx74Kcore_cache_map
 [C(LL)] = {
        [C(OP_READ)] = {
                [C(RESULT_ACCESS)]      = { 0x1c, CNTR_ODD, P },
-                [C(RESULT_MISS)]        = { 0x1d, CNTR_EVEN | CNTR_ODD, P },
+                [C(RESULT_MISS)]        = { 0x1d, CNTR_EVEN, P },
        },
        [C(OP_WRITE)] = {
                [C(RESULT_ACCESS)]      = { 0x1c, CNTR_ODD, P },
-                [C(RESULT_MISS)]        = { 0x1d, CNTR_EVEN | CNTR_ODD, P },
+                [C(RESULT_MISS)]        = { 0x1d, CNTR_EVEN, P },
        },
 },
 [C(ITLB)] = {
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index c69da3734699..5b28e81d94a0 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -473,7 +473,7 @@ static void __init fill_ipi_map(void)
 {
        int cpu;
-        for (cpu = 0; cpu < NR_CPUS; cpu++) {
+        for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
                fill_ipi_map1(gic_resched_int_base, cpu, GIC_CPU_INT1);
                fill_ipi_map1(gic_call_int_base, cpu, GIC_CPU_INT2);
        }
@@ -574,8 +574,9 @@ void __init arch_init_irq(void)
                /* FIXME */
                int i;
 #if defined(CONFIG_MIPS_MT_SMP)
-                gic_call_int_base = GIC_NUM_INTRS - NR_CPUS;
+                gic_call_int_base = GIC_NUM_INTRS -
-                gic_resched_int_base = gic_call_int_base - NR_CPUS;
+                        (NR_CPUS - nr_cpu_ids) * 2 - nr_cpu_ids;
+                gic_resched_int_base = gic_call_int_base - nr_cpu_ids;
                fill_ipi_map();
 #endif
                gic_init(GIC_BASE_ADDR, GIC_ADDRSPACE_SZ, gic_intr_map,
@@ -599,7 +600,7 @@ void __init arch_init_irq(void)
                printk("CPU%d: status register now %08x\n", smp_processor_id(), read_c0_status());
                write_c0_status(0x1100dc00);
                printk("CPU%d: status register frc %08x\n", smp_processor_id(), read_c0_status());
-                for (i = 0; i < NR_CPUS; i++) {
+                for (i = 0; i < nr_cpu_ids; i++) {
                        arch_init_ipiirq(MIPS_GIC_IRQ_BASE +
                                         GIC_RESCHED_INT(i), &irq_resched);
                        arch_init_ipiirq(MIPS_GIC_IRQ_BASE +
diff --git a/arch/mips/ralink/timer.c b/arch/mips/ralink/timer.c
index e49241a2c39a..202785709441 100644
--- a/arch/mips/ralink/timer.c
+++ b/arch/mips/ralink/timer.c
@@ -126,7 +126,7 @@ static int rt_timer_probe(struct platform_device *pdev)
                return -ENOENT;
        }
-        rt->membase = devm_request_and_ioremap(&pdev->dev, res);
+        rt->membase = devm_ioremap_resource(&pdev->dev, res);
        if (IS_ERR(rt->membase))
                return PTR_ERR(rt->membase);
diff --git a/arch/parisc/configs/712_defconfig b/arch/parisc/configs/712_defconfig
index 0f90569b9d85..9387cc2693f6 100644
--- a/arch/parisc/configs/712_defconfig
+++ b/arch/parisc/configs/712_defconfig
@@ -40,6 +40,8 @@ CONFIG_IP_NF_QUEUE=m
 CONFIG_LLC2=m
 CONFIG_NET_PKTGEN=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_PARPORT=y
diff --git a/arch/parisc/configs/a500_defconfig b/arch/parisc/configs/a500_defconfig
index b647b182dacc..90025322b75e 100644
--- a/arch/parisc/configs/a500_defconfig
+++ b/arch/parisc/configs/a500_defconfig
@@ -79,6 +79,8 @@ CONFIG_IP_DCCP=m
 CONFIG_LLC2=m
 CONFIG_NET_PKTGEN=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_BLK_DEV_UMEM=m
diff --git a/arch/parisc/configs/b180_defconfig b/arch/parisc/configs/b180_defconfig
index e289f5bf3148..f1a0c25bef8d 100644
--- a/arch/parisc/configs/b180_defconfig
+++ b/arch/parisc/configs/b180_defconfig
@@ -4,6 +4,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_BLK_DEV_INITRD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODVERSIONS=y
@@ -27,6 +28,8 @@ CONFIG_IP_PNP_BOOTP=y
 # CONFIG_INET_LRO is not set
 CONFIG_IPV6=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_PARPORT=y
 CONFIG_PARPORT_PC=y
diff --git a/arch/parisc/configs/c3000_defconfig b/arch/parisc/configs/c3000_defconfig
index 311ca367b622..ec1b014952b6 100644
--- a/arch/parisc/configs/c3000_defconfig
+++ b/arch/parisc/configs/c3000_defconfig
@@ -5,6 +5,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
@@ -39,6 +40,8 @@ CONFIG_NETFILTER_DEBUG=y
 CONFIG_IP_NF_QUEUE=m
 CONFIG_NET_PKTGEN=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_BLK_DEV_UMEM=m
diff --git a/arch/parisc/configs/c8000_defconfig b/arch/parisc/configs/c8000_defconfig
index f11006361297..e1c8d2015c89 100644
--- a/arch/parisc/configs/c8000_defconfig
+++ b/arch/parisc/configs/c8000_defconfig
@@ -62,6 +62,8 @@ CONFIG_TIPC=m
 CONFIG_LLC2=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 CONFIG_PARPORT=y
 CONFIG_PARPORT_PC=y
diff --git a/arch/parisc/configs/default_defconfig b/arch/parisc/configs/default_defconfig
index dfe88f6c95c4..ba61495e1fa4 100644
--- a/arch/parisc/configs/default_defconfig
+++ b/arch/parisc/configs/default_defconfig
@@ -49,6 +49,8 @@ CONFIG_INET6_ESP=y
 CONFIG_INET6_IPCOMP=y
 CONFIG_LLC2=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_PARPORT=y
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index b521c0adf4ec..c035673209f7 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -602,7 +602,6 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
                __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
        }
 }
-EXPORT_SYMBOL_GPL(flush_cache_page);
 #ifdef CONFIG_PARISC_TMPALIAS
diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
index 37aabd772fbb..d2d58258aea6 100644
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -195,6 +195,8 @@ common_stext:
        ldw             MEM_PDC_HI(%r0),%r6
        depd            %r6, 31, 32, %r3        /* move to upper word */
+        mfctl           %cr30,%r6               /* PCX-W2 firmware bug */
        ldo             PDC_PSW(%r0),%arg0              /* 21 */
        ldo             PDC_PSW_SET_DEFAULTS(%r0),%arg1 /* 2 */
        ldo             PDC_PSW_WIDE_BIT(%r0),%arg2     /* 2 */
@@ -203,6 +205,8 @@ common_stext:
        copy            %r0,%arg3
 stext_pdc_ret:
+        mtctl           %r6,%cr30               /* restore task thread info */
        /* restore rfi target address*/
        ldd             TI_TASK-THREAD_SZ_ALGN(%sp), %r10
        tophys_r1       %r10
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index bf56e33f8257..2345bdb4d917 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -691,4 +691,5 @@ void bpf_jit_free(struct sk_filter *fp)
 {
        if (fp->bpf_func != sk_run_filter)
                module_free(NULL, fp->bpf_func);
+        kfree(fp);
 }
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 9b60a36c348d..2204400d0bd5 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -748,7 +748,9 @@ static inline void pgste_set_key(pte_t *ptep, pgste_t pgste, pte_t entry)
 static inline void pgste_set_pte(pte_t *ptep, pte_t entry)
 {
-        if (!MACHINE_HAS_ESOP && (pte_val(entry) & _PAGE_WRITE)) {
+        if (!MACHINE_HAS_ESOP &&
+            (pte_val(entry) & _PAGE_PRESENT) &&
+            (pte_val(entry) & _PAGE_WRITE)) {
                /*
                 * Without enhanced suppression-on-protection force
                 * the dirty bit on for all writable ptes.
diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
index 8ad8af915032..819b94d22720 100644
--- a/arch/s390/include/asm/timex.h
+++ b/arch/s390/include/asm/timex.h
@@ -71,30 +71,30 @@ static inline void local_tick_enable(unsigned long long comp)
 typedef unsigned long long cycles_t;
-static inline unsigned long long get_tod_clock(void)
-{
-        unsigned long long clk;
-#ifdef CONFIG_HAVE_MARCH_Z9_109_FEATURES
-        asm volatile(".insn s,0xb27c0000,%0" : "=Q" (clk) : : "cc");
-#else
-        asm volatile("stck %0" : "=Q" (clk) : : "cc");
-#endif
-        return clk;
-}
 static inline void get_tod_clock_ext(char *clk)
 {
        asm volatile("stcke %0" : "=Q" (*clk) : : "cc");
 }
-static inline unsigned long long get_tod_clock_xt(void)
+static inline unsigned long long get_tod_clock(void)
 {
        unsigned char clk[16];
        get_tod_clock_ext(clk);
        return *((unsigned long long *)&clk[1]);
 }
+static inline unsigned long long get_tod_clock_fast(void)
+{
+#ifdef CONFIG_HAVE_MARCH_Z9_109_FEATURES
+        unsigned long long clk;
+        asm volatile("stckf %0" : "=Q" (clk) : : "cc");
+        return clk;
+#else
+        return get_tod_clock();
+#endif
+}
 static inline cycles_t get_cycles(void)
 {
        return (cycles_t) get_tod_clock() >> 2;
@@ -125,7 +125,7 @@ extern u64 sched_clock_base_cc;
 */
 static inline unsigned long long get_tod_clock_monotonic(void)
 {
-        return get_tod_clock_xt() - sched_clock_base_cc;
+        return get_tod_clock() - sched_clock_base_cc;
 }
 /**
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
index 1389b637dae5..adaa9e9478d8 100644
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -99,7 +99,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
                        break;
                }
        }
-        return err;
+        return err ? -EFAULT : 0;
 }
 int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
@@ -148,7 +148,7 @@ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
                        break;
                }
        }
-        return err;
+        return err ? -EFAULT : 0;
 }
 static int save_sigregs32(struct pt_regs *regs, _sigregs32 __user *sregs)
diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index f1279dc2e1bc..17d62fe5d7b7 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -867,7 +867,7 @@ static inline void
 debug_finish_entry(debug_info_t * id, debug_entry_t* active, int level,
                        int exception)
 {
-        active->id.stck = get_tod_clock();
+        active->id.stck = get_tod_clock_fast();
        active->id.fields.cpuid = smp_processor_id();
        active->caller = __builtin_return_address(0);
        active->id.fields.exception = exception;
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 7f35cb33e510..7f1f7ac5cf7f 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -385,7 +385,7 @@ static int kvm_cpu_has_interrupt(struct kvm_vcpu *vcpu)
        }
        if ((!rc) && (vcpu->arch.sie_block->ckc <
-                get_tod_clock() + vcpu->arch.sie_block->epoch)) {
+                get_tod_clock_fast() + vcpu->arch.sie_block->epoch)) {
                if ((!psw_extint_disabled(vcpu)) &&
                        (vcpu->arch.sie_block->gcr[0] & 0x800ul))
                        rc = 1;
@@ -425,7 +425,7 @@ int kvm_s390_handle_wait(struct kvm_vcpu *vcpu)
                goto no_timer;
        }
-        now = get_tod_clock() + vcpu->arch.sie_block->epoch;
+        now = get_tod_clock_fast() + vcpu->arch.sie_block->epoch;
        if (vcpu->arch.sie_block->ckc < now) {
                __unset_cpu_idle(vcpu);
                return 0;
@@ -515,7 +515,7 @@ void kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu)
        }
        if ((vcpu->arch.sie_block->ckc <
-                get_tod_clock() + vcpu->arch.sie_block->epoch))
+                get_tod_clock_fast() + vcpu->arch.sie_block->epoch))
                __try_deliver_ckc_interrupt(vcpu);
        if (atomic_read(&fi->active)) {
diff --git a/arch/s390/lib/delay.c b/arch/s390/lib/delay.c
index 57c87d7d7ede..a9f3d0042d58 100644
--- a/arch/s390/lib/delay.c
+++ b/arch/s390/lib/delay.c
@@ -44,7 +44,7 @@ static void __udelay_disabled(unsigned long long usecs)
        do {
                set_clock_comparator(end);
                vtime_stop_cpu();
-        } while (get_tod_clock() < end);
+        } while (get_tod_clock_fast() < end);
        lockdep_on();
        __ctl_load(cr0, 0, 0);
        __ctl_load(cr6, 6, 6);
@@ -55,7 +55,7 @@ static void __udelay_enabled(unsigned long long usecs)
 {
        u64 clock_saved, end;
-        end = get_tod_clock() + (usecs << 12);
+        end = get_tod_clock_fast() + (usecs << 12);
        do {
                clock_saved = 0;
                if (end < S390_lowcore.clock_comparator) {
@@ -65,7 +65,7 @@ static void __udelay_enabled(unsigned long long usecs)
                vtime_stop_cpu();
                if (clock_saved)
                        local_tick_enable(clock_saved);
-        } while (get_tod_clock() < end);
+        } while (get_tod_clock_fast() < end);
 }
 /*
@@ -109,8 +109,8 @@ void udelay_simple(unsigned long long usecs)
 {
        u64 end;
-        end = get_tod_clock() + (usecs << 12);
+        end = get_tod_clock_fast() + (usecs << 12);
-        while (get_tod_clock() < end)
+        while (get_tod_clock_fast() < end)
                cpu_relax();
 }
@@ -120,10 +120,10 @@ void __ndelay(unsigned long long nsecs)
        nsecs <<= 9;
        do_div(nsecs, 125);
-        end = get_tod_clock() + nsecs;
+        end = get_tod_clock_fast() + nsecs;
        if (nsecs & ~0xfffUL)
                __udelay(nsecs >> 12);
-        while (get_tod_clock() < end)
+        while (get_tod_clock_fast() < end)
                barrier();
 }
 EXPORT_SYMBOL(__ndelay);
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 709239285869..a5df511e27a2 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -881,7 +881,9 @@ void bpf_jit_free(struct sk_filter *fp)
        struct bpf_binary_header *header = (void *)addr;
        if (fp->bpf_func == sk_run_filter)
-                return;
+                goto free_filter;
        set_memory_rw(addr, header->pages);
        module_free(NULL, header);
+free_filter:
+        kfree(fp);
 }
diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
index 9c7be59e6f5a..218b6b23c378 100644
--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -808,4 +808,5 @@ void bpf_jit_free(struct sk_filter *fp)
 {
        if (fp->bpf_func != sk_run_filter)
                module_free(NULL, fp->bpf_func);
+        kfree(fp);
 }
diff --git a/arch/um/kernel/exitcode.c b/arch/um/kernel/exitcode.c
index 829df49dee99..41ebbfebb333 100644
--- a/arch/um/kernel/exitcode.c
+++ b/arch/um/kernel/exitcode.c
@@ -40,9 +40,11 @@ static ssize_t exitcode_proc_write(struct file *file,
                const char __user *buffer, size_t count, loff_t *pos)
 {
        char *end, buf[sizeof("nnnnn\0")];
+        size_t size;
        int tmp;
-        if (copy_from_user(buf, buffer, count))
+        size = min(count, sizeof(buf));
+        if (copy_from_user(buf, buffer, size))
                return -EFAULT;
        tmp = simple_strtol(buf, &end, 0);
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 145d703227bf..e22d7f5f9837 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -638,10 +638,10 @@ config PARAVIRT_SPINLOCKS
          spinlock implementation with something virtualization-friendly
          (for example, block the virtual CPU rather than spinning).
-          Unfortunately the downside is an up to 5% performance hit on
+          It has a minimal impact on native kernels and gives a nice performance
-          native kernels, with various workloads.
+          benefit on paravirtualized KVM / Xen kernels.
-          If you are unsure how to answer this question, answer N.
+          If you are unsure how to answer this question, answer Y.
 source "arch/x86/xen/Kconfig"
@@ -1033,6 +1033,7 @@ config X86_REBOOTFIXUPS
 config MICROCODE
        tristate "CPU microcode loading support"
+        depends on CPU_SUP_AMD || CPU_SUP_INTEL
        select FW_LOADER
        ---help---
diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index 0da5200ee79d..b3e18f800302 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -128,7 +128,8 @@ do {							\
 do {                                                                    \
        typedef typeof(var) pao_T__;                                    \
        const int pao_ID__ = (__builtin_constant_p(val) &&              \
-                              ((val) == 1 || (val) == -1)) ? (val) : 0; \
+                              ((val) == 1 || (val) == -1)) ?            \
+                                (int)(val) : 0;                         \
        if (0) {                                                        \
                pao_T__ pao_tmp__;                                      \
                pao_tmp__ = (val);                                      \
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index 15e8563e5c24..df94598ad05a 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -402,17 +402,6 @@ void alternatives_enable_smp(void)
 {
        struct smp_alt_module *mod;
-#ifdef CONFIG_LOCKDEP
-        /*
-         * Older binutils section handling bug prevented
-         * alternatives-replacement from working reliably.
-         *
-         * If this still occurs then you should see a hang
-         * or crash shortly after this line:
-         */
-        pr_info("lockdep: fixing up alternatives\n");
-#endif
        /* Why bother if there are no other CPUs? */
        BUG_ON(num_possible_cpus() == 1);
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 1191ac1c9d25..a419814cea57 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -113,7 +113,7 @@ static int __init early_get_pnodeid(void)
                break;
        case UV3_HUB_PART_NUMBER:
        case UV3_HUB_PART_NUMBER_X:
-                uv_min_hub_revision_id += UV3_HUB_REVISION_BASE - 1;
+                uv_min_hub_revision_id += UV3_HUB_REVISION_BASE;
                break;
        }
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 9d8449158cf9..8a87a3224121 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1276,16 +1276,16 @@ void perf_events_lapic_init(void)
 static int __kprobes
 perf_event_nmi_handler(unsigned int cmd, struct pt_regs *regs)
 {
-        int ret;
        u64 start_clock;
        u64 finish_clock;
+        int ret;
        if (!atomic_read(&active_events))
                return NMI_DONE;
-        start_clock = local_clock();
+        start_clock = sched_clock();
        ret = x86_pmu.handle_irq(regs);
-        finish_clock = local_clock();
+        finish_clock = sched_clock();
        perf_sample_event_took(finish_clock - start_clock);
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index a0e2a8a80c94..b2046e4d0b59 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -609,7 +609,7 @@ static struct dentry *d_kvm_debug;
 struct dentry *kvm_init_debugfs(void)
 {
-        d_kvm_debug = debugfs_create_dir("kvm", NULL);
+        d_kvm_debug = debugfs_create_dir("kvm-guest", NULL);
        if (!d_kvm_debug)
                printk(KERN_WARNING "Could not create 'kvm' debugfs directory\n");
diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
index ba77ebc2c353..6fcb49ce50a1 100644
--- a/arch/x86/kernel/nmi.c
+++ b/arch/x86/kernel/nmi.c
@@ -113,10 +113,10 @@ static int __kprobes nmi_handle(unsigned int type, struct pt_regs *regs, bool b2
                u64 before, delta, whole_msecs;
                int remainder_ns, decimal_msecs, thishandled;
-                before = local_clock();
+                before = sched_clock();
                thishandled = a->handler(type, regs);
                handled += thishandled;
-                delta = local_clock() - before;
+                delta = sched_clock() - before;
                trace_nmi_handler(a->handler, (int)delta, thishandled);
                if (delta < nmi_longest_ns)
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 79c216aa0e2b..516593e1ce33 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -772,13 +772,21 @@ out:
        return;
 }
+static void bpf_jit_free_deferred(struct work_struct *work)
+{
+        struct sk_filter *fp = container_of(work, struct sk_filter, work);
+        unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
+        struct bpf_binary_header *header = (void *)addr;
+        set_memory_rw(addr, header->pages);
+        module_free(NULL, header);
+        kfree(fp);
+}
 void bpf_jit_free(struct sk_filter *fp)
 {
        if (fp->bpf_func != sk_run_filter) {
-                unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
+                INIT_WORK(&fp->work, bpf_jit_free_deferred);
-                struct bpf_binary_header *header = (void *)addr;
+                schedule_work(&fp->work);
-                set_memory_rw(addr, header->pages);
-                module_free(NULL, header);
        }
 }
diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
index de1dfa18d0a1..21dbe6bdb8ed 100644
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1122,7 +1122,7 @@ ENDPROC(fast_syscall_spill_registers)
 * a3: exctable, original value in excsave1
 */
-fast_syscall_spill_registers_fixup:
+ENTRY(fast_syscall_spill_registers_fixup)
        rsr     a2, windowbase  # get current windowbase (a2 is saved)
        xsr     a0, depc        # restore depc and a0
@@ -1134,22 +1134,26 @@ fast_syscall_spill_registers_fixup:
         */
        xsr     a3, excsave1    # get spill-mask
-        slli    a2, a3, 1       # shift left by one
+        slli    a3, a3, 1       # shift left by one
-        slli    a3, a2, 32-WSBITS
+        slli    a2, a3, 32-WSBITS
-        src     a2, a2, a3      # a1 = xxwww1yyxxxwww1yy......
+        src     a2, a3, a2      # a2 = xxwww1yyxxxwww1yy......
        wsr     a2, windowstart # set corrected windowstart
-        rsr     a3, excsave1
+        srli    a3, a3, 1
-        l32i    a2, a3, EXC_TABLE_DOUBLE_SAVE   # restore a2
+        rsr     a2, excsave1
-        l32i    a3, a3, EXC_TABLE_PARAM # original WB (in user task)
+        l32i    a2, a2, EXC_TABLE_DOUBLE_SAVE   # restore a2
+        xsr     a2, excsave1
+        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE   # save a3
+        l32i    a3, a2, EXC_TABLE_PARAM # original WB (in user task)
+        xsr     a2, excsave1
        /* Return to the original (user task) WINDOWBASE.
         * We leave the following frame behind:
         * a0, a1, a2   same
-         * a3:          trashed (saved in excsave_1)
+         * a3:          trashed (saved in EXC_TABLE_DOUBLE_SAVE)
         * depc:        depc (we have to return to that address)
-         * excsave_1:   a3
+         * excsave_1:   exctable
         */
        wsr     a3, windowbase
@@ -1159,9 +1163,9 @@ fast_syscall_spill_registers_fixup:
         *  a0: return address
         *  a1: used, stack pointer
         *  a2: kernel stack pointer
-         *  a3: available, saved in EXCSAVE_1
+         *  a3: available
         *  depc: exception address
-         *  excsave: a3
+         *  excsave: exctable
         * Note: This frame might be the same as above.
         */
@@ -1181,9 +1185,12 @@ fast_syscall_spill_registers_fixup:
        rsr     a0, exccause
        addx4   a0, a0, a3                      # find entry in table
        l32i    a0, a0, EXC_TABLE_FAST_USER     # load handler
+        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
        jx      a0
-fast_syscall_spill_registers_fixup_return:
+ENDPROC(fast_syscall_spill_registers_fixup)
+ENTRY(fast_syscall_spill_registers_fixup_return)
        /* When we return here, all registers have been restored (a2: DEPC) */
@@ -1191,13 +1198,13 @@ fast_syscall_spill_registers_fixup_return:
        /* Restore fixup handler. */
-        xsr     a3, excsave1
+        rsr     a2, excsave1
-        movi    a2, fast_syscall_spill_registers_fixup
+        s32i    a3, a2, EXC_TABLE_DOUBLE_SAVE
-        s32i    a2, a3, EXC_TABLE_FIXUP
+        movi    a3, fast_syscall_spill_registers_fixup
-        s32i    a0, a3, EXC_TABLE_DOUBLE_SAVE
+        s32i    a3, a2, EXC_TABLE_FIXUP
-        rsr     a2, windowbase
+        rsr     a3, windowbase
-        s32i    a2, a3, EXC_TABLE_PARAM
+        s32i    a3, a2, EXC_TABLE_PARAM
-        l32i    a2, a3, EXC_TABLE_KSTK
+        l32i    a2, a2, EXC_TABLE_KSTK
        /* Load WB at the time the exception occurred. */
@@ -1206,8 +1213,12 @@ fast_syscall_spill_registers_fixup_return:
        wsr     a3, windowbase
        rsync
+        rsr     a3, excsave1
+        l32i    a3, a3, EXC_TABLE_DOUBLE_SAVE
        rfde
+ENDPROC(fast_syscall_spill_registers_fixup_return)
 /*
 * spill all registers.
diff --git a/arch/xtensa/kernel/signal.c b/arch/xtensa/kernel/signal.c
index 718eca1850bd..98b67d5f1514 100644
--- a/arch/xtensa/kernel/signal.c
+++ b/arch/xtensa/kernel/signal.c
@@ -341,7 +341,7 @@ static int setup_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
        sp = regs->areg[1];
-        if ((ka->sa.sa_flags & SA_ONSTACK) != 0 && ! on_sig_stack(sp)) {
+        if ((ka->sa.sa_flags & SA_ONSTACK) != 0 && sas_ss_flags(sp) == 0) {
                sp = current->sas_ss_sp + current->sas_ss_size;
        }
diff --git a/arch/xtensa/platforms/iss/network.c b/arch/xtensa/platforms/iss/network.c
index 56f88b7afe2f..e9e1aad8c271 100644
--- a/arch/xtensa/platforms/iss/network.c
+++ b/arch/xtensa/platforms/iss/network.c
@@ -737,7 +737,8 @@ static int __init iss_net_setup(char *str)
                return 1;
        }
-        if ((new = alloc_bootmem(sizeof new)) == NULL) {
+        new = alloc_bootmem(sizeof(*new));
+        if (new == NULL) {
                printk("Alloc_bootmem failed\n");
                return 1;
        }
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 5ea5c32609ac..6efe2ac6902f 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -123,9 +123,9 @@ config ACPI_BUTTON
        default y
        help
          This driver handles events on the power, sleep, and lid buttons.
-          A daemon reads /proc/acpi/event and perform user-defined actions
+          A daemon reads events from input devices or via netlink and
-          such as shutting down the system.  This is necessary for
+          performs user-defined actions such as shutting down the system.
-          software-controlled poweroff.
+          This is necessary for software-controlled poweroff.
          To compile this driver as a module, choose M here:
          the module will be called button.
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 59d3202f6b36..a94383d1f350 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -1025,60 +1025,4 @@ void acpi_dev_pm_detach(struct device *dev, bool power_off)
        }
 }
 EXPORT_SYMBOL_GPL(acpi_dev_pm_detach);
-/**
- * acpi_dev_pm_add_dependent - Add physical device depending for PM.
- * @handle: Handle of ACPI device node.
- * @depdev: Device depending on that node for PM.
- */
-void acpi_dev_pm_add_dependent(acpi_handle handle, struct device *depdev)
-{
-        struct acpi_device_physical_node *dep;
-        struct acpi_device *adev;
-        if (!depdev || acpi_bus_get_device(handle, &adev))
-                return;
-        mutex_lock(&adev->physical_node_lock);
-        list_for_each_entry(dep, &adev->power_dependent, node)
-                if (dep->dev == depdev)
-                        goto out;
-        dep = kzalloc(sizeof(*dep), GFP_KERNEL);
-        if (dep) {
-                dep->dev = depdev;
-                list_add_tail(&dep->node, &adev->power_dependent);
-        }
- out:
-        mutex_unlock(&adev->physical_node_lock);
-}
-EXPORT_SYMBOL_GPL(acpi_dev_pm_add_dependent);
-/**
- * acpi_dev_pm_remove_dependent - Remove physical device depending for PM.
- * @handle: Handle of ACPI device node.
- * @depdev: Device depending on that node for PM.
- */
-void acpi_dev_pm_remove_dependent(acpi_handle handle, struct device *depdev)
-{
-        struct acpi_device_physical_node *dep;
-        struct acpi_device *adev;
-        if (!depdev || acpi_bus_get_device(handle, &adev))
-                return;
-        mutex_lock(&adev->physical_node_lock);
-        list_for_each_entry(dep, &adev->power_dependent, node)
-                if (dep->dev == depdev) {
-                        list_del(&dep->node);
-                        kfree(dep);
-                        break;
-                }
-        mutex_unlock(&adev->physical_node_lock);
-}
-EXPORT_SYMBOL_GPL(acpi_dev_pm_remove_dependent);
 #endif /* CONFIG_PM */
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 0dbe5cdf3396..c2ad391d8041 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -59,16 +59,9 @@ ACPI_MODULE_NAME("power");
 #define ACPI_POWER_RESOURCE_STATE_ON    0x01
 #define ACPI_POWER_RESOURCE_STATE_UNKNOWN 0xFF
-struct acpi_power_dependent_device {
-        struct list_head node;
-        struct acpi_device *adev;
-        struct work_struct work;
-};
 struct acpi_power_resource {
        struct acpi_device device;
        struct list_head list_node;
-        struct list_head dependent;
        char *name;
        u32 system_level;
        u32 order;
@@ -233,32 +226,6 @@ static int acpi_power_get_list_state(struct list_head *list, int *state)
        return 0;
 }
-static void acpi_power_resume_dependent(struct work_struct *work)
-{
-        struct acpi_power_dependent_device *dep;
-        struct acpi_device_physical_node *pn;
-        struct acpi_device *adev;
-        int state;
-        dep = container_of(work, struct acpi_power_dependent_device, work);
-        adev = dep->adev;
-        if (acpi_power_get_inferred_state(adev, &state))
-                return;
-        if (state > ACPI_STATE_D0)
-                return;
-        mutex_lock(&adev->physical_node_lock);
-        list_for_each_entry(pn, &adev->physical_node_list, node)
-                pm_request_resume(pn->dev);
-        list_for_each_entry(pn, &adev->power_dependent, node)
-                pm_request_resume(pn->dev);
-        mutex_unlock(&adev->physical_node_lock);
-}
 static int __acpi_power_on(struct acpi_power_resource *resource)
 {
        acpi_status status = AE_OK;
@@ -283,14 +250,8 @@ static int acpi_power_on_unlocked(struct acpi_power_resource *resource)
                                  resource->name));
        } else {
                result = __acpi_power_on(resource);
-                if (result) {
+                if (result)
                        resource->ref_count--;
-                } else {
-                        struct acpi_power_dependent_device *dep;
-                        list_for_each_entry(dep, &resource->dependent, node)
-                                schedule_work(&dep->work);
-                }
        }
        return result;
 }
@@ -390,52 +351,6 @@ static int acpi_power_on_list(struct list_head *list)
        return result;
 }
-static void acpi_power_add_dependent(struct acpi_power_resource *resource,
-                                     struct acpi_device *adev)
-{
-        struct acpi_power_dependent_device *dep;
-        mutex_lock(&resource->resource_lock);
-        list_for_each_entry(dep, &resource->dependent, node)
-                if (dep->adev == adev)
-                        goto out;
-        dep = kzalloc(sizeof(*dep), GFP_KERNEL);
-        if (!dep)
-                goto out;
-        dep->adev = adev;
-        INIT_WORK(&dep->work, acpi_power_resume_dependent);
-        list_add_tail(&dep->node, &resource->dependent);
- out:
-        mutex_unlock(&resource->resource_lock);
-}
-static void acpi_power_remove_dependent(struct acpi_power_resource *resource,
-                                        struct acpi_device *adev)
-{
-        struct acpi_power_dependent_device *dep;
-        struct work_struct *work = NULL;
-        mutex_lock(&resource->resource_lock);
-        list_for_each_entry(dep, &resource->dependent, node)
-                if (dep->adev == adev) {
-                        list_del(&dep->node);
-                        work = &dep->work;
-                        break;
-                }
-        mutex_unlock(&resource->resource_lock);
-        if (work) {
-                cancel_work_sync(work);
-                kfree(dep);
-        }
-}
 static struct attribute *attrs[] = {
        NULL,
 };
@@ -524,8 +439,6 @@ static void acpi_power_expose_hide(struct acpi_device *adev,
 void acpi_power_add_remove_device(struct acpi_device *adev, bool add)
 {
-        struct acpi_device_power_state *ps;
-        struct acpi_power_resource_entry *entry;
        int state;
        if (adev->wakeup.flags.valid)
@@ -535,16 +448,6 @@ void acpi_power_add_remove_device(struct acpi_device *adev, bool add)
        if (!adev->power.flags.power_resources)
                return;
-        ps = &adev->power.states[ACPI_STATE_D0];
-        list_for_each_entry(entry, &ps->resources, node) {
-                struct acpi_power_resource *resource = entry->resource;
-                if (add)
-                        acpi_power_add_dependent(resource, adev);
-                else
-                        acpi_power_remove_dependent(resource, adev);
-        }
        for (state = ACPI_STATE_D0; state <= ACPI_STATE_D3_HOT; state++)
                acpi_power_expose_hide(adev,
                                       &adev->power.states[state].resources,
@@ -882,7 +785,6 @@ int acpi_add_power_resource(acpi_handle handle)
        acpi_init_device_object(device, handle, ACPI_BUS_TYPE_POWER,
                                ACPI_STA_DEFAULT);
        mutex_init(&resource->resource_lock);
-        INIT_LIST_HEAD(&resource->dependent);
        INIT_LIST_HEAD(&resource->list_node);
        resource->name = device->pnp.bus_id;
        strcpy(acpi_device_name(device), ACPI_POWER_DEVICE_NAME);
@@ -936,8 +838,10 @@ void acpi_resume_power_resources(void)
                mutex_lock(&resource->resource_lock);
                result = acpi_power_get_state(resource->device.handle, &state);
-                if (result)
+                if (result) {
+                        mutex_unlock(&resource->resource_lock);
                        continue;
+                }
                if (state == ACPI_POWER_RESOURCE_STATE_OFF
                    && resource->ref_count) {
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 407ad13cac2f..fee8a297c7d9 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -999,7 +999,6 @@ int acpi_device_add(struct acpi_device *device,
        INIT_LIST_HEAD(&device->wakeup_list);
        INIT_LIST_HEAD(&device->physical_node_list);
        mutex_init(&device->physical_node_lock);
-        INIT_LIST_HEAD(&device->power_dependent);
        new_bus_id = kzalloc(sizeof(struct acpi_device_bus_id), GFP_KERNEL);
        if (!new_bus_id) {
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 9d715ae5ff6b..8e28f923cf7f 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1343,7 +1343,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (!(hpriv->cap & HOST_CAP_SSS) || ahci_ignore_sss)
                host->flags |= ATA_HOST_PARALLEL_SCAN;
        else
-                printk(KERN_INFO "ahci: SSS flag set, parallel bus scan disabled\n");
+                dev_info(&pdev->dev, "SSS flag set, parallel bus scan disabled\n");
        if (pi.flags & ATA_FLAG_EM)
                ahci_reset_em(host);
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index 2daaee05cab1..7d3b85385bfc 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -184,7 +184,7 @@ static int ahci_probe(struct platform_device *pdev)
        if (!(hpriv->cap & HOST_CAP_SSS) || ahci_ignore_sss)
                host->flags |= ATA_HOST_PARALLEL_SCAN;
        else
-                printk(KERN_INFO "ahci: SSS flag set, parallel bus scan disabled\n");
+                dev_info(dev, "SSS flag set, parallel bus scan disabled\n");
        if (pi.flags & ATA_FLAG_EM)
                ahci_reset_em(host);
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index acfd0f711069..aaac4fb0d564 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -778,8 +778,16 @@ static void ahci_start_port(struct ata_port *ap)
                                rc = ap->ops->transmit_led_message(ap,
                                                               emp->led_state,
                                                               4);
+                                /*
+                                 * If busy, give a breather but do not
+                                 * release EH ownership by using msleep()
+                                 * instead of ata_msleep().  EM Transmit
+                                 * bit is busy for the whole host and
+                                 * releasing ownership will cause other
+                                 * ports to fail the same way.
+                                 */
                                if (rc == -EBUSY)
-                                        ata_msleep(ap, 1);
+                                        msleep(1);
                                else
                                        break;
                        }
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index 4ba8b0405572..ab714d2ad978 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -1035,17 +1035,3 @@ void ata_acpi_on_disable(struct ata_device *dev)
 {
        ata_acpi_clear_gtf(dev);
 }
-void ata_scsi_acpi_bind(struct ata_device *dev)
-{
-        acpi_handle handle = ata_dev_acpi_handle(dev);
-        if (handle)
-                acpi_dev_pm_add_dependent(handle, &dev->sdev->sdev_gendev);
-}
-void ata_scsi_acpi_unbind(struct ata_device *dev)
-{
-        acpi_handle handle = ata_dev_acpi_handle(dev);
-        if (handle)
-                acpi_dev_pm_remove_dependent(handle, &dev->sdev->sdev_gendev);
-}
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index c69fcce505c0..370462fa8e01 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1322,14 +1322,14 @@ void ata_eh_qc_complete(struct ata_queued_cmd *qc)
 *      should be retried.  To be used from EH.
 *
 *      SCSI midlayer limits the number of retries to scmd->allowed.
- *      scmd->retries is decremented for commands which get retried
+ *      scmd->allowed is incremented for commands which get retried
 *      due to unrelated failures (qc->err_mask is zero).
 */
 void ata_eh_qc_retry(struct ata_queued_cmd *qc)
 {
        struct scsi_cmnd *scmd = qc->scsicmd;
-        if (!qc->err_mask && scmd->retries)
+        if (!qc->err_mask)
-                scmd->retries--;
+                scmd->allowed++;
        __ata_eh_qc_complete(qc);
 }
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 97a0cef12959..db6dfcfa3e2e 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3679,7 +3679,6 @@ void ata_scsi_scan_host(struct ata_port *ap, int sync)
                        if (!IS_ERR(sdev)) {
                                dev->sdev = sdev;
                                scsi_device_put(sdev);
-                                ata_scsi_acpi_bind(dev);
                        } else {
                                dev->sdev = NULL;
                        }
@@ -3767,8 +3766,6 @@ static void ata_scsi_remove_dev(struct ata_device *dev)
        struct scsi_device *sdev;
        unsigned long flags;
-        ata_scsi_acpi_unbind(dev);
        /* Alas, we need to grab scan_mutex to ensure SCSI device
         * state doesn't change underneath us and thus
         * scsi_device_get() always succeeds.  The mutex locking can
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index eeeb77845d48..45b5ab3a95d5 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -121,8 +121,6 @@ extern void ata_acpi_set_state(struct ata_port *ap, pm_message_t state);
 extern void ata_acpi_bind_port(struct ata_port *ap);
 extern void ata_acpi_bind_dev(struct ata_device *dev);
 extern acpi_handle ata_dev_acpi_handle(struct ata_device *dev);
-extern void ata_scsi_acpi_bind(struct ata_device *dev);
-extern void ata_scsi_acpi_unbind(struct ata_device *dev);
 #else
 static inline void ata_acpi_dissociate(struct ata_host *host) { }
 static inline int ata_acpi_on_suspend(struct ata_port *ap) { return 0; }
@@ -133,8 +131,6 @@ static inline void ata_acpi_set_state(struct ata_port *ap,
                                      pm_message_t state) { }
 static inline void ata_acpi_bind_port(struct ata_port *ap) {}
 static inline void ata_acpi_bind_dev(struct ata_device *dev) {}
-static inline void ata_scsi_acpi_bind(struct ata_device *dev) {}
-static inline void ata_scsi_acpi_unbind(struct ata_device *dev) {}
 #endif
 /* libata-scsi.c */
diff --git a/drivers/ata/pata_isapnp.c b/drivers/ata/pata_isapnp.c
index 4bceb8803a10..b33d1f99b3a4 100644
--- a/drivers/ata/pata_isapnp.c
+++ b/drivers/ata/pata_isapnp.c
@@ -78,7 +78,7 @@ static int isapnp_init_one(struct pnp_dev *idev, const struct pnp_device_id *dev
        ap->ioaddr.cmd_addr = cmd_addr;
-        if (pnp_port_valid(idev, 1) == 0) {
+        if (pnp_port_valid(idev, 1)) {
                ctl_addr = devm_ioport_map(&idev->dev,
                                           pnp_port_start(idev, 1), 1);
                ap->ioaddr.altstatus_addr = ctl_addr;
diff --git a/drivers/clk/clk-nomadik.c b/drivers/clk/clk-nomadik.c
index 51410c2ac2cb..4d978a3c88f7 100644
--- a/drivers/clk/clk-nomadik.c
+++ b/drivers/clk/clk-nomadik.c
@@ -27,6 +27,14 @@
 */
 #define SRC_CR                  0x00U
+#define SRC_CR_T0_ENSEL         BIT(15)
+#define SRC_CR_T1_ENSEL         BIT(17)
+#define SRC_CR_T2_ENSEL         BIT(19)
+#define SRC_CR_T3_ENSEL         BIT(21)
+#define SRC_CR_T4_ENSEL         BIT(23)
+#define SRC_CR_T5_ENSEL         BIT(25)
+#define SRC_CR_T6_ENSEL         BIT(27)
+#define SRC_CR_T7_ENSEL         BIT(29)
 #define SRC_XTALCR              0x0CU
 #define SRC_XTALCR_XTALTIMEN    BIT(20)
 #define SRC_XTALCR_SXTALDIS     BIT(19)
@@ -543,6 +551,19 @@ void __init nomadik_clk_init(void)
                       __func__, np->name);
                return;
        }
+        /* Set all timers to use the 2.4 MHz TIMCLK */
+        val = readl(src_base + SRC_CR);
+        val |= SRC_CR_T0_ENSEL;
+        val |= SRC_CR_T1_ENSEL;
+        val |= SRC_CR_T2_ENSEL;
+        val |= SRC_CR_T3_ENSEL;
+        val |= SRC_CR_T4_ENSEL;
+        val |= SRC_CR_T5_ENSEL;
+        val |= SRC_CR_T6_ENSEL;
+        val |= SRC_CR_T7_ENSEL;
+        writel(val, src_base + SRC_CR);
        val = readl(src_base + SRC_XTALCR);
        pr_info("SXTALO is %s\n",
                (val & SRC_XTALCR_SXTALDIS) ? "disabled" : "enabled");
diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
index fc777bdc1886..81a202d12a7a 100644
--- a/drivers/clk/mvebu/armada-370.c
+++ b/drivers/clk/mvebu/armada-370.c
@@ -39,8 +39,8 @@ static const struct coreclk_ratio a370_coreclk_ratios[] __initconst = {
 };
 static const u32 a370_tclk_freqs[] __initconst = {
-        16600000,
+        166000000,
-        20000000,
+        200000000,
 };
 static u32 __init a370_get_tclk_freq(void __iomem *sar)
diff --git a/drivers/clk/socfpga/clk.c b/drivers/clk/socfpga/clk.c
index 5bb848cac6ec..81dd31a686df 100644
--- a/drivers/clk/socfpga/clk.c
+++ b/drivers/clk/socfpga/clk.c
@@ -49,7 +49,7 @@
 #define SOCFPGA_L4_SP_CLK               "l4_sp_clk"
 #define SOCFPGA_NAND_CLK                "nand_clk"
 #define SOCFPGA_NAND_X_CLK              "nand_x_clk"
-#define SOCFPGA_MMC_CLK                 "mmc_clk"
+#define SOCFPGA_MMC_CLK                 "sdmmc_clk"
 #define SOCFPGA_DB_CLK                  "gpio_db_clk"
 #define div_mask(width) ((1 << (width)) - 1)
diff --git a/drivers/clk/versatile/clk-icst.c b/drivers/clk/versatile/clk-icst.c
index 67ccf4aa7277..f5e4c21b301f 100644
--- a/drivers/clk/versatile/clk-icst.c
+++ b/drivers/clk/versatile/clk-icst.c
@@ -107,7 +107,7 @@ static int icst_set_rate(struct clk_hw *hw, unsigned long rate,
        vco = icst_hz_to_vco(icst->params, rate);
        icst->rate = icst_hz(icst->params, vco);
-        vco_set(icst->vcoreg, icst->lockreg, vco);
+        vco_set(icst->lockreg, icst->vcoreg, vco);
        return 0;
 }
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 08ae128cce9b..c73fc2b74de2 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -65,6 +65,7 @@ void proc_fork_connector(struct task_struct *task)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -80,6 +81,7 @@ void proc_fork_connector(struct task_struct *task)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        /*  If cn_netlink_send() failed, the data is not sent */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -96,6 +98,7 @@ void proc_exec_connector(struct task_struct *task)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -106,6 +109,7 @@ void proc_exec_connector(struct task_struct *task)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -122,6 +126,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        ev->what = which_id;
        ev->event_data.id.process_pid = task->pid;
        ev->event_data.id.process_tgid = task->tgid;
@@ -145,6 +150,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -160,6 +166,7 @@ void proc_sid_connector(struct task_struct *task)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -170,6 +177,7 @@ void proc_sid_connector(struct task_struct *task)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -185,6 +193,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -203,6 +212,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -218,6 +228,7 @@ void proc_comm_connector(struct task_struct *task)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -229,6 +240,7 @@ void proc_comm_connector(struct task_struct *task)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -244,6 +256,7 @@ void proc_coredump_connector(struct task_struct *task)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -254,6 +267,7 @@ void proc_coredump_connector(struct task_struct *task)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -269,6 +283,7 @@ void proc_exit_connector(struct task_struct *task)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -281,6 +296,7 @@ void proc_exit_connector(struct task_struct *task)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -304,6 +320,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
        msg = (struct cn_msg *)buffer;
        ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
        msg->seq = rcvd_seq;
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -313,6 +330,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = rcvd_ack + 1;
        msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
        cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index 6ecfa758942c..a36749f1e44a 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -109,7 +109,7 @@ int cn_netlink_send(struct cn_msg *msg, u32 __group, gfp_t gfp_mask)
        data = nlmsg_data(nlh);
-        memcpy(data, msg, sizeof(*data) + msg->len);
+        memcpy(data, msg, size);
        NETLINK_CB(skb).dst_group = group;
@@ -157,17 +157,18 @@ static int cn_call_callback(struct sk_buff *skb)
 static void cn_rx_skb(struct sk_buff *__skb)
 {
        struct nlmsghdr *nlh;
-        int err;
        struct sk_buff *skb;
+        int len, err;
        skb = skb_get(__skb);
        if (skb->len >= NLMSG_HDRLEN) {
                nlh = nlmsg_hdr(skb);
+                len = nlmsg_len(nlh);
-                if (nlh->nlmsg_len < sizeof(struct cn_msg) ||
+                if (len < (int)sizeof(struct cn_msg) ||
                    skb->len < nlh->nlmsg_len ||
-                    nlh->nlmsg_len > CONNECTOR_MAX_MSG_SIZE) {
+                    len > CONNECTOR_MAX_MSG_SIZE) {
                        kfree_skb(skb);
                        return;
                }
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index d2c3253e015e..506fd23c7550 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -986,12 +986,12 @@ static int __init acpi_cpufreq_init(void)
 {
        int ret;
+        if (acpi_disabled)
+                return -ENODEV;
        /* don't keep reloading if cpufreq_driver exists */
        if (cpufreq_get_current_driver())
-                return 0;
+                return -EEXIST;
-        if (acpi_disabled)
-                return 0;
        pr_debug("acpi_cpufreq_init\n");
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 32b3479a2405..eb3fdc755000 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -48,7 +48,7 @@ static inline int32_t div_fp(int32_t x, int32_t y)
 }
 struct sample {
-        int core_pct_busy;
+        int32_t core_pct_busy;
        u64 aperf;
        u64 mperf;
        int freq;
@@ -68,7 +68,7 @@ struct _pid {
        int32_t i_gain;
        int32_t d_gain;
        int deadband;
-        int last_err;
+        int32_t last_err;
 };
 struct cpudata {
@@ -153,16 +153,15 @@ static inline void pid_d_gain_set(struct _pid *pid, int percent)
        pid->d_gain = div_fp(int_tofp(percent), int_tofp(100));
 }
-static signed int pid_calc(struct _pid *pid, int busy)
+static signed int pid_calc(struct _pid *pid, int32_t busy)
 {
-        signed int err, result;
+        signed int result;
        int32_t pterm, dterm, fp_error;
        int32_t integral_limit;
-        err = pid->setpoint - busy;
+        fp_error = int_tofp(pid->setpoint) - busy;
-        fp_error = int_tofp(err);
-        if (abs(err) <= pid->deadband)
+        if (abs(fp_error) <= int_tofp(pid->deadband))
                return 0;
        pterm = mul_fp(pid->p_gain, fp_error);
@@ -176,8 +175,8 @@ static signed int pid_calc(struct _pid *pid, int busy)
        if (pid->integral < -integral_limit)
                pid->integral = -integral_limit;
-        dterm = mul_fp(pid->d_gain, (err - pid->last_err));
+        dterm = mul_fp(pid->d_gain, fp_error - pid->last_err);
-        pid->last_err = err;
+        pid->last_err = fp_error;
        result = pterm + mul_fp(pid->integral, pid->i_gain) + dterm;
@@ -367,12 +366,13 @@ static int intel_pstate_turbo_pstate(void)
 static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
 {
        int max_perf = cpu->pstate.turbo_pstate;
+        int max_perf_adj;
        int min_perf;
        if (limits.no_turbo)
                max_perf = cpu->pstate.max_pstate;
-        max_perf = fp_toint(mul_fp(int_tofp(max_perf), limits.max_perf));
+        max_perf_adj = fp_toint(mul_fp(int_tofp(max_perf), limits.max_perf));
-        *max = clamp_t(int, max_perf,
+        *max = clamp_t(int, max_perf_adj,
                        cpu->pstate.min_pstate, cpu->pstate.turbo_pstate);
        min_perf = fp_toint(mul_fp(int_tofp(max_perf), limits.min_perf));
@@ -383,6 +383,7 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
 static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
 {
        int max_perf, min_perf;
+        u64 val;
        intel_pstate_get_min_max(cpu, &min_perf, &max_perf);
@@ -394,11 +395,11 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
        trace_cpu_frequency(pstate * 100000, cpu->cpu);
        cpu->pstate.current_pstate = pstate;
+        val = pstate << 8;
        if (limits.no_turbo)
-                wrmsrl(MSR_IA32_PERF_CTL, BIT(32) | (pstate << 8));
+                val |= (u64)1 << 32;
-        else
-                wrmsrl(MSR_IA32_PERF_CTL, pstate << 8);
+        wrmsrl(MSR_IA32_PERF_CTL, val);
 }
 static inline void intel_pstate_pstate_increase(struct cpudata *cpu, int steps)
@@ -435,8 +436,9 @@ static inline void intel_pstate_calc_busy(struct cpudata *cpu,
                                        struct sample *sample)
 {
        u64 core_pct;
-        core_pct = div64_u64(sample->aperf * 100, sample->mperf);
+        core_pct = div64_u64(int_tofp(sample->aperf * 100),
-        sample->freq = cpu->pstate.max_pstate * core_pct * 1000;
+                             sample->mperf);
+        sample->freq = fp_toint(cpu->pstate.max_pstate * core_pct * 1000);
        sample->core_pct_busy = core_pct;
 }
@@ -468,22 +470,19 @@ static inline void intel_pstate_set_sample_time(struct cpudata *cpu)
        mod_timer_pinned(&cpu->timer, jiffies + delay);
 }
-static inline int intel_pstate_get_scaled_busy(struct cpudata *cpu)
+static inline int32_t intel_pstate_get_scaled_busy(struct cpudata *cpu)
 {
-        int32_t busy_scaled;
        int32_t core_busy, max_pstate, current_pstate;
-        core_busy = int_tofp(cpu->samples[cpu->sample_ptr].core_pct_busy);
+        core_busy = cpu->samples[cpu->sample_ptr].core_pct_busy;
        max_pstate = int_tofp(cpu->pstate.max_pstate);
        current_pstate = int_tofp(cpu->pstate.current_pstate);
-        busy_scaled = mul_fp(core_busy, div_fp(max_pstate, current_pstate));
+        return mul_fp(core_busy, div_fp(max_pstate, current_pstate));
-        return fp_toint(busy_scaled);
 }
 static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
 {
-        int busy_scaled;
+        int32_t busy_scaled;
        struct _pid *pid;
        signed int ctl = 0;
        int steps;
@@ -637,8 +636,8 @@ static int intel_pstate_cpu_exit(struct cpufreq_policy *policy)
 static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
 {
-        int rc, min_pstate, max_pstate;
        struct cpudata *cpu;
+        int rc;
        rc = intel_pstate_init_cpu(policy->cpu);
        if (rc)
@@ -652,9 +651,8 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
        else
                policy->policy = CPUFREQ_POLICY_POWERSAVE;
-        intel_pstate_get_min_max(cpu, &min_pstate, &max_pstate);
+        policy->min = cpu->pstate.min_pstate * 100000;
-        policy->min = min_pstate * 100000;
+        policy->max = cpu->pstate.turbo_pstate * 100000;
-        policy->max = max_pstate * 100000;
        /* cpuinfo and default policy values */
        policy->cpuinfo.min_freq = cpu->pstate.min_pstate * 100000;
diff --git a/drivers/cpufreq/s3c64xx-cpufreq.c b/drivers/cpufreq/s3c64xx-cpufreq.c
index 8a72b0c555f8..15631f92ab7d 100644
--- a/drivers/cpufreq/s3c64xx-cpufreq.c
+++ b/drivers/cpufreq/s3c64xx-cpufreq.c
@@ -166,7 +166,7 @@ static void __init s3c64xx_cpufreq_config_regulator(void)
                if (freq->frequency == CPUFREQ_ENTRY_INVALID)
                        continue;
-                dvfs = &s3c64xx_dvfs_table[freq->index];
+                dvfs = &s3c64xx_dvfs_table[freq->driver_data];
                found = 0;
                for (i = 0; i < count; i++) {
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 3519111c566b..10b577fcf48d 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -305,6 +305,7 @@ static struct dma_async_tx_descriptor *edma_prep_slave_sg(
                                edma_alloc_slot(EDMA_CTLR(echan->ch_num),
                                                EDMA_SLOT_ANY);
                        if (echan->slot[i] < 0) {
+                                kfree(edesc);
                                dev_err(dev, "Failed to allocate slot\n");
                                kfree(edesc);
                                return NULL;
@@ -346,6 +347,7 @@ static struct dma_async_tx_descriptor *edma_prep_slave_sg(
                        ccnt = sg_dma_len(sg) / (acnt * bcnt);
                        if (ccnt > (SZ_64K - 1)) {
                                dev_err(dev, "Exceeded max SG segment size\n");
+                                kfree(edesc);
                                return NULL;
                        }
                        cidx = acnt * bcnt;
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index e572dd20bdee..fe58d0833a11 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -61,7 +61,7 @@ static int drm_version(struct drm_device *dev, void *data,
 /** Ioctl table */
 static const struct drm_ioctl_desc drm_ioctls[] = {
-        DRM_IOCTL_DEF(DRM_IOCTL_VERSION, drm_version, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_IOCTL_VERSION, drm_version, DRM_UNLOCKED|DRM_RENDER_ALLOW),
        DRM_IOCTL_DEF(DRM_IOCTL_GET_UNIQUE, drm_getunique, 0),
        DRM_IOCTL_DEF(DRM_IOCTL_GET_MAGIC, drm_getmagic, 0),
        DRM_IOCTL_DEF(DRM_IOCTL_IRQ_BUSID, drm_irq_by_busid, DRM_MASTER|DRM_ROOT_ONLY),
@@ -402,9 +402,16 @@ long drm_ioctl(struct file *filp,
                cmd = ioctl->cmd_drv;
        }
        else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
+                u32 drv_size;
                ioctl = &drm_ioctls[nr];
-                cmd = ioctl->cmd;
+                drv_size = _IOC_SIZE(ioctl->cmd);
                usize = asize = _IOC_SIZE(cmd);
+                if (drv_size > asize)
+                        asize = drv_size;
+                cmd = ioctl->cmd;
        } else
                goto err_i1;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 69d8ed5416c3..2ad27880cd04 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -505,6 +505,8 @@ static int i915_drm_freeze(struct drm_device *dev)
                intel_modeset_suspend_hw(dev);
        }
+        i915_gem_suspend_gtt_mappings(dev);
        i915_save_state(dev);
        intel_opregion_fini(dev);
@@ -648,7 +650,8 @@ static int i915_drm_thaw(struct drm_device *dev)
                mutex_lock(&dev->struct_mutex);
                i915_gem_restore_gtt_mappings(dev);
                mutex_unlock(&dev->struct_mutex);
-        }
+        } else if (drm_core_check_feature(dev, DRIVER_MODESET))
+                i915_check_and_clear_faults(dev);
        __i915_drm_thaw(dev);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 35874b3a86dc..ab0f2c0a440c 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -497,10 +497,12 @@ struct i915_address_space {
        /* FIXME: Need a more generic return type */
        gen6_gtt_pte_t (*pte_encode)(dma_addr_t addr,
-                                     enum i915_cache_level level);
+                                     enum i915_cache_level level,
+                                     bool valid); /* Create a valid PTE */
        void (*clear_range)(struct i915_address_space *vm,
                            unsigned int first_entry,
-                            unsigned int num_entries);
+                            unsigned int num_entries,
+                            bool use_scratch);
        void (*insert_entries)(struct i915_address_space *vm,
                               struct sg_table *st,
                               unsigned int first_entry,
@@ -2065,6 +2067,8 @@ void i915_ppgtt_bind_object(struct i915_hw_ppgtt *ppgtt,
 void i915_ppgtt_unbind_object(struct i915_hw_ppgtt *ppgtt,
                              struct drm_i915_gem_object *obj);
+void i915_check_and_clear_faults(struct drm_device *dev);
+void i915_gem_suspend_gtt_mappings(struct drm_device *dev);
 void i915_gem_restore_gtt_mappings(struct drm_device *dev);
 int __must_check i915_gem_gtt_prepare_object(struct drm_i915_gem_object *obj);
 void i915_gem_gtt_bind_object(struct drm_i915_gem_object *obj,
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 212f6d8c35ec..1f7b4caefb6e 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -58,9 +58,10 @@
 #define HSW_WT_ELLC_LLC_AGE0            HSW_CACHEABILITY_CONTROL(0x6)
 static gen6_gtt_pte_t snb_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level)
+                                     enum i915_cache_level level,
+                                     bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= GEN6_PTE_ADDR_ENCODE(addr);
        switch (level) {
@@ -79,9 +80,10 @@ static gen6_gtt_pte_t snb_pte_encode(dma_addr_t addr,
 }
 static gen6_gtt_pte_t ivb_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level)
+                                     enum i915_cache_level level,
+                                     bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= GEN6_PTE_ADDR_ENCODE(addr);
        switch (level) {
@@ -105,9 +107,10 @@ static gen6_gtt_pte_t ivb_pte_encode(dma_addr_t addr,
 #define BYT_PTE_SNOOPED_BY_CPU_CACHES   (1 << 2)
 static gen6_gtt_pte_t byt_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level)
+                                     enum i915_cache_level level,
+                                     bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= GEN6_PTE_ADDR_ENCODE(addr);
        /* Mark the page as writeable.  Other platforms don't have a
@@ -122,9 +125,10 @@ static gen6_gtt_pte_t byt_pte_encode(dma_addr_t addr,
 }
 static gen6_gtt_pte_t hsw_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level)
+                                     enum i915_cache_level level,
+                                     bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= HSW_PTE_ADDR_ENCODE(addr);
        if (level != I915_CACHE_NONE)
@@ -134,9 +138,10 @@ static gen6_gtt_pte_t hsw_pte_encode(dma_addr_t addr,
 }
 static gen6_gtt_pte_t iris_pte_encode(dma_addr_t addr,
-                                      enum i915_cache_level level)
+                                      enum i915_cache_level level,
+                                      bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= HSW_PTE_ADDR_ENCODE(addr);
        switch (level) {
@@ -236,7 +241,8 @@ static int gen6_ppgtt_enable(struct drm_device *dev)
 /* PPGTT support for Sandybdrige/Gen6 and later */
 static void gen6_ppgtt_clear_range(struct i915_address_space *vm,
                                   unsigned first_entry,
-                                   unsigned num_entries)
+                                   unsigned num_entries,
+                                   bool use_scratch)
 {
        struct i915_hw_ppgtt *ppgtt =
                container_of(vm, struct i915_hw_ppgtt, base);
@@ -245,7 +251,7 @@ static void gen6_ppgtt_clear_range(struct i915_address_space *vm,
        unsigned first_pte = first_entry % I915_PPGTT_PT_ENTRIES;
        unsigned last_pte, i;
-        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC);
+        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC, true);
        while (num_entries) {
                last_pte = first_pte + num_entries;
@@ -282,7 +288,7 @@ static void gen6_ppgtt_insert_entries(struct i915_address_space *vm,
                dma_addr_t page_addr;
                page_addr = sg_page_iter_dma_address(&sg_iter);
-                pt_vaddr[act_pte] = vm->pte_encode(page_addr, cache_level);
+                pt_vaddr[act_pte] = vm->pte_encode(page_addr, cache_level, true);
                if (++act_pte == I915_PPGTT_PT_ENTRIES) {
                        kunmap_atomic(pt_vaddr);
                        act_pt++;
@@ -367,7 +373,7 @@ static int gen6_ppgtt_init(struct i915_hw_ppgtt *ppgtt)
        }
        ppgtt->base.clear_range(&ppgtt->base, 0,
-                                ppgtt->num_pd_entries * I915_PPGTT_PT_ENTRIES);
+                                ppgtt->num_pd_entries * I915_PPGTT_PT_ENTRIES, true);
        ppgtt->pd_offset = first_pd_entry_in_global_pt * sizeof(gen6_gtt_pte_t);
@@ -444,7 +450,8 @@ void i915_ppgtt_unbind_object(struct i915_hw_ppgtt *ppgtt,
 {
        ppgtt->base.clear_range(&ppgtt->base,
                                i915_gem_obj_ggtt_offset(obj) >> PAGE_SHIFT,
-                                obj->base.size >> PAGE_SHIFT);
+                                obj->base.size >> PAGE_SHIFT,
+                                true);
 }
 extern int intel_iommu_gfx_mapped;
@@ -485,15 +492,65 @@ static void undo_idling(struct drm_i915_private *dev_priv, bool interruptible)
                dev_priv->mm.interruptible = interruptible;
 }
+void i915_check_and_clear_faults(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct intel_ring_buffer *ring;
+        int i;
+        if (INTEL_INFO(dev)->gen < 6)
+                return;
+        for_each_ring(ring, dev_priv, i) {
+                u32 fault_reg;
+                fault_reg = I915_READ(RING_FAULT_REG(ring));
+                if (fault_reg & RING_FAULT_VALID) {
+                        DRM_DEBUG_DRIVER("Unexpected fault\n"
+                                         "\tAddr: 0x%08lx\\n"
+                                         "\tAddress space: %s\n"
+                                         "\tSource ID: %d\n"
+                                         "\tType: %d\n",
+                                         fault_reg & PAGE_MASK,
+                                         fault_reg & RING_FAULT_GTTSEL_MASK ? "GGTT" : "PPGTT",
+                                         RING_FAULT_SRCID(fault_reg),
+                                         RING_FAULT_FAULT_TYPE(fault_reg));
+                        I915_WRITE(RING_FAULT_REG(ring),
+                                   fault_reg & ~RING_FAULT_VALID);
+                }
+        }
+        POSTING_READ(RING_FAULT_REG(&dev_priv->ring[RCS]));
+}
+void i915_gem_suspend_gtt_mappings(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        /* Don't bother messing with faults pre GEN6 as we have little
+         * documentation supporting that it's a good idea.
+         */
+        if (INTEL_INFO(dev)->gen < 6)
+                return;
+        i915_check_and_clear_faults(dev);
+        dev_priv->gtt.base.clear_range(&dev_priv->gtt.base,
+                                       dev_priv->gtt.base.start / PAGE_SIZE,
+                                       dev_priv->gtt.base.total / PAGE_SIZE,
+                                       false);
+}
 void i915_gem_restore_gtt_mappings(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_object *obj;
+        i915_check_and_clear_faults(dev);
        /* First fill our portion of the GTT with scratch pages */
        dev_priv->gtt.base.clear_range(&dev_priv->gtt.base,
                                       dev_priv->gtt.base.start / PAGE_SIZE,
-                                       dev_priv->gtt.base.total / PAGE_SIZE);
+                                       dev_priv->gtt.base.total / PAGE_SIZE,
+                                       true);
        list_for_each_entry(obj, &dev_priv->mm.bound_list, global_list) {
                i915_gem_clflush_object(obj, obj->pin_display);
@@ -536,7 +593,7 @@ static void gen6_ggtt_insert_entries(struct i915_address_space *vm,
        for_each_sg_page(st->sgl, &sg_iter, st->nents, 0) {
                addr = sg_page_iter_dma_address(&sg_iter);
-                iowrite32(vm->pte_encode(addr, level), &gtt_entries[i]);
+                iowrite32(vm->pte_encode(addr, level, true), &gtt_entries[i]);
                i++;
        }
@@ -548,7 +605,7 @@ static void gen6_ggtt_insert_entries(struct i915_address_space *vm,
         */
        if (i != 0)
                WARN_ON(readl(&gtt_entries[i-1]) !=
-                        vm->pte_encode(addr, level));
+                        vm->pte_encode(addr, level, true));
        /* This next bit makes the above posting read even more important. We
         * want to flush the TLBs only after we're certain all the PTE updates
@@ -560,7 +617,8 @@ static void gen6_ggtt_insert_entries(struct i915_address_space *vm,
 static void gen6_ggtt_clear_range(struct i915_address_space *vm,
                                  unsigned int first_entry,
-                                  unsigned int num_entries)
+                                  unsigned int num_entries,
+                                  bool use_scratch)
 {
        struct drm_i915_private *dev_priv = vm->dev->dev_private;
        gen6_gtt_pte_t scratch_pte, __iomem *gtt_base =
@@ -573,7 +631,8 @@ static void gen6_ggtt_clear_range(struct i915_address_space *vm,
                 first_entry, num_entries, max_entries))
                num_entries = max_entries;
-        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC);
+        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC, use_scratch);
        for (i = 0; i < num_entries; i++)
                iowrite32(scratch_pte, &gtt_base[i]);
        readl(gtt_base);
@@ -594,7 +653,8 @@ static void i915_ggtt_insert_entries(struct i915_address_space *vm,
 static void i915_ggtt_clear_range(struct i915_address_space *vm,
                                  unsigned int first_entry,
-                                  unsigned int num_entries)
+                                  unsigned int num_entries,
+                                  bool unused)
 {
        intel_gtt_clear_range(first_entry, num_entries);
 }
@@ -622,7 +682,8 @@ void i915_gem_gtt_unbind_object(struct drm_i915_gem_object *obj)
        dev_priv->gtt.base.clear_range(&dev_priv->gtt.base,
                                       entry,
-                                       obj->base.size >> PAGE_SHIFT);
+                                       obj->base.size >> PAGE_SHIFT,
+                                       true);
        obj->has_global_gtt_mapping = 0;
 }
@@ -709,11 +770,11 @@ void i915_gem_setup_global_gtt(struct drm_device *dev,
                const unsigned long count = (hole_end - hole_start) / PAGE_SIZE;
                DRM_DEBUG_KMS("clearing unused GTT space: [%lx, %lx]\n",
                              hole_start, hole_end);
-                ggtt_vm->clear_range(ggtt_vm, hole_start / PAGE_SIZE, count);
+                ggtt_vm->clear_range(ggtt_vm, hole_start / PAGE_SIZE, count, true);
        }
        /* And finally clear the reserved guard page */
-        ggtt_vm->clear_range(ggtt_vm, end / PAGE_SIZE - 1, 1);
+        ggtt_vm->clear_range(ggtt_vm, end / PAGE_SIZE - 1, 1, true);
 }
 static bool
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 38f96f65d87a..ef9b35479f01 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -604,6 +604,10 @@
 #define   ARB_MODE_SWIZZLE_IVB  (1<<5)
 #define RENDER_HWS_PGA_GEN7     (0x04080)
 #define RING_FAULT_REG(ring)    (0x4094 + 0x100*(ring)->id)
+#define   RING_FAULT_GTTSEL_MASK (1<<11)
+#define   RING_FAULT_SRCID(x)   ((x >> 3) & 0xff)
+#define   RING_FAULT_FAULT_TYPE(x) ((x >> 1) & 0x3)
+#define   RING_FAULT_VALID      (1<<0)
 #define DONE_REG                0x40b0
 #define BSD_HWS_PGA_GEN7        (0x04180)
 #define BLT_HWS_PGA_GEN7        (0x04280)
@@ -4279,7 +4283,9 @@
 #define FDI_RX_CHICKEN(pipe) _PIPE(pipe, _FDI_RXA_CHICKEN, _FDI_RXB_CHICKEN)
 #define SOUTH_DSPCLK_GATE_D     0xc2020
+#define  PCH_DPLUNIT_CLOCK_GATE_DISABLE (1<<30)
 #define  PCH_DPLSUNIT_CLOCK_GATE_DISABLE (1<<29)
+#define  PCH_CPUNIT_CLOCK_GATE_DISABLE (1<<14)
 #define  PCH_LP_PARTITION_LEVEL_DISABLE  (1<<12)
 /* CPU: FDI_TX */
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index ea9022ef15d5..10d1de5bce6f 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -83,8 +83,7 @@ static bool intel_crt_get_hw_state(struct intel_encoder *encoder,
        return true;
 }
-static void intel_crt_get_config(struct intel_encoder *encoder,
+static unsigned int intel_crt_get_flags(struct intel_encoder *encoder)
-                                 struct intel_crtc_config *pipe_config)
 {
        struct drm_i915_private *dev_priv = encoder->base.dev->dev_private;
        struct intel_crt *crt = intel_encoder_to_crt(encoder);
@@ -102,7 +101,25 @@ static void intel_crt_get_config(struct intel_encoder *encoder,
        else
                flags |= DRM_MODE_FLAG_NVSYNC;
-        pipe_config->adjusted_mode.flags |= flags;
+        return flags;
+}
+static void intel_crt_get_config(struct intel_encoder *encoder,
+                                 struct intel_crtc_config *pipe_config)
+{
+        pipe_config->adjusted_mode.flags |= intel_crt_get_flags(encoder);
+}
+static void hsw_crt_get_config(struct intel_encoder *encoder,
+                               struct intel_crtc_config *pipe_config)
+{
+        intel_ddi_get_config(encoder, pipe_config);
+        pipe_config->adjusted_mode.flags &= ~(DRM_MODE_FLAG_PHSYNC |
+                                              DRM_MODE_FLAG_NHSYNC |
+                                              DRM_MODE_FLAG_PVSYNC |
+                                              DRM_MODE_FLAG_NVSYNC);
+        pipe_config->adjusted_mode.flags |= intel_crt_get_flags(encoder);
 }
 /* Note: The caller is required to filter out dpms modes not supported by the
@@ -799,7 +816,10 @@ void intel_crt_init(struct drm_device *dev)
        crt->base.mode_set = intel_crt_mode_set;
        crt->base.disable = intel_disable_crt;
        crt->base.enable = intel_enable_crt;
-        crt->base.get_config = intel_crt_get_config;
+        if (IS_HASWELL(dev))
+                crt->base.get_config = hsw_crt_get_config;
+        else
+                crt->base.get_config = intel_crt_get_config;
        if (I915_HAS_HOTPLUG(dev))
                crt->base.hpd_pin = HPD_CRT;
        if (HAS_DDI(dev))
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 63de2701b974..b53fff84a7d5 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1249,8 +1249,8 @@ static void intel_ddi_hot_plug(struct intel_encoder *intel_encoder)
                intel_dp_check_link_status(intel_dp);
 }
-static void intel_ddi_get_config(struct intel_encoder *encoder,
+void intel_ddi_get_config(struct intel_encoder *encoder,
-                                 struct intel_crtc_config *pipe_config)
+                          struct intel_crtc_config *pipe_config)
 {
        struct drm_i915_private *dev_priv = encoder->base.dev->dev_private;
        struct intel_crtc *intel_crtc = to_intel_crtc(encoder->base.crtc);
@@ -1268,6 +1268,23 @@ static void intel_ddi_get_config(struct intel_encoder *encoder,
                flags |= DRM_MODE_FLAG_NVSYNC;
        pipe_config->adjusted_mode.flags |= flags;
+        switch (temp & TRANS_DDI_BPC_MASK) {
+        case TRANS_DDI_BPC_6:
+                pipe_config->pipe_bpp = 18;
+                break;
+        case TRANS_DDI_BPC_8:
+                pipe_config->pipe_bpp = 24;
+                break;
+        case TRANS_DDI_BPC_10:
+                pipe_config->pipe_bpp = 30;
+                break;
+        case TRANS_DDI_BPC_12:
+                pipe_config->pipe_bpp = 36;
+                break;
+        default:
+                break;
+        }
 }
 static void intel_ddi_destroy(struct drm_encoder *encoder)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 581fb4b2f766..d78d33f9337d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2327,9 +2327,10 @@ static void intel_fdi_normal_train(struct drm_crtc *crtc)
                           FDI_FE_ERRC_ENABLE);
 }
-static bool pipe_has_enabled_pch(struct intel_crtc *intel_crtc)
+static bool pipe_has_enabled_pch(struct intel_crtc *crtc)
 {
-        return intel_crtc->base.enabled && intel_crtc->config.has_pch_encoder;
+        return crtc->base.enabled && crtc->active &&
+                crtc->config.has_pch_encoder;
 }
 static void ivb_modeset_global_resources(struct drm_device *dev)
@@ -2979,6 +2980,48 @@ static void ironlake_pch_transcoder_set_timings(struct intel_crtc *crtc,
                   I915_READ(VSYNCSHIFT(cpu_transcoder)));
 }
+static void cpt_enable_fdi_bc_bifurcation(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        uint32_t temp;
+        temp = I915_READ(SOUTH_CHICKEN1);
+        if (temp & FDI_BC_BIFURCATION_SELECT)
+                return;
+        WARN_ON(I915_READ(FDI_RX_CTL(PIPE_B)) & FDI_RX_ENABLE);
+        WARN_ON(I915_READ(FDI_RX_CTL(PIPE_C)) & FDI_RX_ENABLE);
+        temp |= FDI_BC_BIFURCATION_SELECT;
+        DRM_DEBUG_KMS("enabling fdi C rx\n");
+        I915_WRITE(SOUTH_CHICKEN1, temp);
+        POSTING_READ(SOUTH_CHICKEN1);
+}
+static void ivybridge_update_fdi_bc_bifurcation(struct intel_crtc *intel_crtc)
+{
+        struct drm_device *dev = intel_crtc->base.dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        switch (intel_crtc->pipe) {
+        case PIPE_A:
+                break;
+        case PIPE_B:
+                if (intel_crtc->config.fdi_lanes > 2)
+                        WARN_ON(I915_READ(SOUTH_CHICKEN1) & FDI_BC_BIFURCATION_SELECT);
+                else
+                        cpt_enable_fdi_bc_bifurcation(dev);
+                break;
+        case PIPE_C:
+                cpt_enable_fdi_bc_bifurcation(dev);
+                break;
+        default:
+                BUG();
+        }
+}
 /*
 * Enable PCH resources required for PCH ports:
 *   - PCH PLLs
@@ -2997,6 +3040,9 @@ static void ironlake_pch_enable(struct drm_crtc *crtc)
        assert_pch_transcoder_disabled(dev_priv, pipe);
+        if (IS_IVYBRIDGE(dev))
+                ivybridge_update_fdi_bc_bifurcation(intel_crtc);
        /* Write the TU size bits before fdi link training, so that error
         * detection works. */
        I915_WRITE(FDI_RX_TUSIZE1(pipe),
@@ -4983,6 +5029,22 @@ static bool i9xx_get_pipe_config(struct intel_crtc *crtc,
        if (!(tmp & PIPECONF_ENABLE))
                return false;
+        if (IS_G4X(dev) || IS_VALLEYVIEW(dev)) {
+                switch (tmp & PIPECONF_BPC_MASK) {
+                case PIPECONF_6BPC:
+                        pipe_config->pipe_bpp = 18;
+                        break;
+                case PIPECONF_8BPC:
+                        pipe_config->pipe_bpp = 24;
+                        break;
+                case PIPECONF_10BPC:
+                        pipe_config->pipe_bpp = 30;
+                        break;
+                default:
+                        break;
+                }
+        }
        intel_get_pipe_timings(crtc, pipe_config);
        i9xx_get_pfit_config(crtc, pipe_config);
@@ -5576,48 +5638,6 @@ static bool ironlake_compute_clocks(struct drm_crtc *crtc,
        return true;
 }
-static void cpt_enable_fdi_bc_bifurcation(struct drm_device *dev)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        uint32_t temp;
-        temp = I915_READ(SOUTH_CHICKEN1);
-        if (temp & FDI_BC_BIFURCATION_SELECT)
-                return;
-        WARN_ON(I915_READ(FDI_RX_CTL(PIPE_B)) & FDI_RX_ENABLE);
-        WARN_ON(I915_READ(FDI_RX_CTL(PIPE_C)) & FDI_RX_ENABLE);
-        temp |= FDI_BC_BIFURCATION_SELECT;
-        DRM_DEBUG_KMS("enabling fdi C rx\n");
-        I915_WRITE(SOUTH_CHICKEN1, temp);
-        POSTING_READ(SOUTH_CHICKEN1);
-}
-static void ivybridge_update_fdi_bc_bifurcation(struct intel_crtc *intel_crtc)
-{
-        struct drm_device *dev = intel_crtc->base.dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        switch (intel_crtc->pipe) {
-        case PIPE_A:
-                break;
-        case PIPE_B:
-                if (intel_crtc->config.fdi_lanes > 2)
-                        WARN_ON(I915_READ(SOUTH_CHICKEN1) & FDI_BC_BIFURCATION_SELECT);
-                else
-                        cpt_enable_fdi_bc_bifurcation(dev);
-                break;
-        case PIPE_C:
-                cpt_enable_fdi_bc_bifurcation(dev);
-                break;
-        default:
-                BUG();
-        }
-}
 int ironlake_get_lanes_required(int target_clock, int link_bw, int bpp)
 {
        /*
@@ -5811,9 +5831,6 @@ static int ironlake_crtc_mode_set(struct drm_crtc *crtc,
                                             &intel_crtc->config.fdi_m_n);
        }
-        if (IS_IVYBRIDGE(dev))
-                ivybridge_update_fdi_bc_bifurcation(intel_crtc);
        ironlake_set_pipeconf(crtc);
        /* Set up the display plane register */
@@ -5881,6 +5898,23 @@ static bool ironlake_get_pipe_config(struct intel_crtc *crtc,
        if (!(tmp & PIPECONF_ENABLE))
                return false;
+        switch (tmp & PIPECONF_BPC_MASK) {
+        case PIPECONF_6BPC:
+                pipe_config->pipe_bpp = 18;
+                break;
+        case PIPECONF_8BPC:
+                pipe_config->pipe_bpp = 24;
+                break;
+        case PIPECONF_10BPC:
+                pipe_config->pipe_bpp = 30;
+                break;
+        case PIPECONF_12BPC:
+                pipe_config->pipe_bpp = 36;
+                break;
+        default:
+                break;
+        }
        if (I915_READ(PCH_TRANSCONF(crtc->pipe)) & TRANS_ENABLE) {
                struct intel_shared_dpll *pll;
@@ -8612,6 +8646,9 @@ intel_pipe_config_compare(struct drm_device *dev,
        PIPE_CONF_CHECK_X(dpll_hw_state.fp0);
        PIPE_CONF_CHECK_X(dpll_hw_state.fp1);
+        if (IS_G4X(dev) || INTEL_INFO(dev)->gen >= 5)
+                PIPE_CONF_CHECK_I(pipe_bpp);
 #undef PIPE_CONF_CHECK_X
 #undef PIPE_CONF_CHECK_I
 #undef PIPE_CONF_CHECK_FLAGS
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 2c555f91bfae..1a431377d83b 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1401,6 +1401,26 @@ static void intel_dp_get_config(struct intel_encoder *encoder,
                else
                        pipe_config->port_clock = 270000;
        }
+        if (is_edp(intel_dp) && dev_priv->vbt.edp_bpp &&
+            pipe_config->pipe_bpp > dev_priv->vbt.edp_bpp) {
+                /*
+                 * This is a big fat ugly hack.
+                 *
+                 * Some machines in UEFI boot mode provide us a VBT that has 18
+                 * bpp and 1.62 GHz link bandwidth for eDP, which for reasons
+                 * unknown we fail to light up. Yet the same BIOS boots up with
+                 * 24 bpp and 2.7 GHz link. Use the same bpp as the BIOS uses as
+                 * max, not what it tells us to use.
+                 *
+                 * Note: This will still be broken if the eDP panel is not lit
+                 * up by the BIOS, and thus we can't get the mode at module
+                 * load.
+                 */
+                DRM_DEBUG_KMS("pipe has %d bpp for eDP panel, overriding BIOS-provided max %d bpp\n",
+                              pipe_config->pipe_bpp, dev_priv->vbt.edp_bpp);
+                dev_priv->vbt.edp_bpp = pipe_config->pipe_bpp;
+        }
 }
 static bool is_edp_psr(struct intel_dp *intel_dp)
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 9b7b68fd5d47..7f2b384ac939 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -765,6 +765,8 @@ extern void intel_ddi_prepare_link_retrain(struct drm_encoder *encoder);
 extern bool
 intel_ddi_connector_get_hw_state(struct intel_connector *intel_connector);
 extern void intel_ddi_fdi_disable(struct drm_crtc *crtc);
+extern void intel_ddi_get_config(struct intel_encoder *encoder,
+                                 struct intel_crtc_config *pipe_config);
 extern void intel_display_handle_reset(struct drm_device *dev);
 extern bool intel_set_cpu_fifo_underrun_reporting(struct drm_device *dev,
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 831a5c021c4b..b8af94a5be39 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -700,6 +700,22 @@ static const struct dmi_system_id intel_no_lvds[] = {
        },
        {
                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Intel D410PT",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "Intel"),
+                        DMI_MATCH(DMI_BOARD_NAME, "D410PT"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Intel D425KT",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "Intel"),
+                        DMI_EXACT_MATCH(DMI_BOARD_NAME, "D425KT"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
                .ident = "Intel D510MO",
                .matches = {
                        DMI_MATCH(DMI_BOARD_VENDOR, "Intel"),
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index f4c5e95b2d6f..26c2ea3e985c 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4759,7 +4759,9 @@ static void cpt_init_clock_gating(struct drm_device *dev)
         * gating for the panel power sequencer or it will fail to
         * start up when no ports are active.
         */
-        I915_WRITE(SOUTH_DSPCLK_GATE_D, PCH_DPLSUNIT_CLOCK_GATE_DISABLE);
+        I915_WRITE(SOUTH_DSPCLK_GATE_D, PCH_DPLSUNIT_CLOCK_GATE_DISABLE |
+                   PCH_DPLUNIT_CLOCK_GATE_DISABLE |
+                   PCH_CPUNIT_CLOCK_GATE_DISABLE);
        I915_WRITE(SOUTH_CHICKEN2, I915_READ(SOUTH_CHICKEN2) |
                   DPLS_EDP_PPS_FIX_DIS);
        /* The below fixes the weird display corruption, a few pixels shifted
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 32923d2f6002..5e891b226acf 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -707,24 +707,37 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
        switch (connector->connector_type) {
        case DRM_MODE_CONNECTOR_DVII:
        case DRM_MODE_CONNECTOR_HDMIB: /* HDMI-B is basically DL-DVI; analog works fine */
-                if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
+                if (radeon_audio != 0) {
-                    (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                        if (radeon_connector->use_digital &&
-                     (radeon_connector->audio == RADEON_AUDIO_AUTO)))
+                            (radeon_connector->audio == RADEON_AUDIO_ENABLE))
-                        return ATOM_ENCODER_MODE_HDMI;
+                                return ATOM_ENCODER_MODE_HDMI;
-                else if (radeon_connector->use_digital)
+                        else if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                                 (radeon_connector->audio == RADEON_AUDIO_AUTO))
+                                return ATOM_ENCODER_MODE_HDMI;
+                        else if (radeon_connector->use_digital)
+                                return ATOM_ENCODER_MODE_DVI;
+                        else
+                                return ATOM_ENCODER_MODE_CRT;
+                } else if (radeon_connector->use_digital) {
                        return ATOM_ENCODER_MODE_DVI;
-                else
+                } else {
                        return ATOM_ENCODER_MODE_CRT;
+                }
                break;
        case DRM_MODE_CONNECTOR_DVID:
        case DRM_MODE_CONNECTOR_HDMIA:
        default:
-                if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
+                if (radeon_audio != 0) {
-                    (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                        if (radeon_connector->audio == RADEON_AUDIO_ENABLE)
-                     (radeon_connector->audio == RADEON_AUDIO_AUTO)))
+                                return ATOM_ENCODER_MODE_HDMI;
-                        return ATOM_ENCODER_MODE_HDMI;
+                        else if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
-                else
+                                 (radeon_connector->audio == RADEON_AUDIO_AUTO))
+                                return ATOM_ENCODER_MODE_HDMI;
+                        else
+                                return ATOM_ENCODER_MODE_DVI;
+                } else {
                        return ATOM_ENCODER_MODE_DVI;
+                }
                break;
        case DRM_MODE_CONNECTOR_LVDS:
                return ATOM_ENCODER_MODE_LVDS;
@@ -732,14 +745,19 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
        case DRM_MODE_CONNECTOR_DisplayPort:
                dig_connector = radeon_connector->con_priv;
                if ((dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
-                    (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP))
+                    (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP)) {
                        return ATOM_ENCODER_MODE_DP;
-                else if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
+                } else if (radeon_audio != 0) {
-                         (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                        if (radeon_connector->audio == RADEON_AUDIO_ENABLE)
-                          (radeon_connector->audio == RADEON_AUDIO_AUTO)))
+                                return ATOM_ENCODER_MODE_HDMI;
-                        return ATOM_ENCODER_MODE_HDMI;
+                        else if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
-                else
+                                 (radeon_connector->audio == RADEON_AUDIO_AUTO))
+                                return ATOM_ENCODER_MODE_HDMI;
+                        else
+                                return ATOM_ENCODER_MODE_DVI;
+                } else {
                        return ATOM_ENCODER_MODE_DVI;
+                }
                break;
        case DRM_MODE_CONNECTOR_eDP:
                return ATOM_ENCODER_MODE_DP;
@@ -1655,7 +1673,7 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
                         * does the same thing and more.
                         */
                        if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730) &&
-                            (rdev->family != CHIP_RS880))
+                            (rdev->family != CHIP_RS780) && (rdev->family != CHIP_RS880))
                                atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
                }
                if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index b874ccdf52f7..9cd2bc989ac7 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -1694,6 +1694,7 @@ static int cik_init_microcode(struct radeon_device *rdev)
                               fw_name);
                        release_firmware(rdev->smc_fw);
                        rdev->smc_fw = NULL;
+                        err = 0;
                } else if (rdev->smc_fw->size != smc_req_size) {
                        printk(KERN_ERR
                               "cik_smc: Bogus length %zu in firmware \"%s\"\n",
@@ -3182,6 +3183,7 @@ int cik_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
        r = radeon_ib_get(rdev, ring->idx, &ib, NULL, 256);
        if (r) {
                DRM_ERROR("radeon: failed to get ib (%d).\n", r);
+                radeon_scratch_free(rdev, scratch);
                return r;
        }
        ib.ptr[0] = PACKET3(PACKET3_SET_UCONFIG_REG, 1);
@@ -3198,6 +3200,8 @@ int cik_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
        r = radeon_fence_wait(ib.fence, false);
        if (r) {
                DRM_ERROR("radeon: fence wait failed (%d).\n", r);
+                radeon_scratch_free(rdev, scratch);
+                radeon_ib_free(rdev, &ib);
                return r;
        }
        for (i = 0; i < rdev->usec_timeout; i++) {
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 85a69d2ea3d2..9fcd338c0fcf 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -113,6 +113,9 @@ void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder)
        u8 *sadb;
        int sad_count;
+        /* XXX: setting this register causes hangs on some asics */
+        return;
        if (!dig->afmt->pin)
                return;
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index f815c20640bd..57fcc4b16a52 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -67,6 +67,9 @@ static void dce4_afmt_write_speaker_allocation(struct drm_encoder *encoder)
        u8 *sadb;
        int sad_count;
+        /* XXX: setting this register causes hangs on some asics */
+        return;
        list_for_each_entry(connector, &encoder->dev->mode_config.connector_list, head) {
                if (connector->encoder == encoder)
                        radeon_connector = to_radeon_connector(connector);
@@ -288,6 +291,7 @@ void evergreen_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode
        /* fglrx clears sth in AFMT_AUDIO_PACKET_CONTROL2 here */
        WREG32(HDMI_ACR_PACKET_CONTROL + offset,
+               HDMI_ACR_SOURCE | /* select SW CTS value */
               HDMI_ACR_AUTO_SEND); /* allow hw to sent ACR packets when required */
        evergreen_hdmi_update_ACR(encoder, mode->clock);
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 71399065db04..b41905573cd2 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -2635,7 +2635,7 @@ int kv_dpm_init(struct radeon_device *rdev)
        pi->caps_sclk_ds = true;
        pi->enable_auto_thermal_throttling = true;
        pi->disable_nb_ps3_in_battery = false;
-        pi->bapm_enable = true;
+        pi->bapm_enable = false;
        pi->voltage_drop_t = 0;
        pi->caps_sclk_throttle_low_notification = false;
        pi->caps_fps = false; /* true? */
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 93c1f9ef5da9..cac2866d79da 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -804,6 +804,7 @@ int ni_init_microcode(struct radeon_device *rdev)
                               fw_name);
                        release_firmware(rdev->smc_fw);
                        rdev->smc_fw = NULL;
+                        err = 0;
                } else if (rdev->smc_fw->size != smc_req_size) {
                        printk(KERN_ERR
                               "ni_mc: Bogus length %zu in firmware \"%s\"\n",
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 2a1b1876b431..f9be22062df1 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2302,6 +2302,7 @@ int r600_init_microcode(struct radeon_device *rdev)
                               fw_name);
                        release_firmware(rdev->smc_fw);
                        rdev->smc_fw = NULL;
+                        err = 0;
                } else if (rdev->smc_fw->size != smc_req_size) {
                        printk(KERN_ERR
                               "smc: Bogus length %zu in firmware \"%s\"\n",
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index 5b729319f27b..06022e3b9c3b 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -309,6 +309,9 @@ static void dce3_2_afmt_write_speaker_allocation(struct drm_encoder *encoder)
        u8 *sadb;
        int sad_count;
+        /* XXX: setting this register causes hangs on some asics */
+        return;
        list_for_each_entry(connector, &encoder->dev->mode_config.connector_list, head) {
                if (connector->encoder == encoder)
                        radeon_connector = to_radeon_connector(connector);
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index a400ac1c4147..24f4960f59ee 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1272,8 +1272,8 @@ struct radeon_blacklist_clocks
 struct radeon_clock_and_voltage_limits {
        u32 sclk;
        u32 mclk;
-        u32 vddc;
+        u16 vddc;
-        u32 vddci;
+        u16 vddci;
 };
 struct radeon_clock_array {
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 79159b5da05b..64565732cb98 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1658,9 +1658,12 @@ radeon_add_atom_connector(struct drm_device *dev,
                        drm_object_attach_property(&radeon_connector->base.base,
                                                      rdev->mode_info.underscan_vborder_property,
                                                      0);
-                        drm_object_attach_property(&radeon_connector->base.base,
+                        if (radeon_audio != 0)
-                                                   rdev->mode_info.audio_property,
+                                drm_object_attach_property(&radeon_connector->base.base,
-                                                   RADEON_AUDIO_DISABLE);
+                                                           rdev->mode_info.audio_property,
+                                                           (radeon_audio == 1) ?
+                                                           RADEON_AUDIO_AUTO :
+                                                           RADEON_AUDIO_DISABLE);
                        subpixel_order = SubPixelHorizontalRGB;
                        connector->interlace_allowed = true;
                        if (connector_type == DRM_MODE_CONNECTOR_HDMIB)
@@ -1754,10 +1757,12 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                              rdev->mode_info.underscan_vborder_property,
                                                              0);
                        }
-                        if (ASIC_IS_DCE2(rdev)) {
+                        if (ASIC_IS_DCE2(rdev) && (radeon_audio != 0)) {
                                drm_object_attach_property(&radeon_connector->base.base,
-                                                              rdev->mode_info.audio_property,
+                                                           rdev->mode_info.audio_property,
-                                                              RADEON_AUDIO_DISABLE);
+                                                           (radeon_audio == 1) ?
+                                                           RADEON_AUDIO_AUTO :
+                                                           RADEON_AUDIO_DISABLE);
                        }
                        if (connector_type == DRM_MODE_CONNECTOR_DVII) {
                                radeon_connector->dac_load_detect = true;
@@ -1799,10 +1804,12 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                              rdev->mode_info.underscan_vborder_property,
                                                              0);
                        }
-                        if (ASIC_IS_DCE2(rdev)) {
+                        if (ASIC_IS_DCE2(rdev) && (radeon_audio != 0)) {
                                drm_object_attach_property(&radeon_connector->base.base,
-                                                              rdev->mode_info.audio_property,
+                                                           rdev->mode_info.audio_property,
-                                                              RADEON_AUDIO_DISABLE);
+                                                           (radeon_audio == 1) ?
+                                                           RADEON_AUDIO_AUTO :
+                                                           RADEON_AUDIO_DISABLE);
                        }
                        subpixel_order = SubPixelHorizontalRGB;
                        connector->interlace_allowed = true;
@@ -1843,10 +1850,12 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                              rdev->mode_info.underscan_vborder_property,
                                                              0);
                        }
-                        if (ASIC_IS_DCE2(rdev)) {
+                        if (ASIC_IS_DCE2(rdev) && (radeon_audio != 0)) {
                                drm_object_attach_property(&radeon_connector->base.base,
-                                                              rdev->mode_info.audio_property,
+                                                           rdev->mode_info.audio_property,
-                                                              RADEON_AUDIO_DISABLE);
+                                                           (radeon_audio == 1) ?
+                                                           RADEON_AUDIO_AUTO :
+                                                           RADEON_AUDIO_DISABLE);
                        }
                        connector->interlace_allowed = true;
                        /* in theory with a DP to VGA converter... */
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 66c222836631..80285e35bc65 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -85,9 +85,8 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                   VRAM, also but everything into VRAM on AGP cards to avoid
                   image corruptions */
                if (p->ring == R600_RING_TYPE_UVD_INDEX &&
-                    p->rdev->family < CHIP_PALM &&
                    (i == 0 || drm_pci_device_is_agp(p->rdev->ddev))) {
+                        /* TODO: is this still needed for NI+ ? */
                        p->relocs[i].lobj.domain =
                                RADEON_GEM_DOMAIN_VRAM;
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index cdd12dcd988b..9c14a1ba1de4 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -153,7 +153,7 @@ int radeon_benchmarking = 0;
 int radeon_testing = 0;
 int radeon_connector_table = 0;
 int radeon_tv = 1;
-int radeon_audio = 1;
+int radeon_audio = -1;
 int radeon_disp_priority = 0;
 int radeon_hw_i2c = 0;
 int radeon_pcie_gen2 = -1;
@@ -196,7 +196,7 @@ module_param_named(connector_table, radeon_connector_table, int, 0444);
 MODULE_PARM_DESC(tv, "TV enable (0 = disable)");
 module_param_named(tv, radeon_tv, int, 0444);
-MODULE_PARM_DESC(audio, "Audio enable (1 = enable)");
+MODULE_PARM_DESC(audio, "Audio enable (-1 = auto, 0 = disable, 1 = enable)");
 module_param_named(audio, radeon_audio, int, 0444);
 MODULE_PARM_DESC(disp_priority, "Display Priority (0 = auto, 1 = normal, 2 = high)");
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 4f2e73f79638..308eff5be1b4 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -476,7 +476,8 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
                return -EINVAL;
        }
-        if (p->rdev->family < CHIP_PALM && (cmd == 0 || cmd == 0x3) &&
+        /* TODO: is this still necessary on NI+ ? */
+        if ((cmd == 0 || cmd == 0x3) &&
            (start >> 28) != (p->rdev->uvd.gpu_addr >> 28)) {
                DRM_ERROR("msg/fb buffer %LX-%LX out of 256MB segment!\n",
                          start, end);
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index d4652af425b8..d96f7cbca0a1 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -1681,6 +1681,7 @@ static int si_init_microcode(struct radeon_device *rdev)
                       fw_name);
                release_firmware(rdev->smc_fw);
                rdev->smc_fw = NULL;
+                err = 0;
        } else if (rdev->smc_fw->size != smc_req_size) {
                printk(KERN_ERR
                       "si_smc: Bogus length %zu in firmware \"%s\"\n",
diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c
index 3100fa9cb52f..7266805d9786 100644
--- a/drivers/gpu/drm/radeon/uvd_v1_0.c
+++ b/drivers/gpu/drm/radeon/uvd_v1_0.c
@@ -212,8 +212,8 @@ int uvd_v1_0_start(struct radeon_device *rdev)
        /* enable VCPU clock */
        WREG32(UVD_VCPU_CNTL,  1 << 9);
-        /* enable UMC and NC0 */
+        /* enable UMC */
-        WREG32_P(UVD_LMI_CTRL2, 1 << 13, ~((1 << 8) | (1 << 13)));
+        WREG32_P(UVD_LMI_CTRL2, 0, ~(1 << 8));
        /* boot up the VCPU */
        WREG32(UVD_SOFT_RESET, 0);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 1a90f0a2f7e5..0508f93b9795 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -740,9 +740,17 @@ static void vmw_postclose(struct drm_device *dev,
        struct vmw_fpriv *vmw_fp;
        vmw_fp = vmw_fpriv(file_priv);
-        ttm_object_file_release(&vmw_fp->tfile);
-        if (vmw_fp->locked_master)
+        if (vmw_fp->locked_master) {
+                struct vmw_master *vmaster =
+                        vmw_master(vmw_fp->locked_master);
+                ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
+                ttm_vt_unlock(&vmaster->lock);
                drm_master_put(&vmw_fp->locked_master);
+        }
+        ttm_object_file_release(&vmw_fp->tfile);
        kfree(vmw_fp);
 }
@@ -925,14 +933,13 @@ static void vmw_master_drop(struct drm_device *dev,
        vmw_fp->locked_master = drm_master_get(file_priv->master);
        ret = ttm_vt_lock(&vmaster->lock, false, vmw_fp->tfile);
-        vmw_execbuf_release_pinned_bo(dev_priv);
        if (unlikely((ret != 0))) {
                DRM_ERROR("Unable to lock TTM at VT switch.\n");
                drm_master_put(&vmw_fp->locked_master);
        }
-        ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
+        ttm_lock_set_kill(&vmaster->lock, false, SIGTERM);
+        vmw_execbuf_release_pinned_bo(dev_priv);
        if (!dev_priv->enable_fb) {
                ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 0e67cf41065d..37fb4befec82 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -970,7 +970,7 @@ void vmw_resource_unreserve(struct vmw_resource *res,
        if (new_backup)
                res->backup_offset = new_backup_offset;
-        if (!res->func->may_evict)
+        if (!res->func->may_evict || res->id == -1)
                return;
        write_lock(&dev_priv->resource_lock);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 5a8c01112a23..e80da62363bc 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -319,7 +319,7 @@ static s32 item_sdata(struct hid_item *item)
 static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
 {
-        __u32 raw_value;
+        __s32 raw_value;
        switch (item->tag) {
        case HID_GLOBAL_ITEM_TAG_PUSH:
@@ -370,10 +370,11 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
                return 0;
        case HID_GLOBAL_ITEM_TAG_UNIT_EXPONENT:
-                /* Units exponent negative numbers are given through a
+                /* Many devices provide unit exponent as a two's complement
-                 * two's complement.
+                 * nibble due to the common misunderstanding of HID
-                 * See "6.2.2.7 Global Items" for more information. */
+                 * specification 1.11, 6.2.2.7 Global Items. Attempt to handle
-                raw_value = item_udata(item);
+                 * both this and the standard encoding. */
+                raw_value = item_sdata(item);
                if (!(raw_value & 0xfffffff0))
                        parser->global.unit_exponent = hid_snto32(raw_value, 4);
                else
@@ -1870,6 +1871,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
        { }
 };
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 9cbc7ab07dfa..f0296a50be5f 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -633,6 +633,7 @@
 #define USB_DEVICE_ID_NEXTWINDOW_TOUCHSCREEN    0x0003
 #define USB_VENDOR_ID_NINTENDO          0x057e
+#define USB_VENDOR_ID_NINTENDO2         0x054c
 #define USB_DEVICE_ID_NINTENDO_WIIMOTE  0x0306
 #define USB_DEVICE_ID_NINTENDO_WIIMOTE2 0x0330
@@ -792,6 +793,8 @@
 #define USB_DEVICE_ID_SYNAPTICS_COMP_TP 0x0009
 #define USB_DEVICE_ID_SYNAPTICS_WTP     0x0010
 #define USB_DEVICE_ID_SYNAPTICS_DPAD    0x0013
+#define USB_DEVICE_ID_SYNAPTICS_LTS1    0x0af8
+#define USB_DEVICE_ID_SYNAPTICS_LTS2    0x1d10
 #define USB_VENDOR_ID_THINGM            0x27b8
 #define USB_DEVICE_ID_BLINK1            0x01ed
@@ -919,4 +922,7 @@
 #define USB_VENDOR_ID_PRIMAX    0x0461
 #define USB_DEVICE_ID_PRIMAX_KEYBOARD   0x4e05
+#define USB_VENDOR_ID_SIS       0x0457
+#define USB_DEVICE_ID_SIS_TS    0x1013
 #endif
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 8741d953dcc8..d97f2323af57 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -192,6 +192,7 @@ static int hidinput_setkeycode(struct input_dev *dev,
        return -EINVAL;
 }
 /**
 * hidinput_calc_abs_res - calculate an absolute axis resolution
 * @field: the HID report field to calculate resolution for
@@ -234,23 +235,17 @@ __s32 hidinput_calc_abs_res(const struct hid_field *field, __u16 code)
        case ABS_MT_TOOL_Y:
        case ABS_MT_TOUCH_MAJOR:
        case ABS_MT_TOUCH_MINOR:
-                if (field->unit & 0xffffff00)           /* Not a length */
+                if (field->unit == 0x11) {              /* If centimeters */
-                        return 0;
-                unit_exponent += hid_snto32(field->unit >> 4, 4) - 1;
-                switch (field->unit & 0xf) {
-                case 0x1:                               /* If centimeters */
                        /* Convert to millimeters */
                        unit_exponent += 1;
-                        break;
+                } else if (field->unit == 0x13) {       /* If inches */
-                case 0x3:                               /* If inches */
                        /* Convert to millimeters */
                        prev = physical_extents;
                        physical_extents *= 254;
                        if (physical_extents < prev)
                                return 0;
                        unit_exponent -= 1;
-                        break;
+                } else {
-                default:
                        return 0;
                }
                break;
diff --git a/drivers/hid/hid-wiimote-core.c b/drivers/hid/hid-wiimote-core.c
index abb20db2b443..1446f526ee8b 100644
--- a/drivers/hid/hid-wiimote-core.c
+++ b/drivers/hid/hid-wiimote-core.c
@@ -834,7 +834,8 @@ static void wiimote_init_set_type(struct wiimote_data *wdata,
                goto done;
        }
-        if (vendor == USB_VENDOR_ID_NINTENDO) {
+        if (vendor == USB_VENDOR_ID_NINTENDO ||
+            vendor == USB_VENDOR_ID_NINTENDO2) {
                if (product == USB_DEVICE_ID_NINTENDO_WIIMOTE) {
                        devtype = WIIMOTE_DEV_GEN10;
                        goto done;
@@ -1855,6 +1856,8 @@ static void wiimote_hid_remove(struct hid_device *hdev)
 static const struct hid_device_id wiimote_hid_devices[] = {
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
                                USB_DEVICE_ID_NINTENDO_WIIMOTE) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2,
+                                USB_DEVICE_ID_NINTENDO_WIIMOTE) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
                                USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
        { }
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 07345521f421..3fca3be08337 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -110,6 +110,9 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_SIS, USB_DEVICE_ID_SIS_TS, HID_QUIRK_NO_INIT_REPORTS },
        { 0, 0 }
 };
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index 5ceda710f516..b84791f03a27 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -31,6 +31,17 @@ config INFINIBAND_USER_ACCESS
          libibverbs, libibcm and a hardware driver library from
          <http://www.openfabrics.org/git/>.
+config INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
+       bool "Experimental and unstable ABI for userspace access to flow steering verbs"
+       depends on INFINIBAND_USER_ACCESS
+       depends on STAGING
+        ---help---
+          The final ABI for userspace access to flow steering verbs
+          has not been defined.  To use the current ABI, *WHICH WILL
+          CHANGE IN THE FUTURE*, say Y here.
+          If unsure, say N.
 config INFINIBAND_USER_MEM
        bool
        depends on INFINIBAND_USER_ACCESS != n
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index d040b877475f..d8f9c6c272d7 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -217,7 +217,9 @@ IB_UVERBS_DECLARE_CMD(destroy_srq);
 IB_UVERBS_DECLARE_CMD(create_xsrq);
 IB_UVERBS_DECLARE_CMD(open_xrcd);
 IB_UVERBS_DECLARE_CMD(close_xrcd);
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 IB_UVERBS_DECLARE_CMD(create_flow);
 IB_UVERBS_DECLARE_CMD(destroy_flow);
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 #endif /* UVERBS_H */
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index f2b81b9ee0d6..2f0f01b70e3b 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -54,7 +54,9 @@ static struct uverbs_lock_class qp_lock_class	= { .name = "QP-uobj" };
 static struct uverbs_lock_class ah_lock_class   = { .name = "AH-uobj" };
 static struct uverbs_lock_class srq_lock_class  = { .name = "SRQ-uobj" };
 static struct uverbs_lock_class xrcd_lock_class = { .name = "XRCD-uobj" };
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 static struct uverbs_lock_class rule_lock_class = { .name = "RULE-uobj" };
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 #define INIT_UDATA(udata, ibuf, obuf, ilen, olen)                       \
        do {                                                            \
@@ -2599,6 +2601,7 @@ out_put:
        return ret ? ret : in_len;
 }
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 static int kern_spec_to_ib_spec(struct ib_kern_spec *kern_spec,
                                union ib_flow_spec *ib_spec)
 {
@@ -2824,6 +2827,7 @@ ssize_t ib_uverbs_destroy_flow(struct ib_uverbs_file *file,
        return ret ? ret : in_len;
 }
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 static int __uverbs_create_xsrq(struct ib_uverbs_file *file,
                                struct ib_uverbs_create_xsrq *cmd,
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 75ad86c4abf8..2df31f68ea09 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -115,8 +115,10 @@ static ssize_t (*uverbs_cmd_table[])(struct ib_uverbs_file *file,
        [IB_USER_VERBS_CMD_CLOSE_XRCD]          = ib_uverbs_close_xrcd,
        [IB_USER_VERBS_CMD_CREATE_XSRQ]         = ib_uverbs_create_xsrq,
        [IB_USER_VERBS_CMD_OPEN_QP]             = ib_uverbs_open_qp,
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
        [IB_USER_VERBS_CMD_CREATE_FLOW]         = ib_uverbs_create_flow,
        [IB_USER_VERBS_CMD_DESTROY_FLOW]        = ib_uverbs_destroy_flow
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 };
 static void ib_uverbs_add_one(struct ib_device *device);
@@ -605,6 +607,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
        if (!(file->device->ib_dev->uverbs_cmd_mask & (1ull << hdr.command)))
                return -ENOSYS;
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
        if (hdr.command >= IB_USER_VERBS_CMD_THRESHOLD) {
                struct ib_uverbs_cmd_hdr_ex hdr_ex;
@@ -621,6 +624,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                                                     (hdr_ex.out_words +
                                                      hdr_ex.provider_out_words) * 4);
        } else {
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
                if (hdr.in_words * 4 != count)
                        return -EINVAL;
@@ -628,7 +632,9 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                                                     buf + sizeof(hdr),
                                                     hdr.in_words * 4,
                                                     hdr.out_words * 4);
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
        }
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 }
 static int ib_uverbs_mmap(struct file *filp, struct vm_area_struct *vma)
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index d6c5a73becf4..f0612645de99 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1691,9 +1691,11 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
                ibdev->ib_dev.create_flow       = mlx4_ib_create_flow;
                ibdev->ib_dev.destroy_flow      = mlx4_ib_destroy_flow;
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
                ibdev->ib_dev.uverbs_cmd_mask   |=
                        (1ull << IB_USER_VERBS_CMD_CREATE_FLOW) |
                        (1ull << IB_USER_VERBS_CMD_DESTROY_FLOW);
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
        }
        mlx4_ib_alloc_eqs(dev, ibdev);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 3591855cc5b5..6df23502059a 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -594,7 +594,7 @@ isert_connect_release(struct isert_conn *isert_conn)
        pr_debug("Entering isert_connect_release(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
-        if (device->use_frwr)
+        if (device && device->use_frwr)
                isert_conn_free_frwr_pool(isert_conn);
        if (isert_conn->conn_qp) {
diff --git a/drivers/input/input.c b/drivers/input/input.c
index c04469928925..e75d015024a1 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1734,6 +1734,7 @@ EXPORT_SYMBOL_GPL(input_class);
 */
 struct input_dev *input_allocate_device(void)
 {
+        static atomic_t input_no = ATOMIC_INIT(0);
        struct input_dev *dev;
        dev = kzalloc(sizeof(struct input_dev), GFP_KERNEL);
@@ -1743,9 +1744,13 @@ struct input_dev *input_allocate_device(void)
                device_initialize(&dev->dev);
                mutex_init(&dev->mutex);
                spin_lock_init(&dev->event_lock);
+                init_timer(&dev->timer);
                INIT_LIST_HEAD(&dev->h_list);
                INIT_LIST_HEAD(&dev->node);
+                dev_set_name(&dev->dev, "input%ld",
+                             (unsigned long) atomic_inc_return(&input_no) - 1);
                __module_get(THIS_MODULE);
        }
@@ -2019,7 +2024,6 @@ static void devm_input_device_unregister(struct device *dev, void *res)
 */
 int input_register_device(struct input_dev *dev)
 {
-        static atomic_t input_no = ATOMIC_INIT(0);
        struct input_devres *devres = NULL;
        struct input_handler *handler;
        unsigned int packet_size;
@@ -2059,7 +2063,6 @@ int input_register_device(struct input_dev *dev)
         * If delay and period are pre-set by the driver, then autorepeating
         * is handled by the driver itself and we don't do it in input.c.
         */
-        init_timer(&dev->timer);
        if (!dev->rep[REP_DELAY] && !dev->rep[REP_PERIOD]) {
                dev->timer.data = (long) dev;
                dev->timer.function = input_repeat_key;
@@ -2073,9 +2076,6 @@ int input_register_device(struct input_dev *dev)
        if (!dev->setkeycode)
                dev->setkeycode = input_default_setkeycode;
-        dev_set_name(&dev->dev, "input%ld",
-                     (unsigned long) atomic_inc_return(&input_no) - 1);
        error = device_add(&dev->dev);
        if (error)
                goto err_free_vals;
diff --git a/drivers/input/keyboard/pxa27x_keypad.c b/drivers/input/keyboard/pxa27x_keypad.c
index 134c3b404a54..a2e758d27584 100644
--- a/drivers/input/keyboard/pxa27x_keypad.c
+++ b/drivers/input/keyboard/pxa27x_keypad.c
@@ -786,10 +786,17 @@ static int pxa27x_keypad_probe(struct platform_device *pdev)
        input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
        input_set_capability(input_dev, EV_MSC, MSC_SCAN);
-        if (pdata)
+        if (pdata) {
                error = pxa27x_keypad_build_keycode(keypad);
-        else
+        } else {
                error = pxa27x_keypad_build_keycode_from_dt(keypad);
+                /*
+                 * Data that we get from DT resides in dynamically
+                 * allocated memory so we need to update our pdata
+                 * pointer.
+                 */
+                pdata = keypad->pdata;
+        }
        if (error) {
                dev_err(&pdev->dev, "failed to build keycode\n");
                goto failed_put_clk;
diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index 082684e7f390..9365535ba7f1 100644
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -351,7 +351,9 @@ static void cm109_urb_irq_callback(struct urb *urb)
        if (status) {
                if (status == -ESHUTDOWN)
                        return;
-                dev_err(&dev->intf->dev, "%s: urb status %d\n", __func__, status);
+                dev_err_ratelimited(&dev->intf->dev, "%s: urb status %d\n",
+                                    __func__, status);
+                goto out;
        }
        /* Special keys */
@@ -418,8 +420,12 @@ static void cm109_urb_ctl_callback(struct urb *urb)
             dev->ctl_data->byte[2],
             dev->ctl_data->byte[3]);
-        if (status)
+        if (status) {
-                dev_err(&dev->intf->dev, "%s: urb status %d\n", __func__, status);
+                if (status == -ESHUTDOWN)
+                        return;
+                dev_err_ratelimited(&dev->intf->dev, "%s: urb status %d\n",
+                                    __func__, status);
+        }
        spin_lock(&dev->ctl_submit_lock);
@@ -427,7 +433,7 @@ static void cm109_urb_ctl_callback(struct urb *urb)
        if (likely(!dev->shutdown)) {
-                if (dev->buzzer_pending) {
+                if (dev->buzzer_pending || status) {
                        dev->buzzer_pending = 0;
                        dev->ctl_urb_pending = 1;
                        cm109_submit_buzz_toggle(dev);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 7c5d72a6a26a..83658472ad25 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -103,6 +103,7 @@ static const struct alps_model_info alps_model_data[] = {
        /* Dell Latitude E5500, E6400, E6500, Precision M4400 */
        { { 0x62, 0x02, 0x14 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf,
                ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },
+        { { 0x73, 0x00, 0x14 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf, ALPS_DUALPOINT },              /* Dell XT2 */
        { { 0x73, 0x02, 0x50 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf, ALPS_FOUR_BUTTONS },           /* Dell Vostro 1400 */
        { { 0x52, 0x01, 0x14 }, 0x00, ALPS_PROTO_V2, 0xff, 0xff,
                ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },                            /* Toshiba Tecra A11-11L */
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 78e4de42efaa..52c9ebf94729 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -223,21 +223,26 @@ static int i8042_flush(void)
 {
        unsigned long flags;
        unsigned char data, str;
-        int i = 0;
+        int count = 0;
+        int retval = 0;
        spin_lock_irqsave(&i8042_lock, flags);
-        while (((str = i8042_read_status()) & I8042_STR_OBF) && (i < I8042_BUFFER_SIZE)) {
+        while ((str = i8042_read_status()) & I8042_STR_OBF) {
-                udelay(50);
+                if (count++ < I8042_BUFFER_SIZE) {
-                data = i8042_read_data();
+                        udelay(50);
-                i++;
+                        data = i8042_read_data();
-                dbg("%02x <- i8042 (flush, %s)\n",
+                        dbg("%02x <- i8042 (flush, %s)\n",
-                    data, str & I8042_STR_AUXDATA ? "aux" : "kbd");
+                            data, str & I8042_STR_AUXDATA ? "aux" : "kbd");
+                } else {
+                        retval = -EIO;
+                        break;
+                }
        }
        spin_unlock_irqrestore(&i8042_lock, flags);
-        return i;
+        return retval;
 }
 /*
@@ -849,7 +854,7 @@ static int __init i8042_check_aux(void)
 static int i8042_controller_check(void)
 {
-        if (i8042_flush() == I8042_BUFFER_SIZE) {
+        if (i8042_flush()) {
                pr_err("No controller found\n");
                return -ENODEV;
        }
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index 79b69ea47f74..e53416a4d7f3 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -1031,6 +1031,7 @@ static void wacom_destroy_leds(struct wacom *wacom)
 }
 static enum power_supply_property wacom_battery_props[] = {
+        POWER_SUPPLY_PROP_SCOPE,
        POWER_SUPPLY_PROP_CAPACITY
 };
@@ -1042,6 +1043,9 @@ static int wacom_battery_get_property(struct power_supply *psy,
        int ret = 0;
        switch (psp) {
+                case POWER_SUPPLY_PROP_SCOPE:
+                        val->intval = POWER_SUPPLY_SCOPE_DEVICE;
+                        break;
                case POWER_SUPPLY_PROP_CAPACITY:
                        val->intval =
                                wacom->wacom_wac.battery_capacity * 100 / 31;
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index b2aa503c16b1..c59b797eeafa 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -2054,6 +2054,12 @@ static const struct wacom_features wacom_features_0x101 =
 static const struct wacom_features wacom_features_0x10D =
        { "Wacom ISDv4 10D",      WACOM_PKGLEN_MTTPC,     26202, 16325,  255,
          0, MTTPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
+static const struct wacom_features wacom_features_0x10E =
+        { "Wacom ISDv4 10E",      WACOM_PKGLEN_MTTPC,     27760, 15694,  255,
+          0, MTTPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
+static const struct wacom_features wacom_features_0x10F =
+        { "Wacom ISDv4 10F",      WACOM_PKGLEN_MTTPC,     27760, 15694,  255,
+          0, MTTPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
 static const struct wacom_features wacom_features_0x4001 =
        { "Wacom ISDv4 4001",      WACOM_PKGLEN_MTTPC,     26202, 16325,  255,
          0, MTTPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
@@ -2248,6 +2254,8 @@ const struct usb_device_id wacom_ids[] = {
        { USB_DEVICE_WACOM(0x100) },
        { USB_DEVICE_WACOM(0x101) },
        { USB_DEVICE_WACOM(0x10D) },
+        { USB_DEVICE_WACOM(0x10E) },
+        { USB_DEVICE_WACOM(0x10F) },
        { USB_DEVICE_WACOM(0x300) },
        { USB_DEVICE_WACOM(0x301) },
        { USB_DEVICE_WACOM(0x304) },
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index b6a74bcbb08f..2a7f0dd6abab 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -1000,7 +1000,7 @@ static void request_write(struct cached_dev *dc, struct search *s)
                if (bio->bi_rw & REQ_FLUSH) {
                        /* Also need to send a flush to the backing device */
-                        struct bio *flush = bio_alloc_bioset(0, GFP_NOIO,
+                        struct bio *flush = bio_alloc_bioset(GFP_NOIO, 0,
                                                             dc->disk.bio_split);
                        flush->bi_rw    = WRITE_FLUSH;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index adf4d7e1d5e1..561a65f82e26 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8111,6 +8111,7 @@ static int md_set_badblocks(struct badblocks *bb, sector_t s, int sectors,
        u64 *p;
        int lo, hi;
        int rv = 1;
+        unsigned long flags;
        if (bb->shift < 0)
                /* badblocks are disabled */
@@ -8125,7 +8126,7 @@ static int md_set_badblocks(struct badblocks *bb, sector_t s, int sectors,
                sectors = next - s;
        }
-        write_seqlock_irq(&bb->lock);
+        write_seqlock_irqsave(&bb->lock, flags);
        p = bb->page;
        lo = 0;
@@ -8241,7 +8242,7 @@ static int md_set_badblocks(struct badblocks *bb, sector_t s, int sectors,
        bb->changed = 1;
        if (!acknowledged)
                bb->unacked_exist = 1;
-        write_sequnlock_irq(&bb->lock);
+        write_sequnlock_irqrestore(&bb->lock, flags);
        return rv;
 }
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index d60412c7f995..aacf6bf352d8 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1479,6 +1479,7 @@ static int raid1_spare_active(struct mddev *mddev)
                        }
                }
                if (rdev
+                    && rdev->recovery_offset == MaxSector
                    && !test_bit(Faulty, &rdev->flags)
                    && !test_and_set_bit(In_sync, &rdev->flags)) {
                        count++;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index df7b0a06b0ea..73dc8a377522 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1782,6 +1782,7 @@ static int raid10_spare_active(struct mddev *mddev)
                        }
                        sysfs_notify_dirent_safe(tmp->replacement->sysfs_state);
                } else if (tmp->rdev
+                           && tmp->rdev->recovery_offset == MaxSector
                           && !test_bit(Faulty, &tmp->rdev->flags)
                           && !test_and_set_bit(In_sync, &tmp->rdev->flags)) {
                        count++;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 7ff4f252ca1a..f8b906843926 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -778,6 +778,12 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                        bi->bi_io_vec[0].bv_len = STRIPE_SIZE;
                        bi->bi_io_vec[0].bv_offset = 0;
                        bi->bi_size = STRIPE_SIZE;
+                        /*
+                         * If this is discard request, set bi_vcnt 0. We don't
+                         * want to confuse SCSI because SCSI will replace payload
+                         */
+                        if (rw & REQ_DISCARD)
+                                bi->bi_vcnt = 0;
                        if (rrdev)
                                set_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags);
@@ -816,6 +822,12 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                        rbi->bi_io_vec[0].bv_len = STRIPE_SIZE;
                        rbi->bi_io_vec[0].bv_offset = 0;
                        rbi->bi_size = STRIPE_SIZE;
+                        /*
+                         * If this is discard request, set bi_vcnt 0. We don't
+                         * want to confuse SCSI because SCSI will replace payload
+                         */
+                        if (rw & REQ_DISCARD)
+                                rbi->bi_vcnt = 0;
                        if (conf->mddev->gendisk)
                                trace_block_bio_remap(bdev_get_queue(rbi->bi_bdev),
                                                      rbi, disk_devt(conf->mddev->gendisk),
@@ -2910,6 +2922,14 @@ static void handle_stripe_clean_event(struct r5conf *conf,
                }
                /* now that discard is done we can proceed with any sync */
                clear_bit(STRIPE_DISCARD, &sh->state);
+                /*
+                 * SCSI discard will change some bio fields and the stripe has
+                 * no updated data, so remove it from hash list and the stripe
+                 * will be reinitialized
+                 */
+                spin_lock_irq(&conf->device_lock);
+                remove_hash(sh);
+                spin_unlock_irq(&conf->device_lock);
                if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state))
                        set_bit(STRIPE_HANDLE, &sh->state);
diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
index 2521f7e23018..e79749cfec81 100644
--- a/drivers/media/dvb-frontends/tda10071.c
+++ b/drivers/media/dvb-frontends/tda10071.c
@@ -912,14 +912,8 @@ static int tda10071_init(struct dvb_frontend *fe)
                { 0xd5, 0x03, 0x03 },
        };
-        /* firmware status */
+        if (priv->warm) {
-        ret = tda10071_rd_reg(priv, 0x51, &tmp);
-        if (ret)
-                goto error;
-        if (!tmp) {
                /* warm state - wake up device from sleep */
-                priv->warm = 1;
                for (i = 0; i < ARRAY_SIZE(tab); i++) {
                        ret = tda10071_wr_reg_mask(priv, tab[i].reg,
@@ -937,7 +931,6 @@ static int tda10071_init(struct dvb_frontend *fe)
                        goto error;
        } else {
                /* cold state - try to download firmware */
-                priv->warm = 0;
                /* request the firmware, this will block and timeout */
                ret = request_firmware(&fw, fw_file, priv->i2c->dev.parent);
diff --git a/drivers/media/i2c/ad9389b.c b/drivers/media/i2c/ad9389b.c
index bb0c99d7a4f1..b06a7e54ee0d 100644
--- a/drivers/media/i2c/ad9389b.c
+++ b/drivers/media/i2c/ad9389b.c
@@ -628,16 +628,13 @@ static int ad9389b_s_stream(struct v4l2_subdev *sd, int enable)
 static const struct v4l2_dv_timings_cap ad9389b_timings_cap = {
        .type = V4L2_DV_BT_656_1120,
-        .bt = {
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
-                .max_width = 1920,
+        .reserved = { 0 },
-                .max_height = 1200,
+        V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
-                .min_pixelclock = 25000000,
+                V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
-                .max_pixelclock = 170000000,
-                .standards = V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
                        V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE |
+                V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
-                        V4L2_DV_BT_CAP_REDUCED_BLANKING | V4L2_DV_BT_CAP_CUSTOM,
+                V4L2_DV_BT_CAP_CUSTOM)
-        },
 };
 static int ad9389b_s_dv_timings(struct v4l2_subdev *sd,
diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c
index 7a576097471f..7c8d971f1f61 100644
--- a/drivers/media/i2c/adv7511.c
+++ b/drivers/media/i2c/adv7511.c
@@ -119,16 +119,14 @@ static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq);
 static const struct v4l2_dv_timings_cap adv7511_timings_cap = {
        .type = V4L2_DV_BT_656_1120,
-        .bt = {
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
-                .max_width = ADV7511_MAX_WIDTH,
+        .reserved = { 0 },
-                .max_height = ADV7511_MAX_HEIGHT,
+        V4L2_INIT_BT_TIMINGS(0, ADV7511_MAX_WIDTH, 0, ADV7511_MAX_HEIGHT,
-                .min_pixelclock = ADV7511_MIN_PIXELCLOCK,
+                ADV7511_MIN_PIXELCLOCK, ADV7511_MAX_PIXELCLOCK,
-                .max_pixelclock = ADV7511_MAX_PIXELCLOCK,
+                V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
-                .standards = V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
                        V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE |
+                V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
-                        V4L2_DV_BT_CAP_REDUCED_BLANKING | V4L2_DV_BT_CAP_CUSTOM,
+                        V4L2_DV_BT_CAP_CUSTOM)
-        },
 };
 static inline struct adv7511_state *get_adv7511_state(struct v4l2_subdev *sd)
@@ -1126,6 +1124,7 @@ static int adv7511_probe(struct i2c_client *client, const struct i2c_device_id *
        state->i2c_edid = i2c_new_dummy(client->adapter, state->i2c_edid_addr >> 1);
        if (state->i2c_edid == NULL) {
                v4l2_err(sd, "failed to register edid i2c client\n");
+                err = -ENOMEM;
                goto err_entity;
        }
@@ -1133,6 +1132,7 @@ static int adv7511_probe(struct i2c_client *client, const struct i2c_device_id *
        state->work_queue = create_singlethread_workqueue(sd->name);
        if (state->work_queue == NULL) {
                v4l2_err(sd, "could not create workqueue\n");
+                err = -ENOMEM;
                goto err_unreg_cec;
        }
diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
index d1748901337c..22f729d66a96 100644
--- a/drivers/media/i2c/adv7842.c
+++ b/drivers/media/i2c/adv7842.c
@@ -546,30 +546,24 @@ static inline bool is_digital_input(struct v4l2_subdev *sd)
 static const struct v4l2_dv_timings_cap adv7842_timings_cap_analog = {
        .type = V4L2_DV_BT_656_1120,
-        .bt = {
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
-                .max_width = 1920,
+        .reserved = { 0 },
-                .max_height = 1200,
+        V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
-                .min_pixelclock = 25000000,
+                V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
-                .max_pixelclock = 170000000,
-                .standards = V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
                        V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE |
+                V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
-                        V4L2_DV_BT_CAP_REDUCED_BLANKING | V4L2_DV_BT_CAP_CUSTOM,
+                        V4L2_DV_BT_CAP_CUSTOM)
-        },
 };
 static const struct v4l2_dv_timings_cap adv7842_timings_cap_digital = {
        .type = V4L2_DV_BT_656_1120,
-        .bt = {
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
-                .max_width = 1920,
+        .reserved = { 0 },
-                .max_height = 1200,
+        V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 225000000,
-                .min_pixelclock = 25000000,
+                V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
-                .max_pixelclock = 225000000,
-                .standards = V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
                        V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE |
+                V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
-                        V4L2_DV_BT_CAP_REDUCED_BLANKING | V4L2_DV_BT_CAP_CUSTOM,
+                        V4L2_DV_BT_CAP_CUSTOM)
-        },
 };
 static inline const struct v4l2_dv_timings_cap *
diff --git a/drivers/media/i2c/ths8200.c b/drivers/media/i2c/ths8200.c
index a58a8f663ffb..d9f65d7e3e58 100644
--- a/drivers/media/i2c/ths8200.c
+++ b/drivers/media/i2c/ths8200.c
@@ -46,14 +46,10 @@ struct ths8200_state {
 static const struct v4l2_dv_timings_cap ths8200_timings_cap = {
        .type = V4L2_DV_BT_656_1120,
-        .bt = {
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
-                .max_width = 1920,
+        .reserved = { 0 },
-                .max_height = 1080,
+        V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1080, 25000000, 148500000,
-                .min_pixelclock = 25000000,
+                V4L2_DV_BT_STD_CEA861, V4L2_DV_BT_CAP_PROGRESSIVE)
-                .max_pixelclock = 148500000,
-                .standards = V4L2_DV_BT_STD_CEA861,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE,
-        },
 };
 static inline struct ths8200_state *to_state(struct v4l2_subdev *sd)
diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c
index e12bbd8c3f0b..fb60da85bc2c 100644
--- a/drivers/media/pci/saa7134/saa7134-video.c
+++ b/drivers/media/pci/saa7134/saa7134-video.c
@@ -1455,6 +1455,7 @@ static int video_release(struct file *file)
        /* stop video capture */
        if (res_check(fh, RESOURCE_VIDEO)) {
+                pm_qos_remove_request(&dev->qos_request);
                videobuf_streamoff(&fh->cap);
                res_free(dev,fh,RESOURCE_VIDEO);
        }
diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index 15d23968d1de..9b88a4601007 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -1423,6 +1423,7 @@ static int s5p_jpeg_probe(struct platform_device *pdev)
        jpeg->vfd_decoder->release      = video_device_release;
        jpeg->vfd_decoder->lock         = &jpeg->lock;
        jpeg->vfd_decoder->v4l2_dev     = &jpeg->v4l2_dev;
+        jpeg->vfd_decoder->vfl_dir      = VFL_DIR_M2M;
        ret = video_register_device(jpeg->vfd_decoder, VFL_TYPE_GRABBER, -1);
        if (ret) {
diff --git a/drivers/media/platform/sh_vou.c b/drivers/media/platform/sh_vou.c
index 7a9c5e9329f2..4f30341dc2ab 100644
--- a/drivers/media/platform/sh_vou.c
+++ b/drivers/media/platform/sh_vou.c
@@ -776,7 +776,7 @@ static int sh_vou_try_fmt_vid_out(struct file *file, void *priv,
        v4l_bound_align_image(&pix->width, 0, VOU_MAX_IMAGE_WIDTH, 1,
                              &pix->height, 0, VOU_MAX_IMAGE_HEIGHT, 1, 0);
-        for (i = 0; ARRAY_SIZE(vou_fmt); i++)
+        for (i = 0; i < ARRAY_SIZE(vou_fmt); i++)
                if (vou_fmt[i].pfmt == pix->pixelformat)
                        return 0;
diff --git a/drivers/media/platform/soc_camera/mx3_camera.c b/drivers/media/platform/soc_camera/mx3_camera.c
index 8f9f6211c52e..f975b7008692 100644
--- a/drivers/media/platform/soc_camera/mx3_camera.c
+++ b/drivers/media/platform/soc_camera/mx3_camera.c
@@ -266,7 +266,6 @@ static void mx3_videobuf_queue(struct vb2_buffer *vb)
        struct idmac_channel *ichan = mx3_cam->idmac_channel[0];
        struct idmac_video_param *video = &ichan->params.video;
        const struct soc_mbus_pixelfmt *host_fmt = icd->current_fmt->host_fmt;
-        unsigned long flags;
        dma_cookie_t cookie;
        size_t new_size;
@@ -328,7 +327,7 @@ static void mx3_videobuf_queue(struct vb2_buffer *vb)
                memset(vb2_plane_vaddr(vb, 0), 0xaa, vb2_get_plane_payload(vb, 0));
 #endif
-        spin_lock_irqsave(&mx3_cam->lock, flags);
+        spin_lock_irq(&mx3_cam->lock);
        list_add_tail(&buf->queue, &mx3_cam->capture);
        if (!mx3_cam->active)
@@ -351,7 +350,7 @@ static void mx3_videobuf_queue(struct vb2_buffer *vb)
        if (mx3_cam->active == buf)
                mx3_cam->active = NULL;
-        spin_unlock_irqrestore(&mx3_cam->lock, flags);
+        spin_unlock_irq(&mx3_cam->lock);
 error:
        vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
 }
diff --git a/drivers/media/tuners/e4000.c b/drivers/media/tuners/e4000.c
index ad9309da4a91..6c96e4898777 100644
--- a/drivers/media/tuners/e4000.c
+++ b/drivers/media/tuners/e4000.c
@@ -19,6 +19,7 @@
 */
 #include "e4000_priv.h"
+#include <linux/math64.h>
 /* write multiple registers */
 static int e4000_wr_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
@@ -233,7 +234,7 @@ static int e4000_set_params(struct dvb_frontend *fe)
         * or more.
         */
        f_vco = c->frequency * e4000_pll_lut[i].mul;
-        sigma_delta = 0x10000UL * (f_vco % priv->cfg->clock) / priv->cfg->clock;
+        sigma_delta = div_u64(0x10000ULL * (f_vco % priv->cfg->clock), priv->cfg->clock);
        buf[0] = f_vco / priv->cfg->clock;
        buf[1] = (sigma_delta >> 0) & 0xff;
        buf[2] = (sigma_delta >> 8) & 0xff;
diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c
index c43c8d32be40..be77482c3070 100644
--- a/drivers/media/usb/stkwebcam/stk-webcam.c
+++ b/drivers/media/usb/stkwebcam/stk-webcam.c
@@ -111,6 +111,13 @@ static const struct dmi_system_id stk_upside_down_dmi_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "F3JC")
                }
        },
+        {
+                .ident = "T12Rg-H",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "HCL Infosystems Limited"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "T12Rg-H")
+                }
+        },
        {}
 };
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index 81695d48c13e..c3bb2502225b 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -2090,6 +2090,15 @@ static struct usb_device_id uvc_ids[] = {
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0,
          .driver_info          = UVC_QUIRK_PROBE_MINMAX },
+        /* Microsoft Lifecam NX-3000 */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x045e,
+          .idProduct            = 0x0721,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_PROBE_DEF },
        /* Microsoft Lifecam VX-7000 */
        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
@@ -2174,6 +2183,15 @@ static struct usb_device_id uvc_ids[] = {
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0,
          .driver_info          = UVC_QUIRK_PROBE_DEF },
+        /* Dell SP2008WFP Monitor */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x05a9,
+          .idProduct            = 0x2641,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_PROBE_DEF },
        /* Dell Alienware X51 */
        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index 594c75eab5a5..de0e87f0b2c3 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -353,7 +353,9 @@ static int __verify_length(struct vb2_buffer *vb, const struct v4l2_buffer *b)
                        if (b->m.planes[plane].bytesused > length)
                                return -EINVAL;
-                        if (b->m.planes[plane].data_offset >=
+                        if (b->m.planes[plane].data_offset > 0 &&
+                            b->m.planes[plane].data_offset >=
                            b->m.planes[plane].bytesused)
                                return -EINVAL;
                }
diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c b/drivers/media/v4l2-core/videobuf2-dma-contig.c
index fd56f2563201..646f08f4f504 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
@@ -423,6 +423,39 @@ static inline int vma_is_io(struct vm_area_struct *vma)
        return !!(vma->vm_flags & (VM_IO | VM_PFNMAP));
 }
+static int vb2_dc_get_user_pfn(unsigned long start, int n_pages,
+        struct vm_area_struct *vma, unsigned long *res)
+{
+        unsigned long pfn, start_pfn, prev_pfn;
+        unsigned int i;
+        int ret;
+        if (!vma_is_io(vma))
+                return -EFAULT;
+        ret = follow_pfn(vma, start, &pfn);
+        if (ret)
+                return ret;
+        start_pfn = pfn;
+        start += PAGE_SIZE;
+        for (i = 1; i < n_pages; ++i, start += PAGE_SIZE) {
+                prev_pfn = pfn;
+                ret = follow_pfn(vma, start, &pfn);
+                if (ret) {
+                        pr_err("no page for address %lu\n", start);
+                        return ret;
+                }
+                if (pfn != prev_pfn + 1)
+                        return -EINVAL;
+        }
+        *res = start_pfn;
+        return 0;
+}
 static int vb2_dc_get_user_pages(unsigned long start, struct page **pages,
        int n_pages, struct vm_area_struct *vma, int write)
 {
@@ -433,6 +466,9 @@ static int vb2_dc_get_user_pages(unsigned long start, struct page **pages,
                        unsigned long pfn;
                        int ret = follow_pfn(vma, start, &pfn);
+                        if (!pfn_valid(pfn))
+                                return -EINVAL;
                        if (ret) {
                                pr_err("no page for address %lu\n", start);
                                return ret;
@@ -468,16 +504,49 @@ static void vb2_dc_put_userptr(void *buf_priv)
        struct vb2_dc_buf *buf = buf_priv;
        struct sg_table *sgt = buf->dma_sgt;
-        dma_unmap_sg(buf->dev, sgt->sgl, sgt->orig_nents, buf->dma_dir);
+        if (sgt) {
-        if (!vma_is_io(buf->vma))
+                dma_unmap_sg(buf->dev, sgt->sgl, sgt->orig_nents, buf->dma_dir);
-                vb2_dc_sgt_foreach_page(sgt, vb2_dc_put_dirty_page);
+                if (!vma_is_io(buf->vma))
+                        vb2_dc_sgt_foreach_page(sgt, vb2_dc_put_dirty_page);
-        sg_free_table(sgt);
+                sg_free_table(sgt);
-        kfree(sgt);
+                kfree(sgt);
+        }
        vb2_put_vma(buf->vma);
        kfree(buf);
 }
+/*
+ * For some kind of reserved memory there might be no struct page available,
+ * so all that can be done to support such 'pages' is to try to convert
+ * pfn to dma address or at the last resort just assume that
+ * dma address == physical address (like it has been assumed in earlier version
+ * of videobuf2-dma-contig
+ */
+#ifdef __arch_pfn_to_dma
+static inline dma_addr_t vb2_dc_pfn_to_dma(struct device *dev, unsigned long pfn)
+{
+        return (dma_addr_t)__arch_pfn_to_dma(dev, pfn);
+}
+#elif defined(__pfn_to_bus)
+static inline dma_addr_t vb2_dc_pfn_to_dma(struct device *dev, unsigned long pfn)
+{
+        return (dma_addr_t)__pfn_to_bus(pfn);
+}
+#elif defined(__pfn_to_phys)
+static inline dma_addr_t vb2_dc_pfn_to_dma(struct device *dev, unsigned long pfn)
+{
+        return (dma_addr_t)__pfn_to_phys(pfn);
+}
+#else
+static inline dma_addr_t vb2_dc_pfn_to_dma(struct device *dev, unsigned long pfn)
+{
+        /* really, we cannot do anything better at this point */
+        return (dma_addr_t)(pfn) << PAGE_SHIFT;
+}
+#endif
 static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
        unsigned long size, int write)
 {
@@ -548,6 +617,14 @@ static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
        /* extract page list from userspace mapping */
        ret = vb2_dc_get_user_pages(start, pages, n_pages, vma, write);
        if (ret) {
+                unsigned long pfn;
+                if (vb2_dc_get_user_pfn(start, n_pages, vma, &pfn) == 0) {
+                        buf->dma_addr = vb2_dc_pfn_to_dma(buf->dev, pfn);
+                        buf->size = size;
+                        kfree(pages);
+                        return buf;
+                }
                pr_err("failed to get user pages\n");
                goto fail_vma;
        }
diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
index 59ab0692f0b9..a9830ff8e3f3 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
@@ -349,7 +349,7 @@ static int legacy_set_geometry(struct gpmi_nand_data *this)
 int common_nfc_set_geometry(struct gpmi_nand_data *this)
 {
-        return set_geometry_by_ecc_info(this) ? 0 : legacy_set_geometry(this);
+        return legacy_set_geometry(this);
 }
 struct dma_chan *get_dma_chan(struct gpmi_nand_data *this)
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index dd03dfdfb0d6..c28d4e29af1a 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -1320,7 +1320,12 @@ static int pxa3xx_nand_probe(struct platform_device *pdev)
        for (cs = 0; cs < pdata->num_cs; cs++) {
                struct mtd_info *mtd = info->host[cs]->mtd;
-                mtd->name = pdev->name;
+                /*
+                 * The mtd name matches the one used in 'mtdparts' kernel
+                 * parameter. This name cannot be changed or otherwise
+                 * user's mtd partitions configuration would get broken.
+                 */
+                mtd->name = "pxa3xx_nand-0";
                info->cs = cs;
                ret = pxa3xx_nand_scan(mtd);
                if (ret) {
diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
index 3b1ff6148702..693d8ffe4653 100644
--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -1405,10 +1405,10 @@ static int at91_can_remove(struct platform_device *pdev)
 static const struct platform_device_id at91_can_id_table[] = {
        {
-                .name = "at91_can",
+                .name = "at91sam9x5_can",
                .driver_data = (kernel_ulong_t)&at91_at91sam9x5_data,
        }, {
-                .name = "at91sam9x5_can",
+                .name = "at91_can",
                .driver_data = (kernel_ulong_t)&at91_at91sam9263_data,
        }, {
                /* sentinel */
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index f9cba4123c66..1870c4731a57 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -705,14 +705,14 @@ static size_t can_get_size(const struct net_device *dev)
        size_t size;
        size = nla_total_size(sizeof(u32));   /* IFLA_CAN_STATE */
-        size += sizeof(struct can_ctrlmode);  /* IFLA_CAN_CTRLMODE */
+        size += nla_total_size(sizeof(struct can_ctrlmode));  /* IFLA_CAN_CTRLMODE */
        size += nla_total_size(sizeof(u32));  /* IFLA_CAN_RESTART_MS */
-        size += sizeof(struct can_bittiming); /* IFLA_CAN_BITTIMING */
+        size += nla_total_size(sizeof(struct can_bittiming)); /* IFLA_CAN_BITTIMING */
-        size += sizeof(struct can_clock);     /* IFLA_CAN_CLOCK */
+        size += nla_total_size(sizeof(struct can_clock));     /* IFLA_CAN_CLOCK */
        if (priv->do_get_berr_counter)        /* IFLA_CAN_BERR_COUNTER */
-                size += sizeof(struct can_berr_counter);
+                size += nla_total_size(sizeof(struct can_berr_counter));
        if (priv->bittiming_const)            /* IFLA_CAN_BITTIMING_CONST */
-                size += sizeof(struct can_bittiming_const);
+                size += nla_total_size(sizeof(struct can_bittiming_const));
        return size;
 }
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 3f21142138b7..8f5ce747feb5 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -62,7 +62,7 @@
 #define FLEXCAN_MCR_BCC                 BIT(16)
 #define FLEXCAN_MCR_LPRIO_EN            BIT(13)
 #define FLEXCAN_MCR_AEN                 BIT(12)
-#define FLEXCAN_MCR_MAXMB(x)            ((x) & 0xf)
+#define FLEXCAN_MCR_MAXMB(x)            ((x) & 0x1f)
 #define FLEXCAN_MCR_IDAM_A              (0 << 8)
 #define FLEXCAN_MCR_IDAM_B              (1 << 8)
 #define FLEXCAN_MCR_IDAM_C              (2 << 8)
@@ -735,9 +735,11 @@ static int flexcan_chip_start(struct net_device *dev)
         *
         */
        reg_mcr = flexcan_read(&regs->mcr);
+        reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff);
        reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_FEN | FLEXCAN_MCR_HALT |
                FLEXCAN_MCR_SUPV | FLEXCAN_MCR_WRN_EN |
-                FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS;
+                FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS |
+                FLEXCAN_MCR_MAXMB(FLEXCAN_TX_BUF_ID);
        netdev_dbg(dev, "%s: writing mcr=0x%08x", __func__, reg_mcr);
        flexcan_write(reg_mcr, &regs->mcr);
@@ -771,6 +773,10 @@ static int flexcan_chip_start(struct net_device *dev)
        netdev_dbg(dev, "%s: writing ctrl=0x%08x", __func__, reg_ctrl);
        flexcan_write(reg_ctrl, &regs->ctrl);
+        /* Abort any pending TX, mark Mailbox as INACTIVE */
+        flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
+                      &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
        /* acceptance mask/acceptance code (accept everything) */
        flexcan_write(0x0, &regs->rxgmask);
        flexcan_write(0x0, &regs->rx14mask);
@@ -979,9 +985,9 @@ static void unregister_flexcandev(struct net_device *dev)
 }
 static const struct of_device_id flexcan_of_match[] = {
-        { .compatible = "fsl,p1010-flexcan", .data = &fsl_p1010_devtype_data, },
-        { .compatible = "fsl,imx28-flexcan", .data = &fsl_imx28_devtype_data, },
        { .compatible = "fsl,imx6q-flexcan", .data = &fsl_imx6q_devtype_data, },
+        { .compatible = "fsl,imx28-flexcan", .data = &fsl_imx28_devtype_data, },
+        { .compatible = "fsl,p1010-flexcan", .data = &fsl_p1010_devtype_data, },
        { /* sentinel */ },
 };
 MODULE_DEVICE_TABLE(of, flexcan_of_match);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 97b3d32a98bd..c5e375ddd6c0 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1197,8 +1197,9 @@ union cdu_context {
 /* TM (timers) host DB constants */
 #define TM_ILT_PAGE_SZ_HW       0
 #define TM_ILT_PAGE_SZ          (4096 << TM_ILT_PAGE_SZ_HW) /* 4K */
-/* #define TM_CONN_NUM          (CNIC_STARTING_CID+CNIC_ISCSI_CXT_MAX) */
+#define TM_CONN_NUM             (BNX2X_FIRST_VF_CID + \
-#define TM_CONN_NUM             1024
+                                 BNX2X_VF_CIDS + \
+                                 CNIC_ISCSI_CID_MAX)
 #define TM_ILT_SZ               (8 * TM_CONN_NUM)
 #define TM_ILT_LINES            DIV_ROUND_UP(TM_ILT_SZ, TM_ILT_PAGE_SZ)
@@ -1527,7 +1528,6 @@ struct bnx2x {
 #define PCI_32BIT_FLAG                  (1 << 1)
 #define ONE_PORT_FLAG                   (1 << 2)
 #define NO_WOL_FLAG                     (1 << 3)
-#define USING_DAC_FLAG                  (1 << 4)
 #define USING_MSIX_FLAG                 (1 << 5)
 #define USING_MSI_FLAG                  (1 << 6)
 #define DISABLE_MSI_FLAG                (1 << 7)
@@ -1621,7 +1621,7 @@ struct bnx2x {
        u16                     rx_ticks_int;
        u16                     rx_ticks;
 /* Maximal coalescing timeout in us */
-#define BNX2X_MAX_COALESCE_TOUT         (0xf0*12)
+#define BNX2X_MAX_COALESCE_TOUT         (0xff*BNX2X_BTR)
        u32                     lin_cnt;
@@ -2072,7 +2072,8 @@ u32 bnx2x_dmae_opcode(struct bnx2x *bp, u8 src_type, u8 dst_type,
 void bnx2x_prep_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae,
                               u8 src_type, u8 dst_type);
-int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae);
+int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae,
+                               u32 *comp);
 /* FLR related routines */
 u32 bnx2x_flr_clnup_poll_count(struct bnx2x *bp);
@@ -2498,4 +2499,8 @@ enum bnx2x_pci_bus_speed {
 };
 void bnx2x_set_local_cmng(struct bnx2x *bp);
+#define MCPR_SCRATCH_BASE(bp) \
+        (CHIP_IS_E1x(bp) ? MCP_REG_MCPR_SCRATCH : MCP_A_REG_MCPR_SCRATCH)
 #endif /* bnx2x.h */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index e66beff2704d..4ab4c89c60cd 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -681,6 +681,7 @@ static void bnx2x_gro_receive(struct bnx2x *bp, struct bnx2x_fastpath *fp,
                }
        }
 #endif
+        skb_record_rx_queue(skb, fp->rx_queue);
        napi_gro_receive(&fp->napi, skb);
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 324de5f05332..e8efa1c93ffe 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -891,17 +891,8 @@ static void bnx2x_get_regs(struct net_device *dev,
         * will re-enable parity attentions right after the dump.
         */
-        /* Disable parity on path 0 */
-        bnx2x_pretend_func(bp, 0);
        bnx2x_disable_blocks_parity(bp);
-        /* Disable parity on path 1 */
-        bnx2x_pretend_func(bp, 1);
-        bnx2x_disable_blocks_parity(bp);
-        /* Return to current function */
-        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
        dump_hdr.header_size = (sizeof(struct dump_header) / 4) - 1;
        dump_hdr.preset = DUMP_ALL_PRESETS;
        dump_hdr.version = BNX2X_DUMP_VERSION;
@@ -928,18 +919,9 @@ static void bnx2x_get_regs(struct net_device *dev,
        /* Actually read the registers */
        __bnx2x_get_regs(bp, p);
-        /* Re-enable parity attentions on path 0 */
+        /* Re-enable parity attentions */
-        bnx2x_pretend_func(bp, 0);
        bnx2x_clear_blocks_parity(bp);
        bnx2x_enable_blocks_parity(bp);
-        /* Re-enable parity attentions on path 1 */
-        bnx2x_pretend_func(bp, 1);
-        bnx2x_clear_blocks_parity(bp);
-        bnx2x_enable_blocks_parity(bp);
-        /* Return to current function */
-        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
 }
 static int bnx2x_get_preset_regs_len(struct net_device *dev, u32 preset)
@@ -993,17 +975,8 @@ static int bnx2x_get_dump_data(struct net_device *dev,
         * will re-enable parity attentions right after the dump.
         */
-        /* Disable parity on path 0 */
-        bnx2x_pretend_func(bp, 0);
        bnx2x_disable_blocks_parity(bp);
-        /* Disable parity on path 1 */
-        bnx2x_pretend_func(bp, 1);
-        bnx2x_disable_blocks_parity(bp);
-        /* Return to current function */
-        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
        dump_hdr.header_size = (sizeof(struct dump_header) / 4) - 1;
        dump_hdr.preset = bp->dump_preset_idx;
        dump_hdr.version = BNX2X_DUMP_VERSION;
@@ -1032,19 +1005,10 @@ static int bnx2x_get_dump_data(struct net_device *dev,
        /* Actually read the registers */
        __bnx2x_get_preset_regs(bp, p, dump_hdr.preset);
-        /* Re-enable parity attentions on path 0 */
+        /* Re-enable parity attentions */
-        bnx2x_pretend_func(bp, 0);
        bnx2x_clear_blocks_parity(bp);
        bnx2x_enable_blocks_parity(bp);
-        /* Re-enable parity attentions on path 1 */
-        bnx2x_pretend_func(bp, 1);
-        bnx2x_clear_blocks_parity(bp);
-        bnx2x_enable_blocks_parity(bp);
-        /* Return to current function */
-        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
        return 0;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h
index 76df015f486a..c2dfea7968f4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h
@@ -640,23 +640,35 @@ static const struct {
 * [30] MCP Latched ump_tx_parity
 * [31] MCP Latched scpad_parity
 */
-#define MISC_AEU_ENABLE_MCP_PRTY_BITS   \
+#define MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS       \
        (AEU_INPUTS_ATTN_BITS_MCP_LATCHED_ROM_PARITY | \
         AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_RX_PARITY | \
-         AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY | \
+         AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY)
+#define MISC_AEU_ENABLE_MCP_PRTY_BITS   \
+        (MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS | \
         AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY)
 /* Below registers control the MCP parity attention output. When
 * MISC_AEU_ENABLE_MCP_PRTY_BITS are set - attentions are
 * enabled, when cleared - disabled.
 */
-static const u32 mcp_attn_ctl_regs[] = {
+static const struct {
-        MISC_REG_AEU_ENABLE4_FUNC_0_OUT_0,
+        u32 addr;
-        MISC_REG_AEU_ENABLE4_NIG_0,
+        u32 bits;
-        MISC_REG_AEU_ENABLE4_PXP_0,
+} mcp_attn_ctl_regs[] = {
-        MISC_REG_AEU_ENABLE4_FUNC_1_OUT_0,
+        { MISC_REG_AEU_ENABLE4_FUNC_0_OUT_0,
-        MISC_REG_AEU_ENABLE4_NIG_1,
+                MISC_AEU_ENABLE_MCP_PRTY_BITS },
-        MISC_REG_AEU_ENABLE4_PXP_1
+        { MISC_REG_AEU_ENABLE4_NIG_0,
+                MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS },
+        { MISC_REG_AEU_ENABLE4_PXP_0,
+                MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS },
+        { MISC_REG_AEU_ENABLE4_FUNC_1_OUT_0,
+                MISC_AEU_ENABLE_MCP_PRTY_BITS },
+        { MISC_REG_AEU_ENABLE4_NIG_1,
+                MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS },
+        { MISC_REG_AEU_ENABLE4_PXP_1,
+                MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS }
 };
 static inline void bnx2x_set_mcp_parity(struct bnx2x *bp, u8 enable)
@@ -665,14 +677,14 @@ static inline void bnx2x_set_mcp_parity(struct bnx2x *bp, u8 enable)
        u32 reg_val;
        for (i = 0; i < ARRAY_SIZE(mcp_attn_ctl_regs); i++) {
-                reg_val = REG_RD(bp, mcp_attn_ctl_regs[i]);
+                reg_val = REG_RD(bp, mcp_attn_ctl_regs[i].addr);
                if (enable)
-                        reg_val |= MISC_AEU_ENABLE_MCP_PRTY_BITS;
+                        reg_val |= mcp_attn_ctl_regs[i].bits;
                else
-                        reg_val &= ~MISC_AEU_ENABLE_MCP_PRTY_BITS;
+                        reg_val &= ~mcp_attn_ctl_regs[i].bits;
-                REG_WR(bp, mcp_attn_ctl_regs[i], reg_val);
+                REG_WR(bp, mcp_attn_ctl_regs[i].addr, reg_val);
        }
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 82b658d8c04c..b42f89ce02ef 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -503,9 +503,9 @@ void bnx2x_prep_dmae_with_comp(struct bnx2x *bp,
 }
 /* issue a dmae command over the init-channel and wait for completion */
-int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae)
+int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae,
+                               u32 *comp)
 {
-        u32 *wb_comp = bnx2x_sp(bp, wb_comp);
        int cnt = CHIP_REV_IS_SLOW(bp) ? (400000) : 4000;
        int rc = 0;
@@ -518,14 +518,14 @@ int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae)
        spin_lock_bh(&bp->dmae_lock);
        /* reset completion */
-        *wb_comp = 0;
+        *comp = 0;
        /* post the command on the channel used for initializations */
        bnx2x_post_dmae(bp, dmae, INIT_DMAE_C(bp));
        /* wait for completion */
        udelay(5);
-        while ((*wb_comp & ~DMAE_PCI_ERR_FLAG) != DMAE_COMP_VAL) {
+        while ((*comp & ~DMAE_PCI_ERR_FLAG) != DMAE_COMP_VAL) {
                if (!cnt ||
                    (bp->recovery_state != BNX2X_RECOVERY_DONE &&
@@ -537,7 +537,7 @@ int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae)
                cnt--;
                udelay(50);
        }
-        if (*wb_comp & DMAE_PCI_ERR_FLAG) {
+        if (*comp & DMAE_PCI_ERR_FLAG) {
                BNX2X_ERR("DMAE PCI error!\n");
                rc = DMAE_PCI_ERROR;
        }
@@ -574,7 +574,7 @@ void bnx2x_write_dmae(struct bnx2x *bp, dma_addr_t dma_addr, u32 dst_addr,
        dmae.len = len32;
        /* issue the command and wait for completion */
-        rc = bnx2x_issue_dmae_with_comp(bp, &dmae);
+        rc = bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
        if (rc) {
                BNX2X_ERR("DMAE returned failure %d\n", rc);
                bnx2x_panic();
@@ -611,7 +611,7 @@ void bnx2x_read_dmae(struct bnx2x *bp, u32 src_addr, u32 len32)
        dmae.len = len32;
        /* issue the command and wait for completion */
-        rc = bnx2x_issue_dmae_with_comp(bp, &dmae);
+        rc = bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
        if (rc) {
                BNX2X_ERR("DMAE returned failure %d\n", rc);
                bnx2x_panic();
@@ -751,6 +751,10 @@ static int bnx2x_mc_assert(struct bnx2x *bp)
        return rc;
 }
+#define MCPR_TRACE_BUFFER_SIZE  (0x800)
+#define SCRATCH_BUFFER_SIZE(bp) \
+        (CHIP_IS_E1(bp) ? 0x10000 : (CHIP_IS_E1H(bp) ? 0x20000 : 0x28000))
 void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
 {
        u32 addr, val;
@@ -775,7 +779,17 @@ void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
                trace_shmem_base = bp->common.shmem_base;
        else
                trace_shmem_base = SHMEM2_RD(bp, other_shmem_base_addr);
-        addr = trace_shmem_base - 0x800;
+        /* sanity */
+        if (trace_shmem_base < MCPR_SCRATCH_BASE(bp) + MCPR_TRACE_BUFFER_SIZE ||
+            trace_shmem_base >= MCPR_SCRATCH_BASE(bp) +
+                                SCRATCH_BUFFER_SIZE(bp)) {
+                BNX2X_ERR("Unable to dump trace buffer (mark %x)\n",
+                          trace_shmem_base);
+                return;
+        }
+        addr = trace_shmem_base - MCPR_TRACE_BUFFER_SIZE;
        /* validate TRCB signature */
        mark = REG_RD(bp, addr);
@@ -787,14 +801,17 @@ void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
        /* read cyclic buffer pointer */
        addr += 4;
        mark = REG_RD(bp, addr);
-        mark = (CHIP_IS_E1x(bp) ? MCP_REG_MCPR_SCRATCH : MCP_A_REG_MCPR_SCRATCH)
+        mark = MCPR_SCRATCH_BASE(bp) + ((mark + 0x3) & ~0x3) - 0x08000000;
-                        + ((mark + 0x3) & ~0x3) - 0x08000000;
+        if (mark >= trace_shmem_base || mark < addr + 4) {
+                BNX2X_ERR("Mark doesn't fall inside Trace Buffer\n");
+                return;
+        }
        printk("%s" "begin fw dump (mark 0x%x)\n", lvl, mark);
        printk("%s", lvl);
        /* dump buffer after the mark */
-        for (offset = mark; offset <= trace_shmem_base; offset += 0x8*4) {
+        for (offset = mark; offset < trace_shmem_base; offset += 0x8*4) {
                for (word = 0; word < 8; word++)
                        data[word] = htonl(REG_RD(bp, offset + 4*word));
                data[8] = 0x0;
@@ -4280,65 +4297,60 @@ static void _print_next_block(int idx, const char *blk)
        pr_cont("%s%s", idx ? ", " : "", blk);
 }
-static int bnx2x_check_blocks_with_parity0(struct bnx2x *bp, u32 sig,
+static bool bnx2x_check_blocks_with_parity0(struct bnx2x *bp, u32 sig,
-                                            int par_num, bool print)
+                                            int *par_num, bool print)
 {
-        int i = 0;
+        u32 cur_bit;
-        u32 cur_bit = 0;
+        bool res;
+        int i;
+        res = false;
        for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                if (sig & cur_bit) {
-                        switch (cur_bit) {
+                        res |= true; /* Each bit is real error! */
-                        case AEU_INPUTS_ATTN_BITS_BRB_PARITY_ERROR:
-                                if (print) {
+                        if (print) {
-                                        _print_next_block(par_num++, "BRB");
+                                switch (cur_bit) {
+                                case AEU_INPUTS_ATTN_BITS_BRB_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "BRB");
                                        _print_parity(bp,
                                                      BRB1_REG_BRB1_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_PARSER_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_PARSER_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
-                                if (print) {
+                                                          "PARSER");
-                                        _print_next_block(par_num++, "PARSER");
                                        _print_parity(bp, PRS_REG_PRS_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_TSDM_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_TSDM_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "TSDM");
-                                if (print) {
-                                        _print_next_block(par_num++, "TSDM");
                                        _print_parity(bp,
                                                      TSDM_REG_TSDM_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_SEARCHER_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_SEARCHER_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
-                                if (print) {
-                                        _print_next_block(par_num++,
                                                          "SEARCHER");
                                        _print_parity(bp, SRC_REG_SRC_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_TCM_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_TCM_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "TCM");
-                                if (print) {
+                                        _print_parity(bp, TCM_REG_TCM_PRTY_STS);
-                                        _print_next_block(par_num++, "TCM");
+                                        break;
-                                        _print_parity(bp,
+                                case AEU_INPUTS_ATTN_BITS_TSEMI_PARITY_ERROR:
-                                                      TCM_REG_TCM_PRTY_STS);
+                                        _print_next_block((*par_num)++,
-                                }
+                                                          "TSEMI");
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_TSEMI_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "TSEMI");
                                        _print_parity(bp,
                                                      TSEM_REG_TSEM_PRTY_STS_0);
                                        _print_parity(bp,
                                                      TSEM_REG_TSEM_PRTY_STS_1);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_PBCLIENT_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_PBCLIENT_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "XPB");
-                                if (print) {
-                                        _print_next_block(par_num++, "XPB");
                                        _print_parity(bp, GRCBASE_XPB +
                                                          PB_REG_PB_PRTY_STS);
+                                        break;
                                }
-                                break;
                        }
                        /* Clear the bit */
@@ -4346,53 +4358,59 @@ static int bnx2x_check_blocks_with_parity0(struct bnx2x *bp, u32 sig,
                }
        }
-        return par_num;
+        return res;
 }
-static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
+static bool bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
-                                            int par_num, bool *global,
+                                            int *par_num, bool *global,
                                            bool print)
 {
-        int i = 0;
+        u32 cur_bit;
-        u32 cur_bit = 0;
+        bool res;
+        int i;
+        res = false;
        for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                if (sig & cur_bit) {
+                        res |= true; /* Each bit is real error! */
                        switch (cur_bit) {
                        case AEU_INPUTS_ATTN_BITS_PBF_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "PBF");
+                                        _print_next_block((*par_num)++, "PBF");
                                        _print_parity(bp, PBF_REG_PBF_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_QM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "QM");
+                                        _print_next_block((*par_num)++, "QM");
                                        _print_parity(bp, QM_REG_QM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_TIMERS_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "TM");
+                                        _print_next_block((*par_num)++, "TM");
                                        _print_parity(bp, TM_REG_TM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_XSDM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "XSDM");
+                                        _print_next_block((*par_num)++, "XSDM");
                                        _print_parity(bp,
                                                      XSDM_REG_XSDM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_XCM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "XCM");
+                                        _print_next_block((*par_num)++, "XCM");
                                        _print_parity(bp, XCM_REG_XCM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_XSEMI_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "XSEMI");
+                                        _print_next_block((*par_num)++,
+                                                          "XSEMI");
                                        _print_parity(bp,
                                                      XSEM_REG_XSEM_PRTY_STS_0);
                                        _print_parity(bp,
@@ -4401,7 +4419,7 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                                break;
                        case AEU_INPUTS_ATTN_BITS_DOORBELLQ_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                          "DOORBELLQ");
                                        _print_parity(bp,
                                                      DORQ_REG_DORQ_PRTY_STS);
@@ -4409,7 +4427,7 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                                break;
                        case AEU_INPUTS_ATTN_BITS_NIG_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "NIG");
+                                        _print_next_block((*par_num)++, "NIG");
                                        if (CHIP_IS_E1x(bp)) {
                                                _print_parity(bp,
                                                        NIG_REG_NIG_PRTY_STS);
@@ -4423,32 +4441,34 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                                break;
                        case AEU_INPUTS_ATTN_BITS_VAUX_PCI_CORE_PARITY_ERROR:
                                if (print)
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                          "VAUX PCI CORE");
                                *global = true;
                                break;
                        case AEU_INPUTS_ATTN_BITS_DEBUG_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "DEBUG");
+                                        _print_next_block((*par_num)++,
+                                                          "DEBUG");
                                        _print_parity(bp, DBG_REG_DBG_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_USDM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "USDM");
+                                        _print_next_block((*par_num)++, "USDM");
                                        _print_parity(bp,
                                                      USDM_REG_USDM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_UCM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "UCM");
+                                        _print_next_block((*par_num)++, "UCM");
                                        _print_parity(bp, UCM_REG_UCM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_USEMI_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "USEMI");
+                                        _print_next_block((*par_num)++,
+                                                          "USEMI");
                                        _print_parity(bp,
                                                      USEM_REG_USEM_PRTY_STS_0);
                                        _print_parity(bp,
@@ -4457,21 +4477,21 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                                break;
                        case AEU_INPUTS_ATTN_BITS_UPB_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "UPB");
+                                        _print_next_block((*par_num)++, "UPB");
                                        _print_parity(bp, GRCBASE_UPB +
                                                          PB_REG_PB_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_CSDM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "CSDM");
+                                        _print_next_block((*par_num)++, "CSDM");
                                        _print_parity(bp,
                                                      CSDM_REG_CSDM_PRTY_STS);
                                }
                                break;
                        case AEU_INPUTS_ATTN_BITS_CCM_PARITY_ERROR:
                                if (print) {
-                                        _print_next_block(par_num++, "CCM");
+                                        _print_next_block((*par_num)++, "CCM");
                                        _print_parity(bp, CCM_REG_CCM_PRTY_STS);
                                }
                                break;
@@ -4482,80 +4502,73 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                }
        }
-        return par_num;
+        return res;
 }
-static int bnx2x_check_blocks_with_parity2(struct bnx2x *bp, u32 sig,
+static bool bnx2x_check_blocks_with_parity2(struct bnx2x *bp, u32 sig,
-                                            int par_num, bool print)
+                                            int *par_num, bool print)
 {
-        int i = 0;
+        u32 cur_bit;
-        u32 cur_bit = 0;
+        bool res;
+        int i;
+        res = false;
        for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                if (sig & cur_bit) {
-                        switch (cur_bit) {
+                        res |= true; /* Each bit is real error! */
-                        case AEU_INPUTS_ATTN_BITS_CSEMI_PARITY_ERROR:
+                        if (print) {
-                                if (print) {
+                                switch (cur_bit) {
-                                        _print_next_block(par_num++, "CSEMI");
+                                case AEU_INPUTS_ATTN_BITS_CSEMI_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
+                                                          "CSEMI");
                                        _print_parity(bp,
                                                      CSEM_REG_CSEM_PRTY_STS_0);
                                        _print_parity(bp,
                                                      CSEM_REG_CSEM_PRTY_STS_1);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_PXP_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_PXP_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "PXP");
-                                if (print) {
-                                        _print_next_block(par_num++, "PXP");
                                        _print_parity(bp, PXP_REG_PXP_PRTY_STS);
                                        _print_parity(bp,
                                                      PXP2_REG_PXP2_PRTY_STS_0);
                                        _print_parity(bp,
                                                      PXP2_REG_PXP2_PRTY_STS_1);
-                                }
+                                        break;
-                                break;
+                                case AEU_IN_ATTN_BITS_PXPPCICLOCKCLIENT_PARITY_ERROR:
-                        case AEU_IN_ATTN_BITS_PXPPCICLOCKCLIENT_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
-                                if (print)
+                                                          "PXPPCICLOCKCLIENT");
-                                        _print_next_block(par_num++,
+                                        break;
-                                        "PXPPCICLOCKCLIENT");
+                                case AEU_INPUTS_ATTN_BITS_CFC_PARITY_ERROR:
-                                break;
+                                        _print_next_block((*par_num)++, "CFC");
-                        case AEU_INPUTS_ATTN_BITS_CFC_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "CFC");
                                        _print_parity(bp,
                                                      CFC_REG_CFC_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_CDU_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_CDU_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "CDU");
-                                if (print) {
-                                        _print_next_block(par_num++, "CDU");
                                        _print_parity(bp, CDU_REG_CDU_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_DMAE_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_DMAE_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "DMAE");
-                                if (print) {
-                                        _print_next_block(par_num++, "DMAE");
                                        _print_parity(bp,
                                                      DMAE_REG_DMAE_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_IGU_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_IGU_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "IGU");
-                                if (print) {
-                                        _print_next_block(par_num++, "IGU");
                                        if (CHIP_IS_E1x(bp))
                                                _print_parity(bp,
                                                        HC_REG_HC_PRTY_STS);
                                        else
                                                _print_parity(bp,
                                                        IGU_REG_IGU_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_MISC_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_MISC_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "MISC");
-                                if (print) {
-                                        _print_next_block(par_num++, "MISC");
                                        _print_parity(bp,
                                                      MISC_REG_MISC_PRTY_STS);
+                                        break;
                                }
-                                break;
                        }
                        /* Clear the bit */
@@ -4563,40 +4576,49 @@ static int bnx2x_check_blocks_with_parity2(struct bnx2x *bp, u32 sig,
                }
        }
-        return par_num;
+        return res;
 }
-static int bnx2x_check_blocks_with_parity3(u32 sig, int par_num,
+static bool bnx2x_check_blocks_with_parity3(struct bnx2x *bp, u32 sig,
-                                           bool *global, bool print)
+                                            int *par_num, bool *global,
+                                            bool print)
 {
-        int i = 0;
+        bool res = false;
-        u32 cur_bit = 0;
+        u32 cur_bit;
+        int i;
        for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                if (sig & cur_bit) {
                        switch (cur_bit) {
                        case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_ROM_PARITY:
                                if (print)
-                                        _print_next_block(par_num++, "MCP ROM");
+                                        _print_next_block((*par_num)++,
+                                                          "MCP ROM");
                                *global = true;
+                                res |= true;
                                break;
                        case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_RX_PARITY:
                                if (print)
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                          "MCP UMP RX");
                                *global = true;
+                                res |= true;
                                break;
                        case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY:
                                if (print)
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                          "MCP UMP TX");
                                *global = true;
+                                res |= true;
                                break;
                        case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY:
                                if (print)
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                          "MCP SCPAD");
-                                *global = true;
+                                /* clear latched SCPAD PATIRY from MCP */
+                                REG_WR(bp, MISC_REG_AEU_CLR_LATCH_SIGNAL,
+                                       1UL << 10);
                                break;
                        }
@@ -4605,45 +4627,50 @@ static int bnx2x_check_blocks_with_parity3(u32 sig, int par_num,
                }
        }
-        return par_num;
+        return res;
 }
-static int bnx2x_check_blocks_with_parity4(struct bnx2x *bp, u32 sig,
+static bool bnx2x_check_blocks_with_parity4(struct bnx2x *bp, u32 sig,
-                                            int par_num, bool print)
+                                            int *par_num, bool print)
 {
-        int i = 0;
+        u32 cur_bit;
-        u32 cur_bit = 0;
+        bool res;
+        int i;
+        res = false;
        for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                if (sig & cur_bit) {
-                        switch (cur_bit) {
+                        res |= true; /* Each bit is real error! */
-                        case AEU_INPUTS_ATTN_BITS_PGLUE_PARITY_ERROR:
+                        if (print) {
-                                if (print) {
+                                switch (cur_bit) {
-                                        _print_next_block(par_num++, "PGLUE_B");
+                                case AEU_INPUTS_ATTN_BITS_PGLUE_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
+                                                          "PGLUE_B");
                                        _print_parity(bp,
-                                                PGLUE_B_REG_PGLUE_B_PRTY_STS);
+                                                      PGLUE_B_REG_PGLUE_B_PRTY_STS);
-                                }
+                                        break;
-                                break;
+                                case AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR:
-                        case AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "ATC");
-                                if (print) {
-                                        _print_next_block(par_num++, "ATC");
                                        _print_parity(bp,
                                                      ATC_REG_ATC_PRTY_STS);
+                                        break;
                                }
-                                break;
                        }
                        /* Clear the bit */
                        sig &= ~cur_bit;
                }
        }
-        return par_num;
+        return res;
 }
 static bool bnx2x_parity_attn(struct bnx2x *bp, bool *global, bool print,
                              u32 *sig)
 {
+        bool res = false;
        if ((sig[0] & HW_PRTY_ASSERT_SET_0) ||
            (sig[1] & HW_PRTY_ASSERT_SET_1) ||
            (sig[2] & HW_PRTY_ASSERT_SET_2) ||
@@ -4660,23 +4687,22 @@ static bool bnx2x_parity_attn(struct bnx2x *bp, bool *global, bool print,
                if (print)
                        netdev_err(bp->dev,
                                   "Parity errors detected in blocks: ");
-                par_num = bnx2x_check_blocks_with_parity0(bp,
+                res |= bnx2x_check_blocks_with_parity0(bp,
-                        sig[0] & HW_PRTY_ASSERT_SET_0, par_num, print);
+                        sig[0] & HW_PRTY_ASSERT_SET_0, &par_num, print);
-                par_num = bnx2x_check_blocks_with_parity1(bp,
+                res |= bnx2x_check_blocks_with_parity1(bp,
-                        sig[1] & HW_PRTY_ASSERT_SET_1, par_num, global, print);
+                        sig[1] & HW_PRTY_ASSERT_SET_1, &par_num, global, print);
-                par_num = bnx2x_check_blocks_with_parity2(bp,
+                res |= bnx2x_check_blocks_with_parity2(bp,
-                        sig[2] & HW_PRTY_ASSERT_SET_2, par_num, print);
+                        sig[2] & HW_PRTY_ASSERT_SET_2, &par_num, print);
-                par_num = bnx2x_check_blocks_with_parity3(
+                res |= bnx2x_check_blocks_with_parity3(bp,
-                        sig[3] & HW_PRTY_ASSERT_SET_3, par_num, global, print);
+                        sig[3] & HW_PRTY_ASSERT_SET_3, &par_num, global, print);
-                par_num = bnx2x_check_blocks_with_parity4(bp,
+                res |= bnx2x_check_blocks_with_parity4(bp,
-                        sig[4] & HW_PRTY_ASSERT_SET_4, par_num, print);
+                        sig[4] & HW_PRTY_ASSERT_SET_4, &par_num, print);
                if (print)
                        pr_cont("\n");
+        }
-                return true;
+        return res;
-        } else
-                return false;
 }
 /**
@@ -7126,7 +7152,7 @@ static int bnx2x_init_hw_port(struct bnx2x *bp)
        int port = BP_PORT(bp);
        int init_phase = port ? PHASE_PORT1 : PHASE_PORT0;
        u32 low, high;
-        u32 val;
+        u32 val, reg;
        DP(NETIF_MSG_HW, "starting port init  port %d\n", port);
@@ -7271,6 +7297,17 @@ static int bnx2x_init_hw_port(struct bnx2x *bp)
        val |= CHIP_IS_E1(bp) ? 0 : 0x10;
        REG_WR(bp, MISC_REG_AEU_MASK_ATTN_FUNC_0 + port*4, val);
+        /* SCPAD_PARITY should NOT trigger close the gates */
+        reg = port ? MISC_REG_AEU_ENABLE4_NIG_1 : MISC_REG_AEU_ENABLE4_NIG_0;
+        REG_WR(bp, reg,
+               REG_RD(bp, reg) &
+               ~AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY);
+        reg = port ? MISC_REG_AEU_ENABLE4_PXP_1 : MISC_REG_AEU_ENABLE4_PXP_0;
+        REG_WR(bp, reg,
+               REG_RD(bp, reg) &
+               ~AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY);
        bnx2x_init_block(bp, BLOCK_NIG, init_phase);
        if (!CHIP_IS_E1x(bp)) {
@@ -11685,9 +11722,6 @@ static int bnx2x_init_bp(struct bnx2x *bp)
 static int bnx2x_open(struct net_device *dev)
 {
        struct bnx2x *bp = netdev_priv(dev);
-        bool global = false;
-        int other_engine = BP_PATH(bp) ? 0 : 1;
-        bool other_load_status, load_status;
        int rc;
        bp->stats_init = true;
@@ -11703,6 +11737,10 @@ static int bnx2x_open(struct net_device *dev)
         * Parity recovery is only relevant for PF driver.
         */
        if (IS_PF(bp)) {
+                int other_engine = BP_PATH(bp) ? 0 : 1;
+                bool other_load_status, load_status;
+                bool global = false;
                other_load_status = bnx2x_get_load_status(bp, other_engine);
                load_status = bnx2x_get_load_status(bp, BP_PATH(bp));
                if (!bnx2x_reset_is_done(bp, BP_PATH(bp)) ||
@@ -12080,7 +12118,6 @@ static int bnx2x_set_coherency_mask(struct bnx2x *bp)
        struct device *dev = &bp->pdev->dev;
        if (dma_set_mask(dev, DMA_BIT_MASK(64)) == 0) {
-                bp->flags |= USING_DAC_FLAG;
                if (dma_set_coherent_mask(dev, DMA_BIT_MASK(64)) != 0) {
                        dev_err(dev, "dma_set_coherent_mask failed, aborting\n");
                        return -EIO;
@@ -12248,8 +12285,7 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
                NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_HIGHDMA;
        dev->features |= dev->hw_features | NETIF_F_HW_VLAN_CTAG_RX;
-        if (bp->flags & USING_DAC_FLAG)
+        dev->features |= NETIF_F_HIGHDMA;
-                dev->features |= NETIF_F_HIGHDMA;
        /* Add Loopback capability to the device */
        dev->hw_features |= NETIF_F_LOOPBACK;
@@ -12612,24 +12648,24 @@ static int set_max_cos_est(int chip_id)
                return BNX2X_MULTI_TX_COS_E1X;
        case BCM57712:
        case BCM57712_MF:
-        case BCM57712_VF:
                return BNX2X_MULTI_TX_COS_E2_E3A0;
        case BCM57800:
        case BCM57800_MF:
-        case BCM57800_VF:
        case BCM57810:
        case BCM57810_MF:
        case BCM57840_4_10:
        case BCM57840_2_20:
        case BCM57840_O:
        case BCM57840_MFO:
-        case BCM57810_VF:
        case BCM57840_MF:
-        case BCM57840_VF:
        case BCM57811:
        case BCM57811_MF:
-        case BCM57811_VF:
                return BNX2X_MULTI_TX_COS_E3B0;
+        case BCM57712_VF:
+        case BCM57800_VF:
+        case BCM57810_VF:
+        case BCM57840_VF:
+        case BCM57811_VF:
                return 1;
        default:
                pr_err("Unknown board_type (%d), aborting\n", chip_id);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 9ad012bdd915..bf08ad68b405 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -470,10 +470,10 @@ static int bnx2x_vfop_qdtor_cmd(struct bnx2x *bp,
                                 bnx2x_vfop_qdtor, cmd->done);
                return bnx2x_vfop_transition(bp, vf, bnx2x_vfop_qdtor,
                                             cmd->block);
+        } else {
+                BNX2X_ERR("VF[%d] failed to add a vfop\n", vf->abs_vfid);
+                return -ENOMEM;
        }
-        DP(BNX2X_MSG_IOV, "VF[%d] failed to add a vfop. rc %d\n",
-           vf->abs_vfid, vfop->rc);
-        return -ENOMEM;
 }
 static void
@@ -3390,14 +3390,16 @@ int bnx2x_set_vf_mac(struct net_device *dev, int vfidx, u8 *mac)
                rc = bnx2x_del_all_macs(bp, mac_obj, BNX2X_ETH_MAC, true);
                if (rc) {
                        BNX2X_ERR("failed to delete eth macs\n");
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto out;
                }
                /* remove existing uc list macs */
                rc = bnx2x_del_all_macs(bp, mac_obj, BNX2X_UC_LIST_MAC, true);
                if (rc) {
                        BNX2X_ERR("failed to delete uc_list macs\n");
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto out;
                }
                /* configure the new mac to device */
@@ -3405,6 +3407,7 @@ int bnx2x_set_vf_mac(struct net_device *dev, int vfidx, u8 *mac)
                bnx2x_set_mac_one(bp, (u8 *)&bulletin->mac, mac_obj, true,
                                  BNX2X_ETH_MAC, &ramrod_flags);
+out:
                bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_MAC);
        }
@@ -3467,7 +3470,8 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
                                          &ramrod_flags);
                if (rc) {
                        BNX2X_ERR("failed to delete vlans\n");
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto out;
                }
                /* send queue update ramrod to configure default vlan and silent
@@ -3501,7 +3505,8 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
                        rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
                        if (rc) {
                                BNX2X_ERR("failed to configure vlan\n");
-                                return -EINVAL;
+                                rc =  -EINVAL;
+                                goto out;
                        }
                        /* configure default vlan to vf queue and set silent
@@ -3519,18 +3524,18 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
                rc = bnx2x_queue_state_change(bp, &q_params);
                if (rc) {
                        BNX2X_ERR("Failed to configure default VLAN\n");
-                        return rc;
+                        goto out;
                }
                /* clear the flag indicating that this VF needs its vlan
-                 * (will only be set if the HV configured th Vlan before vf was
+                 * (will only be set if the HV configured the Vlan before vf was
-                 * and we were called because the VF came up later
+                 * up and we were called because the VF came up later
                 */
+out:
                vf->cfg_flags &= ~VF_CFG_VLAN;
                bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
        }
-        return 0;
+        return rc;
 }
 /* crc is the first field in the bulletin board. Compute the crc over the
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index 86436c77af03..3b75070411aa 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -196,7 +196,7 @@ static void bnx2x_hw_stats_post(struct bnx2x *bp)
        } else if (bp->func_stx) {
                *stats_comp = 0;
-                bnx2x_post_dmae(bp, dmae, INIT_DMAE_C(bp));
+                bnx2x_issue_dmae_with_comp(bp, dmae, stats_comp);
        }
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index da16953eb2ec..28757dfacf0d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -980,7 +980,7 @@ static int bnx2x_copy32_vf_dmae(struct bnx2x *bp, u8 from_vf,
        dmae.len = len32;
        /* issue the command and wait for completion */
-        return bnx2x_issue_dmae_with_comp(bp, &dmae);
+        return bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
 }
 static void bnx2x_vf_mbx_resp(struct bnx2x *bp, struct bnx2x_virtf *vf)
diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c
index 78d6d6b970e1..48f52882a22b 100644
--- a/drivers/net/ethernet/calxeda/xgmac.c
+++ b/drivers/net/ethernet/calxeda/xgmac.c
@@ -106,7 +106,6 @@
 #define XGMAC_DMA_HW_FEATURE    0x00000f58      /* Enabled Hardware Features */
 #define XGMAC_ADDR_AE           0x80000000
-#define XGMAC_MAX_FILTER_ADDR   31
 /* PMT Control and Status */
 #define XGMAC_PMT_POINTER_RESET 0x80000000
@@ -384,6 +383,7 @@ struct xgmac_priv {
        struct device *device;
        struct napi_struct napi;
+        int max_macs;
        struct xgmac_extra_stats xstats;
        spinlock_t stats_lock;
@@ -1291,14 +1291,12 @@ static void xgmac_set_rx_mode(struct net_device *dev)
        netdev_dbg(priv->dev, "# mcasts %d, # unicast %d\n",
                 netdev_mc_count(dev), netdev_uc_count(dev));
-        if (dev->flags & IFF_PROMISC) {
+        if (dev->flags & IFF_PROMISC)
-                writel(XGMAC_FRAME_FILTER_PR, ioaddr + XGMAC_FRAME_FILTER);
+                value |= XGMAC_FRAME_FILTER_PR;
-                return;
-        }
        memset(hash_filter, 0, sizeof(hash_filter));
-        if (netdev_uc_count(dev) > XGMAC_MAX_FILTER_ADDR) {
+        if (netdev_uc_count(dev) > priv->max_macs) {
                use_hash = true;
                value |= XGMAC_FRAME_FILTER_HUC | XGMAC_FRAME_FILTER_HPF;
        }
@@ -1321,7 +1319,7 @@ static void xgmac_set_rx_mode(struct net_device *dev)
                goto out;
        }
-        if ((netdev_mc_count(dev) + reg - 1) > XGMAC_MAX_FILTER_ADDR) {
+        if ((netdev_mc_count(dev) + reg - 1) > priv->max_macs) {
                use_hash = true;
                value |= XGMAC_FRAME_FILTER_HMC | XGMAC_FRAME_FILTER_HPF;
        } else {
@@ -1342,8 +1340,8 @@ static void xgmac_set_rx_mode(struct net_device *dev)
        }
 out:
-        for (i = reg; i < XGMAC_MAX_FILTER_ADDR; i++)
+        for (i = reg; i <= priv->max_macs; i++)
-                xgmac_set_mac_addr(ioaddr, NULL, reg);
+                xgmac_set_mac_addr(ioaddr, NULL, i);
        for (i = 0; i < XGMAC_NUM_HASH; i++)
                writel(hash_filter[i], ioaddr + XGMAC_HASH(i));
@@ -1761,6 +1759,13 @@ static int xgmac_probe(struct platform_device *pdev)
        uid = readl(priv->base + XGMAC_VERSION);
        netdev_info(ndev, "h/w version is 0x%x\n", uid);
+        /* Figure out how many valid mac address filter registers we have */
+        writel(1, priv->base + XGMAC_ADDR_HIGH(31));
+        if (readl(priv->base + XGMAC_ADDR_HIGH(31)) == 1)
+                priv->max_macs = 31;
+        else
+                priv->max_macs = 7;
        writel(0, priv->base + XGMAC_DMA_INTR_ENA);
        ndev->irq = platform_get_irq(pdev, 0);
        if (ndev->irq == -ENXIO) {
diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index 5f5896e522d2..a7a941b1a655 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -158,18 +158,6 @@ static inline board_info_t *to_dm9000_board(struct net_device *dev)
 /* DM9000 network board routine ---------------------------- */
-static void
-dm9000_reset(board_info_t * db)
-{
-        dev_dbg(db->dev, "resetting device\n");
-        /* RESET device */
-        writeb(DM9000_NCR, db->io_addr);
-        udelay(200);
-        writeb(NCR_RST, db->io_data);
-        udelay(200);
-}
 /*
 *   Read a byte from I/O port
 */
@@ -191,6 +179,27 @@ iow(board_info_t * db, int reg, int value)
        writeb(value, db->io_data);
 }
+static void
+dm9000_reset(board_info_t *db)
+{
+        dev_dbg(db->dev, "resetting device\n");
+        /* Reset DM9000, see DM9000 Application Notes V1.22 Jun 11, 2004 page 29
+         * The essential point is that we have to do a double reset, and the
+         * instruction is to set LBK into MAC internal loopback mode.
+         */
+        iow(db, DM9000_NCR, 0x03);
+        udelay(100); /* Application note says at least 20 us */
+        if (ior(db, DM9000_NCR) & 1)
+                dev_err(db->dev, "dm9000 did not respond to first reset\n");
+        iow(db, DM9000_NCR, 0);
+        iow(db, DM9000_NCR, 0x03);
+        udelay(100);
+        if (ior(db, DM9000_NCR) & 1)
+                dev_err(db->dev, "dm9000 did not respond to second reset\n");
+}
 /* routines for sending block to chip */
 static void dm9000_outblk_8bit(void __iomem *reg, void *data, int count)
@@ -744,15 +753,20 @@ static const struct ethtool_ops dm9000_ethtool_ops = {
 static void dm9000_show_carrier(board_info_t *db,
                                unsigned carrier, unsigned nsr)
 {
+        int lpa;
        struct net_device *ndev = db->ndev;
+        struct mii_if_info *mii = &db->mii;
        unsigned ncr = dm9000_read_locked(db, DM9000_NCR);
-        if (carrier)
+        if (carrier) {
-                dev_info(db->dev, "%s: link up, %dMbps, %s-duplex, no LPA\n",
+                lpa = mii->mdio_read(mii->dev, mii->phy_id, MII_LPA);
+                dev_info(db->dev,
+                         "%s: link up, %dMbps, %s-duplex, lpa 0x%04X\n",
                         ndev->name, (nsr & NSR_SPEED) ? 10 : 100,
-                         (ncr & NCR_FDX) ? "full" : "half");
+                         (ncr & NCR_FDX) ? "full" : "half", lpa);
-        else
+        } else {
                dev_info(db->dev, "%s: link down\n", ndev->name);
+        }
 }
 static void
@@ -890,9 +904,15 @@ dm9000_init_dm9000(struct net_device *dev)
                        (dev->features & NETIF_F_RXCSUM) ? RCSR_CSUM : 0);
        iow(db, DM9000_GPCR, GPCR_GEP_CNTL);    /* Let GPIO0 output */
+        iow(db, DM9000_GPR, 0);
-        dm9000_phy_write(dev, 0, MII_BMCR, BMCR_RESET); /* PHY RESET */
+        /* If we are dealing with DM9000B, some extra steps are required: a
-        dm9000_phy_write(dev, 0, MII_DM_DSPCR, DSPCR_INIT_PARAM); /* Init */
+         * manual phy reset, and setting init params.
+         */
+        if (db->type == TYPE_DM9000B) {
+                dm9000_phy_write(dev, 0, MII_BMCR, BMCR_RESET);
+                dm9000_phy_write(dev, 0, MII_DM_DSPCR, DSPCR_INIT_PARAM);
+        }
        ncr = (db->flags & DM9000_PLATF_EXT_PHY) ? NCR_EXT_PHY : 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index bd0e0c0bbcd8..c08fd32bb8e5 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1198,7 +1198,6 @@ int be_cmd_txq_create(struct be_adapter *adapter, struct be_tx_obj *txo)
        if (lancer_chip(adapter)) {
                req->hdr.version = 1;
-                req->if_id = cpu_to_le16(adapter->if_handle);
        } else if (BEx_chip(adapter)) {
                if (adapter->function_caps & BE_FUNCTION_CAPS_SUPER_NIC)
                        req->hdr.version = 2;
@@ -1206,6 +1205,8 @@ int be_cmd_txq_create(struct be_adapter *adapter, struct be_tx_obj *txo)
                req->hdr.version = 2;
        }
+        if (req->hdr.version > 0)
+                req->if_id = cpu_to_le16(adapter->if_handle);
        req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
        req->ulp_num = BE_ULP1_NUM;
        req->type = BE_ETH_TX_RING_TYPE_STANDARD;
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index c4eaadeb572f..9fbe4dda7a0e 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -88,6 +88,7 @@
 #include <asm/io.h>
 #include <asm/reg.h>
+#include <asm/mpc85xx.h>
 #include <asm/irq.h>
 #include <asm/uaccess.h>
 #include <linux/module.h>
@@ -939,9 +940,8 @@ static void gfar_init_filer_table(struct gfar_private *priv)
        }
 }
-static void gfar_detect_errata(struct gfar_private *priv)
+static void __gfar_detect_errata_83xx(struct gfar_private *priv)
 {
-        struct device *dev = &priv->ofdev->dev;
        unsigned int pvr = mfspr(SPRN_PVR);
        unsigned int svr = mfspr(SPRN_SVR);
        unsigned int mod = (svr >> 16) & 0xfff6; /* w/o E suffix */
@@ -957,15 +957,33 @@ static void gfar_detect_errata(struct gfar_private *priv)
            (pvr == 0x80861010 && (mod & 0xfff9) == 0x80c0))
                priv->errata |= GFAR_ERRATA_76;
-        /* MPC8313 and MPC837x all rev */
+        /* MPC8313 Rev < 2.0 */
-        if ((pvr == 0x80850010 && mod == 0x80b0) ||
+        if (pvr == 0x80850010 && mod == 0x80b0 && rev < 0x0020)
-            (pvr == 0x80861010 && (mod & 0xfff9) == 0x80c0))
+                priv->errata |= GFAR_ERRATA_12;
-                priv->errata |= GFAR_ERRATA_A002;
+}
-        /* MPC8313 Rev < 2.0, MPC8548 rev 2.0 */
+static void __gfar_detect_errata_85xx(struct gfar_private *priv)
-        if ((pvr == 0x80850010 && mod == 0x80b0 && rev < 0x0020) ||
+{
-            (pvr == 0x80210020 && mod == 0x8030 && rev == 0x0020))
+        unsigned int svr = mfspr(SPRN_SVR);
+        if ((SVR_SOC_VER(svr) == SVR_8548) && (SVR_REV(svr) == 0x20))
                priv->errata |= GFAR_ERRATA_12;
+        if (((SVR_SOC_VER(svr) == SVR_P2020) && (SVR_REV(svr) < 0x20)) ||
+            ((SVR_SOC_VER(svr) == SVR_P2010) && (SVR_REV(svr) < 0x20)))
+                priv->errata |= GFAR_ERRATA_76; /* aka eTSEC 20 */
+}
+static void gfar_detect_errata(struct gfar_private *priv)
+{
+        struct device *dev = &priv->ofdev->dev;
+        /* no plans to fix */
+        priv->errata |= GFAR_ERRATA_A002;
+        if (pvr_version_is(PVR_VER_E500V1) || pvr_version_is(PVR_VER_E500V2))
+                __gfar_detect_errata_85xx(priv);
+        else /* non-mpc85xx parts, i.e. e300 core based */
+                __gfar_detect_errata_83xx(priv);
        if (priv->errata)
                dev_info(dev, "enabled errata workarounds, flags: 0x%x\n",
@@ -1599,7 +1617,7 @@ static int __gfar_is_rx_idle(struct gfar_private *priv)
        /* Normaly TSEC should not hang on GRS commands, so we should
         * actually wait for IEVENT_GRSC flag.
         */
-        if (likely(!gfar_has_errata(priv, GFAR_ERRATA_A002)))
+        if (!gfar_has_errata(priv, GFAR_ERRATA_A002))
                return 0;
        /* Read the eTSEC register at offset 0xD1C. If bits 7-14 are
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 86d51429a189..151e00cad113 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -2655,6 +2655,8 @@ static int igb_set_eee(struct net_device *netdev,
            (hw->phy.media_type != e1000_media_type_copper))
                return -EOPNOTSUPP;
+        memset(&eee_curr, 0, sizeof(struct ethtool_eee));
        ret_val = igb_get_eee(netdev, &eee_curr);
        if (ret_val)
                return ret_val;
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 7fb5677451f9..2c210ec35d59 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -1131,15 +1131,13 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
        p->rx_discard += rdlp(mp, RX_DISCARD_FRAME_CNT);
        p->rx_overrun += rdlp(mp, RX_OVERRUN_FRAME_CNT);
        spin_unlock_bh(&mp->mib_counters_lock);
-        mod_timer(&mp->mib_counters_timer, jiffies + 30 * HZ);
 }
 static void mib_counters_timer_wrapper(unsigned long _mp)
 {
        struct mv643xx_eth_private *mp = (void *)_mp;
        mib_counters_update(mp);
+        mod_timer(&mp->mib_counters_timer, jiffies + 30 * HZ);
 }
@@ -2237,6 +2235,7 @@ static int mv643xx_eth_open(struct net_device *dev)
                mp->int_mask |= INT_TX_END_0 << i;
        }
+        add_timer(&mp->mib_counters_timer);
        port_start(mp);
        wrlp(mp, INT_MASK_EXT, INT_EXT_LINK_PHY | INT_EXT_TX);
@@ -2534,6 +2533,7 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev,
        if (!ppdev)
                return -ENOMEM;
        ppdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
+        ppdev->dev.of_node = pnp;
        ret = platform_device_add_resources(ppdev, &res, 1);
        if (ret)
@@ -2916,7 +2916,6 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
        mp->mib_counters_timer.data = (unsigned long)mp;
        mp->mib_counters_timer.function = mib_counters_timer_wrapper;
        mp->mib_counters_timer.expires = jiffies + 30 * HZ;
-        add_timer(&mp->mib_counters_timer);
        spin_lock_init(&mp->mib_counters_lock);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index dec455c8f627..afe2efa69c86 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -70,14 +70,15 @@ static int mlx4_alloc_pages(struct mlx4_en_priv *priv,
                put_page(page);
                return -ENOMEM;
        }
-        page_alloc->size = PAGE_SIZE << order;
+        page_alloc->page_size = PAGE_SIZE << order;
        page_alloc->page = page;
        page_alloc->dma = dma;
-        page_alloc->offset = frag_info->frag_align;
+        page_alloc->page_offset = frag_info->frag_align;
        /* Not doing get_page() for each frag is a big win
         * on asymetric workloads.
         */
-        atomic_set(&page->_count, page_alloc->size / frag_info->frag_stride);
+        atomic_set(&page->_count,
+                   page_alloc->page_size / frag_info->frag_stride);
        return 0;
 }
@@ -96,16 +97,19 @@ static int mlx4_en_alloc_frags(struct mlx4_en_priv *priv,
        for (i = 0; i < priv->num_frags; i++) {
                frag_info = &priv->frag_info[i];
                page_alloc[i] = ring_alloc[i];
-                page_alloc[i].offset += frag_info->frag_stride;
+                page_alloc[i].page_offset += frag_info->frag_stride;
-                if (page_alloc[i].offset + frag_info->frag_stride <= ring_alloc[i].size)
+                if (page_alloc[i].page_offset + frag_info->frag_stride <=
+                    ring_alloc[i].page_size)
                        continue;
                if (mlx4_alloc_pages(priv, &page_alloc[i], frag_info, gfp))
                        goto out;
        }
        for (i = 0; i < priv->num_frags; i++) {
                frags[i] = ring_alloc[i];
-                dma = ring_alloc[i].dma + ring_alloc[i].offset;
+                dma = ring_alloc[i].dma + ring_alloc[i].page_offset;
                ring_alloc[i] = page_alloc[i];
                rx_desc->data[i].addr = cpu_to_be64(dma);
        }
@@ -117,7 +121,7 @@ out:
                frag_info = &priv->frag_info[i];
                if (page_alloc[i].page != ring_alloc[i].page) {
                        dma_unmap_page(priv->ddev, page_alloc[i].dma,
-                                page_alloc[i].size, PCI_DMA_FROMDEVICE);
+                                page_alloc[i].page_size, PCI_DMA_FROMDEVICE);
                        page = page_alloc[i].page;
                        atomic_set(&page->_count, 1);
                        put_page(page);
@@ -131,10 +135,12 @@ static void mlx4_en_free_frag(struct mlx4_en_priv *priv,
                              int i)
 {
        const struct mlx4_en_frag_info *frag_info = &priv->frag_info[i];
+        u32 next_frag_end = frags[i].page_offset + 2 * frag_info->frag_stride;
-        if (frags[i].offset + frag_info->frag_stride > frags[i].size)
+        if (next_frag_end > frags[i].page_size)
-                dma_unmap_page(priv->ddev, frags[i].dma, frags[i].size,
+                dma_unmap_page(priv->ddev, frags[i].dma, frags[i].page_size,
-                                         PCI_DMA_FROMDEVICE);
+                               PCI_DMA_FROMDEVICE);
        if (frags[i].page)
                put_page(frags[i].page);
@@ -161,7 +167,7 @@ out:
                page_alloc = &ring->page_alloc[i];
                dma_unmap_page(priv->ddev, page_alloc->dma,
-                               page_alloc->size, PCI_DMA_FROMDEVICE);
+                               page_alloc->page_size, PCI_DMA_FROMDEVICE);
                page = page_alloc->page;
                atomic_set(&page->_count, 1);
                put_page(page);
@@ -184,10 +190,11 @@ static void mlx4_en_destroy_allocator(struct mlx4_en_priv *priv,
                       i, page_count(page_alloc->page));
                dma_unmap_page(priv->ddev, page_alloc->dma,
-                                page_alloc->size, PCI_DMA_FROMDEVICE);
+                                page_alloc->page_size, PCI_DMA_FROMDEVICE);
-                while (page_alloc->offset + frag_info->frag_stride < page_alloc->size) {
+                while (page_alloc->page_offset + frag_info->frag_stride <
+                       page_alloc->page_size) {
                        put_page(page_alloc->page);
-                        page_alloc->offset += frag_info->frag_stride;
+                        page_alloc->page_offset += frag_info->frag_stride;
                }
                page_alloc->page = NULL;
        }
@@ -478,7 +485,7 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
                /* Save page reference in skb */
                __skb_frag_set_page(&skb_frags_rx[nr], frags[nr].page);
                skb_frag_size_set(&skb_frags_rx[nr], frag_info->frag_size);
-                skb_frags_rx[nr].page_offset = frags[nr].offset;
+                skb_frags_rx[nr].page_offset = frags[nr].page_offset;
                skb->truesize += frag_info->frag_stride;
                frags[nr].page = NULL;
        }
@@ -517,7 +524,7 @@ static struct sk_buff *mlx4_en_rx_skb(struct mlx4_en_priv *priv,
        /* Get pointer to first fragment so we could copy the headers into the
         * (linear part of the) skb */
-        va = page_address(frags[0].page) + frags[0].offset;
+        va = page_address(frags[0].page) + frags[0].page_offset;
        if (length <= SMALL_PACKET_SIZE) {
                /* We are copying all relevant data to the skb - temporarily
@@ -645,7 +652,7 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud
                        dma_sync_single_for_cpu(priv->ddev, dma, sizeof(*ethh),
                                                DMA_FROM_DEVICE);
                        ethh = (struct ethhdr *)(page_address(frags[0].page) +
-                                                 frags[0].offset);
+                                                 frags[0].page_offset);
                        if (is_multicast_ether_addr(ethh->h_dest)) {
                                struct mlx4_mac_entry *entry;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 5e0aa569306a..bf06e3610d27 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -237,8 +237,8 @@ struct mlx4_en_tx_desc {
 struct mlx4_en_rx_alloc {
        struct page     *page;
        dma_addr_t      dma;
-        u32             offset;
+        u32             page_offset;
-        u32             size;
+        u32             page_size;
 };
 struct mlx4_en_tx_ring {
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index bd1a2d2bc2ae..ea54d95e5b9f 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -448,7 +448,8 @@ static int moxart_mac_probe(struct platform_device *pdev)
        irq = irq_of_parse_and_map(node, 0);
        if (irq <= 0) {
                netdev_err(ndev, "irq_of_parse_and_map failed\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto irq_map_fail;
        }
        priv = netdev_priv(ndev);
@@ -472,24 +473,32 @@ static int moxart_mac_probe(struct platform_device *pdev)
        priv->tx_desc_base = dma_alloc_coherent(NULL, TX_REG_DESC_SIZE *
                                                TX_DESC_NUM, &priv->tx_base,
                                                GFP_DMA | GFP_KERNEL);
-        if (priv->tx_desc_base == NULL)
+        if (priv->tx_desc_base == NULL) {
+                ret = -ENOMEM;
                goto init_fail;
+        }
        priv->rx_desc_base = dma_alloc_coherent(NULL, RX_REG_DESC_SIZE *
                                                RX_DESC_NUM, &priv->rx_base,
                                                GFP_DMA | GFP_KERNEL);
-        if (priv->rx_desc_base == NULL)
+        if (priv->rx_desc_base == NULL) {
+                ret = -ENOMEM;
                goto init_fail;
+        }
        priv->tx_buf_base = kmalloc(priv->tx_buf_size * TX_DESC_NUM,
                                    GFP_ATOMIC);
-        if (!priv->tx_buf_base)
+        if (!priv->tx_buf_base) {
+                ret = -ENOMEM;
                goto init_fail;
+        }
        priv->rx_buf_base = kmalloc(priv->rx_buf_size * RX_DESC_NUM,
                                    GFP_ATOMIC);
-        if (!priv->rx_buf_base)
+        if (!priv->rx_buf_base) {
+                ret = -ENOMEM;
                goto init_fail;
+        }
        platform_set_drvdata(pdev, ndev);
@@ -522,7 +531,8 @@ static int moxart_mac_probe(struct platform_device *pdev)
 init_fail:
        netdev_err(ndev, "init failed\n");
        moxart_mac_free_memory(ndev);
+irq_map_fail:
+        free_netdev(ndev);
        return ret;
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index ebe4c86e5230..ff83a9fcd4c5 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -665,7 +665,7 @@ static int qlcnic_set_channels(struct net_device *dev,
                        return err;
        }
-        if (channel->tx_count) {
+        if (qlcnic_82xx_check(adapter) && channel->tx_count) {
                err = qlcnic_validate_max_tx_rings(adapter, channel->tx_count);
                if (err)
                        return err;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 21d00a0449a1..9e61eb867452 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -2257,7 +2257,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        err = qlcnic_alloc_adapter_resources(adapter);
        if (err)
-                goto err_out_free_netdev;
+                goto err_out_free_wq;
        adapter->dev_rst_time = jiffies;
        adapter->ahw->revision_id = pdev->revision;
@@ -2396,6 +2396,9 @@ err_out_disable_msi:
 err_out_free_hw:
        qlcnic_free_adapter_resources(adapter);
+err_out_free_wq:
+        destroy_workqueue(adapter->qlcnic_wq);
 err_out_free_netdev:
        free_netdev(netdev);
@@ -3648,11 +3651,6 @@ int qlcnic_validate_max_tx_rings(struct qlcnic_adapter *adapter, u32 txq)
        u8 max_hw = QLCNIC_MAX_TX_RINGS;
        u32 max_allowed;
-        if (!qlcnic_82xx_check(adapter)) {
-                netdev_err(netdev, "No Multi TX-Q support\n");
-                return -EINVAL;
-        }
        if (!qlcnic_use_msi_x && !qlcnic_use_msi) {
                netdev_err(netdev, "No Multi TX-Q support in INT-x mode\n");
                return -EINVAL;
@@ -3692,8 +3690,7 @@ int qlcnic_validate_max_rss(struct qlcnic_adapter *adapter,
        u8 max_hw = adapter->ahw->max_rx_ques;
        u32 max_allowed;
-        if (qlcnic_82xx_check(adapter) && !qlcnic_use_msi_x &&
+        if (!qlcnic_use_msi_x && !qlcnic_use_msi) {
-            !qlcnic_use_msi) {
                netdev_err(netdev, "No RSS support in INT-x mode\n");
                return -EINVAL;
        }
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 5cd831ebfa83..b57c278d3b46 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -688,12 +688,16 @@ static struct sh_eth_cpu_data r8a7740_data = {
        .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
                          EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
                          EESR_TDE | EESR_ECI,
+        .fdr_value      = 0x0000070f,
+        .rmcr_value     = 0x00000001,
        .apr            = 1,
        .mpr            = 1,
        .tpauser        = 1,
        .bculr          = 1,
        .hw_swap        = 1,
+        .rpadir         = 1,
+        .rpadir_value   = 2 << 16,
        .no_trimd       = 1,
        .no_ade         = 1,
        .tsu            = 1,
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 9f18ae984f9e..21f9ad6392e9 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -444,6 +444,18 @@ static const struct efx_hw_stat_desc efx_ef10_stat_desc[EF10_STAT_COUNT] = {
        EF10_DMA_STAT(rx_align_error, RX_ALIGN_ERROR_PKTS),
        EF10_DMA_STAT(rx_length_error, RX_LENGTH_ERROR_PKTS),
        EF10_DMA_STAT(rx_nodesc_drops, RX_NODESC_DROPS),
+        EF10_DMA_STAT(rx_pm_trunc_bb_overflow, PM_TRUNC_BB_OVERFLOW),
+        EF10_DMA_STAT(rx_pm_discard_bb_overflow, PM_DISCARD_BB_OVERFLOW),
+        EF10_DMA_STAT(rx_pm_trunc_vfifo_full, PM_TRUNC_VFIFO_FULL),
+        EF10_DMA_STAT(rx_pm_discard_vfifo_full, PM_DISCARD_VFIFO_FULL),
+        EF10_DMA_STAT(rx_pm_trunc_qbb, PM_TRUNC_QBB),
+        EF10_DMA_STAT(rx_pm_discard_qbb, PM_DISCARD_QBB),
+        EF10_DMA_STAT(rx_pm_discard_mapping, PM_DISCARD_MAPPING),
+        EF10_DMA_STAT(rx_dp_q_disabled_packets, RXDP_Q_DISABLED_PKTS),
+        EF10_DMA_STAT(rx_dp_di_dropped_packets, RXDP_DI_DROPPED_PKTS),
+        EF10_DMA_STAT(rx_dp_streaming_packets, RXDP_STREAMING_PKTS),
+        EF10_DMA_STAT(rx_dp_emerg_fetch, RXDP_EMERGENCY_FETCH_CONDITIONS),
+        EF10_DMA_STAT(rx_dp_emerg_wait, RXDP_EMERGENCY_WAIT_CONDITIONS),
 };
 #define HUNT_COMMON_STAT_MASK ((1ULL << EF10_STAT_tx_bytes) |           \
@@ -498,44 +510,72 @@ static const struct efx_hw_stat_desc efx_ef10_stat_desc[EF10_STAT_COUNT] = {
 #define HUNT_40G_EXTRA_STAT_MASK ((1ULL << EF10_STAT_rx_align_error) |  \
                                  (1ULL << EF10_STAT_rx_length_error))
-#if BITS_PER_LONG == 64
+/* These statistics are only provided if the firmware supports the
-#define STAT_MASK_BITMAP(bits) (bits)
+ * capability PM_AND_RXDP_COUNTERS.
-#else
+ */
-#define STAT_MASK_BITMAP(bits) (bits) & 0xffffffff, (bits) >> 32
+#define HUNT_PM_AND_RXDP_STAT_MASK (                                    \
-#endif
+        (1ULL << EF10_STAT_rx_pm_trunc_bb_overflow) |                   \
+        (1ULL << EF10_STAT_rx_pm_discard_bb_overflow) |                 \
-static const unsigned long *efx_ef10_stat_mask(struct efx_nic *efx)
+        (1ULL << EF10_STAT_rx_pm_trunc_vfifo_full) |                    \
-{
+        (1ULL << EF10_STAT_rx_pm_discard_vfifo_full) |                  \
-        static const unsigned long hunt_40g_stat_mask[] = {
+        (1ULL << EF10_STAT_rx_pm_trunc_qbb) |                           \
-                STAT_MASK_BITMAP(HUNT_COMMON_STAT_MASK |
+        (1ULL << EF10_STAT_rx_pm_discard_qbb) |                         \
-                                 HUNT_40G_EXTRA_STAT_MASK)
+        (1ULL << EF10_STAT_rx_pm_discard_mapping) |                     \
-        };
+        (1ULL << EF10_STAT_rx_dp_q_disabled_packets) |                  \
-        static const unsigned long hunt_10g_only_stat_mask[] = {
+        (1ULL << EF10_STAT_rx_dp_di_dropped_packets) |                  \
-                STAT_MASK_BITMAP(HUNT_COMMON_STAT_MASK |
+        (1ULL << EF10_STAT_rx_dp_streaming_packets) |                   \
-                                 HUNT_10G_ONLY_STAT_MASK)
+        (1ULL << EF10_STAT_rx_dp_emerg_fetch) |                         \
-        };
+        (1ULL << EF10_STAT_rx_dp_emerg_wait))
+static u64 efx_ef10_raw_stat_mask(struct efx_nic *efx)
+{
+        u64 raw_mask = HUNT_COMMON_STAT_MASK;
        u32 port_caps = efx_mcdi_phy_get_caps(efx);
+        struct efx_ef10_nic_data *nic_data = efx->nic_data;
        if (port_caps & (1 << MC_CMD_PHY_CAP_40000FDX_LBN))
-                return hunt_40g_stat_mask;
+                raw_mask |= HUNT_40G_EXTRA_STAT_MASK;
        else
-                return hunt_10g_only_stat_mask;
+                raw_mask |= HUNT_10G_ONLY_STAT_MASK;
+        if (nic_data->datapath_caps &
+            (1 << MC_CMD_GET_CAPABILITIES_OUT_PM_AND_RXDP_COUNTERS_LBN))
+                raw_mask |= HUNT_PM_AND_RXDP_STAT_MASK;
+        return raw_mask;
+}
+static void efx_ef10_get_stat_mask(struct efx_nic *efx, unsigned long *mask)
+{
+        u64 raw_mask = efx_ef10_raw_stat_mask(efx);
+#if BITS_PER_LONG == 64
+        mask[0] = raw_mask;
+#else
+        mask[0] = raw_mask & 0xffffffff;
+        mask[1] = raw_mask >> 32;
+#endif
 }
 static size_t efx_ef10_describe_stats(struct efx_nic *efx, u8 *names)
 {
+        DECLARE_BITMAP(mask, EF10_STAT_COUNT);
+        efx_ef10_get_stat_mask(efx, mask);
        return efx_nic_describe_stats(efx_ef10_stat_desc, EF10_STAT_COUNT,
-                                      efx_ef10_stat_mask(efx), names);
+                                      mask, names);
 }
 static int efx_ef10_try_update_nic_stats(struct efx_nic *efx)
 {
        struct efx_ef10_nic_data *nic_data = efx->nic_data;
-        const unsigned long *stats_mask = efx_ef10_stat_mask(efx);
+        DECLARE_BITMAP(mask, EF10_STAT_COUNT);
        __le64 generation_start, generation_end;
        u64 *stats = nic_data->stats;
        __le64 *dma_stats;
+        efx_ef10_get_stat_mask(efx, mask);
        dma_stats = efx->stats_buffer.addr;
        nic_data = efx->nic_data;
@@ -543,8 +583,9 @@ static int efx_ef10_try_update_nic_stats(struct efx_nic *efx)
        if (generation_end == EFX_MC_STATS_GENERATION_INVALID)
                return 0;
        rmb();
-        efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT, stats_mask,
+        efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT, mask,
                             stats, efx->stats_buffer.addr, false);
+        rmb();
        generation_start = dma_stats[MC_CMD_MAC_GENERATION_START];
        if (generation_end != generation_start)
                return -EAGAIN;
@@ -563,12 +604,14 @@ static int efx_ef10_try_update_nic_stats(struct efx_nic *efx)
 static size_t efx_ef10_update_stats(struct efx_nic *efx, u64 *full_stats,
                                    struct rtnl_link_stats64 *core_stats)
 {
-        const unsigned long *mask = efx_ef10_stat_mask(efx);
+        DECLARE_BITMAP(mask, EF10_STAT_COUNT);
        struct efx_ef10_nic_data *nic_data = efx->nic_data;
        u64 *stats = nic_data->stats;
        size_t stats_count = 0, index;
        int retry;
+        efx_ef10_get_stat_mask(efx, mask);
        /* If we're unlucky enough to read statistics during the DMA, wait
         * up to 10ms for it to finish (typically takes <500us)
         */
diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
index c082562dbf4e..366c8e3e3784 100644
--- a/drivers/net/ethernet/sfc/mcdi.c
+++ b/drivers/net/ethernet/sfc/mcdi.c
@@ -963,7 +963,7 @@ static int efx_mcdi_drv_attach(struct efx_nic *efx, bool driver_operating,
                               bool *was_attached)
 {
        MCDI_DECLARE_BUF(inbuf, MC_CMD_DRV_ATTACH_IN_LEN);
-        MCDI_DECLARE_BUF(outbuf, MC_CMD_DRV_ATTACH_OUT_LEN);
+        MCDI_DECLARE_BUF(outbuf, MC_CMD_DRV_ATTACH_EXT_OUT_LEN);
        size_t outlen;
        int rc;
@@ -981,6 +981,22 @@ static int efx_mcdi_drv_attach(struct efx_nic *efx, bool driver_operating,
                goto fail;
        }
+        /* We currently assume we have control of the external link
+         * and are completely trusted by firmware.  Abort probing
+         * if that's not true for this function.
+         */
+        if (driver_operating &&
+            outlen >= MC_CMD_DRV_ATTACH_EXT_OUT_LEN &&
+            (MCDI_DWORD(outbuf, DRV_ATTACH_EXT_OUT_FUNC_FLAGS) &
+             (1 << MC_CMD_DRV_ATTACH_EXT_OUT_FLAG_LINKCTRL |
+              1 << MC_CMD_DRV_ATTACH_EXT_OUT_FLAG_TRUSTED)) !=
+            (1 << MC_CMD_DRV_ATTACH_EXT_OUT_FLAG_LINKCTRL |
+             1 << MC_CMD_DRV_ATTACH_EXT_OUT_FLAG_TRUSTED)) {
+                netif_err(efx, probe, efx->net_dev,
+                          "This driver version only supports one function per port\n");
+                return -ENODEV;
+        }
        if (was_attached != NULL)
                *was_attached = MCDI_DWORD(outbuf, DRV_ATTACH_OUT_OLD_STATE);
        return 0;
diff --git a/drivers/net/ethernet/sfc/mcdi_pcol.h b/drivers/net/ethernet/sfc/mcdi_pcol.h
index b5cf62492f8e..e0a63ddb7a6c 100644
--- a/drivers/net/ethernet/sfc/mcdi_pcol.h
+++ b/drivers/net/ethernet/sfc/mcdi_pcol.h
@@ -2574,8 +2574,58 @@
 #define          MC_CMD_MAC_RX_LANES01_DISP_ERR  0x39 /* enum */
 #define          MC_CMD_MAC_RX_LANES23_DISP_ERR  0x3a /* enum */
 #define          MC_CMD_MAC_RX_MATCH_FAULT  0x3b /* enum */
-#define          MC_CMD_GMAC_DMABUF_START  0x40 /* enum */
+/* enum: PM trunc_bb_overflow counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
-#define          MC_CMD_GMAC_DMABUF_END    0x5f /* enum */
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_TRUNC_BB_OVERFLOW  0x3c
+/* enum: PM discard_bb_overflow counter. Valid for EF10 with
+ * PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_PM_DISCARD_BB_OVERFLOW  0x3d
+/* enum: PM trunc_vfifo_full counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_TRUNC_VFIFO_FULL  0x3e
+/* enum: PM discard_vfifo_full counter. Valid for EF10 with
+ * PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_PM_DISCARD_VFIFO_FULL  0x3f
+/* enum: PM trunc_qbb counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_TRUNC_QBB  0x40
+/* enum: PM discard_qbb counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_DISCARD_QBB  0x41
+/* enum: PM discard_mapping counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_DISCARD_MAPPING  0x42
+/* enum: RXDP counter: Number of packets dropped due to the queue being
+ * disabled. Valid for EF10 with PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_Q_DISABLED_PKTS  0x43
+/* enum: RXDP counter: Number of packets dropped by the DICPU. Valid for EF10
+ * with PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_DI_DROPPED_PKTS  0x45
+/* enum: RXDP counter: Number of non-host packets. Valid for EF10 with
+ * PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_STREAMING_PKTS  0x46
+/* enum: RXDP counter: Number of times an emergency descriptor fetch was
+ * performed. Valid for EF10 with PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_EMERGENCY_FETCH_CONDITIONS  0x47
+/* enum: RXDP counter: Number of times the DPCPU waited for an existing
+ * descriptor fetch. Valid for EF10 with PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_EMERGENCY_WAIT_CONDITIONS  0x48
+/* enum: Start of GMAC stats buffer space, for Siena only. */
+#define          MC_CMD_GMAC_DMABUF_START  0x40
+/* enum: End of GMAC stats buffer space, for Siena only. */
+#define          MC_CMD_GMAC_DMABUF_END    0x5f
 #define          MC_CMD_MAC_GENERATION_END 0x60 /* enum */
 #define          MC_CMD_MAC_NSTATS  0x61 /* enum */
@@ -5065,6 +5115,8 @@
 #define        MC_CMD_GET_CAPABILITIES_OUT_RX_BATCHING_WIDTH 1
 #define        MC_CMD_GET_CAPABILITIES_OUT_MCAST_FILTER_CHAINING_LBN 26
 #define        MC_CMD_GET_CAPABILITIES_OUT_MCAST_FILTER_CHAINING_WIDTH 1
+#define        MC_CMD_GET_CAPABILITIES_OUT_PM_AND_RXDP_COUNTERS_LBN 27
+#define        MC_CMD_GET_CAPABILITIES_OUT_PM_AND_RXDP_COUNTERS_WIDTH 1
 /* RxDPCPU firmware id. */
 #define       MC_CMD_GET_CAPABILITIES_OUT_RX_DPCPU_FW_ID_OFST 4
 #define       MC_CMD_GET_CAPABILITIES_OUT_RX_DPCPU_FW_ID_LEN 2
diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c
index e7dbd2dd202e..9826594c8a48 100644
--- a/drivers/net/ethernet/sfc/nic.c
+++ b/drivers/net/ethernet/sfc/nic.c
@@ -469,8 +469,7 @@ size_t efx_nic_describe_stats(const struct efx_hw_stat_desc *desc, size_t count,
 * @count: Length of the @desc array
 * @mask: Bitmask of which elements of @desc are enabled
 * @stats: Buffer to update with the converted statistics.  The length
- *      of this array must be at least the number of set bits in the
+ *      of this array must be at least @count.
- *      first @count bits of @mask.
 * @dma_buf: DMA buffer containing hardware statistics
 * @accumulate: If set, the converted values will be added rather than
 *      directly stored to the corresponding elements of @stats
@@ -503,11 +502,9 @@ void efx_nic_update_stats(const struct efx_hw_stat_desc *desc, size_t count,
                        }
                        if (accumulate)
-                                *stats += val;
+                                stats[index] += val;
                        else
-                                *stats = val;
+                                stats[index] = val;
                }
-                ++stats;
        }
 }
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index fda29d39032f..890bbbe8320e 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -386,6 +386,18 @@ enum {
        EF10_STAT_rx_align_error,
        EF10_STAT_rx_length_error,
        EF10_STAT_rx_nodesc_drops,
+        EF10_STAT_rx_pm_trunc_bb_overflow,
+        EF10_STAT_rx_pm_discard_bb_overflow,
+        EF10_STAT_rx_pm_trunc_vfifo_full,
+        EF10_STAT_rx_pm_discard_vfifo_full,
+        EF10_STAT_rx_pm_trunc_qbb,
+        EF10_STAT_rx_pm_discard_qbb,
+        EF10_STAT_rx_pm_discard_mapping,
+        EF10_STAT_rx_dp_q_disabled_packets,
+        EF10_STAT_rx_dp_di_dropped_packets,
+        EF10_STAT_rx_dp_streaming_packets,
+        EF10_STAT_rx_dp_emerg_fetch,
+        EF10_STAT_rx_dp_emerg_wait,
        EF10_STAT_COUNT
 };
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index 5730fe2445a6..98eedb90cdc3 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -1124,8 +1124,7 @@ static const char * chip_ids[ 16 ] =  {
                        void __iomem *__ioaddr = ioaddr;                \
                        if (__len >= 2 && (unsigned long)__ptr & 2) {   \
                                __len -= 2;                             \
-                                SMC_outw(*(u16 *)__ptr, ioaddr,         \
+                                SMC_outsw(ioaddr, DATA_REG(lp), __ptr, 1); \
-                                        DATA_REG(lp));          \
                                __ptr += 2;                             \
                        }                                               \
                        if (SMC_CAN_USE_DATACS && lp->datacs)           \
@@ -1133,8 +1132,7 @@ static const char * chip_ids[ 16 ] =  {
                        SMC_outsl(__ioaddr, DATA_REG(lp), __ptr, __len>>2); \
                        if (__len & 2) {                                \
                                __ptr += (__len & ~3);                  \
-                                SMC_outw(*((u16 *)__ptr), ioaddr,       \
+                                SMC_outsw(ioaddr, DATA_REG(lp), __ptr, 1); \
-                                         DATA_REG(lp));         \
                        }                                               \
                } else if (SMC_16BIT(lp))                               \
                        SMC_outsw(ioaddr, DATA_REG(lp), p, (l) >> 1);   \
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 79974e31187a..cc3ce557e4aa 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -639,13 +639,6 @@ void cpsw_rx_handler(void *token, int len, int status)
 static irqreturn_t cpsw_interrupt(int irq, void *dev_id)
 {
        struct cpsw_priv *priv = dev_id;
-        u32 rx, tx, rx_thresh;
-        rx_thresh = __raw_readl(&priv->wr_regs->rx_thresh_stat);
-        rx = __raw_readl(&priv->wr_regs->rx_stat);
-        tx = __raw_readl(&priv->wr_regs->tx_stat);
-        if (!rx_thresh && !rx && !tx)
-                return IRQ_NONE;
        cpsw_intr_disable(priv);
        if (priv->irq_enabled == true) {
@@ -1169,9 +1162,9 @@ static int cpsw_ndo_open(struct net_device *ndev)
                }
        }
+        napi_enable(&priv->napi);
        cpdma_ctlr_start(priv->dma);
        cpsw_intr_enable(priv);
-        napi_enable(&priv->napi);
        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
        cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
@@ -1771,8 +1764,8 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
        }
        data->mac_control = prop;
-        if (!of_property_read_u32(node, "dual_emac", &prop))
+        if (of_property_read_bool(node, "dual_emac"))
-                data->dual_emac = prop;
+                data->dual_emac = 1;
        /*
         * Populate all the child nodes here...
@@ -1782,7 +1775,7 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
        if (ret)
                pr_warn("Doesn't have any child node\n");
-        for_each_node_by_name(slave_node, "slave") {
+        for_each_child_of_node(node, slave_node) {
                struct cpsw_slave_data *slave_data = data->slave_data + i;
                const void *mac_addr = NULL;
                u32 phyid;
@@ -1791,6 +1784,10 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                struct device_node *mdio_node;
                struct platform_device *mdio;
+                /* This is no slave child node, continue */
+                if (strcmp(slave_node->name, "slave"))
+                        continue;
                parp = of_get_property(slave_node, "phy_id", &lenp);
                if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) {
                        pr_err("Missing slave[%d] phy_id property\n", i);
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 67df09ea9d04..6a32ef9d63ae 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -876,8 +876,7 @@ static void emac_dev_mcast_set(struct net_device *ndev)
                    netdev_mc_count(ndev) > EMAC_DEF_MAX_MULTICAST_ADDRESSES) {
                        mbp_enable = (mbp_enable | EMAC_MBP_RXMCAST);
                        emac_add_mcast(priv, EMAC_ALL_MULTI_SET, NULL);
-                }
+                } else if (!netdev_mc_empty(ndev)) {
-                if (!netdev_mc_empty(ndev)) {
                        struct netdev_hw_addr *ha;
                        mbp_enable = (mbp_enable | EMAC_MBP_RXMCAST);
diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index 0721e72f9299..5af1c3e5032a 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -975,7 +975,6 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                        return -EINVAL;         /* Cannot change this parameter when up */
                if ((ym = kmalloc(sizeof(struct yamdrv_ioctl_mcs), GFP_KERNEL)) == NULL)
                        return -ENOBUFS;
-                ym->bitrate = 9600;
                if (copy_from_user(ym, ifr->ifr_data, sizeof(struct yamdrv_ioctl_mcs))) {
                        kfree(ym);
                        return -EFAULT;
diff --git a/drivers/net/ieee802154/mrf24j40.c b/drivers/net/ieee802154/mrf24j40.c
index 42e6deee6db5..0632d34905c7 100644
--- a/drivers/net/ieee802154/mrf24j40.c
+++ b/drivers/net/ieee802154/mrf24j40.c
@@ -82,7 +82,6 @@ struct mrf24j40 {
        struct mutex buffer_mutex; /* only used to protect buf */
        struct completion tx_complete;
-        struct work_struct irqwork;
        u8 *buf; /* 3 bytes. Used for SPI single-register transfers. */
 };
@@ -344,6 +343,8 @@ static int mrf24j40_tx(struct ieee802154_dev *dev, struct sk_buff *skb)
        if (ret)
                goto err;
+        INIT_COMPLETION(devrec->tx_complete);
        /* Set TXNTRIG bit of TXNCON to send packet */
        ret = read_short_reg(devrec, REG_TXNCON, &val);
        if (ret)
@@ -354,8 +355,6 @@ static int mrf24j40_tx(struct ieee802154_dev *dev, struct sk_buff *skb)
                val |= 0x4;
        write_short_reg(devrec, REG_TXNCON, val);
-        INIT_COMPLETION(devrec->tx_complete);
        /* Wait for the device to send the TX complete interrupt. */
        ret = wait_for_completion_interruptible_timeout(
                                                &devrec->tx_complete,
@@ -590,17 +589,6 @@ static struct ieee802154_ops mrf24j40_ops = {
 static irqreturn_t mrf24j40_isr(int irq, void *data)
 {
        struct mrf24j40 *devrec = data;
-        disable_irq_nosync(irq);
-        schedule_work(&devrec->irqwork);
-        return IRQ_HANDLED;
-}
-static void mrf24j40_isrwork(struct work_struct *work)
-{
-        struct mrf24j40 *devrec = container_of(work, struct mrf24j40, irqwork);
        u8 intstat;
        int ret;
@@ -618,7 +606,7 @@ static void mrf24j40_isrwork(struct work_struct *work)
                mrf24j40_handle_rx(devrec);
 out:
-        enable_irq(devrec->spi->irq);
+        return IRQ_HANDLED;
 }
 static int mrf24j40_probe(struct spi_device *spi)
@@ -642,7 +630,6 @@ static int mrf24j40_probe(struct spi_device *spi)
        mutex_init(&devrec->buffer_mutex);
        init_completion(&devrec->tx_complete);
-        INIT_WORK(&devrec->irqwork, mrf24j40_isrwork);
        devrec->spi = spi;
        spi_set_drvdata(spi, devrec);
@@ -688,11 +675,12 @@ static int mrf24j40_probe(struct spi_device *spi)
        val &= ~0x3; /* Clear RX mode (normal) */
        write_short_reg(devrec, REG_RXMCR, val);
-        ret = request_irq(spi->irq,
+        ret = request_threaded_irq(spi->irq,
-                          mrf24j40_isr,
+                                   NULL,
-                          IRQF_TRIGGER_FALLING,
+                                   mrf24j40_isr,
-                          dev_name(&spi->dev),
+                                   IRQF_TRIGGER_LOW|IRQF_ONESHOT,
-                          devrec);
+                                   dev_name(&spi->dev),
+                                   devrec);
        if (ret) {
                dev_err(printdev(devrec), "Unable to get IRQ");
@@ -721,7 +709,6 @@ static int mrf24j40_remove(struct spi_device *spi)
        dev_dbg(printdev(devrec), "remove\n");
        free_irq(spi->irq, devrec);
-        flush_work(&devrec->irqwork); /* TODO: Is this the right call? */
        ieee802154_unregister_device(devrec->dev);
        ieee802154_free_device(devrec->dev);
        /* TODO: Will ieee802154_free_device() wait until ->xmit() is
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 807815fc9968..7cb105c103fe 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1293,7 +1293,8 @@ static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
        if (unlikely(!noblock))
                add_wait_queue(&tfile->wq.wait, &wait);
        while (len) {
-                current->state = TASK_INTERRUPTIBLE;
+                if (unlikely(!noblock))
+                        current->state = TASK_INTERRUPTIBLE;
                /* Read frames from the queue */
                if (!(skb = skb_dequeue(&tfile->socket.sk->sk_receive_queue))) {
@@ -1320,9 +1321,10 @@ static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
                break;
        }
-        current->state = TASK_RUNNING;
+        if (unlikely(!noblock)) {
-        if (unlikely(!noblock))
+                current->state = TASK_RUNNING;
                remove_wait_queue(&tfile->wq.wait, &wait);
+        }
        return ret;
 }
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 3569293df872..846cc19c04f2 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -36,8 +36,8 @@
 #define AX_RXHDR_L4_TYPE_TCP                    16
 #define AX_RXHDR_L3CSUM_ERR                     2
 #define AX_RXHDR_L4CSUM_ERR                     1
-#define AX_RXHDR_CRC_ERR                        ((u32)BIT(31))
+#define AX_RXHDR_CRC_ERR                        ((u32)BIT(29))
-#define AX_RXHDR_DROP_ERR                       ((u32)BIT(30))
+#define AX_RXHDR_DROP_ERR                       ((u32)BIT(31))
 #define AX_ACCESS_MAC                           0x01
 #define AX_ACCESS_PHY                           0x02
 #define AX_ACCESS_EEPROM                        0x04
@@ -1406,6 +1406,19 @@ static const struct driver_info sitecom_info = {
        .tx_fixup = ax88179_tx_fixup,
 };
+static const struct driver_info samsung_info = {
+        .description = "Samsung USB Ethernet Adapter",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
 static const struct usb_device_id products[] = {
 {
        /* ASIX AX88179 10/100/1000 */
@@ -1418,7 +1431,11 @@ static const struct usb_device_id products[] = {
 }, {
        /* Sitecom USB 3.0 to Gigabit Adapter */
        USB_DEVICE(0x0df6, 0x0072),
-        .driver_info = (unsigned long) &sitecom_info,
+        .driver_info = (unsigned long)&sitecom_info,
+}, {
+        /* Samsung USB Ethernet Adapter */
+        USB_DEVICE(0x04e8, 0xa100),
+        .driver_info = (unsigned long)&samsung_info,
 },
        { },
 };
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 3d6aaf79d8b2..818ce90185b5 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -714,6 +714,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
        {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
        {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
+        {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)},    /* Olivetti Olicard 200 */
        {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},    /* Cinterion PLxx */
        /* 4. Gobi 1000 devices */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index bf94e10a37c8..90a429b7ebad 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1688,8 +1688,10 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
        if (dev->can_dma_sg && !(info->flags & FLAG_SEND_ZLP) &&
                !(info->flags & FLAG_MULTI_PACKET)) {
                dev->padding_pkt = kzalloc(1, GFP_KERNEL);
-                if (!dev->padding_pkt)
+                if (!dev->padding_pkt) {
+                        status = -ENOMEM;
                        goto out4;
+                }
        }
        status = register_netdev (net);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index defec2b3c5a4..9fbdfcd1e1a0 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -938,7 +938,9 @@ static int virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs)
                return -EINVAL;
        } else {
                vi->curr_queue_pairs = queue_pairs;
-                schedule_delayed_work(&vi->refill, 0);
+                /* virtnet_open() will refill when device is going to up. */
+                if (dev->flags & IFF_UP)
+                        schedule_delayed_work(&vi->refill, 0);
        }
        return 0;
@@ -1116,6 +1118,11 @@ static int virtnet_cpu_callback(struct notifier_block *nfb,
 {
        struct virtnet_info *vi = container_of(nfb, struct virtnet_info, nb);
+        mutex_lock(&vi->config_lock);
+        if (!vi->config_enable)
+                goto done;
        switch(action & ~CPU_TASKS_FROZEN) {
        case CPU_ONLINE:
        case CPU_DOWN_FAILED:
@@ -1128,6 +1135,9 @@ static int virtnet_cpu_callback(struct notifier_block *nfb,
        default:
                break;
        }
+done:
+        mutex_unlock(&vi->config_lock);
        return NOTIFY_OK;
 }
@@ -1733,7 +1743,9 @@ static int virtnet_restore(struct virtio_device *vdev)
        vi->config_enable = true;
        mutex_unlock(&vi->config_lock);
+        rtnl_lock();
        virtnet_set_queues(vi, vi->curr_queue_pairs);
+        rtnl_unlock();
        return 0;
 }
diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
index 3f0c4f268751..bcfff0d62de4 100644
--- a/drivers/net/wan/farsync.c
+++ b/drivers/net/wan/farsync.c
@@ -1972,6 +1972,7 @@ fst_get_iface(struct fst_card_info *card, struct fst_port_info *port,
        }
        i = port->index;
+        memset(&sync, 0, sizeof(sync));
        sync.clock_rate = FST_RDL(card, portConfig[i].lineSpeed);
        /* Lucky card and linux use same encoding here */
        sync.clock_type = FST_RDB(card, portConfig[i].internalClock) ==
diff --git a/drivers/net/wan/wanxl.c b/drivers/net/wan/wanxl.c
index 6a24a5a70cc7..4c0a69779b89 100644
--- a/drivers/net/wan/wanxl.c
+++ b/drivers/net/wan/wanxl.c
@@ -355,6 +355,7 @@ static int wanxl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                        ifr->ifr_settings.size = size; /* data size wanted */
                        return -ENOBUFS;
                }
+                memset(&line, 0, sizeof(line));
                line.clock_type = get_status(port)->clocking;
                line.clock_rate = 0;
                line.loopback = 0;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index e4f65900132d..709301f88dcd 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -208,6 +208,7 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
        struct ath_hw *ah = sc->sc_ah;
        struct ath_common *common = ath9k_hw_common(ah);
        unsigned long flags;
+        int i;
        if (ath_startrecv(sc) != 0) {
                ath_err(common, "Unable to restart recv logic\n");
@@ -235,6 +236,15 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
                }
        work:
                ath_restart_work(sc);
+                for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+                        if (!ATH_TXQ_SETUP(sc, i))
+                                continue;
+                        spin_lock_bh(&sc->tx.txq[i].axq_lock);
+                        ath_txq_schedule(sc, &sc->tx.txq[i]);
+                        spin_unlock_bh(&sc->tx.txq[i].axq_lock);
+                }
        }
        ieee80211_wake_queues(sc->hw);
@@ -539,21 +549,10 @@ chip_reset:
 static int ath_reset(struct ath_softc *sc)
 {
-        int i, r;
+        int r;
        ath9k_ps_wakeup(sc);
        r = ath_reset_internal(sc, NULL);
-        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
-                if (!ATH_TXQ_SETUP(sc, i))
-                        continue;
-                spin_lock_bh(&sc->tx.txq[i].axq_lock);
-                ath_txq_schedule(sc, &sc->tx.txq[i]);
-                spin_unlock_bh(&sc->tx.txq[i].axq_lock);
-        }
        ath9k_ps_restore(sc);
        return r;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 5ac713d2ff5d..dd30452df966 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1969,15 +1969,18 @@ static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
 static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
                               struct ath_atx_tid *tid, struct sk_buff *skb)
 {
+        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
        struct ath_frame_info *fi = get_frame_info(skb);
        struct list_head bf_head;
-        struct ath_buf *bf;
+        struct ath_buf *bf = fi->bf;
-        bf = fi->bf;
        INIT_LIST_HEAD(&bf_head);
        list_add_tail(&bf->list, &bf_head);
        bf->bf_state.bf_type = 0;
+        if (tid && (tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
+                bf->bf_state.bf_type = BUF_AMPDU;
+                ath_tx_addto_baw(sc, tid, bf);
+        }
        bf->bf_next = NULL;
        bf->bf_lastbf = bf;
diff --git a/drivers/net/wireless/cw1200/cw1200_spi.c b/drivers/net/wireless/cw1200/cw1200_spi.c
index 899cad34ccd3..755a0c8edfe1 100644
--- a/drivers/net/wireless/cw1200/cw1200_spi.c
+++ b/drivers/net/wireless/cw1200/cw1200_spi.c
@@ -237,7 +237,9 @@ static irqreturn_t cw1200_spi_irq_handler(int irq, void *dev_id)
        struct hwbus_priv *self = dev_id;
        if (self->core) {
+                cw1200_spi_lock(self);
                cw1200_irq_handler(self->core);
+                cw1200_spi_unlock(self);
                return IRQ_HANDLED;
        } else {
                return IRQ_NONE;
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 30d45e2fc193..8ac305be68f4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -240,6 +240,12 @@ const struct iwl_cfg iwl6035_2agn_cfg = {
        .ht_params = &iwl6000_ht_params,
 };
+const struct iwl_cfg iwl6035_2agn_sff_cfg = {
+        .name = "Intel(R) Centrino(R) Ultimate-N 6235 AGN",
+        IWL_DEVICE_6035,
+        .ht_params = &iwl6000_ht_params,
+};
 const struct iwl_cfg iwl1030_bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 1030 BGN",
        IWL_DEVICE_6030,
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index e4d370bff306..b03c25e14903 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -280,6 +280,7 @@ extern const struct iwl_cfg iwl2000_2bgn_cfg;
 extern const struct iwl_cfg iwl2000_2bgn_d_cfg;
 extern const struct iwl_cfg iwl2030_2bgn_cfg;
 extern const struct iwl_cfg iwl6035_2agn_cfg;
+extern const struct iwl_cfg iwl6035_2agn_sff_cfg;
 extern const struct iwl_cfg iwl105_bgn_cfg;
 extern const struct iwl_cfg iwl105_bgn_d_cfg;
 extern const struct iwl_cfg iwl135_bgn_cfg;
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index dd57a36ecb10..80b47508647c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -601,8 +601,10 @@ static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
 {
        int ret;
-        WARN_ONCE(trans->state != IWL_TRANS_FW_ALIVE,
+        if (trans->state != IWL_TRANS_FW_ALIVE) {
-                  "%s bad state = %d", __func__, trans->state);
+                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
+                return -EIO;
+        }
        if (!(cmd->flags & CMD_ASYNC))
                lock_map_acquire_read(&trans->sync_cmd_lockdep_map);
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index 21407a353a3b..d58e393324ef 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -273,7 +273,10 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
                if (!mvmvif->queue_params[ac].uapsd)
                        continue;
-                cmd->flags |= cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK);
+                if (mvm->cur_ucode != IWL_UCODE_WOWLAN)
+                        cmd->flags |=
+                                cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK);
                cmd->uapsd_ac_flags |= BIT(ac);
                /* QNDP TID - the highest TID with no admission control */
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 9a7ab8495300..621fb71f282a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -394,6 +394,11 @@ static bool iwl_mvm_scan_abort_notif(struct iwl_notif_wait_data *notif_wait,
                        return false;
                }
+                /*
+                 * If scan cannot be aborted, it means that we had a
+                 * SCAN_COMPLETE_NOTIFICATION in the pipe and it called
+                 * ieee80211_scan_completed already.
+                 */
                IWL_DEBUG_SCAN(mvm, "Scan cannot be aborted, exit now: %d\n",
                               *resp);
                return true;
@@ -417,14 +422,19 @@ void iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
                                               SCAN_COMPLETE_NOTIFICATION };
        int ret;
+        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
+                return;
        iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_abort,
                                   scan_abort_notif,
                                   ARRAY_SIZE(scan_abort_notif),
                                   iwl_mvm_scan_abort_notif, NULL);
-        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD, CMD_SYNC, 0, NULL);
+        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD,
+                                   CMD_SYNC | CMD_SEND_IN_RFKILL, 0, NULL);
        if (ret) {
                IWL_ERR(mvm, "Couldn't send SCAN_ABORT_CMD: %d\n", ret);
+                /* mac80211's state will be cleaned in the fw_restart flow */
                goto out_remove_notif;
        }
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index dc02cb9792af..26108a1a29fa 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -139,13 +139,16 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 /* 6x00 Series */
        {IWL_PCI_DEVICE(0x422B, 0x1101, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x422B, 0x1108, iwl6000_3agn_cfg)},
        {IWL_PCI_DEVICE(0x422B, 0x1121, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x422B, 0x1128, iwl6000_3agn_cfg)},
        {IWL_PCI_DEVICE(0x422C, 0x1301, iwl6000i_2agn_cfg)},
        {IWL_PCI_DEVICE(0x422C, 0x1306, iwl6000i_2abg_cfg)},
        {IWL_PCI_DEVICE(0x422C, 0x1307, iwl6000i_2bg_cfg)},
        {IWL_PCI_DEVICE(0x422C, 0x1321, iwl6000i_2agn_cfg)},
        {IWL_PCI_DEVICE(0x422C, 0x1326, iwl6000i_2abg_cfg)},
        {IWL_PCI_DEVICE(0x4238, 0x1111, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x4238, 0x1118, iwl6000_3agn_cfg)},
        {IWL_PCI_DEVICE(0x4239, 0x1311, iwl6000i_2agn_cfg)},
        {IWL_PCI_DEVICE(0x4239, 0x1316, iwl6000i_2abg_cfg)},
@@ -153,12 +156,16 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
        {IWL_PCI_DEVICE(0x0082, 0x1301, iwl6005_2agn_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0x1306, iwl6005_2abg_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0x1307, iwl6005_2bg_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1308, iwl6005_2agn_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0x1321, iwl6005_2agn_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0x1326, iwl6005_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1328, iwl6005_2agn_cfg)},
        {IWL_PCI_DEVICE(0x0085, 0x1311, iwl6005_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0085, 0x1318, iwl6005_2agn_cfg)},
        {IWL_PCI_DEVICE(0x0085, 0x1316, iwl6005_2abg_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0xC020, iwl6005_2agn_sff_cfg)},
        {IWL_PCI_DEVICE(0x0085, 0xC220, iwl6005_2agn_sff_cfg)},
+        {IWL_PCI_DEVICE(0x0085, 0xC228, iwl6005_2agn_sff_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0x4820, iwl6005_2agn_d_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0x1304, iwl6005_2agn_mow1_cfg)},/* low 5GHz active */
        {IWL_PCI_DEVICE(0x0082, 0x1305, iwl6005_2agn_mow2_cfg)},/* high 5GHz active */
@@ -240,8 +247,11 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 /* 6x35 Series */
        {IWL_PCI_DEVICE(0x088E, 0x4060, iwl6035_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x088E, 0x406A, iwl6035_2agn_sff_cfg)},
        {IWL_PCI_DEVICE(0x088F, 0x4260, iwl6035_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x088F, 0x426A, iwl6035_2agn_sff_cfg)},
        {IWL_PCI_DEVICE(0x088E, 0x4460, iwl6035_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x088E, 0x446A, iwl6035_2agn_sff_cfg)},
        {IWL_PCI_DEVICE(0x088E, 0x4860, iwl6035_2agn_cfg)},
        {IWL_PCI_DEVICE(0x088F, 0x5260, iwl6035_2agn_cfg)},
@@ -260,54 +270,86 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 #if IS_ENABLED(CONFIG_IWLMVM)
 /* 7000 Series */
        {IWL_PCI_DEVICE(0x08B1, 0x4070, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4072, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4170, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4060, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x406A, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4160, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4062, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4162, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0x4270, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x4272, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0x4260, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x426A, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0x4262, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4470, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4472, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4460, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x446A, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4462, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4870, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x486E, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4A70, iwl7260_2ac_cfg_high_temp)},
        {IWL_PCI_DEVICE(0x08B1, 0x4A6E, iwl7260_2ac_cfg_high_temp)},
        {IWL_PCI_DEVICE(0x08B1, 0x4A6C, iwl7260_2ac_cfg_high_temp)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4570, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4560, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x4370, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x4360, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x5070, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4020, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x402A, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0x4220, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0x4420, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC070, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC072, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC170, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC060, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC06A, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC160, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC062, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC162, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC770, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC760, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0xC270, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0xC272, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0xC260, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0xC26A, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0xC262, iwl7260_n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC470, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC472, iwl7260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC460, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC462, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC570, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC560, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0xC370, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC360, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC020, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC02A, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B2, 0xC220, iwl7260_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B1, 0xC420, iwl7260_2n_cfg)},
 /* 3160 Series */
        {IWL_PCI_DEVICE(0x08B3, 0x0070, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x0072, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x0170, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x0172, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x0060, iwl3160_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x0062, iwl3160_n_cfg)},
        {IWL_PCI_DEVICE(0x08B4, 0x0270, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B4, 0x0272, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x0470, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x0472, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B4, 0x0370, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x8070, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8072, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x8170, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8172, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x8060, iwl3160_2n_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x8062, iwl3160_n_cfg)},
        {IWL_PCI_DEVICE(0x08B4, 0x8270, iwl3160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x08B3, 0x8470, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8570, iwl3160_2ac_cfg)},
 #endif /* CONFIG_IWLMVM */
        {0}
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index bad95d28d50d..c3f904d422b0 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1401,6 +1401,10 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        spin_lock_init(&trans_pcie->reg_lock);
        init_waitqueue_head(&trans_pcie->ucode_write_waitq);
+        err = pci_enable_device(pdev);
+        if (err)
+                goto out_no_pci;
        if (!cfg->base_params->pcie_l1_allowed) {
                /*
                 * W/A - seems to solve weird behavior. We need to remove this
@@ -1412,10 +1416,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                                       PCIE_LINK_STATE_CLKPM);
        }
-        err = pci_enable_device(pdev);
-        if (err)
-                goto out_no_pci;
        pci_set_master(pdev);
        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index f45eb29c2ede..1424335163b9 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1102,6 +1102,8 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, int fifo,
                 * non-AGG queue.
                 */
                iwl_clear_bits_prph(trans, SCD_AGGR_SEL, BIT(txq_id));
+                ssn = trans_pcie->txq[txq_id].q.read_ptr;
        }
        /* Place first TFD at index corresponding to start sequence number.
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 9d7c0e6c4fc7..37f873bb342f 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -1422,13 +1422,19 @@ static int mwifiex_deauthenticate_infra(struct mwifiex_private *priv, u8 *mac)
 */
 int mwifiex_deauthenticate(struct mwifiex_private *priv, u8 *mac)
 {
+        int ret = 0;
        if (!priv->media_connected)
                return 0;
        switch (priv->bss_mode) {
        case NL80211_IFTYPE_STATION:
        case NL80211_IFTYPE_P2P_CLIENT:
-                return mwifiex_deauthenticate_infra(priv, mac);
+                ret = mwifiex_deauthenticate_infra(priv, mac);
+                if (ret)
+                        cfg80211_disconnected(priv->netdev, 0, NULL, 0,
+                                              GFP_KERNEL);
+                break;
        case NL80211_IFTYPE_ADHOC:
                return mwifiex_send_cmd_sync(priv,
                                             HostCmd_CMD_802_11_AD_HOC_STOP,
@@ -1440,7 +1446,7 @@ int mwifiex_deauthenticate(struct mwifiex_private *priv, u8 *mac)
                break;
        }
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(mwifiex_deauthenticate);
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index fd778337deee..c2b91f566e05 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -358,10 +358,12 @@ process_start:
                }
        } while (true);
-        if ((adapter->int_status) || IS_CARD_RX_RCVD(adapter))
+        spin_lock_irqsave(&adapter->main_proc_lock, flags);
+        if ((adapter->int_status) || IS_CARD_RX_RCVD(adapter)) {
+                spin_unlock_irqrestore(&adapter->main_proc_lock, flags);
                goto process_start;
+        }
-        spin_lock_irqsave(&adapter->main_proc_lock, flags);
        adapter->mwifiex_processing = false;
        spin_unlock_irqrestore(&adapter->main_proc_lock, flags);
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index 8b057524b252..8c351f71f72f 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -118,7 +118,8 @@ mwifiex_reset_connect_state(struct mwifiex_private *priv, u16 reason_code)
        dev_dbg(adapter->dev,
                "info: successfully disconnected from %pM: reason code %d\n",
                priv->cfg_bssid, reason_code);
-        if (priv->bss_mode == NL80211_IFTYPE_STATION) {
+        if (priv->bss_mode == NL80211_IFTYPE_STATION ||
+            priv->bss_mode == NL80211_IFTYPE_P2P_CLIENT) {
                cfg80211_disconnected(priv->netdev, reason_code, NULL, 0,
                                      GFP_KERNEL);
        }
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 76d95deb274b..dc49e525ae5e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -105,13 +105,11 @@ int rt2x00pci_probe(struct pci_dev *pci_dev, const struct rt2x00_ops *ops)
                goto exit_release_regions;
        }
-        pci_enable_msi(pci_dev);
        hw = ieee80211_alloc_hw(sizeof(struct rt2x00_dev), ops->hw);
        if (!hw) {
                rt2x00_probe_err("Failed to allocate hardware\n");
                retval = -ENOMEM;
-                goto exit_disable_msi;
+                goto exit_release_regions;
        }
        pci_set_drvdata(pci_dev, hw);
@@ -152,9 +150,6 @@ exit_free_reg:
 exit_free_device:
        ieee80211_free_hw(hw);
-exit_disable_msi:
-        pci_disable_msi(pci_dev);
 exit_release_regions:
        pci_release_regions(pci_dev);
@@ -179,8 +174,6 @@ void rt2x00pci_remove(struct pci_dev *pci_dev)
        rt2x00pci_free_reg(rt2x00dev);
        ieee80211_free_hw(hw);
-        pci_disable_msi(pci_dev);
        /*
         * Free the PCI device data.
         */
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index 763cf1defab5..5a060e537fbe 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -343,7 +343,8 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
                                        (bool)GET_RX_DESC_PAGGR(pdesc));
        rx_status->mactime = GET_RX_DESC_TSFL(pdesc);
        if (phystatus) {
-                p_drvinfo = (struct rx_fwinfo_92c *)(pdesc + RTL_RX_DESC_SIZE);
+                p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
+                                                     stats->rx_bufshift);
                rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
                                                 p_drvinfo);
        }
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index b45bce20ad76..1b08d8798372 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -39,11 +39,15 @@ static int connect_rings(struct backend_info *);
 static void connect(struct backend_info *);
 static void backend_create_xenvif(struct backend_info *be);
 static void unregister_hotplug_status_watch(struct backend_info *be);
+static void set_backend_state(struct backend_info *be,
+                              enum xenbus_state state);
 static int netback_remove(struct xenbus_device *dev)
 {
        struct backend_info *be = dev_get_drvdata(&dev->dev);
+        set_backend_state(be, XenbusStateClosed);
        unregister_hotplug_status_watch(be);
        if (be->vif) {
                kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index be12fbfcae10..1ea75236a15f 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -552,9 +552,8 @@ static void __ref enable_slot(struct acpiphp_slot *slot)
        struct acpiphp_func *func;
        int max, pass;
        LIST_HEAD(add_list);
-        int nr_found;
-        nr_found = acpiphp_rescan_slot(slot);
+        acpiphp_rescan_slot(slot);
        max = acpiphp_max_busnr(bus);
        for (pass = 0; pass < 2; pass++) {
                list_for_each_entry(dev, &bus->devices, bus_list) {
@@ -574,9 +573,6 @@ static void __ref enable_slot(struct acpiphp_slot *slot)
                }
        }
        __pci_bus_assign_resources(bus, &add_list, NULL);
-        /* Nothing more to do here if there are no new devices on this bus. */
-        if (!nr_found && (slot->flags & SLOT_ENABLED))
-                return;
        acpiphp_sanitize_bus(bus);
        acpiphp_set_hpp_values(bus);
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 96d6b2eef4f2..b51a7460cc49 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -504,6 +504,7 @@ config ASUS_WMI
        depends on BACKLIGHT_CLASS_DEVICE
        depends on RFKILL || RFKILL = n
        depends on HOTPLUG_PCI
+        depends on ACPI_VIDEO || ACPI_VIDEO = n
        select INPUT_SPARSEKMAP
        select LEDS_CLASS
        select NEW_LEDS
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index d3fd52036fd6..13ec195f0ca6 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -127,18 +127,17 @@ MODULE_PARM_DESC(minor,
                 "default is -1 (automatic)");
 #endif
-static int kbd_backlight = 1;
+static int kbd_backlight = -1;
 module_param(kbd_backlight, int, 0444);
 MODULE_PARM_DESC(kbd_backlight,
                 "set this to 0 to disable keyboard backlight, "
-                 "1 to enable it (default: 0)");
+                 "1 to enable it (default: no change from current value)");
-static int kbd_backlight_timeout;       /* = 0 */
+static int kbd_backlight_timeout = -1;
 module_param(kbd_backlight_timeout, int, 0444);
 MODULE_PARM_DESC(kbd_backlight_timeout,
-                 "set this to 0 to set the default 10 seconds timeout, "
+                 "meaningful values vary from 0 to 3 and their meaning depends "
-                 "1 for 30 seconds, 2 for 60 seconds and 3 to disable timeout "
+                 "on the model (default: no change from current value)");
-                 "(default: 0)");
 #ifdef CONFIG_PM_SLEEP
 static void sony_nc_kbd_backlight_resume(void);
@@ -1844,6 +1843,8 @@ static int sony_nc_kbd_backlight_setup(struct platform_device *pd,
        if (!kbdbl_ctl)
                return -ENOMEM;
+        kbdbl_ctl->mode = kbd_backlight;
+        kbdbl_ctl->timeout = kbd_backlight_timeout;
        kbdbl_ctl->handle = handle;
        if (handle == 0x0137)
                kbdbl_ctl->base = 0x0C00;
@@ -1870,8 +1871,8 @@ static int sony_nc_kbd_backlight_setup(struct platform_device *pd,
        if (ret)
                goto outmode;
-        __sony_nc_kbd_backlight_mode_set(kbd_backlight);
+        __sony_nc_kbd_backlight_mode_set(kbdbl_ctl->mode);
-        __sony_nc_kbd_backlight_timeout_set(kbd_backlight_timeout);
+        __sony_nc_kbd_backlight_timeout_set(kbdbl_ctl->timeout);
        return 0;
@@ -1886,17 +1887,8 @@ outkzalloc:
 static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd)
 {
        if (kbdbl_ctl) {
-                int result;
                device_remove_file(&pd->dev, &kbdbl_ctl->mode_attr);
                device_remove_file(&pd->dev, &kbdbl_ctl->timeout_attr);
-                /* restore the default hw behaviour */
-                sony_call_snc_handle(kbdbl_ctl->handle,
-                                kbdbl_ctl->base | 0x10000, &result);
-                sony_call_snc_handle(kbdbl_ctl->handle,
-                                kbdbl_ctl->base + 0x200, &result);
                kfree(kbdbl_ctl);
                kbdbl_ctl = NULL;
        }
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 5adb2042e824..cee7e2708a1f 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -2077,6 +2077,7 @@ dasd_eckd_build_format(struct dasd_device *base,
        int intensity = 0;
        int r0_perm;
        int nr_tracks;
+        int use_prefix;
        startdev = dasd_alias_get_start_dev(base);
        if (!startdev)
@@ -2106,28 +2107,46 @@ dasd_eckd_build_format(struct dasd_device *base,
                intensity = fdata->intensity;
        }
+        use_prefix = base_priv->features.feature[8] & 0x01;
        switch (intensity) {
        case 0x00:      /* Normal format */
        case 0x08:      /* Normal format, use cdl. */
                cplength = 2 + (rpt*nr_tracks);
-                datasize = sizeof(struct PFX_eckd_data) +
+                if (use_prefix)
-                        sizeof(struct LO_eckd_data) +
+                        datasize = sizeof(struct PFX_eckd_data) +
-                        rpt * nr_tracks * sizeof(struct eckd_count);
+                                sizeof(struct LO_eckd_data) +
+                                rpt * nr_tracks * sizeof(struct eckd_count);
+                else
+                        datasize = sizeof(struct DE_eckd_data) +
+                                sizeof(struct LO_eckd_data) +
+                                rpt * nr_tracks * sizeof(struct eckd_count);
                break;
        case 0x01:      /* Write record zero and format track. */
        case 0x09:      /* Write record zero and format track, use cdl. */
                cplength = 2 + rpt * nr_tracks;
-                datasize = sizeof(struct PFX_eckd_data) +
+                if (use_prefix)
-                        sizeof(struct LO_eckd_data) +
+                        datasize = sizeof(struct PFX_eckd_data) +
-                        sizeof(struct eckd_count) +
+                                sizeof(struct LO_eckd_data) +
-                        rpt * nr_tracks * sizeof(struct eckd_count);
+                                sizeof(struct eckd_count) +
+                                rpt * nr_tracks * sizeof(struct eckd_count);
+                else
+                        datasize = sizeof(struct DE_eckd_data) +
+                                sizeof(struct LO_eckd_data) +
+                                sizeof(struct eckd_count) +
+                                rpt * nr_tracks * sizeof(struct eckd_count);
                break;
        case 0x04:      /* Invalidate track. */
        case 0x0c:      /* Invalidate track, use cdl. */
                cplength = 3;
-                datasize = sizeof(struct PFX_eckd_data) +
+                if (use_prefix)
-                        sizeof(struct LO_eckd_data) +
+                        datasize = sizeof(struct PFX_eckd_data) +
-                        sizeof(struct eckd_count);
+                                sizeof(struct LO_eckd_data) +
+                                sizeof(struct eckd_count);
+                else
+                        datasize = sizeof(struct DE_eckd_data) +
+                                sizeof(struct LO_eckd_data) +
+                                sizeof(struct eckd_count);
                break;
        default:
                dev_warn(&startdev->cdev->dev,
@@ -2147,14 +2166,25 @@ dasd_eckd_build_format(struct dasd_device *base,
        switch (intensity & ~0x08) {
        case 0x00: /* Normal format. */
-                prefix(ccw++, (struct PFX_eckd_data *) data,
+                if (use_prefix) {
-                       fdata->start_unit, fdata->stop_unit,
+                        prefix(ccw++, (struct PFX_eckd_data *) data,
-                       DASD_ECKD_CCW_WRITE_CKD, base, startdev);
+                               fdata->start_unit, fdata->stop_unit,
-                /* grant subsystem permission to format R0 */
+                               DASD_ECKD_CCW_WRITE_CKD, base, startdev);
-                if (r0_perm)
+                        /* grant subsystem permission to format R0 */
-                        ((struct PFX_eckd_data *)data)
+                        if (r0_perm)
-                                ->define_extent.ga_extended |= 0x04;
+                                ((struct PFX_eckd_data *)data)
-                data += sizeof(struct PFX_eckd_data);
+                                        ->define_extent.ga_extended |= 0x04;
+                        data += sizeof(struct PFX_eckd_data);
+                } else {
+                        define_extent(ccw++, (struct DE_eckd_data *) data,
+                                      fdata->start_unit, fdata->stop_unit,
+                                      DASD_ECKD_CCW_WRITE_CKD, startdev);
+                        /* grant subsystem permission to format R0 */
+                        if (r0_perm)
+                                ((struct DE_eckd_data *) data)
+                                        ->ga_extended |= 0x04;
+                        data += sizeof(struct DE_eckd_data);
+                }
                ccw[-1].flags |= CCW_FLAG_CC;
                locate_record(ccw++, (struct LO_eckd_data *) data,
                              fdata->start_unit, 0, rpt*nr_tracks,
@@ -2163,11 +2193,18 @@ dasd_eckd_build_format(struct dasd_device *base,
                data += sizeof(struct LO_eckd_data);
                break;
        case 0x01: /* Write record zero + format track. */
-                prefix(ccw++, (struct PFX_eckd_data *) data,
+                if (use_prefix) {
-                       fdata->start_unit, fdata->stop_unit,
+                        prefix(ccw++, (struct PFX_eckd_data *) data,
-                       DASD_ECKD_CCW_WRITE_RECORD_ZERO,
+                               fdata->start_unit, fdata->stop_unit,
-                       base, startdev);
+                               DASD_ECKD_CCW_WRITE_RECORD_ZERO,
-                data += sizeof(struct PFX_eckd_data);
+                               base, startdev);
+                        data += sizeof(struct PFX_eckd_data);
+                } else {
+                        define_extent(ccw++, (struct DE_eckd_data *) data,
+                               fdata->start_unit, fdata->stop_unit,
+                               DASD_ECKD_CCW_WRITE_RECORD_ZERO, startdev);
+                        data += sizeof(struct DE_eckd_data);
+                }
                ccw[-1].flags |= CCW_FLAG_CC;
                locate_record(ccw++, (struct LO_eckd_data *) data,
                              fdata->start_unit, 0, rpt * nr_tracks + 1,
@@ -2176,10 +2213,17 @@ dasd_eckd_build_format(struct dasd_device *base,
                data += sizeof(struct LO_eckd_data);
                break;
        case 0x04: /* Invalidate track. */
-                prefix(ccw++, (struct PFX_eckd_data *) data,
+                if (use_prefix) {
-                       fdata->start_unit, fdata->stop_unit,
+                        prefix(ccw++, (struct PFX_eckd_data *) data,
-                       DASD_ECKD_CCW_WRITE_CKD, base, startdev);
+                               fdata->start_unit, fdata->stop_unit,
-                data += sizeof(struct PFX_eckd_data);
+                               DASD_ECKD_CCW_WRITE_CKD, base, startdev);
+                        data += sizeof(struct PFX_eckd_data);
+                } else {
+                        define_extent(ccw++, (struct DE_eckd_data *) data,
+                               fdata->start_unit, fdata->stop_unit,
+                               DASD_ECKD_CCW_WRITE_CKD, startdev);
+                        data += sizeof(struct DE_eckd_data);
+                }
                ccw[-1].flags |= CCW_FLAG_CC;
                locate_record(ccw++, (struct LO_eckd_data *) data,
                              fdata->start_unit, 0, 1,
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index a3aa374799dc..1fe264379e0d 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -486,7 +486,7 @@ sclp_sync_wait(void)
        timeout = 0;
        if (timer_pending(&sclp_request_timer)) {
                /* Get timeout TOD value */
-                timeout = get_tod_clock() +
+                timeout = get_tod_clock_fast() +
                          sclp_tod_from_jiffies(sclp_request_timer.expires -
                                                jiffies);
        }
@@ -508,7 +508,7 @@ sclp_sync_wait(void)
        while (sclp_running_state != sclp_running_state_idle) {
                /* Check for expired request timer */
                if (timer_pending(&sclp_request_timer) &&
-                    get_tod_clock() > timeout &&
+                    get_tod_clock_fast() > timeout &&
                    del_timer(&sclp_request_timer))
                        sclp_request_timer.function(sclp_request_timer.data);
                cpu_relax();
diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
index 9b3a24e8d3a0..cf31d3321dab 100644
--- a/drivers/s390/char/vmlogrdr.c
+++ b/drivers/s390/char/vmlogrdr.c
@@ -313,7 +313,7 @@ static int vmlogrdr_open (struct inode *inode, struct file *filp)
        int ret;
        dev_num = iminor(inode);
-        if (dev_num > MAXMINOR)
+        if (dev_num >= MAXMINOR)
                return -ENODEV;
        logptr = &sys_ser[dev_num];
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index d7da67a31c77..88e35d85d205 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -878,9 +878,9 @@ static void css_reset(void)
                        atomic_inc(&chpid_reset_count);
        }
        /* Wait for machine check for all channel paths. */
-        timeout = get_tod_clock() + (RCHP_TIMEOUT << 12);
+        timeout = get_tod_clock_fast() + (RCHP_TIMEOUT << 12);
        while (atomic_read(&chpid_reset_count) != 0) {
-                if (get_tod_clock() > timeout)
+                if (get_tod_clock_fast() > timeout)
                        break;
                cpu_relax();
        }
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 8ed52aa49122..bbd3e511c771 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -338,10 +338,10 @@ again:
                retries++;
                if (!start_time) {
-                        start_time = get_tod_clock();
+                        start_time = get_tod_clock_fast();
                        goto again;
                }
-                if ((get_tod_clock() - start_time) < QDIO_BUSY_BIT_PATIENCE)
+                if (get_tod_clock_fast() - start_time < QDIO_BUSY_BIT_PATIENCE)
                        goto again;
        }
        if (retries) {
@@ -504,7 +504,7 @@ static int get_inbound_buffer_frontier(struct qdio_q *q)
        int count, stop;
        unsigned char state = 0;
-        q->timestamp = get_tod_clock();
+        q->timestamp = get_tod_clock_fast();
        /*
         * Don't check 128 buffers, as otherwise qdio_inbound_q_moved
@@ -595,7 +595,7 @@ static inline int qdio_inbound_q_done(struct qdio_q *q)
         * At this point we know, that inbound first_to_check
         * has (probably) not moved (see qdio_inbound_processing).
         */
-        if (get_tod_clock() > q->u.in.timestamp + QDIO_INPUT_THRESHOLD) {
+        if (get_tod_clock_fast() > q->u.in.timestamp + QDIO_INPUT_THRESHOLD) {
                DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "in done:%02x",
                              q->first_to_check);
                return 1;
@@ -728,7 +728,7 @@ static int get_outbound_buffer_frontier(struct qdio_q *q)
        int count, stop;
        unsigned char state = 0;
-        q->timestamp = get_tod_clock();
+        q->timestamp = get_tod_clock_fast();
        if (need_siga_sync(q))
                if (((queue_type(q) != QDIO_IQDIO_QFMT) &&
diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
index feab3a5e50b5..757eb0716d45 100644
--- a/drivers/scsi/BusLogic.c
+++ b/drivers/scsi/BusLogic.c
@@ -696,7 +696,7 @@ static int __init blogic_init_mm_probeinfo(struct blogic_adapter *adapter)
        while ((pci_device = pci_get_device(PCI_VENDOR_ID_BUSLOGIC,
                                        PCI_DEVICE_ID_BUSLOGIC_MULTIMASTER,
                                        pci_device)) != NULL) {
-                struct blogic_adapter *adapter = adapter;
+                struct blogic_adapter *host_adapter = adapter;
                struct blogic_adapter_info adapter_info;
                enum blogic_isa_ioport mod_ioaddr_req;
                unsigned char bus;
@@ -744,9 +744,9 @@ static int __init blogic_init_mm_probeinfo(struct blogic_adapter *adapter)
                   known and enabled, note that the particular Standard ISA I/O
                   Address should not be probed.
                 */
-                adapter->io_addr = io_addr;
+                host_adapter->io_addr = io_addr;
-                blogic_intreset(adapter);
+                blogic_intreset(host_adapter);
-                if (blogic_cmd(adapter, BLOGIC_INQ_PCI_INFO, NULL, 0,
+                if (blogic_cmd(host_adapter, BLOGIC_INQ_PCI_INFO, NULL, 0,
                                &adapter_info, sizeof(adapter_info)) ==
                                sizeof(adapter_info)) {
                        if (adapter_info.isa_port < 6)
@@ -762,7 +762,7 @@ static int __init blogic_init_mm_probeinfo(struct blogic_adapter *adapter)
                   I/O Address assigned at system initialization.
                 */
                mod_ioaddr_req = BLOGIC_IO_DISABLE;
-                blogic_cmd(adapter, BLOGIC_MOD_IOADDR, &mod_ioaddr_req,
+                blogic_cmd(host_adapter, BLOGIC_MOD_IOADDR, &mod_ioaddr_req,
                                sizeof(mod_ioaddr_req), NULL, 0);
                /*
                   For the first MultiMaster Host Adapter enumerated,
@@ -779,12 +779,12 @@ static int __init blogic_init_mm_probeinfo(struct blogic_adapter *adapter)
                        fetch_localram.offset = BLOGIC_AUTOSCSI_BASE + 45;
                        fetch_localram.count = sizeof(autoscsi_byte45);
-                        blogic_cmd(adapter, BLOGIC_FETCH_LOCALRAM,
+                        blogic_cmd(host_adapter, BLOGIC_FETCH_LOCALRAM,
                                        &fetch_localram, sizeof(fetch_localram),
                                        &autoscsi_byte45,
                                        sizeof(autoscsi_byte45));
-                        blogic_cmd(adapter, BLOGIC_GET_BOARD_ID, NULL, 0, &id,
+                        blogic_cmd(host_adapter, BLOGIC_GET_BOARD_ID, NULL, 0,
-                                        sizeof(id));
+                                        &id, sizeof(id));
                        if (id.fw_ver_digit1 == '5')
                                force_scan_order =
                                        autoscsi_byte45.force_scan_order;
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 408a42ef787a..f0d432c139d0 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -771,6 +771,8 @@ static long aac_compat_do_ioctl(struct aac_dev *dev, unsigned cmd, unsigned long
 static int aac_compat_ioctl(struct scsi_device *sdev, int cmd, void __user *arg)
 {
        struct aac_dev *dev = (struct aac_dev *)sdev->host->hostdata;
+        if (!capable(CAP_SYS_RAWIO))
+                return -EPERM;
        return aac_compat_do_ioctl(dev, cmd, (unsigned long)arg);
 }
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 2ef497ebadc0..ee5c1833eb73 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -20,7 +20,7 @@
 * | Device Discovery             |       0x2095       | 0x2020-0x2022, |
 * |                              |                    | 0x2011-0x2012, |
 * |                              |                    | 0x2016         |
- * | Queue Command and IO tracing |       0x3058       | 0x3006-0x300b  |
+ * | Queue Command and IO tracing |       0x3059       | 0x3006-0x300b  |
 * |                              |                    | 0x3027-0x3028  |
 * |                              |                    | 0x303d-0x3041  |
 * |                              |                    | 0x302d,0x3033  |
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index df1b30ba938c..ff9c86b1a0d8 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1957,6 +1957,15 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
        que = MSW(sts->handle);
        req = ha->req_q_map[que];
+        /* Check for invalid queue pointer */
+        if (req == NULL ||
+            que >= find_first_zero_bit(ha->req_qid_map, ha->max_req_queues)) {
+                ql_dbg(ql_dbg_io, vha, 0x3059,
+                    "Invalid status handle (0x%x): Bad req pointer. req=%p, "
+                    "que=%u.\n", sts->handle, req, que);
+                return;
+        }
        /* Validate handle. */
        if (handle < req->num_outstanding_cmds)
                sp = req->outstanding_cmds[handle];
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index e62d17d41d4e..5693f6d7eddb 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2854,6 +2854,7 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
                gd->events |= DISK_EVENT_MEDIA_CHANGE;
        }
+        blk_pm_runtime_init(sdp->request_queue, dev);
        add_disk(gd);
        if (sdkp->capacity)
                sd_dif_config_host(sdkp);
@@ -2862,7 +2863,6 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
        sd_printk(KERN_NOTICE, sdkp, "Attached SCSI %sdisk\n",
                  sdp->removable ? "removable " : "");
-        blk_pm_runtime_init(sdp->request_queue, dev);
        scsi_autopm_put_device(sdp);
        put_device(&sdkp->dev);
 }
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 5cbc4bb1b395..df5e961484e1 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -105,8 +105,11 @@ static int scatter_elem_sz_prev = SG_SCATTER_SZ;
 static int sg_add(struct device *, struct class_interface *);
 static void sg_remove(struct device *, struct class_interface *);
+static DEFINE_SPINLOCK(sg_open_exclusive_lock);
 static DEFINE_IDR(sg_index_idr);
-static DEFINE_RWLOCK(sg_index_lock);
+static DEFINE_RWLOCK(sg_index_lock);    /* Also used to lock
+                                                           file descriptor list for device */
 static struct class_interface sg_interface = {
        .add_dev        = sg_add,
@@ -143,7 +146,8 @@ typedef struct sg_request {	/* SG_MAX_QUEUE requests outstanding per file */
 } Sg_request;
 typedef struct sg_fd {          /* holds the state of a file descriptor */
-        struct list_head sfd_siblings; /* protected by sfd_lock of device */
+        /* sfd_siblings is protected by sg_index_lock */
+        struct list_head sfd_siblings;
        struct sg_device *parentdp;     /* owning device */
        wait_queue_head_t read_wait;    /* queue read until command done */
        rwlock_t rq_list_lock;  /* protect access to list in req_arr */
@@ -166,12 +170,13 @@ typedef struct sg_fd {		/* holds the state of a file descriptor */
 typedef struct sg_device { /* holds the state of each scsi generic device */
        struct scsi_device *device;
+        wait_queue_head_t o_excl_wait;  /* queue open() when O_EXCL in use */
        int sg_tablesize;       /* adapter's max scatter-gather table size */
        u32 index;              /* device index number */
-        spinlock_t sfd_lock;    /* protect file descriptor list for device */
+        /* sfds is protected by sg_index_lock */
        struct list_head sfds;
-        struct rw_semaphore o_sem;      /* exclude open should hold this rwsem */
        volatile char detached; /* 0->attached, 1->detached pending removal */
+        /* exclude protected by sg_open_exclusive_lock */
        char exclude;           /* opened for exclusive access */
        char sgdebug;           /* 0->off, 1->sense, 9->dump dev, 10-> all devs */
        struct gendisk *disk;
@@ -220,14 +225,35 @@ static int sg_allow_access(struct file *filp, unsigned char *cmd)
        return blk_verify_command(cmd, filp->f_mode & FMODE_WRITE);
 }
+static int get_exclude(Sg_device *sdp)
+{
+        unsigned long flags;
+        int ret;
+        spin_lock_irqsave(&sg_open_exclusive_lock, flags);
+        ret = sdp->exclude;
+        spin_unlock_irqrestore(&sg_open_exclusive_lock, flags);
+        return ret;
+}
+static int set_exclude(Sg_device *sdp, char val)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&sg_open_exclusive_lock, flags);
+        sdp->exclude = val;
+        spin_unlock_irqrestore(&sg_open_exclusive_lock, flags);
+        return val;
+}
 static int sfds_list_empty(Sg_device *sdp)
 {
        unsigned long flags;
        int ret;
-        spin_lock_irqsave(&sdp->sfd_lock, flags);
+        read_lock_irqsave(&sg_index_lock, flags);
        ret = list_empty(&sdp->sfds);
-        spin_unlock_irqrestore(&sdp->sfd_lock, flags);
+        read_unlock_irqrestore(&sg_index_lock, flags);
        return ret;
 }
@@ -239,6 +265,7 @@ sg_open(struct inode *inode, struct file *filp)
        struct request_queue *q;
        Sg_device *sdp;
        Sg_fd *sfp;
+        int res;
        int retval;
        nonseekable_open(inode, filp);
@@ -267,52 +294,54 @@ sg_open(struct inode *inode, struct file *filp)
                goto error_out;
        }
-        if ((flags & O_EXCL) && (O_RDONLY == (flags & O_ACCMODE))) {
+        if (flags & O_EXCL) {
-                retval = -EPERM; /* Can't lock it with read only access */
+                if (O_RDONLY == (flags & O_ACCMODE)) {
-                goto error_out;
+                        retval = -EPERM; /* Can't lock it with read only access */
-        }
+                        goto error_out;
-        if (flags & O_NONBLOCK) {
+                }
-                if (flags & O_EXCL) {
+                if (!sfds_list_empty(sdp) && (flags & O_NONBLOCK)) {
-                        if (!down_write_trylock(&sdp->o_sem)) {
+                        retval = -EBUSY;
-                                retval = -EBUSY;
+                        goto error_out;
-                                goto error_out;
+                }
-                        }
+                res = wait_event_interruptible(sdp->o_excl_wait,
-                } else {
+                                           ((!sfds_list_empty(sdp) || get_exclude(sdp)) ? 0 : set_exclude(sdp, 1)));
-                        if (!down_read_trylock(&sdp->o_sem)) {
+                if (res) {
-                                retval = -EBUSY;
+                        retval = res;   /* -ERESTARTSYS because signal hit process */
-                                goto error_out;
+                        goto error_out;
-                        }
+                }
+        } else if (get_exclude(sdp)) {  /* some other fd has an exclusive lock on dev */
+                if (flags & O_NONBLOCK) {
+                        retval = -EBUSY;
+                        goto error_out;
+                }
+                res = wait_event_interruptible(sdp->o_excl_wait, !get_exclude(sdp));
+                if (res) {
+                        retval = res;   /* -ERESTARTSYS because signal hit process */
+                        goto error_out;
                }
-        } else {
-                if (flags & O_EXCL)
-                        down_write(&sdp->o_sem);
-                else
-                        down_read(&sdp->o_sem);
        }
-        /* Since write lock is held, no need to check sfd_list */
+        if (sdp->detached) {
-        if (flags & O_EXCL)
+                retval = -ENODEV;
-                sdp->exclude = 1;       /* used by release lock */
+                goto error_out;
+        }
        if (sfds_list_empty(sdp)) {     /* no existing opens on this device */
                sdp->sgdebug = 0;
                q = sdp->device->request_queue;
                sdp->sg_tablesize = queue_max_segments(q);
        }
-        sfp = sg_add_sfp(sdp, dev);
+        if ((sfp = sg_add_sfp(sdp, dev)))
-        if (!IS_ERR(sfp))
                filp->private_data = sfp;
-                /* retval is already provably zero at this point because of the
-                 * check after retval = scsi_autopm_get_device(sdp->device))
-                 */
        else {
-                retval = PTR_ERR(sfp);
                if (flags & O_EXCL) {
-                        sdp->exclude = 0;       /* undo if error */
+                        set_exclude(sdp, 0);    /* undo if error */
-                        up_write(&sdp->o_sem);
+                        wake_up_interruptible(&sdp->o_excl_wait);
-                } else
+                }
-                        up_read(&sdp->o_sem);
+                retval = -ENOMEM;
+                goto error_out;
+        }
+        retval = 0;
 error_out:
+        if (retval) {
                scsi_autopm_put_device(sdp->device);
 sdp_put:
                scsi_device_put(sdp->device);
@@ -329,18 +358,13 @@ sg_release(struct inode *inode, struct file *filp)
 {
        Sg_device *sdp;
        Sg_fd *sfp;
-        int excl;
        if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
                return -ENXIO;
        SCSI_LOG_TIMEOUT(3, printk("sg_release: %s\n", sdp->disk->disk_name));
-        excl = sdp->exclude;
+        set_exclude(sdp, 0);
-        sdp->exclude = 0;
+        wake_up_interruptible(&sdp->o_excl_wait);
-        if (excl)
-                up_write(&sdp->o_sem);
-        else
-                up_read(&sdp->o_sem);
        scsi_autopm_put_device(sdp->device);
        kref_put(&sfp->f_ref, sg_remove_sfp);
@@ -1391,9 +1415,8 @@ static Sg_device *sg_alloc(struct gendisk *disk, struct scsi_device *scsidp)
        disk->first_minor = k;
        sdp->disk = disk;
        sdp->device = scsidp;
-        spin_lock_init(&sdp->sfd_lock);
        INIT_LIST_HEAD(&sdp->sfds);
-        init_rwsem(&sdp->o_sem);
+        init_waitqueue_head(&sdp->o_excl_wait);
        sdp->sg_tablesize = queue_max_segments(q);
        sdp->index = k;
        kref_init(&sdp->d_ref);
@@ -1526,13 +1549,11 @@ static void sg_remove(struct device *cl_dev, struct class_interface *cl_intf)
        /* Need a write lock to set sdp->detached. */
        write_lock_irqsave(&sg_index_lock, iflags);
-        spin_lock(&sdp->sfd_lock);
        sdp->detached = 1;
        list_for_each_entry(sfp, &sdp->sfds, sfd_siblings) {
                wake_up_interruptible(&sfp->read_wait);
                kill_fasync(&sfp->async_qp, SIGPOLL, POLL_HUP);
        }
-        spin_unlock(&sdp->sfd_lock);
        write_unlock_irqrestore(&sg_index_lock, iflags);
        sysfs_remove_link(&scsidp->sdev_gendev.kobj, "generic");
@@ -2043,7 +2064,7 @@ sg_add_sfp(Sg_device * sdp, int dev)
        sfp = kzalloc(sizeof(*sfp), GFP_ATOMIC | __GFP_NOWARN);
        if (!sfp)
-                return ERR_PTR(-ENOMEM);
+                return NULL;
        init_waitqueue_head(&sfp->read_wait);
        rwlock_init(&sfp->rq_list_lock);
@@ -2057,13 +2078,9 @@ sg_add_sfp(Sg_device * sdp, int dev)
        sfp->cmd_q = SG_DEF_COMMAND_Q;
        sfp->keep_orphan = SG_DEF_KEEP_ORPHAN;
        sfp->parentdp = sdp;
-        spin_lock_irqsave(&sdp->sfd_lock, iflags);
+        write_lock_irqsave(&sg_index_lock, iflags);
-        if (sdp->detached) {
-                spin_unlock_irqrestore(&sdp->sfd_lock, iflags);
-                return ERR_PTR(-ENODEV);
-        }
        list_add_tail(&sfp->sfd_siblings, &sdp->sfds);
-        spin_unlock_irqrestore(&sdp->sfd_lock, iflags);
+        write_unlock_irqrestore(&sg_index_lock, iflags);
        SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp: sfp=0x%p\n", sfp));
        if (unlikely(sg_big_buff != def_reserved_size))
                sg_big_buff = def_reserved_size;
@@ -2113,9 +2130,10 @@ static void sg_remove_sfp(struct kref *kref)
        struct sg_device *sdp = sfp->parentdp;
        unsigned long iflags;
-        spin_lock_irqsave(&sdp->sfd_lock, iflags);
+        write_lock_irqsave(&sg_index_lock, iflags);
        list_del(&sfp->sfd_siblings);
-        spin_unlock_irqrestore(&sdp->sfd_lock, iflags);
+        write_unlock_irqrestore(&sg_index_lock, iflags);
+        wake_up_interruptible(&sdp->o_excl_wait);
        INIT_WORK(&sfp->ew.work, sg_remove_sfp_usercontext);
        schedule_work(&sfp->ew.work);
@@ -2502,7 +2520,7 @@ static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v)
        return 0;
 }
-/* must be called while holding sg_index_lock and sfd_lock */
+/* must be called while holding sg_index_lock */
 static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)
 {
        int k, m, new_interface, blen, usg;
@@ -2587,26 +2605,22 @@ static int sg_proc_seq_show_debug(struct seq_file *s, void *v)
        read_lock_irqsave(&sg_index_lock, iflags);
        sdp = it ? sg_lookup_dev(it->index) : NULL;
-        if (sdp) {
+        if (sdp && !list_empty(&sdp->sfds)) {
-                spin_lock(&sdp->sfd_lock);
+                struct scsi_device *scsidp = sdp->device;
-                if (!list_empty(&sdp->sfds)) {
-                        struct scsi_device *scsidp = sdp->device;
-                        seq_printf(s, " >>> device=%s ", sdp->disk->disk_name);
+                seq_printf(s, " >>> device=%s ", sdp->disk->disk_name);
-                        if (sdp->detached)
+                if (sdp->detached)
-                                seq_printf(s, "detached pending close ");
+                        seq_printf(s, "detached pending close ");
-                        else
+                else
-                                seq_printf
+                        seq_printf
-                                    (s, "scsi%d chan=%d id=%d lun=%d   em=%d",
+                            (s, "scsi%d chan=%d id=%d lun=%d   em=%d",
-                                     scsidp->host->host_no,
+                             scsidp->host->host_no,
-                                     scsidp->channel, scsidp->id,
+                             scsidp->channel, scsidp->id,
-                                     scsidp->lun,
+                             scsidp->lun,
-                                     scsidp->host->hostt->emulated);
+                             scsidp->host->hostt->emulated);
-                        seq_printf(s, " sg_tablesize=%d excl=%d\n",
+                seq_printf(s, " sg_tablesize=%d excl=%d\n",
-                                   sdp->sg_tablesize, sdp->exclude);
+                           sdp->sg_tablesize, get_exclude(sdp));
-                        sg_proc_debug_helper(s, sdp);
+                sg_proc_debug_helper(s, sdp);
-                }
-                spin_unlock(&sdp->sfd_lock);
        }
        read_unlock_irqrestore(&sg_index_lock, iflags);
        return 0;
diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c
index f91bc1fdd895..639ba96adb36 100644
--- a/drivers/staging/bcm/Bcmchar.c
+++ b/drivers/staging/bcm/Bcmchar.c
@@ -1960,6 +1960,7 @@ cntrlEnd:
                BCM_DEBUG_PRINT(Adapter, DBG_TYPE_OTHERS, OSAL_DBG, DBG_LVL_ALL, "Called IOCTL_BCM_GET_DEVICE_DRIVER_INFO\n");
+                memset(&DevInfo, 0, sizeof(DevInfo));
                DevInfo.MaxRDMBufferSize = BUFFER_4K;
                DevInfo.u32DSDStartOffset = EEPROM_CALPARAM_START;
                DevInfo.u32RxAlignmentCorrection = 0;
diff --git a/drivers/staging/media/msi3101/Kconfig b/drivers/staging/media/msi3101/Kconfig
index b94a95a597d6..76d5bbd4d93c 100644
--- a/drivers/staging/media/msi3101/Kconfig
+++ b/drivers/staging/media/msi3101/Kconfig
@@ -1,3 +1,4 @@
 config USB_MSI3101
        tristate "Mirics MSi3101 SDR Dongle"
        depends on USB && VIDEO_DEV && VIDEO_V4L2
+        select VIDEOBUF2_VMALLOC
diff --git a/drivers/staging/media/msi3101/sdr-msi3101.c b/drivers/staging/media/msi3101/sdr-msi3101.c
index 24c7b70a6cbf..4c3bf776bb20 100644
--- a/drivers/staging/media/msi3101/sdr-msi3101.c
+++ b/drivers/staging/media/msi3101/sdr-msi3101.c
@@ -1131,7 +1131,13 @@ static int msi3101_queue_setup(struct vb2_queue *vq,
        /* Absolute min and max number of buffers available for mmap() */
        *nbuffers = 32;
        *nplanes = 1;
-        sizes[0] = PAGE_ALIGN(3 * 3072); /* 3 * 768 * 4 */
+        /*
+         *   3, wMaxPacketSize 3x 1024 bytes
+         * 504, max IQ sample pairs per 1024 frame
+         *   2, two samples, I and Q
+         *   4, 32-bit float
+         */
+        sizes[0] = PAGE_ALIGN(3 * 504 * 2 * 4); /* = 12096 */
        dev_dbg(&s->udev->dev, "%s: nbuffers=%d sizes[0]=%d\n",
                        __func__, *nbuffers, sizes[0]);
        return 0;
@@ -1657,7 +1663,7 @@ static int vidioc_s_frequency(struct file *file, void *priv,
                        f->frequency * 625UL / 10UL);
 }
-const struct v4l2_ioctl_ops msi3101_ioctl_ops = {
+static const struct v4l2_ioctl_ops msi3101_ioctl_ops = {
        .vidioc_querycap          = msi3101_querycap,
        .vidioc_enum_input        = msi3101_enum_input,
diff --git a/drivers/staging/ozwpan/ozcdev.c b/drivers/staging/ozwpan/ozcdev.c
index 6ccb64fb0786..6ce0af9977d8 100644
--- a/drivers/staging/ozwpan/ozcdev.c
+++ b/drivers/staging/ozwpan/ozcdev.c
@@ -155,6 +155,9 @@ static ssize_t oz_cdev_write(struct file *filp, const char __user *buf,
        struct oz_app_hdr *app_hdr;
        struct oz_serial_ctx *ctx;
+        if (count > sizeof(ei->data) - sizeof(*elt) - sizeof(*app_hdr))
+                return -EINVAL;
        spin_lock_bh(&g_cdev.lock);
        pd = g_cdev.active_pd;
        if (pd)
diff --git a/drivers/staging/sb105x/sb_pci_mp.c b/drivers/staging/sb105x/sb_pci_mp.c
index 23db32f07fd5..a10cdb17038b 100644
--- a/drivers/staging/sb105x/sb_pci_mp.c
+++ b/drivers/staging/sb105x/sb_pci_mp.c
@@ -1063,7 +1063,7 @@ static int mp_wait_modem_status(struct sb_uart_state *state, unsigned long arg)
 static int mp_get_count(struct sb_uart_state *state, struct serial_icounter_struct *icnt)
 {
-        struct serial_icounter_struct icount;
+        struct serial_icounter_struct icount = {};
        struct sb_uart_icount cnow;
        struct sb_uart_port *port = state->port;
diff --git a/drivers/staging/wlags49_h2/wl_priv.c b/drivers/staging/wlags49_h2/wl_priv.c
index c97e0e154d28..7e10dcdc3090 100644
--- a/drivers/staging/wlags49_h2/wl_priv.c
+++ b/drivers/staging/wlags49_h2/wl_priv.c
@@ -570,6 +570,7 @@ int wvlan_uil_put_info(struct uilreq *urq, struct wl_private *lp)
        ltv_t                   *pLtv;
        bool_t                  ltvAllocated = FALSE;
        ENCSTRCT                sEncryption;
+        size_t                  len;
 #ifdef USE_WDS
        hcf_16                  hcfPort  = HCF_PORT_0;
@@ -686,7 +687,8 @@ int wvlan_uil_put_info(struct uilreq *urq, struct wl_private *lp)
                                        break;
                                case CFG_CNF_OWN_NAME:
                                        memset(lp->StationName, 0, sizeof(lp->StationName));
-                                        memcpy((void *)lp->StationName, (void *)&pLtv->u.u8[2], (size_t)pLtv->u.u16[0]);
+                                        len = min_t(size_t, pLtv->u.u16[0], sizeof(lp->StationName));
+                                        strlcpy(lp->StationName, &pLtv->u.u8[2], len);
                                        pLtv->u.u16[0] = CNV_INT_TO_LITTLE(pLtv->u.u16[0]);
                                        break;
                                case CFG_CNF_LOAD_BALANCING:
@@ -1783,6 +1785,7 @@ int wvlan_set_station_nickname(struct net_device *dev,
 {
        struct wl_private *lp = wl_priv(dev);
        unsigned long flags;
+        size_t len;
        int         ret = 0;
        /*------------------------------------------------------------------------*/
@@ -1793,8 +1796,8 @@ int wvlan_set_station_nickname(struct net_device *dev,
        wl_lock(lp, &flags);
        memset(lp->StationName, 0, sizeof(lp->StationName));
+        len = min_t(size_t, wrqu->data.length, sizeof(lp->StationName));
-        memcpy(lp->StationName, extra, wrqu->data.length);
+        strlcpy(lp->StationName, extra, len);
        /* Commit the adapter parameters */
        wl_apply(lp);
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 551c96ca60ac..0f199f6a0738 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -134,10 +134,10 @@ static int pscsi_pmode_enable_hba(struct se_hba *hba, unsigned long mode_flag)
         * pSCSI Host ID and enable for phba mode
         */
        sh = scsi_host_lookup(phv->phv_host_id);
-        if (IS_ERR(sh)) {
+        if (!sh) {
                pr_err("pSCSI: Unable to locate SCSI Host for"
                        " phv_host_id: %d\n", phv->phv_host_id);
-                return PTR_ERR(sh);
+                return -EINVAL;
        }
        phv->phv_lld_host = sh;
@@ -515,10 +515,10 @@ static int pscsi_configure_device(struct se_device *dev)
                        sh = phv->phv_lld_host;
                } else {
                        sh = scsi_host_lookup(pdv->pdv_host_id);
-                        if (IS_ERR(sh)) {
+                        if (!sh) {
                                pr_err("pSCSI: Unable to locate"
                                        " pdv_host_id: %d\n", pdv->pdv_host_id);
-                                return PTR_ERR(sh);
+                                return -EINVAL;
                        }
                }
        } else {
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 4714c6f8da4b..d9b92b2c524d 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -263,6 +263,11 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
                        sectors, cmd->se_dev->dev_attrib.max_write_same_len);
                return TCM_INVALID_CDB_FIELD;
        }
+        /* We always have ANC_SUP == 0 so setting ANCHOR is always an error */
+        if (flags[0] & 0x10) {
+                pr_warn("WRITE SAME with ANCHOR not supported\n");
+                return TCM_INVALID_CDB_FIELD;
+        }
        /*
         * Special case for WRITE_SAME w/ UNMAP=1 that ends up getting
         * translated into block discard requests within backend code.
diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index 3da4fd10b9f8..474cd44fac14 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -82,6 +82,9 @@ static int target_xcopy_locate_se_dev_e4(struct se_cmd *se_cmd, struct xcopy_op
        mutex_lock(&g_device_mutex);
        list_for_each_entry(se_dev, &g_device_list, g_dev_node) {
+                if (!se_dev->dev_attrib.emulate_3pc)
+                        continue;
                memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);
                target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]);
@@ -357,6 +360,7 @@ struct xcopy_pt_cmd {
        struct se_cmd se_cmd;
        struct xcopy_op *xcopy_op;
        struct completion xpt_passthrough_sem;
+        unsigned char sense_buffer[TRANSPORT_SENSE_BUFFER];
 };
 static struct se_port xcopy_pt_port;
@@ -675,7 +679,8 @@ static int target_xcopy_issue_pt_cmd(struct xcopy_pt_cmd *xpt_cmd)
        pr_debug("target_xcopy_issue_pt_cmd(): SCSI status: 0x%02x\n",
                        se_cmd->scsi_status);
-        return 0;
+        return (se_cmd->scsi_status) ? -EINVAL : 0;
 }
 static int target_xcopy_read_source(
@@ -708,7 +713,7 @@ static int target_xcopy_read_source(
                (unsigned long long)src_lba, src_sectors, length);
        transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, NULL, length,
-                                DMA_FROM_DEVICE, 0, NULL);
+                              DMA_FROM_DEVICE, 0, &xpt_cmd->sense_buffer[0]);
        xop->src_pt_cmd = xpt_cmd;
        rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, src_dev, &cdb[0],
@@ -768,7 +773,7 @@ static int target_xcopy_write_destination(
                (unsigned long long)dst_lba, dst_sectors, length);
        transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, NULL, length,
-                                DMA_TO_DEVICE, 0, NULL);
+                              DMA_TO_DEVICE, 0, &xpt_cmd->sense_buffer[0]);
        xop->dst_pt_cmd = xpt_cmd;
        rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, dst_dev, &cdb[0],
@@ -884,30 +889,42 @@ out:
 sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
 {
+        struct se_device *dev = se_cmd->se_dev;
        struct xcopy_op *xop = NULL;
        unsigned char *p = NULL, *seg_desc;
        unsigned int list_id, list_id_usage, sdll, inline_dl, sa;
+        sense_reason_t ret = TCM_INVALID_PARAMETER_LIST;
        int rc;
        unsigned short tdll;
+        if (!dev->dev_attrib.emulate_3pc) {
+                pr_err("EXTENDED_COPY operation explicitly disabled\n");
+                return TCM_UNSUPPORTED_SCSI_OPCODE;
+        }
        sa = se_cmd->t_task_cdb[1] & 0x1f;
        if (sa != 0x00) {
                pr_err("EXTENDED_COPY(LID4) not supported\n");
                return TCM_UNSUPPORTED_SCSI_OPCODE;
        }
+        xop = kzalloc(sizeof(struct xcopy_op), GFP_KERNEL);
+        if (!xop) {
+                pr_err("Unable to allocate xcopy_op\n");
+                return TCM_OUT_OF_RESOURCES;
+        }
+        xop->xop_se_cmd = se_cmd;
        p = transport_kmap_data_sg(se_cmd);
        if (!p) {
                pr_err("transport_kmap_data_sg() failed in target_do_xcopy\n");
+                kfree(xop);
                return TCM_OUT_OF_RESOURCES;
        }
        list_id = p[0];
-        if (list_id != 0x00) {
+        list_id_usage = (p[1] & 0x18) >> 3;
-                pr_err("XCOPY with non zero list_id: 0x%02x\n", list_id);
-                goto out;
-        }
-        list_id_usage = (p[1] & 0x18);
        /*
         * Determine TARGET DESCRIPTOR LIST LENGTH + SEGMENT DESCRIPTOR LIST LENGTH
         */
@@ -920,13 +937,6 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
                goto out;
        }
-        xop = kzalloc(sizeof(struct xcopy_op), GFP_KERNEL);
-        if (!xop) {
-                pr_err("Unable to allocate xcopy_op\n");
-                goto out;
-        }
-        xop->xop_se_cmd = se_cmd;
        pr_debug("Processing XCOPY with list_id: 0x%02x list_id_usage: 0x%02x"
                " tdll: %hu sdll: %u inline_dl: %u\n", list_id, list_id_usage,
                tdll, sdll, inline_dl);
@@ -935,6 +945,17 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
        if (rc <= 0)
                goto out;
+        if (xop->src_dev->dev_attrib.block_size !=
+            xop->dst_dev->dev_attrib.block_size) {
+                pr_err("XCOPY: Non matching src_dev block_size: %u + dst_dev"
+                       " block_size: %u currently unsupported\n",
+                        xop->src_dev->dev_attrib.block_size,
+                        xop->dst_dev->dev_attrib.block_size);
+                xcopy_pt_undepend_remotedev(xop);
+                ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                goto out;
+        }
        pr_debug("XCOPY: Processed %d target descriptors, length: %u\n", rc,
                                rc * XCOPY_TARGET_DESC_LEN);
        seg_desc = &p[16];
@@ -957,7 +978,7 @@ out:
        if (p)
                transport_kunmap_data_sg(se_cmd);
        kfree(xop);
-        return TCM_INVALID_CDB_FIELD;
+        return ret;
 }
 static sense_reason_t target_rcr_operating_parameters(struct se_cmd *se_cmd)
diff --git a/drivers/thermal/samsung/exynos_thermal_common.c b/drivers/thermal/samsung/exynos_thermal_common.c
index f10a6ad37c06..c2301da08ac7 100644
--- a/drivers/thermal/samsung/exynos_thermal_common.c
+++ b/drivers/thermal/samsung/exynos_thermal_common.c
@@ -310,8 +310,6 @@ void exynos_report_trigger(struct thermal_sensor_conf *conf)
        }
        th_zone = conf->pzone_data;
-        if (th_zone->therm_dev)
-                return;
        if (th_zone->bind == false) {
                for (i = 0; i < th_zone->cool_dev_size; i++) {
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index b43afda8acd1..32f38b90c4f6 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -317,6 +317,9 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
        con = readl(data->base + reg->tmu_ctrl);
+        if (pdata->test_mux)
+                con |= (pdata->test_mux << reg->test_mux_addr_shift);
        if (pdata->reference_voltage) {
                con &= ~(reg->buf_vref_sel_mask << reg->buf_vref_sel_shift);
                con |= pdata->reference_voltage << reg->buf_vref_sel_shift;
@@ -488,7 +491,7 @@ static const struct of_device_id exynos_tmu_match[] = {
        },
        {
                .compatible = "samsung,exynos4412-tmu",
-                .data = (void *)EXYNOS5250_TMU_DRV_DATA,
+                .data = (void *)EXYNOS4412_TMU_DRV_DATA,
        },
        {
                .compatible = "samsung,exynos5250-tmu",
@@ -629,9 +632,10 @@ static int exynos_tmu_probe(struct platform_device *pdev)
        if (ret)
                return ret;
-        if (pdata->type == SOC_ARCH_EXYNOS ||
+        if (pdata->type == SOC_ARCH_EXYNOS4210 ||
-                pdata->type == SOC_ARCH_EXYNOS4210 ||
+            pdata->type == SOC_ARCH_EXYNOS4412 ||
-                                pdata->type == SOC_ARCH_EXYNOS5440)
+            pdata->type == SOC_ARCH_EXYNOS5250 ||
+            pdata->type == SOC_ARCH_EXYNOS5440)
                data->soc = pdata->type;
        else {
                ret = -EINVAL;
diff --git a/drivers/thermal/samsung/exynos_tmu.h b/drivers/thermal/samsung/exynos_tmu.h
index b364c9eee701..3fb65547e64c 100644
--- a/drivers/thermal/samsung/exynos_tmu.h
+++ b/drivers/thermal/samsung/exynos_tmu.h
@@ -41,7 +41,8 @@ enum calibration_mode {
 enum soc_type {
        SOC_ARCH_EXYNOS4210 = 1,
-        SOC_ARCH_EXYNOS,
+        SOC_ARCH_EXYNOS4412,
+        SOC_ARCH_EXYNOS5250,
        SOC_ARCH_EXYNOS5440,
 };
@@ -84,6 +85,7 @@ enum soc_type {
 * @triminfo_reload_shift: shift of triminfo reload enable bit in triminfo_ctrl
        reg.
 * @tmu_ctrl: TMU main controller register.
+ * @test_mux_addr_shift: shift bits of test mux address.
 * @buf_vref_sel_shift: shift bits of reference voltage in tmu_ctrl register.
 * @buf_vref_sel_mask: mask bits of reference voltage in tmu_ctrl register.
 * @therm_trip_mode_shift: shift bits of tripping mode in tmu_ctrl register.
@@ -150,6 +152,7 @@ struct exynos_tmu_registers {
        u32     triminfo_reload_shift;
        u32     tmu_ctrl;
+        u32     test_mux_addr_shift;
        u32     buf_vref_sel_shift;
        u32     buf_vref_sel_mask;
        u32     therm_trip_mode_shift;
@@ -257,6 +260,7 @@ struct exynos_tmu_registers {
 * @first_point_trim: temp value of the first point trimming
 * @second_point_trim: temp value of the second point trimming
 * @default_temp_offset: default temperature offset in case of no trimming
+ * @test_mux; information if SoC supports test MUX
 * @cal_type: calibration type for temperature
 * @cal_mode: calibration mode for temperature
 * @freq_clip_table: Table representing frequency reduction percentage.
@@ -286,6 +290,7 @@ struct exynos_tmu_platform_data {
        u8 first_point_trim;
        u8 second_point_trim;
        u8 default_temp_offset;
+        u8 test_mux;
        enum calibration_type cal_type;
        enum calibration_mode cal_mode;
diff --git a/drivers/thermal/samsung/exynos_tmu_data.c b/drivers/thermal/samsung/exynos_tmu_data.c
index 9002499c1f69..073c292baa53 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.c
+++ b/drivers/thermal/samsung/exynos_tmu_data.c
@@ -90,14 +90,15 @@ struct exynos_tmu_init_data const exynos4210_default_tmu_data = {
 };
 #endif
-#if defined(CONFIG_SOC_EXYNOS5250) || defined(CONFIG_SOC_EXYNOS4412)
+#if defined(CONFIG_SOC_EXYNOS4412) || defined(CONFIG_SOC_EXYNOS5250)
-static const struct exynos_tmu_registers exynos5250_tmu_registers = {
+static const struct exynos_tmu_registers exynos4412_tmu_registers = {
        .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
        .triminfo_ctrl = EXYNOS_TMU_TRIMINFO_CON,
        .triminfo_reload_shift = EXYNOS_TRIMINFO_RELOAD_SHIFT,
        .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
+        .test_mux_addr_shift = EXYNOS4412_MUX_ADDR_SHIFT,
        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
        .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
@@ -128,7 +129,7 @@ static const struct exynos_tmu_registers exynos5250_tmu_registers = {
        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
-#define EXYNOS5250_TMU_DATA \
+#define EXYNOS4412_TMU_DATA \
        .threshold_falling = 10, \
        .trigger_levels[0] = 85, \
        .trigger_levels[1] = 103, \
@@ -162,15 +163,32 @@ static const struct exynos_tmu_registers exynos5250_tmu_registers = {
                .temp_level = 103, \
        }, \
        .freq_tab_count = 2, \
-        .type = SOC_ARCH_EXYNOS, \
+        .registers = &exynos4412_tmu_registers, \
-        .registers = &exynos5250_tmu_registers, \
        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
                        TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
                        TMU_SUPPORT_EMUL_TIME)
+#endif
+#if defined(CONFIG_SOC_EXYNOS4412)
+struct exynos_tmu_init_data const exynos4412_default_tmu_data = {
+        .tmu_data = {
+                {
+                        EXYNOS4412_TMU_DATA,
+                        .type = SOC_ARCH_EXYNOS4412,
+                        .test_mux = EXYNOS4412_MUX_ADDR_VALUE,
+                },
+        },
+        .tmu_count = 1,
+};
+#endif
+#if defined(CONFIG_SOC_EXYNOS5250)
 struct exynos_tmu_init_data const exynos5250_default_tmu_data = {
        .tmu_data = {
-                { EXYNOS5250_TMU_DATA },
+                {
+                        EXYNOS4412_TMU_DATA,
+                        .type = SOC_ARCH_EXYNOS5250,
+                },
        },
        .tmu_count = 1,
 };
diff --git a/drivers/thermal/samsung/exynos_tmu_data.h b/drivers/thermal/samsung/exynos_tmu_data.h
index dc7feb51099b..a1ea19d9e0a6 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.h
+++ b/drivers/thermal/samsung/exynos_tmu_data.h
@@ -95,6 +95,10 @@
 #define EXYNOS_MAX_TRIGGER_PER_REG      4
+/* Exynos4412 specific */
+#define EXYNOS4412_MUX_ADDR_VALUE          6
+#define EXYNOS4412_MUX_ADDR_SHIFT          20
 /*exynos5440 specific registers*/
 #define EXYNOS5440_TMU_S0_7_TRIM                0x000
 #define EXYNOS5440_TMU_S0_7_CTRL                0x020
@@ -138,7 +142,14 @@ extern struct exynos_tmu_init_data const exynos4210_default_tmu_data;
 #define EXYNOS4210_TMU_DRV_DATA (NULL)
 #endif
-#if (defined(CONFIG_SOC_EXYNOS5250) || defined(CONFIG_SOC_EXYNOS4412))
+#if defined(CONFIG_SOC_EXYNOS4412)
+extern struct exynos_tmu_init_data const exynos4412_default_tmu_data;
+#define EXYNOS4412_TMU_DRV_DATA (&exynos4412_default_tmu_data)
+#else
+#define EXYNOS4412_TMU_DRV_DATA (NULL)
+#endif
+#if defined(CONFIG_SOC_EXYNOS5250)
 extern struct exynos_tmu_init_data const exynos5250_default_tmu_data;
 #define EXYNOS5250_TMU_DRV_DATA (&exynos5250_default_tmu_data)
 #else
diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
index eeef0e2498ca..fdb07199d9c2 100644
--- a/drivers/thermal/thermal_hwmon.c
+++ b/drivers/thermal/thermal_hwmon.c
@@ -159,7 +159,7 @@ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
        INIT_LIST_HEAD(&hwmon->tz_list);
        strlcpy(hwmon->type, tz->type, THERMAL_NAME_LENGTH);
-        hwmon->device = hwmon_device_register(&tz->device);
+        hwmon->device = hwmon_device_register(NULL);
        if (IS_ERR(hwmon->device)) {
                result = PTR_ERR(hwmon->device);
                goto free_mem;
diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
index 4f8b9af54a5a..5a47cc8c8f85 100644
--- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
@@ -110,6 +110,7 @@ static inline int ti_thermal_get_temp(struct thermal_zone_device *thermal,
                } else {
                        dev_err(bgp->dev,
                                "Failed to read PCB state. Using defaults\n");
+                        ret = 0;
                }
        }
        *temp = ti_thermal_hotspot_temperature(tmp, slope, constant);
diff --git a/drivers/thermal/x86_pkg_temp_thermal.c b/drivers/thermal/x86_pkg_temp_thermal.c
index f36950e4134f..7722cb9d5a80 100644
--- a/drivers/thermal/x86_pkg_temp_thermal.c
+++ b/drivers/thermal/x86_pkg_temp_thermal.c
@@ -316,18 +316,19 @@ static void pkg_temp_thermal_threshold_work_fn(struct work_struct *work)
        int phy_id = topology_physical_package_id(cpu);
        struct phy_dev_entry *phdev = pkg_temp_thermal_get_phy_entry(cpu);
        bool notify = false;
+        unsigned long flags;
        if (!phdev)
                return;
-        spin_lock(&pkg_work_lock);
+        spin_lock_irqsave(&pkg_work_lock, flags);
        ++pkg_work_cnt;
        if (unlikely(phy_id > max_phy_id)) {
-                spin_unlock(&pkg_work_lock);
+                spin_unlock_irqrestore(&pkg_work_lock, flags);
                return;
        }
        pkg_work_scheduled[phy_id] = 0;
-        spin_unlock(&pkg_work_lock);
+        spin_unlock_irqrestore(&pkg_work_lock, flags);
        enable_pkg_thres_interrupt();
        rdmsrl(MSR_IA32_PACKAGE_THERM_STATUS, msr_val);
@@ -397,6 +398,7 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
        int thres_count;
        u32 eax, ebx, ecx, edx;
        u8 *temp;
+        unsigned long flags;
        cpuid(6, &eax, &ebx, &ecx, &edx);
        thres_count = ebx & 0x07;
@@ -420,19 +422,19 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
                goto err_ret_unlock;
        }
-        spin_lock(&pkg_work_lock);
+        spin_lock_irqsave(&pkg_work_lock, flags);
        if (topology_physical_package_id(cpu) > max_phy_id)
                max_phy_id = topology_physical_package_id(cpu);
        temp = krealloc(pkg_work_scheduled,
                        (max_phy_id+1) * sizeof(u8), GFP_ATOMIC);
        if (!temp) {
-                spin_unlock(&pkg_work_lock);
+                spin_unlock_irqrestore(&pkg_work_lock, flags);
                err = -ENOMEM;
                goto err_ret_free;
        }
        pkg_work_scheduled = temp;
        pkg_work_scheduled[topology_physical_package_id(cpu)] = 0;
-        spin_unlock(&pkg_work_lock);
+        spin_unlock_irqrestore(&pkg_work_lock, flags);
        phy_dev_entry->phys_proc_id = topology_physical_package_id(cpu);
        phy_dev_entry->first_cpu = cpu;
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index d067285a2d20..6b0f75eac8a2 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1499,7 +1499,7 @@ static void atmel_set_ops(struct uart_port *port)
 /*
 * Get ip name usart or uart
 */
-static int atmel_get_ip_name(struct uart_port *port)
+static void atmel_get_ip_name(struct uart_port *port)
 {
        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
        int name = UART_GET_IP_NAME(port);
@@ -1518,10 +1518,7 @@ static int atmel_get_ip_name(struct uart_port *port)
                atmel_port->is_usart = false;
        } else {
                dev_err(port->dev, "Not supported ip name, set to uart\n");
-                return -EINVAL;
        }
-        return 0;
 }
 /*
@@ -2405,9 +2402,7 @@ static int atmel_serial_probe(struct platform_device *pdev)
        /*
         * Get port name of usart or uart
         */
-        ret = atmel_get_ip_name(&port->uart);
+        atmel_get_ip_name(&port->uart);
-        if (ret < 0)
-                goto err_add_port;
        return 0;
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index ba475632c5fa..0e808cf91d97 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -642,16 +642,29 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
 {
        struct uio_device *idev = vma->vm_private_data;
        int mi = uio_find_mem_index(vma);
+        struct uio_mem *mem;
        if (mi < 0)
                return -EINVAL;
+        mem = idev->info->mem + mi;
-        vma->vm_ops = &uio_physical_vm_ops;
+        if (vma->vm_end - vma->vm_start > mem->size)
+                return -EINVAL;
+        vma->vm_ops = &uio_physical_vm_ops;
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+        /*
+         * We cannot use the vm_iomap_memory() helper here,
+         * because vma->vm_pgoff is the map index we looked
+         * up above in uio_find_mem_index(), rather than an
+         * actual page offset into the mmap.
+         *
+         * So we just do the physical mmap without a page
+         * offset.
+         */
        return remap_pfn_range(vma,
                               vma->vm_start,
-                               idev->info->mem[mi].addr >> PAGE_SHIFT,
+                               mem->addr >> PAGE_SHIFT,
                               vma->vm_end - vma->vm_start,
                               vma->vm_page_prot);
 }
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index c45f9c0a1b34..b21d553c245b 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -904,6 +904,7 @@ static struct usb_device_id id_table_combined [] = {
        { USB_DEVICE(FTDI_VID, FTDI_LUMEL_PD12_PID) },
        /* Crucible Devices */
        { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
        { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 1b8af461b522..a7019d1e3058 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1307,3 +1307,9 @@
 * Manufacturer: Crucible Technologies
 */
 #define FTDI_CT_COMET_PID       0x8e08
+/*
+ * Product: Z3X Box
+ * Manufacturer: Smart GSM Team
+ */
+#define FTDI_Z3X_PID            0x0011
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index bedf8e47713b..1e6de4cd079d 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -4,11 +4,6 @@
 * Copyright (C) 2001-2007 Greg Kroah-Hartman (greg@kroah.com)
 * Copyright (C) 2003 IBM Corp.
 *
- * Copyright (C) 2009, 2013 Frank Schäfer <fschaefer.oss@googlemail.com>
- *  - fixes, improvements and documentation for the baud rate encoding methods
- * Copyright (C) 2013 Reinhard Max <max@suse.de>
- *  - fixes and improvements for the divisor based baud rate encoding method
- *
 * Original driver for 2.2.x by anonymous
 *
 *      This program is free software; you can redistribute it and/or
@@ -134,18 +129,10 @@ MODULE_DEVICE_TABLE(usb, id_table);
 enum pl2303_type {
-        type_0,         /* H version ? */
+        type_0,         /* don't know the difference between type 0 and */
-        type_1,         /* H version ? */
+        type_1,         /* type 1, until someone from prolific tells us... */
-        HX_TA,          /* HX(A) / X(A) / TA version  */ /* TODO: improve */
+        HX,             /* HX version of the pl2303 chip */
-        HXD_EA_RA_SA,   /* HXD / EA / RA / SA version */ /* TODO: improve */
-        TB,             /* TB version */
-        HX_CLONE,       /* Cheap and less functional clone of the HX chip */
 };
-/*
- * NOTE: don't know the difference between type 0 and type 1,
- * until someone from Prolific tells us...
- * TODO: distinguish between X/HX, TA and HXD, EA, RA, SA variants
- */
 struct pl2303_serial_private {
        enum pl2303_type type;
@@ -185,7 +172,6 @@ static int pl2303_startup(struct usb_serial *serial)
 {
        struct pl2303_serial_private *spriv;
        enum pl2303_type type = type_0;
-        char *type_str = "unknown (treating as type_0)";
        unsigned char *buf;
        spriv = kzalloc(sizeof(*spriv), GFP_KERNEL);
@@ -198,53 +184,15 @@ static int pl2303_startup(struct usb_serial *serial)
                return -ENOMEM;
        }
-        if (serial->dev->descriptor.bDeviceClass == 0x02) {
+        if (serial->dev->descriptor.bDeviceClass == 0x02)
                type = type_0;
-                type_str = "type_0";
+        else if (serial->dev->descriptor.bMaxPacketSize0 == 0x40)
-        } else if (serial->dev->descriptor.bMaxPacketSize0 == 0x40) {
+                type = HX;
-                /*
+        else if (serial->dev->descriptor.bDeviceClass == 0x00)
-                 * NOTE: The bcdDevice version is the only difference between
-                 * the device descriptors of the X/HX, HXD, EA, RA, SA, TA, TB
-                 */
-                if (le16_to_cpu(serial->dev->descriptor.bcdDevice) == 0x300) {
-                        /* Check if the device is a clone */
-                        pl2303_vendor_read(0x9494, 0, serial, buf);
-                        /*
-                         * NOTE: Not sure if this read is really needed.
-                         * The HX returns 0x00, the clone 0x02, but the Windows
-                         * driver seems to ignore the value and continues.
-                         */
-                        pl2303_vendor_write(0x0606, 0xaa, serial);
-                        pl2303_vendor_read(0x8686, 0, serial, buf);
-                        if (buf[0] != 0xaa) {
-                                type = HX_CLONE;
-                                type_str = "X/HX clone (limited functionality)";
-                        } else {
-                                type = HX_TA;
-                                type_str = "X/HX/TA";
-                        }
-                        pl2303_vendor_write(0x0606, 0x00, serial);
-                } else if (le16_to_cpu(serial->dev->descriptor.bcdDevice)
-                                                                     == 0x400) {
-                        type = HXD_EA_RA_SA;
-                        type_str = "HXD/EA/RA/SA";
-                } else if (le16_to_cpu(serial->dev->descriptor.bcdDevice)
-                                                                     == 0x500) {
-                        type = TB;
-                        type_str = "TB";
-                } else {
-                        dev_info(&serial->interface->dev,
-                                           "unknown/unsupported device type\n");
-                        kfree(spriv);
-                        kfree(buf);
-                        return -ENODEV;
-                }
-        } else if (serial->dev->descriptor.bDeviceClass == 0x00
-                   || serial->dev->descriptor.bDeviceClass == 0xFF) {
                type = type_1;
-                type_str = "type_1";
+        else if (serial->dev->descriptor.bDeviceClass == 0xFF)
-        }
+                type = type_1;
-        dev_dbg(&serial->interface->dev, "device type: %s\n", type_str);
+        dev_dbg(&serial->interface->dev, "device type: %d\n", type);
        spriv->type = type;
        usb_set_serial_data(serial, spriv);
@@ -259,10 +207,10 @@ static int pl2303_startup(struct usb_serial *serial)
        pl2303_vendor_read(0x8383, 0, serial, buf);
        pl2303_vendor_write(0, 1, serial);
        pl2303_vendor_write(1, 0, serial);
-        if (type == type_0 || type == type_1)
+        if (type == HX)
-                pl2303_vendor_write(2, 0x24, serial);
-        else
                pl2303_vendor_write(2, 0x44, serial);
+        else
+                pl2303_vendor_write(2, 0x24, serial);
        kfree(buf);
        return 0;
@@ -316,174 +264,65 @@ static int pl2303_set_control_lines(struct usb_serial_port *port, u8 value)
        return retval;
 }
-static int pl2303_baudrate_encode_direct(int baud, enum pl2303_type type,
+static void pl2303_encode_baudrate(struct tty_struct *tty,
-                                                                      u8 buf[4])
+                                        struct usb_serial_port *port,
+                                        u8 buf[4])
 {
-        /*
-         * NOTE: Only the values defined in baud_sup are supported !
-         * => if unsupported values are set, the PL2303 uses 9600 baud instead
-         * => HX clones just don't work at unsupported baud rates < 115200 baud,
-         *    for baud rates > 115200 they run at 115200 baud
-         */
        const int baud_sup[] = { 75, 150, 300, 600, 1200, 1800, 2400, 3600,
-                                 4800, 7200, 9600, 14400, 19200, 28800, 38400,
+                                 4800, 7200, 9600, 14400, 19200, 28800, 38400,
-                                 57600, 115200, 230400, 460800, 614400, 921600,
+                                 57600, 115200, 230400, 460800, 500000, 614400,
-                                 1228800, 2457600, 3000000, 6000000, 12000000 };
+                                 921600, 1228800, 2457600, 3000000, 6000000 };
+        struct usb_serial *serial = port->serial;
+        struct pl2303_serial_private *spriv = usb_get_serial_data(serial);
+        int baud;
+        int i;
        /*
-         * NOTE: With the exception of type_0/1 devices, the following
+         * NOTE: Only the values defined in baud_sup are supported!
-         * additional baud rates are supported (tested with HX rev. 3A only):
+         *       => if unsupported values are set, the PL2303 seems to use
-         * 110*, 56000*, 128000, 134400, 161280, 201600, 256000*, 268800,
+         *          9600 baud (at least my PL2303X always does)
-         * 403200, 806400.      (*: not HX and HX clones)
-         *
-         * Maximum values: HXD, TB: 12000000; HX, TA: 6000000;
-         *                 type_0+1: 1228800; RA: 921600; HX clones, SA: 115200
-         *
-         * As long as we are not using this encoding method for anything else
-         * than the type_0+1, HX and HX clone chips, there is no point in
-         * complicating the code to support them.
         */
-        int i;
+        baud = tty_get_baud_rate(tty);
+        dev_dbg(&port->dev, "baud requested = %d\n", baud);
+        if (!baud)
+                return;
        /* Set baudrate to nearest supported value */
        for (i = 0; i < ARRAY_SIZE(baud_sup); ++i) {
                if (baud_sup[i] > baud)
                        break;
        }
        if (i == ARRAY_SIZE(baud_sup))
                baud = baud_sup[i - 1];
        else if (i > 0 && (baud_sup[i] - baud) > (baud - baud_sup[i - 1]))
                baud = baud_sup[i - 1];
        else
                baud = baud_sup[i];
-        /* Respect the chip type specific baud rate limits */
-        /*
-         * FIXME: as long as we don't know how to distinguish between the
-         * HXD, EA, RA, and SA chip variants, allow the max. value of 12M.
-         */
-        if (type == HX_TA)
-                baud = min_t(int, baud, 6000000);
-        else if (type == type_0 || type == type_1)
-                baud = min_t(int, baud, 1228800);
-        else if (type == HX_CLONE)
-                baud = min_t(int, baud, 115200);
-        /* Direct (standard) baud rate encoding method */
-        put_unaligned_le32(baud, buf);
-        return baud;
-}
-static int pl2303_baudrate_encode_divisor(int baud, enum pl2303_type type,
+        /* type_0, type_1 only support up to 1228800 baud */
-                                                                      u8 buf[4])
+        if (spriv->type != HX)
-{
+                baud = min_t(int, baud, 1228800);
-        /*
-         * Divisor based baud rate encoding method
-         *
-         * NOTE: HX clones do NOT support this method.
-         * It's not clear if the type_0/1 chips support it.
-         *
-         * divisor = 12MHz * 32 / baudrate = 2^A * B
-         *
-         * with
-         *
-         * A = buf[1] & 0x0e
-         * B = buf[0]  +  (buf[1] & 0x01) << 8
-         *
-         * Special cases:
-         * => 8 < B < 16: device seems to work not properly
-         * => B <= 8: device uses the max. value B = 512 instead
-         */
-        unsigned int A, B;
-        /*
+        if (baud <= 115200) {
-         * NOTE: The Windows driver allows maximum baud rates of 110% of the
+                put_unaligned_le32(baud, buf);
-         * specified maximium value.
-         * Quick tests with early (2004) HX (rev. A) chips suggest, that even
-         * higher baud rates (up to the maximum of 24M baud !) are working fine,
-         * but that should really be tested carefully in "real life" scenarios
-         * before removing the upper limit completely.
-         * Baud rates smaller than the specified 75 baud are definitely working
-         * fine.
-         */
-        if (type == type_0 || type == type_1)
-                baud = min_t(int, baud, 1228800 * 1.1);
-        else if (type == HX_TA)
-                baud = min_t(int, baud, 6000000 * 1.1);
-        else if (type == HXD_EA_RA_SA)
-                /* HXD, EA: 12Mbps; RA: 1Mbps; SA: 115200 bps */
-                /*
-                 * FIXME: as long as we don't know how to distinguish between
-                 * these chip variants, allow the max. of these values
-                 */
-                baud = min_t(int, baud, 12000000 * 1.1);
-        else if (type == TB)
-                baud = min_t(int, baud, 12000000 * 1.1);
-        /* Determine factors A and B */
-        A = 0;
-        B = 12000000 * 32 / baud;  /* 12MHz */
-        B <<= 1; /* Add one bit for rounding */
-        while (B > (512 << 1) && A <= 14) {
-                A += 2;
-                B >>= 2;
-        }
-        if (A > 14) { /* max. divisor = min. baudrate reached */
-                A = 14;
-                B = 512;
-                /* => ~45.78 baud */
        } else {
-                B = (B + 1) >> 1; /* Round the last bit */
-        }
-        /* Handle special cases */
-        if (B == 512)
-                B = 0; /* also: 1 to 8 */
-        else if (B < 16)
                /*
-                 * NOTE: With the current algorithm this happens
+                 * Apparently the formula for higher speeds is:
-                 * only for A=0 and means that the min. divisor
+                 * baudrate = 12M * 32 / (2^buf[1]) / buf[0]
-                 * (respectively: the max. baudrate) is reached.
                 */
-                B = 16;         /* => 24 MBaud */
+                unsigned tmp = 12000000 * 32 / baud;
-        /* Encode the baud rate */
+                buf[3] = 0x80;
-        buf[3] = 0x80;     /* Select divisor encoding method */
+                buf[2] = 0;
-        buf[2] = 0;
+                buf[1] = (tmp >= 256);
-        buf[1] = (A & 0x0e);            /* A */
+                while (tmp >= 256) {
-        buf[1] |= ((B & 0x100) >> 8);   /* MSB of B */
+                        tmp >>= 2;
-        buf[0] = B & 0xff;              /* 8 LSBs of B */
+                        buf[1] <<= 1;
-        /* Calculate the actual/resulting baud rate */
+                }
-        if (B <= 8)
+                buf[0] = tmp;
-                B = 512;
+        }
-        baud = 12000000 * 32 / ((1 << A) * B);
-        return baud;
-}
-static void pl2303_encode_baudrate(struct tty_struct *tty,
-                                        struct usb_serial_port *port,
-                                        enum pl2303_type type,
-                                        u8 buf[4])
-{
-        int baud;
-        baud = tty_get_baud_rate(tty);
-        dev_dbg(&port->dev, "baud requested = %d\n", baud);
-        if (!baud)
-                return;
-        /*
-         * There are two methods for setting/encoding the baud rate
-         * 1) Direct method: encodes the baud rate value directly
-         *    => supported by all chip types
-         * 2) Divisor based method: encodes a divisor to a base value (12MHz*32)
-         *    => not supported by HX clones (and likely type_0/1 chips)
-         *
-         * NOTE: Although the divisor based baud rate encoding method is much
-         * more flexible, some of the standard baud rate values can not be
-         * realized exactly. But the difference is very small (max. 0.2%) and
-         * the device likely uses the same baud rate generator for both methods
-         * so that there is likley no difference.
-         */
-        if (type == type_0 || type == type_1 || type == HX_CLONE)
-                baud = pl2303_baudrate_encode_direct(baud, type, buf);
-        else
-                baud = pl2303_baudrate_encode_divisor(baud, type, buf);
        /* Save resulting baud rate */
        tty_encode_baud_rate(tty, baud, baud);
        dev_dbg(&port->dev, "baud set = %d\n", baud);
@@ -540,8 +379,8 @@ static void pl2303_set_termios(struct tty_struct *tty,
                dev_dbg(&port->dev, "data bits = %d\n", buf[6]);
        }
-        /* For reference:   buf[0]:buf[3] baud rate value */
+        /* For reference buf[0]:buf[3] baud rate value */
-        pl2303_encode_baudrate(tty, port, spriv->type, buf);
+        pl2303_encode_baudrate(tty, port, &buf[0]);
        /* For reference buf[4]=0 is 1 stop bits */
        /* For reference buf[4]=1 is 1.5 stop bits */
@@ -618,10 +457,10 @@ static void pl2303_set_termios(struct tty_struct *tty,
        dev_dbg(&port->dev, "0xa1:0x21:0:0  %d - %7ph\n", i, buf);
        if (C_CRTSCTS(tty)) {
-                if (spriv->type == type_0 || spriv->type == type_1)
+                if (spriv->type == HX)
-                        pl2303_vendor_write(0x0, 0x41, serial);
-                else
                        pl2303_vendor_write(0x0, 0x61, serial);
+                else
+                        pl2303_vendor_write(0x0, 0x41, serial);
        } else {
                pl2303_vendor_write(0x0, 0x0, serial);
        }
@@ -658,7 +497,7 @@ static int pl2303_open(struct tty_struct *tty, struct usb_serial_port *port)
        struct pl2303_serial_private *spriv = usb_get_serial_data(serial);
        int result;
-        if (spriv->type == type_0 || spriv->type == type_1) {
+        if (spriv->type != HX) {
                usb_clear_halt(serial->dev, port->write_urb->pipe);
                usb_clear_halt(serial->dev, port->read_urb->pipe);
        } else {
@@ -833,7 +672,6 @@ static void pl2303_break_ctl(struct tty_struct *tty, int break_state)
        result = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
                                 BREAK_REQUEST, BREAK_REQUEST_TYPE, state,
                                 0, NULL, 0, 100);
-        /* NOTE: HX clones don't support sending breaks, -EPIPE is returned */
        if (result)
                dev_err(&port->dev, "error sending break = %d\n", result);
 }
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index ce5221fa393a..e663921eebb6 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1056,7 +1056,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
                if (data_direction != DMA_NONE) {
                        ret = vhost_scsi_map_iov_to_sgl(cmd,
                                        &vq->iov[data_first], data_num,
-                                        data_direction == DMA_TO_DEVICE);
+                                        data_direction == DMA_FROM_DEVICE);
                        if (unlikely(ret)) {
                                vq_err(vq, "Failed to map iov to sgl\n");
                                goto err_free;
diff --git a/drivers/video/au1100fb.c b/drivers/video/au1100fb.c
index a54ccdc4d661..22ad85242e5b 100644
--- a/drivers/video/au1100fb.c
+++ b/drivers/video/au1100fb.c
@@ -361,37 +361,13 @@ void au1100fb_fb_rotate(struct fb_info *fbi, int angle)
 int au1100fb_fb_mmap(struct fb_info *fbi, struct vm_area_struct *vma)
 {
        struct au1100fb_device *fbdev;
-        unsigned int len;
-        unsigned long start=0, off;
        fbdev = to_au1100fb_device(fbi);
-        if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) {
-                return -EINVAL;
-        }
-        start = fbdev->fb_phys & PAGE_MASK;
-        len = PAGE_ALIGN((start & ~PAGE_MASK) + fbdev->fb_len);
-        off = vma->vm_pgoff << PAGE_SHIFT;
-        if ((vma->vm_end - vma->vm_start + off) > len) {
-                return -EINVAL;
-        }
-        off += start;
-        vma->vm_pgoff = off >> PAGE_SHIFT;
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
        pgprot_val(vma->vm_page_prot) |= (6 << 9); //CCA=6
-        if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
+        return vm_iomap_memory(vma, fbdev->fb_phys, fbdev->fb_len);
-                                vma->vm_end - vma->vm_start,
-                                vma->vm_page_prot)) {
-                return -EAGAIN;
-        }
-        return 0;
 }
 static struct fb_ops au1100fb_ops =
diff --git a/drivers/video/au1200fb.c b/drivers/video/au1200fb.c
index 301224ecc950..1d02897d17f2 100644
--- a/drivers/video/au1200fb.c
+++ b/drivers/video/au1200fb.c
@@ -1233,34 +1233,13 @@ static int au1200fb_fb_blank(int blank_mode, struct fb_info *fbi)
 * method mainly to allow the use of the TLB streaming flag (CCA=6)
 */
 static int au1200fb_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
 {
-        unsigned int len;
-        unsigned long start=0, off;
        struct au1200fb_device *fbdev = info->par;
-        if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) {
-                return -EINVAL;
-        }
-        start = fbdev->fb_phys & PAGE_MASK;
-        len = PAGE_ALIGN((start & ~PAGE_MASK) + fbdev->fb_len);
-        off = vma->vm_pgoff << PAGE_SHIFT;
-        if ((vma->vm_end - vma->vm_start + off) > len) {
-                return -EINVAL;
-        }
-        off += start;
-        vma->vm_pgoff = off >> PAGE_SHIFT;
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
        pgprot_val(vma->vm_page_prot) |= _CACHE_MASK; /* CCA=7 */
-        return io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
+        return vm_iomap_memory(vma, fbdev->fb_phys, fbdev->fb_len);
-                                  vma->vm_end - vma->vm_start,
-                                  vma->vm_page_prot);
 }
 static void set_global(u_int cmd, struct au1200_lcd_global_regs_t *pdata)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index b0ef7b07b1b3..51e3afa78354 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6437,6 +6437,7 @@ noinline int can_nocow_extent(struct inode *inode, u64 offset, u64 *len,
        if (btrfs_extent_readonly(root, disk_bytenr))
                goto out;
+        btrfs_release_path(path);
        /*
         * look for other files referencing this extent, if we
diff --git a/fs/dcache.c b/fs/dcache.c
index 41000305d716..ae6ebb88ceff 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -542,7 +542,7 @@ EXPORT_SYMBOL(d_drop);
 * If ref is non-zero, then decrement the refcount too.
 * Returns dentry requiring refcount drop, or NULL if we're done.
 */
-static inline struct dentry *
+static struct dentry *
 dentry_kill(struct dentry *dentry, int unlock_on_failure)
        __releases(dentry->d_lock)
 {
@@ -630,7 +630,8 @@ repeat:
                        goto kill_it;
        }
-        dentry->d_flags |= DCACHE_REFERENCED;
+        if (!(dentry->d_flags & DCACHE_REFERENCED))
+                dentry->d_flags |= DCACHE_REFERENCED;
        dentry_lru_add(dentry);
        dentry->d_lockref.count--;
@@ -1331,14 +1332,6 @@ rename_retry:
 * list is non-empty and continue searching.
 */
-/**
- * have_submounts - check for mounts over a dentry
- * @parent: dentry to check.
- *
- * Return true if the parent or its subdirectories contain
- * a mount point
- */
 static enum d_walk_ret check_mount(void *data, struct dentry *dentry)
 {
        int *ret = data;
@@ -1349,6 +1342,13 @@ static enum d_walk_ret check_mount(void *data, struct dentry *dentry)
        return D_WALK_CONTINUE;
 }
+/**
+ * have_submounts - check for mounts over a dentry
+ * @parent: dentry to check.
+ *
+ * Return true if the parent or its subdirectories contain
+ * a mount point
+ */
 int have_submounts(struct dentry *parent)
 {
        int ret = 0;
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index c88e355f7635..000eae2782b6 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -408,7 +408,7 @@ static loff_t lower_offset_for_page(struct ecryptfs_crypt_stat *crypt_stat,
                                    struct page *page)
 {
        return ecryptfs_lower_header_size(crypt_stat) +
-               (page->index << PAGE_CACHE_SHIFT);
+               ((loff_t)page->index << PAGE_CACHE_SHIFT);
 }
 /**
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 7d52806c2119..4725a07f003c 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1149,7 +1149,7 @@ decrypt_pki_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
        struct ecryptfs_msg_ctx *msg_ctx;
        struct ecryptfs_message *msg = NULL;
        char *auth_tok_sig;
-        char *payload;
+        char *payload = NULL;
        size_t payload_len = 0;
        int rc;
@@ -1203,6 +1203,7 @@ decrypt_pki_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
        }
 out:
        kfree(msg);
+        kfree(payload);
        return rc;
 }
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 473e09da7d02..810c28fb8c3c 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -34,7 +34,6 @@
 #include <linux/mutex.h>
 #include <linux/anon_inodes.h>
 #include <linux/device.h>
-#include <linux/freezer.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include <asm/mman.h>
@@ -1605,8 +1604,7 @@ fetch_events:
                        }
                        spin_unlock_irqrestore(&ep->lock, flags);
-                        if (!freezable_schedule_hrtimeout_range(to, slack,
+                        if (!schedule_hrtimeout_range(to, slack, HRTIMER_MODE_ABS))
-                                                                HRTIMER_MODE_ABS))
                                timed_out = 1;
                        spin_lock_irqsave(&ep->lock, flags);
diff --git a/fs/file_table.c b/fs/file_table.c
index abdd15ad13c9..e900ca518635 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -297,7 +297,7 @@ void flush_delayed_fput(void)
        delayed_fput(NULL);
 }
-static DECLARE_WORK(delayed_fput_work, delayed_fput);
+static DECLARE_DELAYED_WORK(delayed_fput_work, delayed_fput);
 void fput(struct file *file)
 {
@@ -317,7 +317,7 @@ void fput(struct file *file)
                }
                if (llist_add(&file->f_u.fu_llist, &delayed_fput_list))
-                        schedule_work(&delayed_fput_work);
+                        schedule_delayed_work(&delayed_fput_work, 1);
        }
 }
diff --git a/fs/jfs/jfs_inode.c b/fs/jfs/jfs_inode.c
index c1a3e603279c..7f464c513ba0 100644
--- a/fs/jfs/jfs_inode.c
+++ b/fs/jfs/jfs_inode.c
@@ -95,7 +95,7 @@ struct inode *ialloc(struct inode *parent, umode_t mode)
        if (insert_inode_locked(inode) < 0) {
                rc = -EINVAL;
-                goto fail_unlock;
+                goto fail_put;
        }
        inode_init_owner(inode, parent, mode);
@@ -156,7 +156,6 @@ struct inode *ialloc(struct inode *parent, umode_t mode)
 fail_drop:
        dquot_drop(inode);
        inode->i_flags |= S_NOQUOTA;
-fail_unlock:
        clear_nlink(inode);
        unlock_new_inode(inode);
 fail_put:
diff --git a/fs/namei.c b/fs/namei.c
index 645268f23eb6..caa28051e197 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2294,10 +2294,11 @@ out:
 * path_mountpoint - look up a path to be umounted
 * @dfd:        directory file descriptor to start walk from
 * @name:       full pathname to walk
+ * @path:       pointer to container for result
 * @flags:      lookup flags
 *
 * Look up the given name, but don't attempt to revalidate the last component.
- * Returns 0 and "path" will be valid on success; Retuns error otherwise.
+ * Returns 0 and "path" will be valid on success; Returns error otherwise.
 */
 static int
 path_mountpoint(int dfd, const char *name, struct path *path, unsigned int flags)
diff --git a/fs/select.c b/fs/select.c
index 35d4adc749d9..dfd5cb18c012 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -238,8 +238,7 @@ int poll_schedule_timeout(struct poll_wqueues *pwq, int state,
        set_current_state(state);
        if (!pwq->triggered)
-                rc = freezable_schedule_hrtimeout_range(expires, slack,
+                rc = schedule_hrtimeout_range(expires, slack, HRTIMER_MODE_ABS);
-                                                        HRTIMER_MODE_ABS);
        __set_current_state(TASK_RUNNING);
        /*
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 3135c2525c76..a290157265ef 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -328,6 +328,8 @@ loff_t seq_lseek(struct file *file, loff_t offset, int whence)
                                m->read_pos = offset;
                                retval = file->f_pos = offset;
                        }
+                } else {
+                        file->f_pos = offset;
                }
        }
        file->f_version = m->version;
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index 02e113bb8b7d..d9019821aa60 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -311,7 +311,6 @@ struct acpi_device {
        unsigned int physical_node_count;
        struct list_head physical_node_list;
        struct mutex physical_node_lock;
-        struct list_head power_dependent;
        void (*remove)(struct acpi_device *);
 };
@@ -456,8 +455,6 @@ acpi_status acpi_add_pm_notifier(struct acpi_device *adev,
 acpi_status acpi_remove_pm_notifier(struct acpi_device *adev,
                                    acpi_notify_handler handler);
 int acpi_pm_device_sleep_state(struct device *, int *, int);
-void acpi_dev_pm_add_dependent(acpi_handle handle, struct device *depdev);
-void acpi_dev_pm_remove_dependent(acpi_handle handle, struct device *depdev);
 #else
 static inline acpi_status acpi_add_pm_notifier(struct acpi_device *adev,
                                               acpi_notify_handler handler,
@@ -478,10 +475,6 @@ static inline int acpi_pm_device_sleep_state(struct device *d, int *p, int m)
        return (m >= ACPI_STATE_D0 && m <= ACPI_STATE_D3_COLD) ?
                m : ACPI_STATE_D0;
 }
-static inline void acpi_dev_pm_add_dependent(acpi_handle handle,
-                                             struct device *depdev) {}
-static inline void acpi_dev_pm_remove_dependent(acpi_handle handle,
-                                                struct device *depdev) {}
 #endif
 #ifdef CONFIG_PM_RUNTIME
diff --git a/include/linux/filter.h b/include/linux/filter.h
index a6ac84871d6d..ff4e40cd45b1 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -6,6 +6,7 @@
 #include <linux/atomic.h>
 #include <linux/compat.h>
+#include <linux/workqueue.h>
 #include <uapi/linux/filter.h>
 #ifdef CONFIG_COMPAT
@@ -25,15 +26,19 @@ struct sk_filter
 {
        atomic_t                refcnt;
        unsigned int            len;    /* Number of filter blocks */
+        struct rcu_head         rcu;
        unsigned int            (*bpf_func)(const struct sk_buff *skb,
                                            const struct sock_filter *filter);
-        struct rcu_head         rcu;
+        union {
-        struct sock_filter      insns[0];
+                struct sock_filter      insns[0];
+                struct work_struct      work;
+        };
 };
-static inline unsigned int sk_filter_len(const struct sk_filter *fp)
+static inline unsigned int sk_filter_size(unsigned int proglen)
 {
-        return fp->len * sizeof(struct sock_filter) + sizeof(*fp);
+        return max(sizeof(struct sk_filter),
+                   offsetof(struct sk_filter, insns[proglen]));
 }
 extern int sk_filter(struct sock *sk, struct sk_buff *skb);
@@ -67,11 +72,13 @@ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
 }
 #define SK_RUN_FILTER(FILTER, SKB) (*FILTER->bpf_func)(SKB, FILTER->insns)
 #else
+#include <linux/slab.h>
 static inline void bpf_jit_compile(struct sk_filter *fp)
 {
 }
 static inline void bpf_jit_free(struct sk_filter *fp)
 {
+        kfree(fp);
 }
 #define SK_RUN_FILTER(FILTER, SKB) sk_run_filter(SKB, FILTER->insns)
 #endif
diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
index 19c19a5eee29..f6c82de12541 100644
--- a/include/linux/ipc_namespace.h
+++ b/include/linux/ipc_namespace.h
@@ -34,9 +34,9 @@ struct ipc_namespace {
        int             sem_ctls[4];
        int             used_sems;
-        int             msg_ctlmax;
+        unsigned int    msg_ctlmax;
-        int             msg_ctlmnb;
+        unsigned int    msg_ctlmnb;
-        int             msg_ctlmni;
+        unsigned int    msg_ctlmni;
        atomic_t        msg_bytes;
        atomic_t        msg_hdrs;
        int             auto_msgmni;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3de49aca4519..25f5d2d11e7c 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2264,11 +2264,12 @@ static inline void netif_wake_subqueue(struct net_device *dev, u16 queue_index)
 }
 #ifdef CONFIG_XPS
-extern int netif_set_xps_queue(struct net_device *dev, struct cpumask *mask,
+extern int netif_set_xps_queue(struct net_device *dev,
+                               const struct cpumask *mask,
                               u16 index);
 #else
 static inline int netif_set_xps_queue(struct net_device *dev,
-                                      struct cpumask *mask,
+                                      const struct cpumask *mask,
                                      u16 index)
 {
        return 0;
diff --git a/include/linux/percpu.h b/include/linux/percpu.h
index cc88172c7d9a..c74088ab103b 100644
--- a/include/linux/percpu.h
+++ b/include/linux/percpu.h
@@ -332,7 +332,7 @@ do {									\
 #endif
 #ifndef this_cpu_sub
-# define this_cpu_sub(pcp, val)         this_cpu_add((pcp), -(val))
+# define this_cpu_sub(pcp, val)         this_cpu_add((pcp), -(typeof(pcp))(val))
 #endif
 #ifndef this_cpu_inc
@@ -418,7 +418,7 @@ do {									\
 # define this_cpu_add_return(pcp, val)  __pcpu_size_call_return2(this_cpu_add_return_, pcp, val)
 #endif
-#define this_cpu_sub_return(pcp, val)   this_cpu_add_return(pcp, -(val))
+#define this_cpu_sub_return(pcp, val)   this_cpu_add_return(pcp, -(typeof(pcp))(val))
 #define this_cpu_inc_return(pcp)        this_cpu_add_return(pcp, 1)
 #define this_cpu_dec_return(pcp)        this_cpu_add_return(pcp, -1)
@@ -586,7 +586,7 @@ do {									\
 #endif
 #ifndef __this_cpu_sub
-# define __this_cpu_sub(pcp, val)       __this_cpu_add((pcp), -(val))
+# define __this_cpu_sub(pcp, val)       __this_cpu_add((pcp), -(typeof(pcp))(val))
 #endif
 #ifndef __this_cpu_inc
@@ -668,7 +668,7 @@ do {									\
        __pcpu_size_call_return2(__this_cpu_add_return_, pcp, val)
 #endif
-#define __this_cpu_sub_return(pcp, val) __this_cpu_add_return(pcp, -(val))
+#define __this_cpu_sub_return(pcp, val) __this_cpu_add_return(pcp, -(typeof(pcp))(val))
 #define __this_cpu_inc_return(pcp)      __this_cpu_add_return(pcp, 1)
 #define __this_cpu_dec_return(pcp)      __this_cpu_add_return(pcp, -1)
diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h
index bf8086b2506e..9552afa733d8 100644
--- a/include/linux/sched/sysctl.h
+++ b/include/linux/sched/sysctl.h
@@ -2,8 +2,8 @@
 #define _SCHED_SYSCTL_H
 #ifdef CONFIG_DETECT_HUNG_TASK
+extern int           sysctl_hung_task_check_count;
 extern unsigned int  sysctl_hung_task_panic;
-extern unsigned long sysctl_hung_task_check_count;
 extern unsigned long sysctl_hung_task_timeout_secs;
 extern unsigned long sysctl_hung_task_warnings;
 extern int proc_dohung_task_timeout_secs(struct ctl_table *table, int write,
diff --git a/include/linux/yam.h b/include/linux/yam.h
index 7fe28228b274..512cdc2fb80f 100644
--- a/include/linux/yam.h
+++ b/include/linux/yam.h
@@ -77,6 +77,6 @@ struct yamdrv_ioctl_cfg {
 struct yamdrv_ioctl_mcs {
        int cmd;
-        int bitrate;
+        unsigned int bitrate;
        unsigned char bits[YAM_FPGA_SIZE];
 };
diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
index a7a683e30b64..a8c2ef6d3b93 100644
--- a/include/net/cipso_ipv4.h
+++ b/include/net/cipso_ipv4.h
@@ -290,6 +290,7 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
        unsigned char err_offset = 0;
        u8 opt_len = opt[1];
        u8 opt_iter;
+        u8 tag_len;
        if (opt_len < 8) {
                err_offset = 1;
@@ -302,11 +303,12 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
        }
        for (opt_iter = 6; opt_iter < opt_len;) {
-                if (opt[opt_iter + 1] > (opt_len - opt_iter)) {
+                tag_len = opt[opt_iter + 1];
+                if ((tag_len == 0) || (opt[opt_iter + 1] > (opt_len - opt_iter))) {
                        err_offset = opt_iter + 1;
                        goto out;
                }
-                opt_iter += opt[opt_iter + 1];
+                opt_iter += tag_len;
        }
 out:
diff --git a/include/net/dst.h b/include/net/dst.h
index 3bc4865f8267..3c4c944096c9 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -479,10 +479,22 @@ static inline struct dst_entry *xfrm_lookup(struct net *net,
 {
        return dst_orig;
 } 
+static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)
+{
+        return NULL;
+}
 #else
 extern struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
                                     const struct flowi *fl, struct sock *sk,
                                     int flags);
+/* skb attached with this dst needs transformation if dst->xfrm is valid */
+static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)
+{
+        return dst->xfrm;
+}
 #endif
 #endif /* _NET_DST_H */
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index f525e7038cca..2b786b7e3585 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -194,11 +194,9 @@ static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
               skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
 }
-static inline struct in6_addr *rt6_nexthop(struct rt6_info *rt, struct in6_addr *dest)
+static inline struct in6_addr *rt6_nexthop(struct rt6_info *rt)
 {
-        if (rt->rt6i_flags & RTF_GATEWAY)
+        return &rt->rt6i_gateway;
-                return &rt->rt6i_gateway;
-        return dest;
 }
 #endif
diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index d0d11df9cba1..807d6b7a943f 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -133,7 +133,7 @@ struct ieee802154_ops {
 /* Basic interface to register ieee802154 device */
 struct ieee802154_dev *
-ieee802154_alloc_device(size_t priv_data_lex, struct ieee802154_ops *ops);
+ieee802154_alloc_device(size_t priv_data_len, struct ieee802154_ops *ops);
 void ieee802154_free_device(struct ieee802154_dev *dev);
 int ieee802154_register_device(struct ieee802154_dev *dev);
 void ieee802154_unregister_device(struct ieee802154_dev *dev);
diff --git a/include/net/sock.h b/include/net/sock.h
index 1d37a8086bed..808cbc2ec6c1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1630,16 +1630,14 @@ static inline void sk_filter_release(struct sk_filter *fp)
 static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
 {
-        unsigned int size = sk_filter_len(fp);
+        atomic_sub(sk_filter_size(fp->len), &sk->sk_omem_alloc);
-        atomic_sub(size, &sk->sk_omem_alloc);
        sk_filter_release(fp);
 }
 static inline void sk_filter_charge(struct sock *sk, struct sk_filter *fp)
 {
        atomic_inc(&fp->refcnt);
-        atomic_add(sk_filter_len(fp), &sk->sk_omem_alloc);
+        atomic_add(sk_filter_size(fp->len), &sk->sk_omem_alloc);
 }
 /*
diff --git a/include/sound/rcar_snd.h b/include/sound/rcar_snd.h
index fe66533e9b7a..fb0a312bcb81 100644
--- a/include/sound/rcar_snd.h
+++ b/include/sound/rcar_snd.h
@@ -68,6 +68,7 @@ struct rsnd_scu_platform_info {
 *
 * A : generation
 */
+#define RSND_GEN_MASK   (0xF << 0)
 #define RSND_GEN1       (1 << 0) /* fixme */
 #define RSND_GEN2       (2 << 0) /* fixme */
diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index 2e7d9947a10d..2a652d124fbb 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -424,6 +424,25 @@ TRACE_EVENT(sched_pi_setprio,
                        __entry->oldprio, __entry->newprio)
 );
+#ifdef CONFIG_DETECT_HUNG_TASK
+TRACE_EVENT(sched_process_hang,
+        TP_PROTO(struct task_struct *tsk),
+        TP_ARGS(tsk),
+        TP_STRUCT__entry(
+                __array( char,  comm,   TASK_COMM_LEN   )
+                __field( pid_t, pid                     )
+        ),
+        TP_fast_assign(
+                memcpy(__entry->comm, tsk->comm, TASK_COMM_LEN);
+                __entry->pid = tsk->pid;
+        ),
+        TP_printk("comm=%s pid=%d", __entry->comm, __entry->pid)
+);
+#endif /* CONFIG_DETECT_HUNG_TASK */
 #endif /* _TRACE_SCHED_H */
 /* This part must be outside protection */
diff --git a/include/trace/events/target.h b/include/trace/events/target.h
index aef8fc354025..da9cc0f05c93 100644
--- a/include/trace/events/target.h
+++ b/include/trace/events/target.h
@@ -144,7 +144,7 @@ TRACE_EVENT(target_sequencer_start,
        ),
        TP_fast_assign(
-                __entry->unpacked_lun   = cmd->se_lun->unpacked_lun;
+                __entry->unpacked_lun   = cmd->orig_fe_lun;
                __entry->opcode         = cmd->t_task_cdb[0];
                __entry->data_length    = cmd->data_length;
                __entry->task_attribute = cmd->sam_task_attr;
@@ -182,7 +182,7 @@ TRACE_EVENT(target_cmd_complete,
        ),
        TP_fast_assign(
-                __entry->unpacked_lun   = cmd->se_lun->unpacked_lun;
+                __entry->unpacked_lun   = cmd->orig_fe_lun;
                __entry->opcode         = cmd->t_task_cdb[0];
                __entry->data_length    = cmd->data_length;
                __entry->task_attribute = cmd->sam_task_attr;
diff --git a/include/uapi/drm/drm_mode.h b/include/uapi/drm/drm_mode.h
index 550811712f78..28acbaf4a81e 100644
--- a/include/uapi/drm/drm_mode.h
+++ b/include/uapi/drm/drm_mode.h
@@ -223,6 +223,8 @@ struct drm_mode_get_connector {
        __u32 connection;
        __u32 mm_width, mm_height; /**< HxW in millimeters */
        __u32 subpixel;
+        __u32 pad;
 };
 #define DRM_MODE_PROP_PENDING   (1<<0)
diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
index 009a655a5d35..2fc1602e23bb 100644
--- a/include/uapi/linux/perf_event.h
+++ b/include/uapi/linux/perf_event.h
@@ -456,13 +456,15 @@ struct perf_event_mmap_page {
        /*
         * Control data for the mmap() data buffer.
         *
-         * User-space reading the @data_head value should issue an rmb(), on
+         * User-space reading the @data_head value should issue an smp_rmb(),
-         * SMP capable platforms, after reading this value -- see
+         * after reading this value.
-         * perf_event_wakeup().
         *
         * When the mapping is PROT_WRITE the @data_tail value should be
-         * written by userspace to reflect the last read data. In this case
+         * written by userspace to reflect the last read data, after issueing
-         * the kernel will not over-write unread data.
+         * an smp_mb() to separate the data read from the ->data_tail store.
+         * In this case the kernel will not over-write unread data.
+         *
+         * See perf_output_put_handle() for the data ordering.
         */
        __u64   data_head;              /* head in the data section */
        __u64   data_tail;              /* user-space written tail */
diff --git a/include/uapi/linux/tc_act/Kbuild b/include/uapi/linux/tc_act/Kbuild
index 0623ec4e728f..56f121605c99 100644
--- a/include/uapi/linux/tc_act/Kbuild
+++ b/include/uapi/linux/tc_act/Kbuild
@@ -1,5 +1,6 @@
 # UAPI Header export list
 header-y += tc_csum.h
+header-y += tc_defact.h
 header-y += tc_gact.h
 header-y += tc_ipt.h
 header-y += tc_mirred.h
diff --git a/include/linux/tc_act/tc_defact.h b/include/uapi/linux/tc_act/tc_defact.h
index 6f65d07c7ce2..17dddb40f740 100644
--- a/include/linux/tc_act/tc_defact.h
+++ b/include/uapi/linux/tc_act/tc_defact.h
@@ -6,7 +6,7 @@
 struct tc_defact {
        tc_gen;
 };
-                                                                                
 enum {
        TCA_DEF_UNSPEC,
        TCA_DEF_TM,
diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
index 0b233c56b0e4..e3ddd86c90a6 100644
--- a/include/uapi/rdma/ib_user_verbs.h
+++ b/include/uapi/rdma/ib_user_verbs.h
@@ -87,8 +87,10 @@ enum {
        IB_USER_VERBS_CMD_CLOSE_XRCD,
        IB_USER_VERBS_CMD_CREATE_XSRQ,
        IB_USER_VERBS_CMD_OPEN_QP,
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
        IB_USER_VERBS_CMD_CREATE_FLOW = IB_USER_VERBS_CMD_THRESHOLD,
        IB_USER_VERBS_CMD_DESTROY_FLOW
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 };
 /*
@@ -126,6 +128,7 @@ struct ib_uverbs_cmd_hdr {
        __u16 out_words;
 };
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 struct ib_uverbs_cmd_hdr_ex {
        __u32 command;
        __u16 in_words;
@@ -134,6 +137,7 @@ struct ib_uverbs_cmd_hdr_ex {
        __u16 provider_out_words;
        __u32 cmd_hdr_reserved;
 };
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 struct ib_uverbs_get_context {
        __u64 response;
@@ -696,6 +700,7 @@ struct ib_uverbs_detach_mcast {
        __u64 driver_data[0];
 };
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 struct ib_kern_eth_filter {
        __u8  dst_mac[6];
        __u8  src_mac[6];
@@ -780,6 +785,7 @@ struct ib_uverbs_destroy_flow  {
        __u32 comp_mask;
        __u32 flow_handle;
 };
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 struct ib_uverbs_create_srq {
        __u64 response;
diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
index 130dfece27ac..b0e99deb6d05 100644
--- a/ipc/ipc_sysctl.c
+++ b/ipc/ipc_sysctl.c
@@ -62,7 +62,7 @@ static int proc_ipc_dointvec_minmax_orphans(ctl_table *table, int write,
        return err;
 }
-static int proc_ipc_callback_dointvec(ctl_table *table, int write,
+static int proc_ipc_callback_dointvec_minmax(ctl_table *table, int write,
        void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        struct ctl_table ipc_table;
@@ -72,7 +72,7 @@ static int proc_ipc_callback_dointvec(ctl_table *table, int write,
        memcpy(&ipc_table, table, sizeof(ipc_table));
        ipc_table.data = get_ipc(table);
-        rc = proc_dointvec(&ipc_table, write, buffer, lenp, ppos);
+        rc = proc_dointvec_minmax(&ipc_table, write, buffer, lenp, ppos);
        if (write && !rc && lenp_bef == *lenp)
                /*
@@ -152,15 +152,13 @@ static int proc_ipcauto_dointvec_minmax(ctl_table *table, int write,
 #define proc_ipc_dointvec          NULL
 #define proc_ipc_dointvec_minmax   NULL
 #define proc_ipc_dointvec_minmax_orphans   NULL
-#define proc_ipc_callback_dointvec NULL
+#define proc_ipc_callback_dointvec_minmax  NULL
 #define proc_ipcauto_dointvec_minmax NULL
 #endif
 static int zero;
 static int one = 1;
-#ifdef CONFIG_CHECKPOINT_RESTORE
 static int int_max = INT_MAX;
-#endif
 static struct ctl_table ipc_kern_table[] = {
        {
@@ -198,21 +196,27 @@ static struct ctl_table ipc_kern_table[] = {
                .data           = &init_ipc_ns.msg_ctlmax,
                .maxlen         = sizeof (init_ipc_ns.msg_ctlmax),
                .mode           = 0644,
-                .proc_handler   = proc_ipc_dointvec,
+                .proc_handler   = proc_ipc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &int_max,
        },
        {
                .procname       = "msgmni",
                .data           = &init_ipc_ns.msg_ctlmni,
                .maxlen         = sizeof (init_ipc_ns.msg_ctlmni),
                .mode           = 0644,
-                .proc_handler   = proc_ipc_callback_dointvec,
+                .proc_handler   = proc_ipc_callback_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &int_max,
        },
        {
                .procname       =  "msgmnb",
                .data           = &init_ipc_ns.msg_ctlmnb,
                .maxlen         = sizeof (init_ipc_ns.msg_ctlmnb),
                .mode           = 0644,
-                .proc_handler   = proc_ipc_dointvec,
+                .proc_handler   = proc_ipc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &int_max,
        },
        {
                .procname       = "sem",
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 2418b6e71a85..8bd9cfdc70d7 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2039,7 +2039,7 @@ static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
                /* @tsk either already exited or can't exit until the end */
                if (tsk->flags & PF_EXITING)
-                        continue;
+                        goto next;
                /* as per above, nr_threads may decrease, but not increase. */
                BUG_ON(i >= group_size);
@@ -2047,7 +2047,7 @@ static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
                ent.cgrp = task_cgroup_from_root(tsk, root);
                /* nothing to do if this task is already in the cgroup */
                if (ent.cgrp == cgrp)
-                        continue;
+                        goto next;
                /*
                 * saying GFP_ATOMIC has no effect here because we did prealloc
                 * earlier, but it's good form to communicate our expectations.
@@ -2055,7 +2055,7 @@ static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
                retval = flex_array_put(group, i, &ent, GFP_ATOMIC);
                BUG_ON(retval != 0);
                i++;
+        next:
                if (!threadgroup)
                        break;
        } while_each_thread(leader, tsk);
@@ -3188,11 +3188,9 @@ css_next_descendant_post(struct cgroup_subsys_state *pos,
        WARN_ON_ONCE(!rcu_read_lock_held());
-        /* if first iteration, visit the leftmost descendant */
+        /* if first iteration, visit leftmost descendant which may be @root */
-        if (!pos) {
+        if (!pos)
-                next = css_leftmost_descendant(root);
+                return css_leftmost_descendant(root);
-                return next != root ? next : NULL;
-        }
        /* if we visited @root, we're done */
        if (pos == root)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index d49a9d29334c..953c14348375 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6767,6 +6767,10 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr,
        if (ret)
                return -EFAULT;
+        /* disabled for now */
+        if (attr->mmap2)
+                return -EINVAL;
        if (attr->__reserved_1)
                return -EINVAL;
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index cd55144270b5..9c2ddfbf4525 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -87,10 +87,31 @@ again:
                goto out;
        /*
-         * Publish the known good head. Rely on the full barrier implied
+         * Since the mmap() consumer (userspace) can run on a different CPU:
-         * by atomic_dec_and_test() order the rb->head read and this
+         *
-         * write.
+         *   kernel                             user
+         *
+         *   READ ->data_tail                   READ ->data_head
+         *   smp_mb()   (A)                     smp_rmb()       (C)
+         *   WRITE $data                        READ $data
+         *   smp_wmb()  (B)                     smp_mb()        (D)
+         *   STORE ->data_head                  WRITE ->data_tail
+         *
+         * Where A pairs with D, and B pairs with C.
+         *
+         * I don't think A needs to be a full barrier because we won't in fact
+         * write data until we see the store from userspace. So we simply don't
+         * issue the data WRITE until we observe it. Be conservative for now.
+         *
+         * OTOH, D needs to be a full barrier since it separates the data READ
+         * from the tail WRITE.
+         *
+         * For B a WMB is sufficient since it separates two WRITEs, and for C
+         * an RMB is sufficient since it separates two READs.
+         *
+         * See perf_output_begin().
         */
+        smp_wmb();
        rb->user_page->data_head = head;
        /*
@@ -154,9 +175,11 @@ int perf_output_begin(struct perf_output_handle *handle,
                 * Userspace could choose to issue a mb() before updating the
                 * tail pointer. So that all reads will be completed before the
                 * write is issued.
+                 *
+                 * See perf_output_put_handle().
                 */
                tail = ACCESS_ONCE(rb->user_page->data_tail);
-                smp_rmb();
+                smp_mb();
                offset = head = local_read(&rb->head);
                head += size;
                if (unlikely(!perf_output_space(rb, tail, offset, head)))
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 3e97fb126e6b..8807061ca004 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -16,11 +16,12 @@
 #include <linux/export.h>
 #include <linux/sysctl.h>
 #include <linux/utsname.h>
+#include <trace/events/sched.h>
 /*
 * The number of tasks checked:
 */
-unsigned long __read_mostly sysctl_hung_task_check_count = PID_MAX_LIMIT;
+int __read_mostly sysctl_hung_task_check_count = PID_MAX_LIMIT;
 /*
 * Limit number of tasks checked in a batch.
@@ -92,6 +93,9 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
                t->last_switch_count = switch_count;
                return;
        }
+        trace_sched_process_hang(t);
        if (!sysctl_hung_task_warnings)
                return;
        sysctl_hung_task_warnings--;
diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
index b2c71c5873e4..09220656d888 100644
--- a/kernel/lockdep_proc.c
+++ b/kernel/lockdep_proc.c
@@ -421,6 +421,7 @@ static void seq_lock_time(struct seq_file *m, struct lock_time *lt)
        seq_time(m, lt->min);
        seq_time(m, lt->max);
        seq_time(m, lt->total);
+        seq_time(m, lt->nr ? do_div(lt->total, lt->nr) : 0);
 }
 static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
@@ -518,20 +519,20 @@ static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
        }
        if (i) {
                seq_puts(m, "\n");
-                seq_line(m, '.', 0, 40 + 1 + 10 * (14 + 1));
+                seq_line(m, '.', 0, 40 + 1 + 12 * (14 + 1));
                seq_puts(m, "\n");
        }
 }
 static void seq_header(struct seq_file *m)
 {
-        seq_printf(m, "lock_stat version 0.3\n");
+        seq_puts(m, "lock_stat version 0.4\n");
        if (unlikely(!debug_locks))
                seq_printf(m, "*WARNING* lock debugging disabled!! - possibly due to a lockdep warning\n");
-        seq_line(m, '-', 0, 40 + 1 + 10 * (14 + 1));
+        seq_line(m, '-', 0, 40 + 1 + 12 * (14 + 1));
-        seq_printf(m, "%40s %14s %14s %14s %14s %14s %14s %14s %14s "
+        seq_printf(m, "%40s %14s %14s %14s %14s %14s %14s %14s %14s %14s %14s "
                        "%14s %14s\n",
                        "class name",
                        "con-bounces",
@@ -539,12 +540,14 @@ static void seq_header(struct seq_file *m)
                        "waittime-min",
                        "waittime-max",
                        "waittime-total",
+                        "waittime-avg",
                        "acq-bounces",
                        "acquisitions",
                        "holdtime-min",
                        "holdtime-max",
-                        "holdtime-total");
+                        "holdtime-total",
-        seq_line(m, '-', 0, 40 + 1 + 10 * (14 + 1));
+                        "holdtime-avg");
+        seq_line(m, '-', 0, 40 + 1 + 12 * (14 + 1));
        seq_printf(m, "\n");
 }
diff --git a/kernel/mutex.c b/kernel/mutex.c
index 6d647aedffea..d24105b1b794 100644
--- a/kernel/mutex.c
+++ b/kernel/mutex.c
@@ -410,7 +410,7 @@ ww_mutex_set_context_fastpath(struct ww_mutex *lock,
 static __always_inline int __sched
 __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
                    struct lockdep_map *nest_lock, unsigned long ip,
-                    struct ww_acquire_ctx *ww_ctx)
+                    struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx)
 {
        struct task_struct *task = current;
        struct mutex_waiter waiter;
@@ -450,7 +450,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
                struct task_struct *owner;
                struct mspin_node  node;
-                if (!__builtin_constant_p(ww_ctx == NULL) && ww_ctx->acquired > 0) {
+                if (use_ww_ctx && ww_ctx->acquired > 0) {
                        struct ww_mutex *ww;
                        ww = container_of(lock, struct ww_mutex, base);
@@ -480,7 +480,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
                if ((atomic_read(&lock->count) == 1) &&
                    (atomic_cmpxchg(&lock->count, 1, 0) == 1)) {
                        lock_acquired(&lock->dep_map, ip);
-                        if (!__builtin_constant_p(ww_ctx == NULL)) {
+                        if (use_ww_ctx) {
                                struct ww_mutex *ww;
                                ww = container_of(lock, struct ww_mutex, base);
@@ -551,7 +551,7 @@ slowpath:
                        goto err;
                }
-                if (!__builtin_constant_p(ww_ctx == NULL) && ww_ctx->acquired > 0) {
+                if (use_ww_ctx && ww_ctx->acquired > 0) {
                        ret = __mutex_lock_check_stamp(lock, ww_ctx);
                        if (ret)
                                goto err;
@@ -575,7 +575,7 @@ skip_wait:
        lock_acquired(&lock->dep_map, ip);
        mutex_set_owner(lock);
-        if (!__builtin_constant_p(ww_ctx == NULL)) {
+        if (use_ww_ctx) {
                struct ww_mutex *ww = container_of(lock, struct ww_mutex, base);
                struct mutex_waiter *cur;
@@ -615,7 +615,7 @@ mutex_lock_nested(struct mutex *lock, unsigned int subclass)
 {
        might_sleep();
        __mutex_lock_common(lock, TASK_UNINTERRUPTIBLE,
-                            subclass, NULL, _RET_IP_, NULL);
+                            subclass, NULL, _RET_IP_, NULL, 0);
 }
 EXPORT_SYMBOL_GPL(mutex_lock_nested);
@@ -625,7 +625,7 @@ _mutex_lock_nest_lock(struct mutex *lock, struct lockdep_map *nest)
 {
        might_sleep();
        __mutex_lock_common(lock, TASK_UNINTERRUPTIBLE,
-                            0, nest, _RET_IP_, NULL);
+                            0, nest, _RET_IP_, NULL, 0);
 }
 EXPORT_SYMBOL_GPL(_mutex_lock_nest_lock);
@@ -635,7 +635,7 @@ mutex_lock_killable_nested(struct mutex *lock, unsigned int subclass)
 {
        might_sleep();
        return __mutex_lock_common(lock, TASK_KILLABLE,
-                                   subclass, NULL, _RET_IP_, NULL);
+                                   subclass, NULL, _RET_IP_, NULL, 0);
 }
 EXPORT_SYMBOL_GPL(mutex_lock_killable_nested);
@@ -644,7 +644,7 @@ mutex_lock_interruptible_nested(struct mutex *lock, unsigned int subclass)
 {
        might_sleep();
        return __mutex_lock_common(lock, TASK_INTERRUPTIBLE,
-                                   subclass, NULL, _RET_IP_, NULL);
+                                   subclass, NULL, _RET_IP_, NULL, 0);
 }
 EXPORT_SYMBOL_GPL(mutex_lock_interruptible_nested);
@@ -682,7 +682,7 @@ __ww_mutex_lock(struct ww_mutex *lock, struct ww_acquire_ctx *ctx)
        might_sleep();
        ret =  __mutex_lock_common(&lock->base, TASK_UNINTERRUPTIBLE,
-                                   0, &ctx->dep_map, _RET_IP_, ctx);
+                                   0, &ctx->dep_map, _RET_IP_, ctx, 1);
        if (!ret && ctx->acquired > 1)
                return ww_mutex_deadlock_injection(lock, ctx);
@@ -697,7 +697,7 @@ __ww_mutex_lock_interruptible(struct ww_mutex *lock, struct ww_acquire_ctx *ctx)
        might_sleep();
        ret = __mutex_lock_common(&lock->base, TASK_INTERRUPTIBLE,
-                                  0, &ctx->dep_map, _RET_IP_, ctx);
+                                  0, &ctx->dep_map, _RET_IP_, ctx, 1);
        if (!ret && ctx->acquired > 1)
                return ww_mutex_deadlock_injection(lock, ctx);
@@ -809,28 +809,28 @@ __mutex_lock_slowpath(atomic_t *lock_count)
        struct mutex *lock = container_of(lock_count, struct mutex, count);
        __mutex_lock_common(lock, TASK_UNINTERRUPTIBLE, 0,
-                            NULL, _RET_IP_, NULL);
+                            NULL, _RET_IP_, NULL, 0);
 }
 static noinline int __sched
 __mutex_lock_killable_slowpath(struct mutex *lock)
 {
        return __mutex_lock_common(lock, TASK_KILLABLE, 0,
-                                   NULL, _RET_IP_, NULL);
+                                   NULL, _RET_IP_, NULL, 0);
 }
 static noinline int __sched
 __mutex_lock_interruptible_slowpath(struct mutex *lock)
 {
        return __mutex_lock_common(lock, TASK_INTERRUPTIBLE, 0,
-                                   NULL, _RET_IP_, NULL);
+                                   NULL, _RET_IP_, NULL, 0);
 }
 static noinline int __sched
 __ww_mutex_lock_slowpath(struct ww_mutex *lock, struct ww_acquire_ctx *ctx)
 {
        return __mutex_lock_common(&lock->base, TASK_UNINTERRUPTIBLE, 0,
-                                   NULL, _RET_IP_, ctx);
+                                   NULL, _RET_IP_, ctx, 1);
 }
 static noinline int __sched
@@ -838,7 +838,7 @@ __ww_mutex_lock_interruptible_slowpath(struct ww_mutex *lock,
                                            struct ww_acquire_ctx *ctx)
 {
        return __mutex_lock_common(&lock->base, TASK_INTERRUPTIBLE, 0,
-                                   NULL, _RET_IP_, ctx);
+                                   NULL, _RET_IP_, ctx, 1);
 }
 #endif
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index c9c759d5a15c..0121dab83f43 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -846,7 +846,7 @@ static int software_resume(void)
        goto Finish;
 }
-late_initcall(software_resume);
+late_initcall_sync(software_resume);
 static const char * const hibernation_modes[] = {
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index b2f06f3c6a3f..b24ed7f87a14 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -962,9 +962,10 @@ static struct ctl_table kern_table[] = {
        {
                .procname       = "hung_task_check_count",
                .data           = &sysctl_hung_task_check_count,
-                .maxlen         = sizeof(unsigned long),
+                .maxlen         = sizeof(int),
                .mode           = 0644,
-                .proc_handler   = proc_doulongvec_minmax,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
        },
        {
                .procname       = "hung_task_timeout_secs",
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 38959c866789..662c5798a685 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -33,29 +33,64 @@ struct ce_unbind {
        int res;
 };
-/**
+static u64 cev_delta2ns(unsigned long latch, struct clock_event_device *evt,
- * clockevents_delta2ns - Convert a latch value (device ticks) to nanoseconds
+                        bool ismax)
- * @latch:      value to convert
- * @evt:        pointer to clock event device descriptor
- *
- * Math helper, returns latch value converted to nanoseconds (bound checked)
- */
-u64 clockevent_delta2ns(unsigned long latch, struct clock_event_device *evt)
 {
        u64 clc = (u64) latch << evt->shift;
+        u64 rnd;
        if (unlikely(!evt->mult)) {
                evt->mult = 1;
                WARN_ON(1);
        }
+        rnd = (u64) evt->mult - 1;
+        /*
+         * Upper bound sanity check. If the backwards conversion is
+         * not equal latch, we know that the above shift overflowed.
+         */
+        if ((clc >> evt->shift) != (u64)latch)
+                clc = ~0ULL;
+        /*
+         * Scaled math oddities:
+         *
+         * For mult <= (1 << shift) we can safely add mult - 1 to
+         * prevent integer rounding loss. So the backwards conversion
+         * from nsec to device ticks will be correct.
+         *
+         * For mult > (1 << shift), i.e. device frequency is > 1GHz we
+         * need to be careful. Adding mult - 1 will result in a value
+         * which when converted back to device ticks can be larger
+         * than latch by up to (mult - 1) >> shift. For the min_delta
+         * calculation we still want to apply this in order to stay
+         * above the minimum device ticks limit. For the upper limit
+         * we would end up with a latch value larger than the upper
+         * limit of the device, so we omit the add to stay below the
+         * device upper boundary.
+         *
+         * Also omit the add if it would overflow the u64 boundary.
+         */
+        if ((~0ULL - clc > rnd) &&
+            (!ismax || evt->mult <= (1U << evt->shift)))
+                clc += rnd;
        do_div(clc, evt->mult);
-        if (clc < 1000)
-                clc = 1000;
-        if (clc > KTIME_MAX)
-                clc = KTIME_MAX;
-        return clc;
+        /* Deltas less than 1usec are pointless noise */
+        return clc > 1000 ? clc : 1000;
+}
+/**
+ * clockevents_delta2ns - Convert a latch value (device ticks) to nanoseconds
+ * @latch:      value to convert
+ * @evt:        pointer to clock event device descriptor
+ *
+ * Math helper, returns latch value converted to nanoseconds (bound checked)
+ */
+u64 clockevent_delta2ns(unsigned long latch, struct clock_event_device *evt)
+{
+        return cev_delta2ns(latch, evt, false);
 }
 EXPORT_SYMBOL_GPL(clockevent_delta2ns);
@@ -380,8 +415,8 @@ void clockevents_config(struct clock_event_device *dev, u32 freq)
                sec = 600;
        clockevents_calc_mult_shift(dev, freq, sec);
-        dev->min_delta_ns = clockevent_delta2ns(dev->min_delta_ticks, dev);
+        dev->min_delta_ns = cev_delta2ns(dev->min_delta_ticks, dev, false);
-        dev->max_delta_ns = clockevent_delta2ns(dev->max_delta_ticks, dev);
+        dev->max_delta_ns = cev_delta2ns(dev->max_delta_ticks, dev, true);
 }
 /**
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 06344d986eb9..094f3152ec2b 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -983,7 +983,7 @@ config DEBUG_KOBJECT
 config DEBUG_KOBJECT_RELEASE
        bool "kobject release debugging"
-        depends on DEBUG_KERNEL
+        depends on DEBUG_OBJECTS_TIMERS
        help
          kobjects are reference counted objects.  This means that their
          last reference count put is not predictable, and the kobject can
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index a685c8a79578..d16fa295ae1d 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -577,7 +577,8 @@ void sg_miter_stop(struct sg_mapping_iter *miter)
                miter->__offset += miter->consumed;
                miter->__remaining -= miter->consumed;
-                if (miter->__flags & SG_MITER_TO_SG)
+                if ((miter->__flags & SG_MITER_TO_SG) &&
+                    !PageSlab(miter->page))
                        flush_kernel_dcache_page(miter->page);
                if (miter->__flags & SG_MITER_ATOMIC) {
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 610e3df2768a..cca80d96e509 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1278,64 +1278,90 @@ out:
 int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
                                unsigned long addr, pmd_t pmd, pmd_t *pmdp)
 {
+        struct anon_vma *anon_vma = NULL;
        struct page *page;
        unsigned long haddr = addr & HPAGE_PMD_MASK;
+        int page_nid = -1, this_nid = numa_node_id();
        int target_nid;
-        int current_nid = -1;
+        bool page_locked;
-        bool migrated;
+        bool migrated = false;
        spin_lock(&mm->page_table_lock);
        if (unlikely(!pmd_same(pmd, *pmdp)))
                goto out_unlock;
        page = pmd_page(pmd);
-        get_page(page);
+        page_nid = page_to_nid(page);
-        current_nid = page_to_nid(page);
        count_vm_numa_event(NUMA_HINT_FAULTS);
-        if (current_nid == numa_node_id())
+        if (page_nid == this_nid)
                count_vm_numa_event(NUMA_HINT_FAULTS_LOCAL);
+        /*
+         * Acquire the page lock to serialise THP migrations but avoid dropping
+         * page_table_lock if at all possible
+         */
+        page_locked = trylock_page(page);
        target_nid = mpol_misplaced(page, vma, haddr);
        if (target_nid == -1) {
-                put_page(page);
+                /* If the page was locked, there are no parallel migrations */
-                goto clear_pmdnuma;
+                if (page_locked)
+                        goto clear_pmdnuma;
+                /*
+                 * Otherwise wait for potential migrations and retry. We do
+                 * relock and check_same as the page may no longer be mapped.
+                 * As the fault is being retried, do not account for it.
+                 */
+                spin_unlock(&mm->page_table_lock);
+                wait_on_page_locked(page);
+                page_nid = -1;
+                goto out;
        }
-        /* Acquire the page lock to serialise THP migrations */
+        /* Page is misplaced, serialise migrations and parallel THP splits */
+        get_page(page);
        spin_unlock(&mm->page_table_lock);
-        lock_page(page);
+        if (!page_locked)
+                lock_page(page);
+        anon_vma = page_lock_anon_vma_read(page);
        /* Confirm the PTE did not while locked */
        spin_lock(&mm->page_table_lock);
        if (unlikely(!pmd_same(pmd, *pmdp))) {
                unlock_page(page);
                put_page(page);
+                page_nid = -1;
                goto out_unlock;
        }
-        spin_unlock(&mm->page_table_lock);
-        /* Migrate the THP to the requested node */
+        /*
+         * Migrate the THP to the requested node, returns with page unlocked
+         * and pmd_numa cleared.
+         */
+        spin_unlock(&mm->page_table_lock);
        migrated = migrate_misplaced_transhuge_page(mm, vma,
                                pmdp, pmd, addr, page, target_nid);
-        if (!migrated)
+        if (migrated)
-                goto check_same;
+                page_nid = target_nid;
-        task_numa_fault(target_nid, HPAGE_PMD_NR, true);
-        return 0;
-check_same:
+        goto out;
-        spin_lock(&mm->page_table_lock);
-        if (unlikely(!pmd_same(pmd, *pmdp)))
-                goto out_unlock;
 clear_pmdnuma:
+        BUG_ON(!PageLocked(page));
        pmd = pmd_mknonnuma(pmd);
        set_pmd_at(mm, haddr, pmdp, pmd);
        VM_BUG_ON(pmd_numa(*pmdp));
        update_mmu_cache_pmd(vma, addr, pmdp);
+        unlock_page(page);
 out_unlock:
        spin_unlock(&mm->page_table_lock);
-        if (current_nid != -1)
-                task_numa_fault(current_nid, HPAGE_PMD_NR, false);
+out:
+        if (anon_vma)
+                page_unlock_anon_vma_read(anon_vma);
+        if (page_nid != -1)
+                task_numa_fault(page_nid, HPAGE_PMD_NR, migrated);
        return 0;
 }
diff --git a/mm/list_lru.c b/mm/list_lru.c
index 72467914b856..72f9decb0104 100644
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -81,8 +81,9 @@ restart:
                 * decrement nr_to_walk first so that we don't livelock if we
                 * get stuck on large numbesr of LRU_RETRY items
                 */
-                if (--(*nr_to_walk) == 0)
+                if (!*nr_to_walk)
                        break;
+                --*nr_to_walk;
                ret = isolate(item, &nlru->lock, cb_arg);
                switch (ret) {
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 34d3ca9572d6..13b9d0f221b8 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -54,6 +54,7 @@
 #include <linux/page_cgroup.h>
 #include <linux/cpu.h>
 #include <linux/oom.h>
+#include <linux/lockdep.h>
 #include "internal.h"
 #include <net/sock.h>
 #include <net/ip.h>
@@ -2046,6 +2047,12 @@ static int mem_cgroup_soft_reclaim(struct mem_cgroup *root_memcg,
        return total;
 }
+#ifdef CONFIG_LOCKDEP
+static struct lockdep_map memcg_oom_lock_dep_map = {
+        .name = "memcg_oom_lock",
+};
+#endif
 static DEFINE_SPINLOCK(memcg_oom_lock);
 /*
@@ -2083,7 +2090,8 @@ static bool mem_cgroup_oom_trylock(struct mem_cgroup *memcg)
                        }
                        iter->oom_lock = false;
                }
-        }
+        } else
+                mutex_acquire(&memcg_oom_lock_dep_map, 0, 1, _RET_IP_);
        spin_unlock(&memcg_oom_lock);
@@ -2095,6 +2103,7 @@ static void mem_cgroup_oom_unlock(struct mem_cgroup *memcg)
        struct mem_cgroup *iter;
        spin_lock(&memcg_oom_lock);
+        mutex_release(&memcg_oom_lock_dep_map, 1, _RET_IP_);
        for_each_mem_cgroup_tree(iter, memcg)
                iter->oom_lock = false;
        spin_unlock(&memcg_oom_lock);
@@ -2765,10 +2774,10 @@ done:
        *ptr = memcg;
        return 0;
 nomem:
-        *ptr = NULL;
+        if (!(gfp_mask & __GFP_NOFAIL)) {
-        if (gfp_mask & __GFP_NOFAIL)
+                *ptr = NULL;
-                return 0;
+                return -ENOMEM;
-        return -ENOMEM;
+        }
 bypass:
        *ptr = root_mem_cgroup;
        return -EINTR;
@@ -3773,8 +3782,7 @@ void mem_cgroup_move_account_page_stat(struct mem_cgroup *from,
 {
        /* Update stat data for mem_cgroup */
        preempt_disable();
-        WARN_ON_ONCE(from->stat->count[idx] < nr_pages);
+        __this_cpu_sub(from->stat->count[idx], nr_pages);
-        __this_cpu_add(from->stat->count[idx], -nr_pages);
        __this_cpu_add(to->stat->count[idx], nr_pages);
        preempt_enable();
 }
@@ -4950,31 +4958,18 @@ static void mem_cgroup_reparent_charges(struct mem_cgroup *memcg)
        } while (usage > 0);
 }
-/*
- * This mainly exists for tests during the setting of set of use_hierarchy.
- * Since this is the very setting we are changing, the current hierarchy value
- * is meaningless
- */
-static inline bool __memcg_has_children(struct mem_cgroup *memcg)
-{
-        struct cgroup_subsys_state *pos;
-        /* bounce at first found */
-        css_for_each_child(pos, &memcg->css)
-                return true;
-        return false;
-}
-/*
- * Must be called with memcg_create_mutex held, unless the cgroup is guaranteed
- * to be already dead (as in mem_cgroup_force_empty, for instance).  This is
- * from mem_cgroup_count_children(), in the sense that we don't really care how
- * many children we have; we only need to know if we have any.  It also counts
- * any memcg without hierarchy as infertile.
- */
 static inline bool memcg_has_children(struct mem_cgroup *memcg)
 {
-        return memcg->use_hierarchy && __memcg_has_children(memcg);
+        lockdep_assert_held(&memcg_create_mutex);
+        /*
+         * The lock does not prevent addition or deletion to the list
+         * of children, but it prevents a new child from being
+         * initialized based on this parent in css_online(), so it's
+         * enough to decide whether hierarchically inherited
+         * attributes can still be changed or not.
+         */
+        return memcg->use_hierarchy &&
+                !list_empty(&memcg->css.cgroup->children);
 }
 /*
@@ -5054,7 +5049,7 @@ static int mem_cgroup_hierarchy_write(struct cgroup_subsys_state *css,
         */
        if ((!parent_memcg || !parent_memcg->use_hierarchy) &&
                                (val == 1 || val == 0)) {
-                if (!__memcg_has_children(memcg))
+                if (list_empty(&memcg->css.cgroup->children))
                        memcg->use_hierarchy = val;
                else
                        retval = -EBUSY;
diff --git a/mm/memory.c b/mm/memory.c
index 1311f26497e6..d176154c243f 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3521,12 +3521,12 @@ static int do_nonlinear_fault(struct mm_struct *mm, struct vm_area_struct *vma,
 }
 int numa_migrate_prep(struct page *page, struct vm_area_struct *vma,
-                                unsigned long addr, int current_nid)
+                                unsigned long addr, int page_nid)
 {
        get_page(page);
        count_vm_numa_event(NUMA_HINT_FAULTS);
-        if (current_nid == numa_node_id())
+        if (page_nid == numa_node_id())
                count_vm_numa_event(NUMA_HINT_FAULTS_LOCAL);
        return mpol_misplaced(page, vma, addr);
@@ -3537,7 +3537,7 @@ int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
 {
        struct page *page = NULL;
        spinlock_t *ptl;
-        int current_nid = -1;
+        int page_nid = -1;
        int target_nid;
        bool migrated = false;
@@ -3567,15 +3567,10 @@ int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
                return 0;
        }
-        current_nid = page_to_nid(page);
+        page_nid = page_to_nid(page);
-        target_nid = numa_migrate_prep(page, vma, addr, current_nid);
+        target_nid = numa_migrate_prep(page, vma, addr, page_nid);
        pte_unmap_unlock(ptep, ptl);
        if (target_nid == -1) {
-                /*
-                 * Account for the fault against the current node if it not
-                 * being replaced regardless of where the page is located.
-                 */
-                current_nid = numa_node_id();
                put_page(page);
                goto out;
        }
@@ -3583,11 +3578,11 @@ int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
        /* Migrate to the requested node */
        migrated = migrate_misplaced_page(page, target_nid);
        if (migrated)
-                current_nid = target_nid;
+                page_nid = target_nid;
 out:
-        if (current_nid != -1)
+        if (page_nid != -1)
-                task_numa_fault(current_nid, 1, migrated);
+                task_numa_fault(page_nid, 1, migrated);
        return 0;
 }
@@ -3602,7 +3597,6 @@ static int do_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
        unsigned long offset;
        spinlock_t *ptl;
        bool numa = false;
-        int local_nid = numa_node_id();
        spin_lock(&mm->page_table_lock);
        pmd = *pmdp;
@@ -3625,9 +3619,10 @@ static int do_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
        for (addr = _addr + offset; addr < _addr + PMD_SIZE; pte++, addr += PAGE_SIZE) {
                pte_t pteval = *pte;
                struct page *page;
-                int curr_nid = local_nid;
+                int page_nid = -1;
                int target_nid;
-                bool migrated;
+                bool migrated = false;
                if (!pte_present(pteval))
                        continue;
                if (!pte_numa(pteval))
@@ -3649,25 +3644,19 @@ static int do_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
                if (unlikely(page_mapcount(page) != 1))
                        continue;
-                /*
+                page_nid = page_to_nid(page);
-                 * Note that the NUMA fault is later accounted to either
+                target_nid = numa_migrate_prep(page, vma, addr, page_nid);
-                 * the node that is currently running or where the page is
+                pte_unmap_unlock(pte, ptl);
-                 * migrated to.
+                if (target_nid != -1) {
-                 */
+                        migrated = migrate_misplaced_page(page, target_nid);
-                curr_nid = local_nid;
+                        if (migrated)
-                target_nid = numa_migrate_prep(page, vma, addr,
+                                page_nid = target_nid;
-                                               page_to_nid(page));
+                } else {
-                if (target_nid == -1) {
                        put_page(page);
-                        continue;
                }
-                /* Migrate to the requested node */
+                if (page_nid != -1)
-                pte_unmap_unlock(pte, ptl);
+                        task_numa_fault(page_nid, 1, migrated);
-                migrated = migrate_misplaced_page(page, target_nid);
-                if (migrated)
-                        curr_nid = target_nid;
-                task_numa_fault(curr_nid, 1, migrated);
                pte = pte_offset_map_lock(mm, pmdp, addr, &ptl);
        }
diff --git a/mm/migrate.c b/mm/migrate.c
index 7a7325ee1d08..c04692774e88 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1715,12 +1715,12 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
                unlock_page(new_page);
                put_page(new_page);             /* Free it */
-                unlock_page(page);
+                /* Retake the callers reference and putback on LRU */
+                get_page(page);
                putback_lru_page(page);
+                mod_zone_page_state(page_zone(page),
-                count_vm_events(PGMIGRATE_FAIL, HPAGE_PMD_NR);
+                         NR_ISOLATED_ANON + page_lru, -HPAGE_PMD_NR);
-                isolated = 0;
+                goto out_fail;
-                goto out;
        }
        /*
@@ -1737,9 +1737,9 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
        entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
        entry = pmd_mkhuge(entry);
-        page_add_new_anon_rmap(new_page, vma, haddr);
+        pmdp_clear_flush(vma, haddr, pmd);
        set_pmd_at(mm, haddr, pmd, entry);
+        page_add_new_anon_rmap(new_page, vma, haddr);
        update_mmu_cache_pmd(vma, address, &entry);
        page_remove_rmap(page);
        /*
@@ -1758,7 +1758,6 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
        count_vm_events(PGMIGRATE_SUCCESS, HPAGE_PMD_NR);
        count_vm_numa_events(NUMA_PAGE_MIGRATE, HPAGE_PMD_NR);
-out:
        mod_zone_page_state(page_zone(page),
                        NR_ISOLATED_ANON + page_lru,
                        -HPAGE_PMD_NR);
@@ -1767,6 +1766,10 @@ out:
 out_fail:
        count_vm_events(PGMIGRATE_FAIL, HPAGE_PMD_NR);
 out_dropref:
+        entry = pmd_mknonnuma(entry);
+        set_pmd_at(mm, haddr, pmd, entry);
+        update_mmu_cache_pmd(vma, address, &entry);
        unlock_page(page);
        put_page(page);
        return 0;
diff --git a/mm/mprotect.c b/mm/mprotect.c
index a3af058f68e4..412ba2b7326a 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -148,7 +148,7 @@ static inline unsigned long change_pmd_range(struct vm_area_struct *vma,
                                split_huge_page_pmd(vma, addr, pmd);
                        else if (change_huge_pmd(vma, pmd, addr, newprot,
                                                 prot_numa)) {
-                                pages += HPAGE_PMD_NR;
+                                pages++;
                                continue;
                        }
                        /* fall through */
diff --git a/mm/pagewalk.c b/mm/pagewalk.c
index 5da2cbcfdbb5..2beeabf502c5 100644
--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -242,7 +242,7 @@ int walk_page_range(unsigned long addr, unsigned long end,
                if (err)
                        break;
                pgd++;
-        } while (addr = next, addr != end);
+        } while (addr = next, addr < end);
        return err;
 }
diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index 309129732285..c7e634af8516 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c
@@ -171,7 +171,7 @@ static size_t vlan_get_size(const struct net_device *dev)
        return nla_total_size(2) +      /* IFLA_VLAN_PROTOCOL */
               nla_total_size(2) +      /* IFLA_VLAN_ID */
-               sizeof(struct ifla_vlan_flags) + /* IFLA_VLAN_FLAGS */
+               nla_total_size(sizeof(struct ifla_vlan_flags)) + /* IFLA_VLAN_FLAGS */
               vlan_qos_map_size(vlan->nr_ingress_mappings) +
               vlan_qos_map_size(vlan->nr_egress_mappings);
 }
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index c72d1bcdcf49..1356af660b5b 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -65,6 +65,7 @@ static int __init batadv_init(void)
        batadv_recv_handler_init();
        batadv_iv_init();
+        batadv_nc_init();
        batadv_event_workqueue = create_singlethread_workqueue("bat_events");
@@ -142,7 +143,7 @@ int batadv_mesh_init(struct net_device *soft_iface)
        if (ret < 0)
                goto err;
-        ret = batadv_nc_init(bat_priv);
+        ret = batadv_nc_mesh_init(bat_priv);
        if (ret < 0)
                goto err;
@@ -167,7 +168,7 @@ void batadv_mesh_free(struct net_device *soft_iface)
        batadv_vis_quit(bat_priv);
        batadv_gw_node_purge(bat_priv);
-        batadv_nc_free(bat_priv);
+        batadv_nc_mesh_free(bat_priv);
        batadv_dat_free(bat_priv);
        batadv_bla_free(bat_priv);
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index a487d46e0aec..4ecc0b6bf8ab 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -35,6 +35,20 @@ static int batadv_nc_recv_coded_packet(struct sk_buff *skb,
                                       struct batadv_hard_iface *recv_if);
 /**
+ * batadv_nc_init - one-time initialization for network coding
+ */
+int __init batadv_nc_init(void)
+{
+        int ret;
+        /* Register our packet type */
+        ret = batadv_recv_handler_register(BATADV_CODED,
+                                           batadv_nc_recv_coded_packet);
+        return ret;
+}
+/**
 * batadv_nc_start_timer - initialise the nc periodic worker
 * @bat_priv: the bat priv with all the soft interface information
 */
@@ -45,10 +59,10 @@ static void batadv_nc_start_timer(struct batadv_priv *bat_priv)
 }
 /**
- * batadv_nc_init - initialise coding hash table and start house keeping
+ * batadv_nc_mesh_init - initialise coding hash table and start house keeping
 * @bat_priv: the bat priv with all the soft interface information
 */
-int batadv_nc_init(struct batadv_priv *bat_priv)
+int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
 {
        bat_priv->nc.timestamp_fwd_flush = jiffies;
        bat_priv->nc.timestamp_sniffed_purge = jiffies;
@@ -70,11 +84,6 @@ int batadv_nc_init(struct batadv_priv *bat_priv)
        batadv_hash_set_lock_class(bat_priv->nc.coding_hash,
                                   &batadv_nc_decoding_hash_lock_class_key);
-        /* Register our packet type */
-        if (batadv_recv_handler_register(BATADV_CODED,
-                                         batadv_nc_recv_coded_packet) < 0)
-                goto err;
        INIT_DELAYED_WORK(&bat_priv->nc.work, batadv_nc_worker);
        batadv_nc_start_timer(bat_priv);
@@ -1721,12 +1730,11 @@ free_nc_packet:
 }
 /**
- * batadv_nc_free - clean up network coding memory
+ * batadv_nc_mesh_free - clean up network coding memory
 * @bat_priv: the bat priv with all the soft interface information
 */
-void batadv_nc_free(struct batadv_priv *bat_priv)
+void batadv_nc_mesh_free(struct batadv_priv *bat_priv)
 {
-        batadv_recv_handler_unregister(BATADV_CODED);
        cancel_delayed_work_sync(&bat_priv->nc.work);
        batadv_nc_purge_paths(bat_priv, bat_priv->nc.coding_hash, NULL);
diff --git a/net/batman-adv/network-coding.h b/net/batman-adv/network-coding.h
index 85a4ec81ad50..ddfa618e80bf 100644
--- a/net/batman-adv/network-coding.h
+++ b/net/batman-adv/network-coding.h
@@ -22,8 +22,9 @@
 #ifdef CONFIG_BATMAN_ADV_NC
-int batadv_nc_init(struct batadv_priv *bat_priv);
+int batadv_nc_init(void);
-void batadv_nc_free(struct batadv_priv *bat_priv);
+int batadv_nc_mesh_init(struct batadv_priv *bat_priv);
+void batadv_nc_mesh_free(struct batadv_priv *bat_priv);
 void batadv_nc_update_nc_node(struct batadv_priv *bat_priv,
                              struct batadv_orig_node *orig_node,
                              struct batadv_orig_node *orig_neigh_node,
@@ -46,12 +47,17 @@ int batadv_nc_init_debugfs(struct batadv_priv *bat_priv);
 #else /* ifdef CONFIG_BATMAN_ADV_NC */
-static inline int batadv_nc_init(struct batadv_priv *bat_priv)
+static inline int batadv_nc_init(void)
 {
        return 0;
 }
-static inline void batadv_nc_free(struct batadv_priv *bat_priv)
+static inline int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
+{
+        return 0;
+}
+static inline void batadv_nc_mesh_free(struct batadv_priv *bat_priv)
 {
        return;
 }
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index ffd5874f2592..33e8f23acddd 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -700,7 +700,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                vid = nla_get_u16(tb[NDA_VLAN]);
-                if (vid >= VLAN_N_VID) {
+                if (!vid || vid >= VLAN_VID_MASK) {
                        pr_info("bridge: RTM_NEWNEIGH with invalid vlan id %d\n",
                                vid);
                        return -EINVAL;
@@ -794,7 +794,7 @@ int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
                vid = nla_get_u16(tb[NDA_VLAN]);
-                if (vid >= VLAN_N_VID) {
+                if (!vid || vid >= VLAN_VID_MASK) {
                        pr_info("bridge: RTM_NEWNEIGH with invalid vlan id %d\n",
                                vid);
                        return -EINVAL;
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index 85a09bb5ca51..b7b1914dfa25 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -453,7 +453,7 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
                call_rcu_bh(&p->rcu, br_multicast_free_pg);
                err = 0;
-                if (!mp->ports && !mp->mglist && mp->timer_armed &&
+                if (!mp->ports && !mp->mglist &&
                    netif_running(br->dev))
                        mod_timer(&mp->timer, jiffies);
                break;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index d1c578630678..8b0b610ca2c9 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -272,7 +272,7 @@ static void br_multicast_del_pg(struct net_bridge *br,
                del_timer(&p->timer);
                call_rcu_bh(&p->rcu, br_multicast_free_pg);
-                if (!mp->ports && !mp->mglist && mp->timer_armed &&
+                if (!mp->ports && !mp->mglist &&
                    netif_running(br->dev))
                        mod_timer(&mp->timer, jiffies);
@@ -620,7 +620,6 @@ rehash:
        mp->br = br;
        mp->addr = *group;
        setup_timer(&mp->timer, br_multicast_group_expired,
                    (unsigned long)mp);
@@ -660,6 +659,7 @@ static int br_multicast_add_group(struct net_bridge *br,
        struct net_bridge_mdb_entry *mp;
        struct net_bridge_port_group *p;
        struct net_bridge_port_group __rcu **pp;
+        unsigned long now = jiffies;
        int err;
        spin_lock(&br->multicast_lock);
@@ -674,6 +674,7 @@ static int br_multicast_add_group(struct net_bridge *br,
        if (!port) {
                mp->mglist = true;
+                mod_timer(&mp->timer, now + br->multicast_membership_interval);
                goto out;
        }
@@ -681,7 +682,7 @@ static int br_multicast_add_group(struct net_bridge *br,
             (p = mlock_dereference(*pp, br)) != NULL;
             pp = &p->next) {
                if (p->port == port)
-                        goto out;
+                        goto found;
                if ((unsigned long)p->port < (unsigned long)port)
                        break;
        }
@@ -692,6 +693,8 @@ static int br_multicast_add_group(struct net_bridge *br,
        rcu_assign_pointer(*pp, p);
        br_mdb_notify(br->dev, port, group, RTM_NEWMDB);
+found:
+        mod_timer(&p->timer, now + br->multicast_membership_interval);
 out:
        err = 0;
@@ -1191,9 +1194,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
        if (!mp)
                goto out;
-        mod_timer(&mp->timer, now + br->multicast_membership_interval);
-        mp->timer_armed = true;
        max_delay *= br->multicast_last_member_count;
        if (mp->mglist &&
@@ -1270,9 +1270,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
        if (!mp)
                goto out;
-        mod_timer(&mp->timer, now + br->multicast_membership_interval);
-        mp->timer_armed = true;
        max_delay *= br->multicast_last_member_count;
        if (mp->mglist &&
            (timer_pending(&mp->timer) ?
@@ -1358,7 +1355,7 @@ static void br_multicast_leave_group(struct net_bridge *br,
                        call_rcu_bh(&p->rcu, br_multicast_free_pg);
                        br_mdb_notify(br->dev, port, group, RTM_DELMDB);
-                        if (!mp->ports && !mp->mglist && mp->timer_armed &&
+                        if (!mp->ports && !mp->mglist &&
                            netif_running(br->dev))
                                mod_timer(&mp->timer, jiffies);
                }
@@ -1370,12 +1367,30 @@ static void br_multicast_leave_group(struct net_bridge *br,
                     br->multicast_last_member_interval;
        if (!port) {
-                if (mp->mglist && mp->timer_armed &&
+                if (mp->mglist &&
                    (timer_pending(&mp->timer) ?
                     time_after(mp->timer.expires, time) :
                     try_to_del_timer_sync(&mp->timer) >= 0)) {
                        mod_timer(&mp->timer, time);
                }
+                goto out;
+        }
+        for (p = mlock_dereference(mp->ports, br);
+             p != NULL;
+             p = mlock_dereference(p->next, br)) {
+                if (p->port != port)
+                        continue;
+                if (!hlist_unhashed(&p->mglist) &&
+                    (timer_pending(&p->timer) ?
+                     time_after(p->timer.expires, time) :
+                     try_to_del_timer_sync(&p->timer) >= 0)) {
+                        mod_timer(&p->timer, time);
+                }
+                break;
        }
 out:
        spin_unlock(&br->multicast_lock);
@@ -1798,7 +1813,6 @@ void br_multicast_stop(struct net_bridge *br)
                hlist_for_each_entry_safe(mp, n, &mdb->mhash[i],
                                          hlist[ver]) {
                        del_timer(&mp->timer);
-                        mp->timer_armed = false;
                        call_rcu_bh(&mp->rcu, br_multicast_free_group);
                }
        }
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index e74ddc1c29a8..f75d92e4f96b 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -243,7 +243,7 @@ static int br_afspec(struct net_bridge *br,
                vinfo = nla_data(tb[IFLA_BRIDGE_VLAN_INFO]);
-                if (vinfo->vid >= VLAN_N_VID)
+                if (!vinfo->vid || vinfo->vid >= VLAN_VID_MASK)
                        return -EINVAL;
                switch (cmd) {
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index efb57d911569..e14c33b42f75 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -126,7 +126,6 @@ struct net_bridge_mdb_entry
        struct timer_list               timer;
        struct br_ip                    addr;
        bool                            mglist;
-        bool                            timer_armed;
 };
 struct net_bridge_mdb_htable
@@ -643,9 +642,7 @@ static inline u16 br_get_pvid(const struct net_port_vlans *v)
         * vid wasn't set
         */
        smp_rmb();
-        return (v->pvid & VLAN_TAG_PRESENT) ?
+        return v->pvid ?: VLAN_N_VID;
-                        (v->pvid & ~VLAN_TAG_PRESENT) :
-                        VLAN_N_VID;
 }
 #else
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 108084a04671..656a6f3e40de 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -134,7 +134,7 @@ static void br_stp_start(struct net_bridge *br)
        if (br->bridge_forward_delay < BR_MIN_FORWARD_DELAY)
                __br_set_forward_delay(br, BR_MIN_FORWARD_DELAY);
-        else if (br->bridge_forward_delay < BR_MAX_FORWARD_DELAY)
+        else if (br->bridge_forward_delay > BR_MAX_FORWARD_DELAY)
                __br_set_forward_delay(br, BR_MAX_FORWARD_DELAY);
        if (r == 0) {
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 9a9ffe7e4019..53f0990eab58 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -45,37 +45,34 @@ static int __vlan_add(struct net_port_vlans *v, u16 vid, u16 flags)
                return 0;
        }
-        if (vid) {
+        if (v->port_idx) {
-                if (v->port_idx) {
+                p = v->parent.port;
-                        p = v->parent.port;
+                br = p->br;
-                        br = p->br;
+                dev = p->dev;
-                        dev = p->dev;
+        } else {
-                } else {
+                br = v->parent.br;
-                        br = v->parent.br;
+                dev = br->dev;
-                        dev = br->dev;
+        }
-                }
+        ops = dev->netdev_ops;
-                ops = dev->netdev_ops;
+        if (p && (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) {
-                if (p && (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) {
+                /* Add VLAN to the device filter if it is supported.
-                        /* Add VLAN to the device filter if it is supported.
+                 * Stricly speaking, this is not necessary now, since
-                         * Stricly speaking, this is not necessary now, since
+                 * devices are made promiscuous by the bridge, but if
-                         * devices are made promiscuous by the bridge, but if
+                 * that ever changes this code will allow tagged
-                         * that ever changes this code will allow tagged
+                 * traffic to enter the bridge.
-                         * traffic to enter the bridge.
+                 */
-                         */
+                err = ops->ndo_vlan_rx_add_vid(dev, htons(ETH_P_8021Q),
-                        err = ops->ndo_vlan_rx_add_vid(dev, htons(ETH_P_8021Q),
+                                               vid);
-                                                       vid);
+                if (err)
-                        if (err)
+                        return err;
-                                return err;
+        }
-                }
-                err = br_fdb_insert(br, p, dev->dev_addr, vid);
-                if (err) {
-                        br_err(br, "failed insert local address into bridge "
-                               "forwarding table\n");
-                        goto out_filt;
-                }
+        err = br_fdb_insert(br, p, dev->dev_addr, vid);
+        if (err) {
+                br_err(br, "failed insert local address into bridge "
+                       "forwarding table\n");
+                goto out_filt;
        }
        set_bit(vid, v->vlan_bitmap);
@@ -98,7 +95,7 @@ static int __vlan_del(struct net_port_vlans *v, u16 vid)
        __vlan_delete_pvid(v, vid);
        clear_bit(vid, v->untagged_bitmap);
-        if (v->port_idx && vid) {
+        if (v->port_idx) {
                struct net_device *dev = v->parent.port->dev;
                const struct net_device_ops *ops = dev->netdev_ops;
@@ -192,6 +189,8 @@ out:
 bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
                        struct sk_buff *skb, u16 *vid)
 {
+        int err;
        /* If VLAN filtering is disabled on the bridge, all packets are
         * permitted.
         */
@@ -204,20 +203,32 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
        if (!v)
                return false;
-        if (br_vlan_get_tag(skb, vid)) {
+        err = br_vlan_get_tag(skb, vid);
+        if (!*vid) {
                u16 pvid = br_get_pvid(v);
-                /* Frame did not have a tag.  See if pvid is set
+                /* Frame had a tag with VID 0 or did not have a tag.
-                 * on this port.  That tells us which vlan untagged
+                 * See if pvid is set on this port.  That tells us which
-                 * traffic belongs to.
+                 * vlan untagged or priority-tagged traffic belongs to.
                 */
                if (pvid == VLAN_N_VID)
                        return false;
-                /* PVID is set on this port.  Any untagged ingress
+                /* PVID is set on this port.  Any untagged or priority-tagged
-                 * frame is considered to belong to this vlan.
+                 * ingress frame is considered to belong to this vlan.
                 */
-                __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), pvid);
+                *vid = pvid;
+                if (likely(err))
+                        /* Untagged Frame. */
+                        __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), pvid);
+                else
+                        /* Priority-tagged Frame.
+                         * At this point, We know that skb->vlan_tci had
+                         * VLAN_TAG_PRESENT bit and its VID field was 0x000.
+                         * We update only VID field and preserve PCP field.
+                         */
+                        skb->vlan_tci |= pvid;
                return true;
        }
@@ -248,7 +259,9 @@ bool br_allowed_egress(struct net_bridge *br,
        return false;
 }
-/* Must be protected by RTNL */
+/* Must be protected by RTNL.
+ * Must be called with vid in range from 1 to 4094 inclusive.
+ */
 int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags)
 {
        struct net_port_vlans *pv = NULL;
@@ -278,7 +291,9 @@ out:
        return err;
 }
-/* Must be protected by RTNL */
+/* Must be protected by RTNL.
+ * Must be called with vid in range from 1 to 4094 inclusive.
+ */
 int br_vlan_delete(struct net_bridge *br, u16 vid)
 {
        struct net_port_vlans *pv;
@@ -289,14 +304,9 @@ int br_vlan_delete(struct net_bridge *br, u16 vid)
        if (!pv)
                return -EINVAL;
-        if (vid) {
+        spin_lock_bh(&br->hash_lock);
-                /* If the VID !=0 remove fdb for this vid. VID 0 is special
+        fdb_delete_by_addr(br, br->dev->dev_addr, vid);
-                 * in that it's the default and is always there in the fdb.
+        spin_unlock_bh(&br->hash_lock);
-                 */
-                spin_lock_bh(&br->hash_lock);
-                fdb_delete_by_addr(br, br->dev->dev_addr, vid);
-                spin_unlock_bh(&br->hash_lock);
-        }
        __vlan_del(pv, vid);
        return 0;
@@ -329,7 +339,9 @@ unlock:
        return 0;
 }
-/* Must be protected by RTNL */
+/* Must be protected by RTNL.
+ * Must be called with vid in range from 1 to 4094 inclusive.
+ */
 int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags)
 {
        struct net_port_vlans *pv = NULL;
@@ -363,7 +375,9 @@ clean_up:
        return err;
 }
-/* Must be protected by RTNL */
+/* Must be protected by RTNL.
+ * Must be called with vid in range from 1 to 4094 inclusive.
+ */
 int nbp_vlan_delete(struct net_bridge_port *port, u16 vid)
 {
        struct net_port_vlans *pv;
@@ -374,14 +388,9 @@ int nbp_vlan_delete(struct net_bridge_port *port, u16 vid)
        if (!pv)
                return -EINVAL;
-        if (vid) {
+        spin_lock_bh(&port->br->hash_lock);
-                /* If the VID !=0 remove fdb for this vid. VID 0 is special
+        fdb_delete_by_addr(port->br, port->dev->dev_addr, vid);
-                 * in that it's the default and is always there in the fdb.
+        spin_unlock_bh(&port->br->hash_lock);
-                 */
-                spin_lock_bh(&port->br->hash_lock);
-                fdb_delete_by_addr(port->br, port->dev->dev_addr, vid);
-                spin_unlock_bh(&port->br->hash_lock);
-        }
        return __vlan_del(pv, vid);
 }
diff --git a/net/compat.c b/net/compat.c
index f0a1ba6c8086..89032580bd1d 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -71,6 +71,8 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
            __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
            __get_user(kmsg->msg_flags, &umsg->msg_flags))
                return -EFAULT;
+        if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
+                return -EINVAL;
        kmsg->msg_name = compat_ptr(tmp1);
        kmsg->msg_iov = compat_ptr(tmp2);
        kmsg->msg_control = compat_ptr(tmp3);
diff --git a/net/core/dev.c b/net/core/dev.c
index 65f829cfd928..3430b1ed12e5 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1917,7 +1917,8 @@ static struct xps_map *expand_xps_map(struct xps_map *map,
        return new_map;
 }
-int netif_set_xps_queue(struct net_device *dev, struct cpumask *mask, u16 index)
+int netif_set_xps_queue(struct net_device *dev, const struct cpumask *mask,
+                        u16 index)
 {
        struct xps_dev_maps *dev_maps, *new_dev_maps = NULL;
        struct xps_map *map, *new_map;
diff --git a/net/core/filter.c b/net/core/filter.c
index 6438f29ff266..01b780856db2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -644,7 +644,6 @@ void sk_filter_release_rcu(struct rcu_head *rcu)
        struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
        bpf_jit_free(fp);
-        kfree(fp);
 }
 EXPORT_SYMBOL(sk_filter_release_rcu);
@@ -683,7 +682,7 @@ int sk_unattached_filter_create(struct sk_filter **pfp,
        if (fprog->filter == NULL)
                return -EINVAL;
-        fp = kmalloc(fsize + sizeof(*fp), GFP_KERNEL);
+        fp = kmalloc(sk_filter_size(fprog->len), GFP_KERNEL);
        if (!fp)
                return -ENOMEM;
        memcpy(fp->insns, fprog->filter, fsize);
@@ -723,6 +722,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
 {
        struct sk_filter *fp, *old_fp;
        unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
+        unsigned int sk_fsize = sk_filter_size(fprog->len);
        int err;
        if (sock_flag(sk, SOCK_FILTER_LOCKED))
@@ -732,11 +732,11 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
        if (fprog->filter == NULL)
                return -EINVAL;
-        fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
+        fp = sock_kmalloc(sk, sk_fsize, GFP_KERNEL);
        if (!fp)
                return -ENOMEM;
        if (copy_from_user(fp->insns, fprog->filter, fsize)) {
-                sock_kfree_s(sk, fp, fsize+sizeof(*fp));
+                sock_kfree_s(sk, fp, sk_fsize);
                return -EFAULT;
        }
diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
index 3f1ec1586ae1..8d9d05edd2eb 100644
--- a/net/core/secure_seq.c
+++ b/net/core/secure_seq.c
@@ -10,6 +10,7 @@
 #include <net/secure_seq.h>
+#if IS_ENABLED(CONFIG_IPV6) || IS_ENABLED(CONFIG_INET)
 #define NET_SECRET_SIZE (MD5_MESSAGE_BYTES / 4)
 static u32 net_secret[NET_SECRET_SIZE] ____cacheline_aligned;
@@ -29,6 +30,7 @@ static void net_secret_init(void)
                cmpxchg(&net_secret[--i], 0, tmp);
        }
 }
+#endif
 #ifdef CONFIG_INET
 static u32 seq_scale(u32 seq)
diff --git a/net/core/sock.c b/net/core/sock.c
index 5b6beba494a3..0b39e7ae4383 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2319,6 +2319,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
        sk->sk_ll_usec          =       sysctl_net_busy_read;
 #endif
+        sk->sk_pacing_rate = ~0U;
        /*
         * Before updating sk_refcnt, we must commit prior changes to memory
         * (Documentation/RCU/rculist_nulls.txt for details)
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index c85e71e0c7ff..ff41b4d60d30 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -1372,6 +1372,8 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev,
        real_dev = dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK]));
        if (!real_dev)
                return -ENODEV;
+        if (real_dev->type != ARPHRD_IEEE802154)
+                return -EINVAL;
        lowpan_dev_info(dev)->real_dev = real_dev;
        lowpan_dev_info(dev)->fragment_tag = 0;
@@ -1386,6 +1388,9 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev,
        entry->ldev = dev;
+        /* Set the lowpan harware address to the wpan hardware address. */
+        memcpy(dev->dev_addr, real_dev->dev_addr, IEEE802154_ADDR_LEN);
        mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx);
        INIT_LIST_HEAD(&entry->list);
        list_add_tail(&entry->list, &lowpan_devices);
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 7bd8983dbfcf..96da9c77deca 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -287,7 +287,7 @@ begintw:
                        if (unlikely(!INET_TW_MATCH(sk, net, acookie,
                                                    saddr, daddr, ports,
                                                    dif))) {
-                                sock_put(sk);
+                                inet_twsk_put(inet_twsk(sk));
                                goto begintw;
                        }
                        goto out;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index a04d872c54f9..3982eabf61e1 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -772,15 +772,20 @@ static inline int ip_ufo_append_data(struct sock *sk,
                /* initialize protocol header pointer */
                skb->transport_header = skb->network_header + fragheaderlen;
-                skb->ip_summed = CHECKSUM_PARTIAL;
                skb->csum = 0;
-                /* specify the length of each IP datagram fragment */
-                skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen;
-                skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
                __skb_queue_tail(queue, skb);
+        } else if (skb_is_gso(skb)) {
+                goto append;
        }
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        /* specify the length of each IP datagram fragment */
+        skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen;
+        skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+append:
        return skb_append_datato_frags(sk, skb, getfrag, from,
                                       (length - transhdrlen));
 }
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index e805e7b3030e..6e87f853d033 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -125,8 +125,17 @@ static int vti_rcv(struct sk_buff *skb)
                                  iph->saddr, iph->daddr, 0);
        if (tunnel != NULL) {
                struct pcpu_tstats *tstats;
+                u32 oldmark = skb->mark;
+                int ret;
-                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+                /* temporarily mark the skb with the tunnel o_key, to
+                 * only match policies with this mark.
+                 */
+                skb->mark = be32_to_cpu(tunnel->parms.o_key);
+                ret = xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb);
+                skb->mark = oldmark;
+                if (!ret)
                        return -1;
                tstats = this_cpu_ptr(tunnel->dev->tstats);
@@ -135,7 +144,6 @@ static int vti_rcv(struct sk_buff *skb)
                tstats->rx_bytes += skb->len;
                u64_stats_update_end(&tstats->syncp);
-                skb->mark = 0;
                secpath_reset(skb);
                skb->dev = tunnel->dev;
                return 1;
@@ -167,7 +175,7 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
        memset(&fl4, 0, sizeof(fl4));
        flowi4_init_output(&fl4, tunnel->parms.link,
-                           be32_to_cpu(tunnel->parms.i_key), RT_TOS(tos),
+                           be32_to_cpu(tunnel->parms.o_key), RT_TOS(tos),
                           RT_SCOPE_UNIVERSE,
                           IPPROTO_IPIP, 0,
                           dst, tiph->saddr, 0, 0);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 727f4365bcdf..6011615e810d 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2072,7 +2072,7 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
                                                              RT_SCOPE_LINK);
                        goto make_route;
                }
-                if (fl4->saddr) {
+                if (!fl4->saddr) {
                        if (ipv4_is_multicast(fl4->daddr))
                                fl4->saddr = inet_select_addr(dev_out, 0,
                                                              fl4->flowi4_scope);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 25a89eaa669d..a16b01b537ba 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1284,7 +1284,10 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                tp->lost_cnt_hint -= tcp_skb_pcount(prev);
        }
-        TCP_SKB_CB(skb)->tcp_flags |= TCP_SKB_CB(prev)->tcp_flags;
+        TCP_SKB_CB(prev)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags;
+        if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+                TCP_SKB_CB(prev)->end_seq++;
        if (skb == tcp_highest_sack(sk))
                tcp_advance_highest_sack(sk, skb);
@@ -3288,7 +3291,7 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
                        tcp_init_cwnd_reduction(sk, true);
                        tcp_set_ca_state(sk, TCP_CA_CWR);
                        tcp_end_cwnd_reduction(sk);
-                        tcp_set_ca_state(sk, TCP_CA_Open);
+                        tcp_try_keep_open(sk);
                        NET_INC_STATS_BH(sock_net(sk),
                                         LINUX_MIB_TCPLOSSPROBERECOVERY);
                }
@@ -5709,6 +5712,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                } else
                        tcp_init_metrics(sk);
+                tcp_update_pacing_rate(sk);
                /* Prevent spurious tcp_cwnd_restart() on first data packet */
                tp->lsndtime = tcp_time_stamp;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index e6bb8256e59f..d46f2143305c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -637,6 +637,8 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
        unsigned int size = 0;
        unsigned int eff_sacks;
+        opts->options = 0;
 #ifdef CONFIG_TCP_MD5SIG
        *md5 = tp->af_specific->md5_lookup(sk, sk);
        if (unlikely(*md5)) {
@@ -984,8 +986,10 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                                 unsigned int mss_now)
 {
-        if (skb->len <= mss_now || !sk_can_gso(sk) ||
+        /* Make sure we own this skb before messing gso_size/gso_segs */
-            skb->ip_summed == CHECKSUM_NONE) {
+        WARN_ON_ONCE(skb_cloned(skb));
+        if (skb->len <= mss_now || skb->ip_summed == CHECKSUM_NONE) {
                /* Avoid the costly divide in the normal
                 * non-TSO case.
                 */
@@ -1065,9 +1069,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
        if (nsize < 0)
                nsize = 0;
-        if (skb_cloned(skb) &&
+        if (skb_unclone(skb, GFP_ATOMIC))
-            skb_is_nonlinear(skb) &&
-            pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
                return -ENOMEM;
        /* Get a new skb... force flag on. */
@@ -2342,6 +2344,8 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                int oldpcount = tcp_skb_pcount(skb);
                if (unlikely(oldpcount > 1)) {
+                        if (skb_unclone(skb, GFP_ATOMIC))
+                                return -ENOMEM;
                        tcp_init_tso_segs(sk, skb, cur_mss);
                        tcp_adjust_pcount(sk, skb, oldpcount - tcp_skb_pcount(skb));
                }
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 9a459be24af7..ccde54248c8c 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -107,6 +107,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
        memset(fl4, 0, sizeof(struct flowi4));
        fl4->flowi4_mark = skb->mark;
+        fl4->flowi4_oif = skb_dst(skb)->dev->ifindex;
        if (!ip_is_fragment(iph)) {
                switch (iph->protocol) {
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 73784c3d4642..82e1da3a40b9 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -618,8 +618,7 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+offset);
        struct xfrm_state *x;
-        if (type != ICMPV6_DEST_UNREACH &&
+        if (type != ICMPV6_PKT_TOOBIG &&
-            type != ICMPV6_PKT_TOOBIG &&
            type != NDISC_REDIRECT)
                return;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index d3618a78fcac..e67e63f9858d 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -436,8 +436,7 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        struct ip_esp_hdr *esph = (struct ip_esp_hdr *)(skb->data + offset);
        struct xfrm_state *x;
-        if (type != ICMPV6_DEST_UNREACH &&
+        if (type != ICMPV6_PKT_TOOBIG &&
-            type != ICMPV6_PKT_TOOBIG &&
            type != NDISC_REDIRECT)
                return;
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 32b4a1675d82..066640e0ba8e 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -116,7 +116,7 @@ begintw:
                        }
                        if (unlikely(!INET6_TW_MATCH(sk, net, saddr, daddr,
                                                     ports, dif))) {
-                                sock_put(sk);
+                                inet_twsk_put(inet_twsk(sk));
                                goto begintw;
                        }
                        goto out;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 7bb5446b9d73..bf4a9a084de5 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -976,6 +976,7 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
                if (t->parms.o_flags&GRE_SEQ)
                        addend += 4;
        }
+        t->hlen = addend;
        if (p->flags & IP6_TNL_F_CAP_XMIT) {
                int strict = (ipv6_addr_type(&p->raddr) &
@@ -1002,8 +1003,6 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
                }
                ip6_rt_put(rt);
        }
-        t->hlen = addend;
 }
 static int ip6gre_tnl_change(struct ip6_tnl *t,
@@ -1173,9 +1172,8 @@ done:
 static int ip6gre_tunnel_change_mtu(struct net_device *dev, int new_mtu)
 {
-        struct ip6_tnl *tunnel = netdev_priv(dev);
        if (new_mtu < 68 ||
-            new_mtu > 0xFFF8 - dev->hard_header_len - tunnel->hlen)
+            new_mtu > 0xFFF8 - dev->hard_header_len)
                return -EINVAL;
        dev->mtu = new_mtu;
        return 0;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index a54c45ce4a48..91fb4e8212f5 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -105,7 +105,7 @@ static int ip6_finish_output2(struct sk_buff *skb)
        }
        rcu_read_lock_bh();
-        nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
+        nexthop = rt6_nexthop((struct rt6_info *)dst);
        neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
        if (unlikely(!neigh))
                neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
@@ -874,7 +874,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
         */
        rt = (struct rt6_info *) *dst;
        rcu_read_lock_bh();
-        n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt, &fl6->daddr));
+        n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt));
        err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
        rcu_read_unlock_bh();
@@ -1008,6 +1008,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
 {
        struct sk_buff *skb;
+        struct frag_hdr fhdr;
        int err;
        /* There is support for UDP large send offload by network
@@ -1015,8 +1016,6 @@ static inline int ip6_ufo_append_data(struct sock *sk,
         * udp datagram
         */
        if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
-                struct frag_hdr fhdr;
                skb = sock_alloc_send_skb(sk,
                        hh_len + fragheaderlen + transhdrlen + 20,
                        (flags & MSG_DONTWAIT), &err);
@@ -1036,20 +1035,24 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                skb->transport_header = skb->network_header + fragheaderlen;
                skb->protocol = htons(ETH_P_IPV6);
-                skb->ip_summed = CHECKSUM_PARTIAL;
                skb->csum = 0;
-                /* Specify the length of each IPv6 datagram fragment.
-                 * It has to be a multiple of 8.
-                 */
-                skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
-                                             sizeof(struct frag_hdr)) & ~7;
-                skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
-                ipv6_select_ident(&fhdr, rt);
-                skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
                __skb_queue_tail(&sk->sk_write_queue, skb);
+        } else if (skb_is_gso(skb)) {
+                goto append;
        }
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        /* Specify the length of each IPv6 datagram fragment.
+         * It has to be a multiple of 8.
+         */
+        skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
+                                     sizeof(struct frag_hdr)) & ~7;
+        skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+        ipv6_select_ident(&fhdr, rt);
+        skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
+append:
        return skb_append_datato_frags(sk, skb, getfrag, from,
                                       (length - transhdrlen));
 }
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index a791552e0422..583b77e2f69b 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1430,9 +1430,17 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 static int
 ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
 {
-        if (new_mtu < IPV6_MIN_MTU) {
+        struct ip6_tnl *tnl = netdev_priv(dev);
-                return -EINVAL;
+        if (tnl->parms.proto == IPPROTO_IPIP) {
+                if (new_mtu < 68)
+                        return -EINVAL;
+        } else {
+                if (new_mtu < IPV6_MIN_MTU)
+                        return -EINVAL;
        }
+        if (new_mtu > 0xFFF8 - dev->hard_header_len)
+                return -EINVAL;
        dev->mtu = new_mtu;
        return 0;
 }
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 5636a912074a..ce507d9e1c90 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -64,8 +64,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                (struct ip_comp_hdr *)(skb->data + offset);
        struct xfrm_state *x;
-        if (type != ICMPV6_DEST_UNREACH &&
+        if (type != ICMPV6_PKT_TOOBIG &&
-            type != ICMPV6_PKT_TOOBIG &&
            type != NDISC_REDIRECT)
                return;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c979dd96d82a..f54e3a101098 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -476,6 +476,24 @@ out:
 }
 #ifdef CONFIG_IPV6_ROUTER_PREF
+struct __rt6_probe_work {
+        struct work_struct work;
+        struct in6_addr target;
+        struct net_device *dev;
+};
+static void rt6_probe_deferred(struct work_struct *w)
+{
+        struct in6_addr mcaddr;
+        struct __rt6_probe_work *work =
+                container_of(w, struct __rt6_probe_work, work);
+        addrconf_addr_solict_mult(&work->target, &mcaddr);
+        ndisc_send_ns(work->dev, NULL, &work->target, &mcaddr, NULL);
+        dev_put(work->dev);
+        kfree(w);
+}
 static void rt6_probe(struct rt6_info *rt)
 {
        struct neighbour *neigh;
@@ -499,17 +517,23 @@ static void rt6_probe(struct rt6_info *rt)
        if (!neigh ||
            time_after(jiffies, neigh->updated + rt->rt6i_idev->cnf.rtr_probe_interval)) {
-                struct in6_addr mcaddr;
+                struct __rt6_probe_work *work;
-                struct in6_addr *target;
-                if (neigh) {
+                work = kmalloc(sizeof(*work), GFP_ATOMIC);
+                if (neigh && work)
                        neigh->updated = jiffies;
+                if (neigh)
                        write_unlock(&neigh->lock);
-                }
-                target = (struct in6_addr *)&rt->rt6i_gateway;
+                if (work) {
-                addrconf_addr_solict_mult(target, &mcaddr);
+                        INIT_WORK(&work->work, rt6_probe_deferred);
-                ndisc_send_ns(rt->dst.dev, NULL, target, &mcaddr, NULL);
+                        work->target = rt->rt6i_gateway;
+                        dev_hold(rt->dst.dev);
+                        work->dev = rt->dst.dev;
+                        schedule_work(&work->work);
+                }
        } else {
 out:
                write_unlock(&neigh->lock);
@@ -851,7 +875,6 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort,
                        if (ort->rt6i_dst.plen != 128 &&
                            ipv6_addr_equal(&ort->rt6i_dst.addr, daddr))
                                rt->rt6i_flags |= RTF_ANYCAST;
-                        rt->rt6i_gateway = *daddr;
                }
                rt->rt6i_flags |= RTF_CACHE;
@@ -1338,6 +1361,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
        rt->dst.flags |= DST_HOST;
        rt->dst.output  = ip6_output;
        atomic_set(&rt->dst.__refcnt, 1);
+        rt->rt6i_gateway  = fl6->daddr;
        rt->rt6i_dst.addr = fl6->daddr;
        rt->rt6i_dst.plen = 128;
        rt->rt6i_idev     = idev;
@@ -1873,7 +1897,10 @@ static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                        in6_dev_hold(rt->rt6i_idev);
                rt->dst.lastuse = jiffies;
-                rt->rt6i_gateway = ort->rt6i_gateway;
+                if (ort->rt6i_flags & RTF_GATEWAY)
+                        rt->rt6i_gateway = ort->rt6i_gateway;
+                else
+                        rt->rt6i_gateway = *dest;
                rt->rt6i_flags = ort->rt6i_flags;
                if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
                    (RTF_DEFAULT | RTF_ADDRCONF))
@@ -2160,6 +2187,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
        else
                rt->rt6i_flags |= RTF_LOCAL;
+        rt->rt6i_gateway  = *addr;
        rt->rt6i_dst.addr = *addr;
        rt->rt6i_dst.plen = 128;
        rt->rt6i_table = fib6_get_table(net, RT6_TABLE_LOCAL);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 72b7eaaf3ca0..18786098fd41 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1225,9 +1225,6 @@ do_udp_sendmsg:
        if (tclass < 0)
                tclass = np->tclass;
-        if (dontfrag < 0)
-                dontfrag = np->dontfrag;
        if (msg->msg_flags&MSG_CONFIRM)
                goto do_confirm;
 back_from_confirm:
@@ -1246,6 +1243,8 @@ back_from_confirm:
        up->pending = AF_INET6;
 do_append_data:
+        if (dontfrag < 0)
+                dontfrag = np->dontfrag;
        up->len += ulen;
        getfrag  =  is_udplite ?  udplite_getfrag : ip_generic_getfrag;
        err = ip6_append_data(sk, getfrag, msg->msg_iov, ulen,
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 23ed03d786c8..08ed2772b7aa 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -138,6 +138,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
        memset(fl6, 0, sizeof(struct flowi6));
        fl6->flowi6_mark = skb->mark;
+        fl6->flowi6_oif = skb_dst(skb)->dev->ifindex;
        fl6->daddr = reverse ? hdr->saddr : hdr->daddr;
        fl6->saddr = reverse ? hdr->daddr : hdr->saddr;
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9d585370c5b4..911ef03bf8fb 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1098,7 +1098,8 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
        x->id.proto = proto;
        x->id.spi = sa->sadb_sa_spi;
-        x->props.replay_window = sa->sadb_sa_replay;
+        x->props.replay_window = min_t(unsigned int, sa->sadb_sa_replay,
+                                        (sizeof(x->replay.bitmap) * 8));
        if (sa->sadb_sa_flags & SADB_SAFLAGS_NOECN)
                x->props.flags |= XFRM_STATE_NOECN;
        if (sa->sadb_sa_flags & SADB_SAFLAGS_DECAP_DSCP)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index feae495a0a30..b076e8309bc2 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -115,6 +115,11 @@ struct l2tp_net {
 static void l2tp_session_set_header_len(struct l2tp_session *session, int version);
 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
+static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
+{
+        return sk->sk_user_data;
+}
 static inline struct l2tp_net *l2tp_pernet(struct net *net)
 {
        BUG_ON(!net);
@@ -504,7 +509,7 @@ static inline int l2tp_verify_udp_checksum(struct sock *sk,
                return 0;
 #if IS_ENABLED(CONFIG_IPV6)
-        if (sk->sk_family == PF_INET6) {
+        if (sk->sk_family == PF_INET6 && !l2tp_tunnel(sk)->v4mapped) {
                if (!uh->check) {
                        LIMIT_NETDEBUG(KERN_INFO "L2TP: IPv6: checksum is 0\n");
                        return 1;
@@ -1128,7 +1133,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
        /* Queue the packet to IP for output */
        skb->local_df = 1;
 #if IS_ENABLED(CONFIG_IPV6)
-        if (skb->sk->sk_family == PF_INET6)
+        if (skb->sk->sk_family == PF_INET6 && !tunnel->v4mapped)
                error = inet6_csk_xmit(skb, NULL);
        else
 #endif
@@ -1255,7 +1260,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
                /* Calculate UDP checksum if configured to do so */
 #if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == PF_INET6)
+                if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
                        l2tp_xmit_ipv6_csum(sk, skb, udp_len);
                else
 #endif
@@ -1304,10 +1309,9 @@ EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
 */
 static void l2tp_tunnel_destruct(struct sock *sk)
 {
-        struct l2tp_tunnel *tunnel;
+        struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
        struct l2tp_net *pn;
-        tunnel = sk->sk_user_data;
        if (tunnel == NULL)
                goto end;
@@ -1675,7 +1679,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
        }
        /* Check if this socket has already been prepped */
-        tunnel = (struct l2tp_tunnel *)sk->sk_user_data;
+        tunnel = l2tp_tunnel(sk);
        if (tunnel != NULL) {
                /* This socket has already been prepped */
                err = -EBUSY;
@@ -1704,6 +1708,24 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
        if (cfg != NULL)
                tunnel->debug = cfg->debug;
+#if IS_ENABLED(CONFIG_IPV6)
+        if (sk->sk_family == PF_INET6) {
+                struct ipv6_pinfo *np = inet6_sk(sk);
+                if (ipv6_addr_v4mapped(&np->saddr) &&
+                    ipv6_addr_v4mapped(&np->daddr)) {
+                        struct inet_sock *inet = inet_sk(sk);
+                        tunnel->v4mapped = true;
+                        inet->inet_saddr = np->saddr.s6_addr32[3];
+                        inet->inet_rcv_saddr = np->rcv_saddr.s6_addr32[3];
+                        inet->inet_daddr = np->daddr.s6_addr32[3];
+                } else {
+                        tunnel->v4mapped = false;
+                }
+        }
+#endif
        /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
        tunnel->encap = encap;
        if (encap == L2TP_ENCAPTYPE_UDP) {
@@ -1712,7 +1734,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
                udp_sk(sk)->encap_destroy = l2tp_udp_encap_destroy;
 #if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == PF_INET6)
+                if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
                        udpv6_encap_enable();
                else
 #endif
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 66a559b104b6..6f251cbc2ed7 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -194,6 +194,9 @@ struct l2tp_tunnel {
        struct sock             *sock;          /* Parent socket */
        int                     fd;             /* Parent fd, if tunnel socket
                                                 * was created by userspace */
+#if IS_ENABLED(CONFIG_IPV6)
+        bool                    v4mapped;
+#endif
        struct work_struct      del_work;
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 5ebee2ded9e9..8c46b271064a 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -353,7 +353,9 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
                goto error_put_sess_tun;
        }
+        local_bh_disable();
        l2tp_xmit_skb(session, skb, session->hdr_len);
+        local_bh_enable();
        sock_put(ps->tunnel_sock);
        sock_put(sk);
@@ -422,7 +424,9 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        skb->data[0] = ppph[0];
        skb->data[1] = ppph[1];
+        local_bh_disable();
        l2tp_xmit_skb(session, skb, session->hdr_len);
+        local_bh_enable();
        sock_put(sk_tun);
        sock_put(sk);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 2e7855a1b10d..629dee7ec9bf 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3518,7 +3518,7 @@ static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
                return -EINVAL;
        }
        band = chanctx_conf->def.chan->band;
-        sta = sta_info_get(sdata, peer);
+        sta = sta_info_get_bss(sdata, peer);
        if (sta) {
                qos = test_sta_flag(sta, WLAN_STA_WME);
        } else {
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index b6186517ec56..611abfcfb5eb 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -893,6 +893,8 @@ struct tpt_led_trigger {
 *      that the scan completed.
 * @SCAN_ABORTED: Set for our scan work function when the driver reported
 *      a scan complete for an aborted scan.
+ * @SCAN_HW_CANCELLED: Set for our scan work function when the scan is being
+ *      cancelled.
 */
 enum {
        SCAN_SW_SCANNING,
@@ -900,6 +902,7 @@ enum {
        SCAN_ONCHANNEL_SCANNING,
        SCAN_COMPLETED,
        SCAN_ABORTED,
+        SCAN_HW_CANCELLED,
 };
 /**
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index acd1f71adc03..0c2a29484c07 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -394,6 +394,8 @@ void ieee80211_sw_roc_work(struct work_struct *work)
                if (started)
                        ieee80211_start_next_roc(local);
+                else if (list_empty(&local->roc_list))
+                        ieee80211_run_deferred_scan(local);
        }
 out_unlock:
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 54395d7583ba..674eac1f996c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3056,6 +3056,9 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
        case NL80211_IFTYPE_ADHOC:
                if (!bssid)
                        return 0;
+                if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
+                    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
+                        return 0;
                if (ieee80211_is_beacon(hdr->frame_control)) {
                        return 1;
                } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 08afe74b98f4..d2d17a449224 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -238,6 +238,9 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
        enum ieee80211_band band;
        int i, ielen, n_chans;
+        if (test_bit(SCAN_HW_CANCELLED, &local->scanning))
+                return false;
        do {
                if (local->hw_scan_band == IEEE80211_NUM_BANDS)
                        return false;
@@ -940,7 +943,23 @@ void ieee80211_scan_cancel(struct ieee80211_local *local)
        if (!local->scan_req)
                goto out;
+        /*
+         * We have a scan running and the driver already reported completion,
+         * but the worker hasn't run yet or is stuck on the mutex - mark it as
+         * cancelled.
+         */
+        if (test_bit(SCAN_HW_SCANNING, &local->scanning) &&
+            test_bit(SCAN_COMPLETED, &local->scanning)) {
+                set_bit(SCAN_HW_CANCELLED, &local->scanning);
+                goto out;
+        }
        if (test_bit(SCAN_HW_SCANNING, &local->scanning)) {
+                /*
+                 * Make sure that __ieee80211_scan_completed doesn't trigger a
+                 * scan on another band.
+                 */
+                set_bit(SCAN_HW_CANCELLED, &local->scanning);
                if (local->ops->cancel_hw_scan)
                        drv_cancel_hw_scan(local,
                                rcu_dereference_protected(local->scan_sdata,
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 368837fe3b80..78dc2e99027e 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -180,6 +180,9 @@ static void ieee80211_frame_acked(struct sta_info *sta, struct sk_buff *skb)
        struct ieee80211_local *local = sta->local;
        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                sta->last_rx = jiffies;
        if (ieee80211_is_data_qos(mgmt->frame_control)) {
                struct ieee80211_hdr *hdr = (void *) skb->data;
                u8 *qc = ieee80211_get_qos_ctl(hdr);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3456c0486b48..70b5a05c0a4e 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1120,7 +1120,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                tx->sta = rcu_dereference(sdata->u.vlan.sta);
                if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
                        return TX_DROP;
-        } else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
+        } else if (info->flags & (IEEE80211_TX_CTL_INJECTED |
+                                  IEEE80211_TX_INTFL_NL80211_FRAME_TX) ||
                   tx->sdata->control_port_protocol == tx->skb->protocol) {
                tx->sta = sta_info_get_bss(sdata, hdr->addr1);
        }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index e1b34a18b243..69e4ef5348a0 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2103,7 +2103,7 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
 {
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_supported_band *sband;
-        int rate, skip, shift;
+        int rate, shift;
        u8 i, exrates, *pos;
        u32 basic_rates = sdata->vif.bss_conf.basic_rates;
        u32 rate_flags;
@@ -2131,14 +2131,11 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
                pos = skb_put(skb, exrates + 2);
                *pos++ = WLAN_EID_EXT_SUPP_RATES;
                *pos++ = exrates;
-                skip = 0;
                for (i = 8; i < sband->n_bitrates; i++) {
                        u8 basic = 0;
                        if ((rate_flags & sband->bitrates[i].flags)
                            != rate_flags)
                                continue;
-                        if (skip++ < 8)
-                                continue;
                        if (need_basic && basic_rates & BIT(i))
                                basic = 0x80;
                        rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
@@ -2241,6 +2238,10 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
        }
        rate = cfg80211_calculate_bitrate(&ri);
+        if (WARN_ONCE(!rate,
+                      "Invalid bitrate: flags=0x%x, idx=%d, vht_nss=%d\n",
+                      status->flag, status->rate_idx, status->vht_nss))
+                return 0;
        /* rewind from end of MPDU */
        if (status->flag & RX_FLAG_MACTIME_END)
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index bdebd03bc8cd..70866d192efc 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -778,8 +778,8 @@ static int callforward_do_filter(const union nf_inet_addr *src,
                                   flowi6_to_flowi(&fl1), false)) {
                        if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
                                           flowi6_to_flowi(&fl2), false)) {
-                                if (!memcmp(&rt1->rt6i_gateway, &rt2->rt6i_gateway,
+                                if (ipv6_addr_equal(rt6_nexthop(rt1),
-                                            sizeof(rt1->rt6i_gateway)) &&
+                                                    rt6_nexthop(rt2)) &&
                                    rt1->dst.dev == rt2->dst.dev)
                                        ret = 1;
                                dst_release(&rt2->dst);
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index a2fef8b10b96..a9dfdda9ed1d 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -472,20 +472,16 @@ begin:
        if (f->credit > 0 || !q->rate_enable)
                goto out;
-        if (skb->sk && skb->sk->sk_state != TCP_TIME_WAIT) {
+        rate = q->flow_max_rate;
-                rate = skb->sk->sk_pacing_rate ?: q->flow_default_rate;
+        if (skb->sk && skb->sk->sk_state != TCP_TIME_WAIT)
+                rate = min(skb->sk->sk_pacing_rate, rate);
-                rate = min(rate, q->flow_max_rate);
+        if (rate != ~0U) {
-        } else {
-                rate = q->flow_max_rate;
-                if (rate == ~0U)
-                        goto out;
-        }
-        if (rate) {
                u32 plen = max(qdisc_pkt_len(skb), q->quantum);
                u64 len = (u64)plen * NSEC_PER_SEC;
-                do_div(len, rate);
+                if (likely(rate))
+                        do_div(len, rate);
                /* Since socket rate can change later,
                 * clamp the delay to 125 ms.
                 * TODO: maybe segment the too big skb, as in commit
@@ -656,7 +652,7 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
                q->quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]);
        if (tb[TCA_FQ_INITIAL_QUANTUM])
-                q->quantum = nla_get_u32(tb[TCA_FQ_INITIAL_QUANTUM]);
+                q->initial_quantum = nla_get_u32(tb[TCA_FQ_INITIAL_QUANTUM]);
        if (tb[TCA_FQ_FLOW_DEFAULT_RATE])
                q->flow_default_rate = nla_get_u32(tb[TCA_FQ_FLOW_DEFAULT_RATE]);
@@ -735,12 +731,14 @@ static int fq_dump(struct Qdisc *sch, struct sk_buff *skb)
        if (opts == NULL)
                goto nla_put_failure;
+        /* TCA_FQ_FLOW_DEFAULT_RATE is not used anymore,
+         * do not bother giving its value
+         */
        if (nla_put_u32(skb, TCA_FQ_PLIMIT, sch->limit) ||
            nla_put_u32(skb, TCA_FQ_FLOW_PLIMIT, q->flow_plimit) ||
            nla_put_u32(skb, TCA_FQ_QUANTUM, q->quantum) ||
            nla_put_u32(skb, TCA_FQ_INITIAL_QUANTUM, q->initial_quantum) ||
            nla_put_u32(skb, TCA_FQ_RATE_ENABLE, q->rate_enable) ||
-            nla_put_u32(skb, TCA_FQ_FLOW_DEFAULT_RATE, q->flow_default_rate) ||
            nla_put_u32(skb, TCA_FQ_FLOW_MAX_RATE, q->flow_max_rate) ||
            nla_put_u32(skb, TCA_FQ_BUCKETS_LOG, q->fq_trees_log))
                goto nla_put_failure;
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index a6d788d45216..b87e83d07478 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -358,6 +358,21 @@ static psched_time_t packet_len_2_sched_time(unsigned int len, struct netem_sche
        return PSCHED_NS2TICKS(ticks);
 }
+static void tfifo_reset(struct Qdisc *sch)
+{
+        struct netem_sched_data *q = qdisc_priv(sch);
+        struct rb_node *p;
+        while ((p = rb_first(&q->t_root))) {
+                struct sk_buff *skb = netem_rb_to_skb(p);
+                rb_erase(p, &q->t_root);
+                skb->next = NULL;
+                skb->prev = NULL;
+                kfree_skb(skb);
+        }
+}
 static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
 {
        struct netem_sched_data *q = qdisc_priv(sch);
@@ -520,6 +535,7 @@ static unsigned int netem_drop(struct Qdisc *sch)
                        skb->next = NULL;
                        skb->prev = NULL;
                        len = qdisc_pkt_len(skb);
+                        sch->qstats.backlog -= len;
                        kfree_skb(skb);
                }
        }
@@ -609,6 +625,7 @@ static void netem_reset(struct Qdisc *sch)
        struct netem_sched_data *q = qdisc_priv(sch);
        qdisc_reset_queue(sch);
+        tfifo_reset(sch);
        if (q->qdisc)
                qdisc_reset(q->qdisc);
        qdisc_watchdog_cancel(&q->watchdog);
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 0ac3a65daccb..319137340d15 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -536,7 +536,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         * by CRC32-C as described in <draft-ietf-tsvwg-sctpcsum-02.txt>.
         */
        if (!sctp_checksum_disable) {
-                if (!(dst->dev->features & NETIF_F_SCTP_CSUM)) {
+                if (!(dst->dev->features & NETIF_F_SCTP_CSUM) ||
+                    (dst_xfrm(dst) != NULL) || packet->ipfragok) {
                        __u32 crc32 = sctp_start_cksum((__u8 *)sh, cksum_buf_len);
                        /* 3) Put the resultant value into the checksum field in the
diff --git a/net/socket.c b/net/socket.c
index ebed4b68f768..c226aceee65b 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1964,6 +1964,16 @@ struct used_address {
        unsigned int name_len;
 };
+static int copy_msghdr_from_user(struct msghdr *kmsg,
+                                 struct msghdr __user *umsg)
+{
+        if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
+                return -EFAULT;
+        if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
+                return -EINVAL;
+        return 0;
+}
 static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
                         struct msghdr *msg_sys, unsigned int flags,
                         struct used_address *used_address)
@@ -1982,8 +1992,11 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
        if (MSG_CMSG_COMPAT & flags) {
                if (get_compat_msghdr(msg_sys, msg_compat))
                        return -EFAULT;
-        } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
+        } else {
-                return -EFAULT;
+                err = copy_msghdr_from_user(msg_sys, msg);
+                if (err)
+                        return err;
+        }
        if (msg_sys->msg_iovlen > UIO_FASTIOV) {
                err = -EMSGSIZE;
@@ -2191,8 +2204,11 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
        if (MSG_CMSG_COMPAT & flags) {
                if (get_compat_msghdr(msg_sys, msg_compat))
                        return -EFAULT;
-        } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
+        } else {
-                return -EFAULT;
+                err = copy_msghdr_from_user(msg_sys, msg);
+                if (err)
+                        return err;
+        }
        if (msg_sys->msg_iovlen > UIO_FASTIOV) {
                err = -EMSGSIZE;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 86de99ad2976..c1f403bed683 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1246,6 +1246,15 @@ static int unix_socketpair(struct socket *socka, struct socket *sockb)
        return 0;
 }
+static void unix_sock_inherit_flags(const struct socket *old,
+                                    struct socket *new)
+{
+        if (test_bit(SOCK_PASSCRED, &old->flags))
+                set_bit(SOCK_PASSCRED, &new->flags);
+        if (test_bit(SOCK_PASSSEC, &old->flags))
+                set_bit(SOCK_PASSSEC, &new->flags);
+}
 static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
 {
        struct sock *sk = sock->sk;
@@ -1280,6 +1289,7 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
        /* attach accepted sock to socket */
        unix_state_lock(tsk);
        newsock->state = SS_CONNECTED;
+        unix_sock_inherit_flags(sock, newsock);
        sock_graft(tsk, newsock);
        unix_state_unlock(tsk);
        return 0;
diff --git a/net/unix/diag.c b/net/unix/diag.c
index d591091603bf..86fa0f3b2caf 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -124,6 +124,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r
        rep->udiag_family = AF_UNIX;
        rep->udiag_type = sk->sk_type;
        rep->udiag_state = sk->sk_state;
+        rep->pad = 0;
        rep->udiag_ino = sk_ino;
        sock_diag_save_cookie(sk, rep->udiag_cookie);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 67153964aad2..aff959e5a1b3 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -566,18 +566,13 @@ int wiphy_register(struct wiphy *wiphy)
        /* check and set up bitrates */
        ieee80211_set_bitrate_flags(wiphy);
+        rtnl_lock();
        res = device_add(&rdev->wiphy.dev);
-        if (res)
-                return res;
-        res = rfkill_register(rdev->rfkill);
        if (res) {
-                device_del(&rdev->wiphy.dev);
+                rtnl_unlock();
                return res;
        }
-        rtnl_lock();
        /* set up regulatory info */
        wiphy_regulatory_register(wiphy);
@@ -606,6 +601,15 @@ int wiphy_register(struct wiphy *wiphy)
        rdev->wiphy.registered = true;
        rtnl_unlock();
+        res = rfkill_register(rdev->rfkill);
+        if (res) {
+                rfkill_destroy(rdev->rfkill);
+                rdev->rfkill = NULL;
+                wiphy_unregister(&rdev->wiphy);
+                return res;
+        }
        return 0;
 }
 EXPORT_SYMBOL(wiphy_register);
@@ -640,7 +644,8 @@ void wiphy_unregister(struct wiphy *wiphy)
                rtnl_unlock();
                __count == 0; }));
-        rfkill_unregister(rdev->rfkill);
+        if (rdev->rfkill)
+                rfkill_unregister(rdev->rfkill);
        rtnl_lock();
        rdev->wiphy.registered = false;
@@ -953,8 +958,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
        case NETDEV_PRE_UP:
                if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
                        return notifier_from_errno(-EOPNOTSUPP);
-                if (rfkill_blocked(rdev->rfkill))
-                        return notifier_from_errno(-ERFKILL);
                ret = cfg80211_can_add_interface(rdev, wdev->iftype);
                if (ret)
                        return notifier_from_errno(ret);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 9ad43c619c54..3159e9c284c5 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -411,6 +411,9 @@ static inline int
 cfg80211_can_add_interface(struct cfg80211_registered_device *rdev,
                           enum nl80211_iftype iftype)
 {
+        if (rfkill_blocked(rdev->rfkill))
+                return -ERFKILL;
        return cfg80211_can_change_interface(rdev, NULL, iftype);
 }
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 39bff7d36768..403fe29c024d 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -263,6 +263,8 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
                                if (chan->flags & IEEE80211_CHAN_DISABLED)
                                        continue;
                                wdev->wext.ibss.chandef.chan = chan;
+                                wdev->wext.ibss.chandef.center_freq1 =
+                                        chan->center_freq;
                                break;
                        }
@@ -347,6 +349,7 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
        if (chan) {
                wdev->wext.ibss.chandef.chan = chan;
                wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+                wdev->wext.ibss.chandef.center_freq1 = freq;
                wdev->wext.ibss.channel_fixed = true;
        } else {
                /* cfg80211_ibss_wext_join will pick one if needed */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index af8d84a4a5b2..626dc3b5fd8d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2421,7 +2421,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                change = true;
        }
-        if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
+        if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
            !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
                return -EOPNOTSUPP;
@@ -2483,7 +2483,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                                  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                  &flags);
-        if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
+        if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
            !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
                return -EOPNOTSUPP;
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index 7d604c06c3dc..a271c27fac77 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -97,6 +97,10 @@ int ieee80211_radiotap_iterator_init(
        struct ieee80211_radiotap_header *radiotap_header,
        int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
 {
+        /* check the radiotap header can actually be present */
+        if (max_length < sizeof(struct ieee80211_radiotap_header))
+                return -EINVAL;
        /* Linux only supports version 0 radiotap format */
        if (radiotap_header->it_version)
                return -EINVAL;
@@ -131,7 +135,8 @@ int ieee80211_radiotap_iterator_init(
                         */
                        if ((unsigned long)iterator->_arg -
-                            (unsigned long)iterator->_rtheader >
+                            (unsigned long)iterator->_rtheader +
+                            sizeof(uint32_t) >
                            (unsigned long)iterator->_max_length)
                                return -EINVAL;
                }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index ed38d5d81f9e..76e1873811d4 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -334,7 +334,8 @@ static void xfrm_policy_kill(struct xfrm_policy *policy)
        atomic_inc(&policy->genid);
-        del_timer(&policy->polq.hold_timer);
+        if (del_timer(&policy->polq.hold_timer))
+                xfrm_pol_put(policy);
        xfrm_queue_purge(&policy->polq.hold_queue);
        if (del_timer(&policy->timer))
@@ -589,7 +590,8 @@ static void xfrm_policy_requeue(struct xfrm_policy *old,
        spin_lock_bh(&pq->hold_queue.lock);
        skb_queue_splice_init(&pq->hold_queue, &list);
-        del_timer(&pq->hold_timer);
+        if (del_timer(&pq->hold_timer))
+                xfrm_pol_put(old);
        spin_unlock_bh(&pq->hold_queue.lock);
        if (skb_queue_empty(&list))
@@ -600,7 +602,8 @@ static void xfrm_policy_requeue(struct xfrm_policy *old,
        spin_lock_bh(&pq->hold_queue.lock);
        skb_queue_splice(&list, &pq->hold_queue);
        pq->timeout = XFRM_QUEUE_TMO_MIN;
-        mod_timer(&pq->hold_timer, jiffies);
+        if (!mod_timer(&pq->hold_timer, jiffies))
+                xfrm_pol_hold(new);
        spin_unlock_bh(&pq->hold_queue.lock);
 }
@@ -1769,6 +1772,10 @@ static void xfrm_policy_queue_process(unsigned long arg)
        spin_lock(&pq->hold_queue.lock);
        skb = skb_peek(&pq->hold_queue);
+        if (!skb) {
+                spin_unlock(&pq->hold_queue.lock);
+                goto out;
+        }
        dst = skb_dst(skb);
        sk = skb->sk;
        xfrm_decode_session(skb, &fl, dst->ops->family);
@@ -1787,8 +1794,9 @@ static void xfrm_policy_queue_process(unsigned long arg)
                        goto purge_queue;
                pq->timeout = pq->timeout << 1;
-                mod_timer(&pq->hold_timer, jiffies + pq->timeout);
+                if (!mod_timer(&pq->hold_timer, jiffies + pq->timeout))
-                return;
+                        xfrm_pol_hold(pol);
+        goto out;
        }
        dst_release(dst);
@@ -1819,11 +1827,14 @@ static void xfrm_policy_queue_process(unsigned long arg)
                err = dst_output(skb);
        }
+out:
+        xfrm_pol_put(pol);
        return;
 purge_queue:
        pq->timeout = 0;
        xfrm_queue_purge(&pq->hold_queue);
+        xfrm_pol_put(pol);
 }
 static int xdst_queue_output(struct sk_buff *skb)
@@ -1831,7 +1842,8 @@ static int xdst_queue_output(struct sk_buff *skb)
        unsigned long sched_next;
        struct dst_entry *dst = skb_dst(skb);
        struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
-        struct xfrm_policy_queue *pq = &xdst->pols[0]->polq;
+        struct xfrm_policy *pol = xdst->pols[0];
+        struct xfrm_policy_queue *pq = &pol->polq;
        if (pq->hold_queue.qlen > XFRM_MAX_QUEUE_LEN) {
                kfree_skb(skb);
@@ -1850,10 +1862,12 @@ static int xdst_queue_output(struct sk_buff *skb)
        if (del_timer(&pq->hold_timer)) {
                if (time_before(pq->hold_timer.expires, sched_next))
                        sched_next = pq->hold_timer.expires;
+                xfrm_pol_put(pol);
        }
        __skb_queue_tail(&pq->hold_queue, skb);
-        mod_timer(&pq->hold_timer, sched_next);
+        if (!mod_timer(&pq->hold_timer, sched_next))
+                xfrm_pol_hold(pol);
        spin_unlock_bh(&pq->hold_queue.lock);
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 8dafe6d3c6e4..dab57daae408 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -61,9 +61,9 @@ static void xfrm_replay_notify(struct xfrm_state *x, int event)
        switch (event) {
        case XFRM_REPLAY_UPDATE:
-                if (x->replay_maxdiff &&
+                if (!x->replay_maxdiff ||
-                    (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
+                    ((x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
-                    (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
+                    (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff))) {
                        if (x->xflags & XFRM_TIME_DEFER)
                                event = XFRM_REPLAY_TIMEOUT;
                        else
@@ -129,8 +129,7 @@ static int xfrm_replay_check(struct xfrm_state *x,
                return 0;
        diff = x->replay.seq - seq;
-        if (diff >= min_t(unsigned int, x->props.replay_window,
+        if (diff >= x->props.replay_window) {
-                          sizeof(x->replay.bitmap) * 8)) {
                x->stats.replay_window++;
                goto err;
        }
@@ -302,9 +301,10 @@ static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
        switch (event) {
        case XFRM_REPLAY_UPDATE:
-                if (x->replay_maxdiff &&
+                if (!x->replay_maxdiff ||
-                    (replay_esn->seq - preplay_esn->seq < x->replay_maxdiff) &&
+                    ((replay_esn->seq - preplay_esn->seq < x->replay_maxdiff) &&
-                    (replay_esn->oseq - preplay_esn->oseq < x->replay_maxdiff)) {
+                    (replay_esn->oseq - preplay_esn->oseq
+                     < x->replay_maxdiff))) {
                        if (x->xflags & XFRM_TIME_DEFER)
                                event = XFRM_REPLAY_TIMEOUT;
                        else
@@ -353,28 +353,30 @@ static void xfrm_replay_notify_esn(struct xfrm_state *x, int event)
        switch (event) {
        case XFRM_REPLAY_UPDATE:
-                if (!x->replay_maxdiff)
+                if (x->replay_maxdiff) {
-                        break;
+                        if (replay_esn->seq_hi == preplay_esn->seq_hi)
+                                seq_diff = replay_esn->seq - preplay_esn->seq;
-                if (replay_esn->seq_hi == preplay_esn->seq_hi)
+                        else
-                        seq_diff = replay_esn->seq - preplay_esn->seq;
+                                seq_diff = ~preplay_esn->seq + replay_esn->seq
-                else
+                                           + 1;
-                        seq_diff = ~preplay_esn->seq + replay_esn->seq + 1;
-                if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
-                        oseq_diff = replay_esn->oseq - preplay_esn->oseq;
-                else
-                        oseq_diff = ~preplay_esn->oseq + replay_esn->oseq + 1;
-                if (seq_diff < x->replay_maxdiff &&
-                    oseq_diff < x->replay_maxdiff) {
-                        if (x->xflags & XFRM_TIME_DEFER)
+                        if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
-                                event = XFRM_REPLAY_TIMEOUT;
+                                oseq_diff = replay_esn->oseq
+                                            - preplay_esn->oseq;
                        else
-                                return;
+                                oseq_diff = ~preplay_esn->oseq
+                                            + replay_esn->oseq + 1;
+                        if (seq_diff >= x->replay_maxdiff ||
+                            oseq_diff >= x->replay_maxdiff)
+                                break;
                }
+                if (x->xflags & XFRM_TIME_DEFER)
+                        event = XFRM_REPLAY_TIMEOUT;
+                else
+                        return;
                break;
        case XFRM_REPLAY_TIMEOUT:
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 3f565e495ac6..f964d4c00ffb 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -446,7 +446,8 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *
        memcpy(&x->sel, &p->sel, sizeof(x->sel));
        memcpy(&x->lft, &p->lft, sizeof(x->lft));
        x->props.mode = p->mode;
-        x->props.replay_window = p->replay_window;
+        x->props.replay_window = min_t(unsigned int, p->replay_window,
+                                        sizeof(x->replay.bitmap) * 8);
        x->props.reqid = p->reqid;
        x->props.family = p->family;
        memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
@@ -1856,7 +1857,7 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
        if (x->km.state != XFRM_STATE_VALID)
                goto out;
-        err = xfrm_replay_verify_len(x->replay_esn, rp);
+        err = xfrm_replay_verify_len(x->replay_esn, re);
        if (err)
                goto out;
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 487ac6f37ca2..9a11f9f799f4 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -55,6 +55,7 @@ static struct sym_entry *table;
 static unsigned int table_size, table_cnt;
 static int all_symbols = 0;
 static char symbol_prefix_char = '\0';
+static unsigned long long kernel_start_addr = 0;
 int token_profit[0x10000];
@@ -65,7 +66,10 @@ unsigned char best_table_len[256];
 static void usage(void)
 {
-        fprintf(stderr, "Usage: kallsyms [--all-symbols] [--symbol-prefix=<prefix char>] < in.map > out.S\n");
+        fprintf(stderr, "Usage: kallsyms [--all-symbols] "
+                        "[--symbol-prefix=<prefix char>] "
+                        "[--page-offset=<CONFIG_PAGE_OFFSET>] "
+                        "< in.map > out.S\n");
        exit(1);
 }
@@ -194,6 +198,9 @@ static int symbol_valid(struct sym_entry *s)
        int i;
        int offset = 1;
+        if (s->addr < kernel_start_addr)
+                return 0;
        /* skip prefix char */
        if (symbol_prefix_char && *(s->sym + 1) == symbol_prefix_char)
                offset++;
@@ -646,6 +653,9 @@ int main(int argc, char **argv)
                                if ((*p == '"' && *(p+2) == '"') || (*p == '\'' && *(p+2) == '\''))
                                        p++;
                                symbol_prefix_char = *p;
+                        } else if (strncmp(argv[i], "--page-offset=", 14) == 0) {
+                                const char *p = &argv[i][14];
+                                kernel_start_addr = strtoull(p, NULL, 16);
                        } else
                                usage();
                }
diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index 014994936b1c..32b10f53d0b4 100644
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -82,6 +82,8 @@ kallsyms()
                kallsymopt="${kallsymopt} --all-symbols"
        fi
+        kallsymopt="${kallsymopt} --page-offset=$CONFIG_PAGE_OFFSET"
        local aflags="${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL}               \
                      ${NOSTDINC_FLAGS} ${LINUXINCLUDE} ${KBUILD_CPPFLAGS}"
diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 17f45e8aa89c..e1e9e0c999fe 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -49,6 +49,8 @@ static struct snd_pcm *snd_pcm_get(struct snd_card *card, int device)
        struct snd_pcm *pcm;
        list_for_each_entry(pcm, &snd_pcm_devices, list) {
+                if (pcm->internal)
+                        continue;
                if (pcm->card == card && pcm->device == device)
                        return pcm;
        }
@@ -60,6 +62,8 @@ static int snd_pcm_next(struct snd_card *card, int device)
        struct snd_pcm *pcm;
        list_for_each_entry(pcm, &snd_pcm_devices, list) {
+                if (pcm->internal)
+                        continue;
                if (pcm->card == card && pcm->device > device)
                        return pcm->device;
                else if (pcm->card->number > card->number)
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 5b6c4e3c92ca..748c6a941963 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -4864,8 +4864,8 @@ static void hda_power_work(struct work_struct *work)
        spin_unlock(&codec->power_lock);
        state = hda_call_codec_suspend(codec, true);
-        codec->pm_down_notified = 0;
+        if (!codec->pm_down_notified &&
-        if (!bus->power_keep_link_on && (state & AC_PWRST_CLK_STOP_OK)) {
+            !bus->power_keep_link_on && (state & AC_PWRST_CLK_STOP_OK)) {
                codec->pm_down_notified = 1;
                hda_call_pm_notify(bus, false);
        }
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 26ad4f0aade3..b7c89dff7066 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -4475,9 +4475,11 @@ int snd_hda_gen_build_controls(struct hda_codec *codec)
                                            true, &spec->vmaster_mute.sw_kctl);
                if (err < 0)
                        return err;
-                if (spec->vmaster_mute.hook)
+                if (spec->vmaster_mute.hook) {
                        snd_hda_add_vmaster_hook(codec, &spec->vmaster_mute,
                                                 spec->vmaster_mute_enum);
+                        snd_hda_sync_vmaster_hook(&spec->vmaster_mute);
+                }
        }
        free_kctls(spec); /* no longer needed */
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index 0cbdd87dde6d..2aa2f579b4d6 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -968,6 +968,15 @@ static void ad1884_fixup_hp_eapd(struct hda_codec *codec,
        }
 }
+static void ad1884_fixup_thinkpad(struct hda_codec *codec,
+                                  const struct hda_fixup *fix, int action)
+{
+        struct ad198x_spec *spec = codec->spec;
+        if (action == HDA_FIXUP_ACT_PRE_PROBE)
+                spec->gen.keep_eapd_on = 1;
+}
 /* set magic COEFs for dmic */
 static const struct hda_verb ad1884_dmic_init_verbs[] = {
        {0x01, AC_VERB_SET_COEF_INDEX, 0x13f7},
@@ -979,6 +988,7 @@ enum {
        AD1884_FIXUP_AMP_OVERRIDE,
        AD1884_FIXUP_HP_EAPD,
        AD1884_FIXUP_DMIC_COEF,
+        AD1884_FIXUP_THINKPAD,
        AD1884_FIXUP_HP_TOUCHSMART,
 };
@@ -997,6 +1007,12 @@ static const struct hda_fixup ad1884_fixups[] = {
                .type = HDA_FIXUP_VERBS,
                .v.verbs = ad1884_dmic_init_verbs,
        },
+        [AD1884_FIXUP_THINKPAD] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = ad1884_fixup_thinkpad,
+                .chained = true,
+                .chain_id = AD1884_FIXUP_DMIC_COEF,
+        },
        [AD1884_FIXUP_HP_TOUCHSMART] = {
                .type = HDA_FIXUP_VERBS,
                .v.verbs = ad1884_dmic_init_verbs,
@@ -1008,7 +1024,7 @@ static const struct hda_fixup ad1884_fixups[] = {
 static const struct snd_pci_quirk ad1884_fixup_tbl[] = {
        SND_PCI_QUIRK(0x103c, 0x2a82, "HP Touchsmart", AD1884_FIXUP_HP_TOUCHSMART),
        SND_PCI_QUIRK_VENDOR(0x103c, "HP", AD1884_FIXUP_HP_EAPD),
-        SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo Thinkpad", AD1884_FIXUP_DMIC_COEF),
+        SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo Thinkpad", AD1884_FIXUP_THINKPAD),
        {}
 };
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index bf313bea7085..8ad554312b69 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4623,6 +4623,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
        SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_ASUS_MODE4),
+        SND_PCI_QUIRK(0x1043, 0x1bf3, "ASUS N76VZ", ALC662_FIXUP_ASUS_MODE4),
        SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT),
        SND_PCI_QUIRK(0x105b, 0x0cd6, "Foxconn", ALC662_FIXUP_ASUS_MODE2),
        SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
index 651ce0923675..c91eba504f92 100644
--- a/sound/soc/codecs/pcm1681.c
+++ b/sound/soc/codecs/pcm1681.c
@@ -270,7 +270,7 @@ MODULE_DEVICE_TABLE(of, pcm1681_dt_ids);
 static const struct regmap_config pcm1681_regmap = {
        .reg_bits               = 8,
        .val_bits               = 8,
-        .max_register           = ARRAY_SIZE(pcm1681_reg_defaults) + 1,
+        .max_register           = 0x13,
        .reg_defaults           = pcm1681_reg_defaults,
        .num_reg_defaults       = ARRAY_SIZE(pcm1681_reg_defaults),
        .writeable_reg          = pcm1681_writeable_reg,
diff --git a/sound/soc/codecs/pcm1792a.c b/sound/soc/codecs/pcm1792a.c
index 2a8eccf64c76..7613181123fe 100644
--- a/sound/soc/codecs/pcm1792a.c
+++ b/sound/soc/codecs/pcm1792a.c
@@ -188,7 +188,7 @@ MODULE_DEVICE_TABLE(of, pcm1792a_of_match);
 static const struct regmap_config pcm1792a_regmap = {
        .reg_bits               = 8,
        .val_bits               = 8,
-        .max_register           = 24,
+        .max_register           = 23,
        .reg_defaults           = pcm1792a_reg_defaults,
        .num_reg_defaults       = ARRAY_SIZE(pcm1792a_reg_defaults),
        .writeable_reg          = pcm1792a_writeable_reg,
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index 6e3f269243e0..64ad84d8a306 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -674,6 +674,8 @@ static const struct snd_soc_dapm_route intercon[] = {
        /* Left Input */
        {"Left Line1L Mux", "single-ended", "LINE1L"},
        {"Left Line1L Mux", "differential", "LINE1L"},
+        {"Left Line1R Mux", "single-ended", "LINE1R"},
+        {"Left Line1R Mux", "differential", "LINE1R"},
        {"Left Line2L Mux", "single-ended", "LINE2L"},
        {"Left Line2L Mux", "differential", "LINE2L"},
@@ -690,6 +692,8 @@ static const struct snd_soc_dapm_route intercon[] = {
        /* Right Input */
        {"Right Line1R Mux", "single-ended", "LINE1R"},
        {"Right Line1R Mux", "differential", "LINE1R"},
+        {"Right Line1L Mux", "single-ended", "LINE1L"},
+        {"Right Line1L Mux", "differential", "LINE1L"},
        {"Right Line2R Mux", "single-ended", "LINE2R"},
        {"Right Line2R Mux", "differential", "LINE2R"},
diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
index 8b50e5958de5..01daf655e20b 100644
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -530,6 +530,7 @@ static int hp_supply_event(struct snd_soc_dapm_widget *w,
                                hubs->hp_startup_mode);
                        break;
                }
+                break;
        case SND_SOC_DAPM_PRE_PMD:
                snd_soc_update_bits(codec, WM8993_CHARGE_PUMP_1,
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index c6b743978d5e..6b81d0ce2c44 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -936,7 +936,7 @@ static int fsl_ssi_probe(struct platform_device *pdev)
        ssi_private->ssi_phys = res.start;
        ssi_private->irq = irq_of_parse_and_map(np, 0);
-        if (ssi_private->irq == NO_IRQ) {
+        if (ssi_private->irq == 0) {
                dev_err(&pdev->dev, "no irq for node %s\n", np->full_name);
                return -ENXIO;
        }
diff --git a/sound/soc/fsl/imx-mc13783.c b/sound/soc/fsl/imx-mc13783.c
index a3d60d4bea4c..a2fd7321b5a9 100644
--- a/sound/soc/fsl/imx-mc13783.c
+++ b/sound/soc/fsl/imx-mc13783.c
@@ -112,7 +112,7 @@ static int imx_mc13783_probe(struct platform_device *pdev)
                return ret;
        }
-        if (machine_is_mx31_3ds()) {
+        if (machine_is_mx31_3ds() || machine_is_mx31moboard()) {
                imx_audmux_v2_configure_port(MX31_AUDMUX_PORT4_SSI_PINS_4,
                        IMX_AUDMUX_V2_PTCR_SYN,
                        IMX_AUDMUX_V2_PDCR_RXDSEL(MX31_AUDMUX_PORT1_SSI0) |
diff --git a/sound/soc/fsl/imx-ssi.c b/sound/soc/fsl/imx-ssi.c
index f58bcd85c07f..57d6941676ff 100644
--- a/sound/soc/fsl/imx-ssi.c
+++ b/sound/soc/fsl/imx-ssi.c
@@ -600,19 +600,17 @@ static int imx_ssi_probe(struct platform_device *pdev)
        ssi->fiq_params.dma_params_rx = &ssi->dma_params_rx;
        ssi->fiq_params.dma_params_tx = &ssi->dma_params_tx;
-        ret = imx_pcm_fiq_init(pdev, &ssi->fiq_params);
+        ssi->fiq_init = imx_pcm_fiq_init(pdev, &ssi->fiq_params);
-        if (ret)
+        ssi->dma_init = imx_pcm_dma_init(pdev);
-                goto failed_pcm_fiq;
-        ret = imx_pcm_dma_init(pdev);
+        if (ssi->fiq_init && ssi->dma_init) {
-        if (ret)
+                ret = ssi->fiq_init;
-                goto failed_pcm_dma;
+                goto failed_pcm;
+        }
        return 0;
-failed_pcm_dma:
+failed_pcm:
-        imx_pcm_fiq_exit(pdev);
-failed_pcm_fiq:
        snd_soc_unregister_component(&pdev->dev);
 failed_register:
        release_mem_region(res->start, resource_size(res));
@@ -628,8 +626,11 @@ static int imx_ssi_remove(struct platform_device *pdev)
        struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        struct imx_ssi *ssi = platform_get_drvdata(pdev);
-        imx_pcm_dma_exit(pdev);
+        if (!ssi->dma_init)
-        imx_pcm_fiq_exit(pdev);
+                imx_pcm_dma_exit(pdev);
+        if (!ssi->fiq_init)
+                imx_pcm_fiq_exit(pdev);
        snd_soc_unregister_component(&pdev->dev);
diff --git a/sound/soc/fsl/imx-ssi.h b/sound/soc/fsl/imx-ssi.h
index fb1616ba8c59..560c40fc9ebb 100644
--- a/sound/soc/fsl/imx-ssi.h
+++ b/sound/soc/fsl/imx-ssi.h
@@ -211,6 +211,8 @@ struct imx_ssi {
        struct imx_dma_data filter_data_rx;
        struct imx_pcm_fiq_params fiq_params;
+        int fiq_init;
+        int dma_init;
        int enabled;
 };
diff --git a/sound/soc/omap/Kconfig b/sound/soc/omap/Kconfig
index daa78a0095fa..4a07f7179690 100644
--- a/sound/soc/omap/Kconfig
+++ b/sound/soc/omap/Kconfig
@@ -1,6 +1,6 @@
 config SND_OMAP_SOC
        tristate "SoC Audio for the Texas Instruments OMAP chips"
-        depends on (ARCH_OMAP && DMA_OMAP) || (ARCH_ARM && COMPILE_TEST)
+        depends on (ARCH_OMAP && DMA_OMAP) || (ARM && COMPILE_TEST)
        select SND_DMAENGINE_PCM
 config SND_OMAP_SOC_DMIC
@@ -26,7 +26,7 @@ config SND_OMAP_SOC_N810
 config SND_OMAP_SOC_RX51
        tristate "SoC Audio support for Nokia RX-51"
-        depends on SND_OMAP_SOC && ARCH_ARM && (MACH_NOKIA_RX51 || COMPILE_TEST)
+        depends on SND_OMAP_SOC && ARM && (MACH_NOKIA_RX51 || COMPILE_TEST)
        select SND_OMAP_SOC_MCBSP
        select SND_SOC_TLV320AIC3X
        select SND_SOC_TPA6130A2
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
index 9cc6986a8cfb..5dd87f4c919e 100644
--- a/sound/soc/sh/rcar/rsnd.h
+++ b/sound/soc/sh/rcar/rsnd.h
@@ -220,8 +220,8 @@ int rsnd_gen_path_exit(struct rsnd_priv *priv,
 void __iomem *rsnd_gen_reg_get(struct rsnd_priv *priv,
                               struct rsnd_mod *mod,
                               enum rsnd_reg reg);
-#define rsnd_is_gen1(s)         ((s)->info->flags & RSND_GEN1)
+#define rsnd_is_gen1(s)         (((s)->info->flags & RSND_GEN_MASK) == RSND_GEN1)
-#define rsnd_is_gen2(s)         ((s)->info->flags & RSND_GEN2)
+#define rsnd_is_gen2(s)         (((s)->info->flags & RSND_GEN_MASK) == RSND_GEN2)
 /*
 *      R-Car ADG
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index c17c14c394df..b2949aed1ac2 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -1949,7 +1949,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
                                w->active ? "active" : "inactive");
        list_for_each_entry(p, &w->sources, list_sink) {
-                if (p->connected && !p->connected(w, p->sink))
+                if (p->connected && !p->connected(w, p->source))
                        continue;
                if (p->connect)
@@ -3495,6 +3495,7 @@ int snd_soc_dapm_new_dai_widgets(struct snd_soc_dapm_context *dapm,
                if (!w) {
                        dev_err(dapm->dev, "ASoC: Failed to create %s widget\n",
                                dai->driver->playback.stream_name);
+                        return -ENOMEM;
                }
                w->priv = dai;
@@ -3513,6 +3514,7 @@ int snd_soc_dapm_new_dai_widgets(struct snd_soc_dapm_context *dapm,
                if (!w) {
                        dev_err(dapm->dev, "ASoC: Failed to create %s widget\n",
                                dai->driver->capture.stream_name);
+                        return -ENOMEM;
                }
                w->priv = dai;
diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt
index e297b74471b8..ca0d3d9f4bac 100644
--- a/tools/perf/Documentation/perf-record.txt
+++ b/tools/perf/Documentation/perf-record.txt
@@ -90,8 +90,20 @@ OPTIONS
        Number of mmap data pages. Must be a power of two.
 -g::
+        Enables call-graph (stack chain/backtrace) recording.
 --call-graph::
-        Do call-graph (stack chain/backtrace) recording.
+        Setup and enable call-graph (stack chain/backtrace) recording,
+        implies -g.
+        Allows specifying "fp" (frame pointer) or "dwarf"
+        (DWARF's CFI - Call Frame Information) as the method to collect
+        the information used to show the call graphs.
+        In some systems, where binaries are build with gcc
+        --fomit-frame-pointer, using the "fp" method will produce bogus
+        call graphs, using "dwarf", if available (perf tools linked to
+        the libunwind library) should be used instead.
 -q::
 --quiet::
diff --git a/tools/perf/Documentation/perf-top.txt b/tools/perf/Documentation/perf-top.txt
index 58d6598a9686..6a118e71d003 100644
--- a/tools/perf/Documentation/perf-top.txt
+++ b/tools/perf/Documentation/perf-top.txt
@@ -140,20 +140,12 @@ Default is to monitor all CPUS.
 --asm-raw::
        Show raw instruction encoding of assembly instructions.
-G [type,min,order]::
+-G::
+        Enables call-graph (stack chain/backtrace) recording.
 --call-graph::
-        Display call chains using type, min percent threshold and order.
+        Setup and enable call-graph (stack chain/backtrace) recording,
-        type can be either:
+        implies -G.
-        - flat: single column, linear exposure of call chains.
-        - graph: use a graph tree, displaying absolute overhead rates.
-        - fractal: like graph, but displays relative rates. Each branch of
-                 the tree is considered as a new profiled object.
-        order can be either:
-        - callee: callee based call graph.
-        - caller: inverted caller based call graph.
-        Default: fractal,0.5,callee.
 --ignore-callees=<regex>::
        Ignore callees of the function(s) matching the given regex.
diff --git a/tools/perf/builtin-kvm.c b/tools/perf/builtin-kvm.c
index 935d52216c89..fbc2888d6495 100644
--- a/tools/perf/builtin-kvm.c
+++ b/tools/perf/builtin-kvm.c
@@ -888,11 +888,18 @@ static s64 perf_kvm__mmap_read_idx(struct perf_kvm_stat *kvm, int idx,
        while ((event = perf_evlist__mmap_read(kvm->evlist, idx)) != NULL) {
                err = perf_evlist__parse_sample(kvm->evlist, event, &sample);
                if (err) {
+                        perf_evlist__mmap_consume(kvm->evlist, idx);
                        pr_err("Failed to parse sample\n");
                        return -1;
                }
                err = perf_session_queue_event(kvm->session, event, &sample, 0);
+                /*
+                 * FIXME: Here we can't consume the event, as perf_session_queue_event will
+                 *        point to it, and it'll get possibly overwritten by the kernel.
+                 */
+                perf_evlist__mmap_consume(kvm->evlist, idx);
                if (err) {
                        pr_err("Failed to enqueue sample: %d\n", err);
                        return -1;
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index a41ac41546c9..d04651484640 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -712,21 +712,12 @@ static int get_stack_size(char *str, unsigned long *_size)
 }
 #endif /* LIBUNWIND_SUPPORT */
-int record_parse_callchain_opt(const struct option *opt,
+int record_parse_callchain(const char *arg, struct perf_record_opts *opts)
-                               const char *arg, int unset)
 {
-        struct perf_record_opts *opts = opt->value;
        char *tok, *name, *saveptr = NULL;
        char *buf;
        int ret = -1;
-        /* --no-call-graph */
-        if (unset)
-                return 0;
-        /* We specified default option if none is provided. */
-        BUG_ON(!arg);
        /* We need buffer that we know we can write to. */
        buf = malloc(strlen(arg) + 1);
        if (!buf)
@@ -764,13 +755,9 @@ int record_parse_callchain_opt(const struct option *opt,
                                ret = get_stack_size(tok, &size);
                                opts->stack_dump_size = size;
                        }
-                        if (!ret)
-                                pr_debug("callchain: stack dump size %d\n",
-                                         opts->stack_dump_size);
 #endif /* LIBUNWIND_SUPPORT */
                } else {
-                        pr_err("callchain: Unknown -g option "
+                        pr_err("callchain: Unknown --call-graph option "
                               "value: %s\n", arg);
                        break;
                }
@@ -778,13 +765,52 @@ int record_parse_callchain_opt(const struct option *opt,
        } while (0);
        free(buf);
+        return ret;
+}
+static void callchain_debug(struct perf_record_opts *opts)
+{
+        pr_debug("callchain: type %d\n", opts->call_graph);
+        if (opts->call_graph == CALLCHAIN_DWARF)
+                pr_debug("callchain: stack dump size %d\n",
+                         opts->stack_dump_size);
+}
+int record_parse_callchain_opt(const struct option *opt,
+                               const char *arg,
+                               int unset)
+{
+        struct perf_record_opts *opts = opt->value;
+        int ret;
+        /* --no-call-graph */
+        if (unset) {
+                opts->call_graph = CALLCHAIN_NONE;
+                pr_debug("callchain: disabled\n");
+                return 0;
+        }
+        ret = record_parse_callchain(arg, opts);
        if (!ret)
-                pr_debug("callchain: type %d\n", opts->call_graph);
+                callchain_debug(opts);
        return ret;
 }
+int record_callchain_opt(const struct option *opt,
+                         const char *arg __maybe_unused,
+                         int unset __maybe_unused)
+{
+        struct perf_record_opts *opts = opt->value;
+        if (opts->call_graph == CALLCHAIN_NONE)
+                opts->call_graph = CALLCHAIN_FP;
+        callchain_debug(opts);
+        return 0;
+}
 static const char * const record_usage[] = {
        "perf record [<options>] [<command>]",
        "perf record [<options>] -- <command> [<options>]",
@@ -813,12 +839,12 @@ static struct perf_record record = {
        },
 };
-#define CALLCHAIN_HELP "do call-graph (stack chain/backtrace) recording: "
+#define CALLCHAIN_HELP "setup and enables call-graph (stack chain/backtrace) recording: "
 #ifdef LIBUNWIND_SUPPORT
-const char record_callchain_help[] = CALLCHAIN_HELP "[fp] dwarf";
+const char record_callchain_help[] = CALLCHAIN_HELP "fp dwarf";
 #else
-const char record_callchain_help[] = CALLCHAIN_HELP "[fp]";
+const char record_callchain_help[] = CALLCHAIN_HELP "fp";
 #endif
 /*
@@ -858,9 +884,12 @@ const struct option record_options[] = {
                     "number of mmap data pages"),
        OPT_BOOLEAN(0, "group", &record.opts.group,
                    "put the counters into a counter group"),
-        OPT_CALLBACK_DEFAULT('g', "call-graph", &record.opts,
+        OPT_CALLBACK_NOOPT('g', NULL, &record.opts,
-                             "mode[,dump_size]", record_callchain_help,
+                           NULL, "enables call-graph recording" ,
-                             &record_parse_callchain_opt, "fp"),
+                           &record_callchain_opt),
+        OPT_CALLBACK(0, "call-graph", &record.opts,
+                     "mode[,dump_size]", record_callchain_help,
+                     &record_parse_callchain_opt),
        OPT_INCR('v', "verbose", &verbose,
                    "be more verbose (show counter open errors, etc)"),
        OPT_BOOLEAN('q', "quiet", &quiet, "don't print any message"),
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 212214162bb2..5a11f13e56f9 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -810,7 +810,7 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
                ret = perf_evlist__parse_sample(top->evlist, event, &sample);
                if (ret) {
                        pr_err("Can't parse sample, err = %d\n", ret);
-                        continue;
+                        goto next_event;
                }
                evsel = perf_evlist__id2evsel(session->evlist, sample.id);
@@ -825,13 +825,13 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
                case PERF_RECORD_MISC_USER:
                        ++top->us_samples;
                        if (top->hide_user_symbols)
-                                continue;
+                                goto next_event;
                        machine = &session->machines.host;
                        break;
                case PERF_RECORD_MISC_KERNEL:
                        ++top->kernel_samples;
                        if (top->hide_kernel_symbols)
-                                continue;
+                                goto next_event;
                        machine = &session->machines.host;
                        break;
                case PERF_RECORD_MISC_GUEST_KERNEL:
@@ -847,7 +847,7 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
                         */
                        /* Fall thru */
                default:
-                        continue;
+                        goto next_event;
                }
@@ -859,6 +859,8 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
                        machine__process_event(machine, event);
                } else
                        ++session->stats.nr_unknown_events;
+next_event:
+                perf_evlist__mmap_consume(top->evlist, idx);
        }
 }
@@ -1016,16 +1018,16 @@ out_delete:
 }
 static int
-parse_callchain_opt(const struct option *opt, const char *arg, int unset)
+callchain_opt(const struct option *opt, const char *arg, int unset)
 {
-        /*
-         * --no-call-graph
-         */
-        if (unset)
-                return 0;
        symbol_conf.use_callchain = true;
+        return record_callchain_opt(opt, arg, unset);
+}
+static int
+parse_callchain_opt(const struct option *opt, const char *arg, int unset)
+{
+        symbol_conf.use_callchain = true;
        return record_parse_callchain_opt(opt, arg, unset);
 }
@@ -1106,9 +1108,12 @@ int cmd_top(int argc, const char **argv, const char *prefix __maybe_unused)
                   "sort by key(s): pid, comm, dso, symbol, parent, weight, local_weight"),
        OPT_BOOLEAN('n', "show-nr-samples", &symbol_conf.show_nr_samples,
                    "Show a column with the number of samples"),
-        OPT_CALLBACK_DEFAULT('G', "call-graph", &top.record_opts,
+        OPT_CALLBACK_NOOPT('G', NULL, &top.record_opts,
-                             "mode[,dump_size]", record_callchain_help,
+                           NULL, "enables call-graph recording",
-                             &parse_callchain_opt, "fp"),
+                           &callchain_opt),
+        OPT_CALLBACK(0, "call-graph", &top.record_opts,
+                     "mode[,dump_size]", record_callchain_help,
+                     &parse_callchain_opt),
        OPT_CALLBACK(0, "ignore-callees", NULL, "regex",
                   "ignore callees of these functions in call graphs",
                   report_parse_ignore_callees_opt),
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 71aa3e35406b..99c8d9ad6729 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -987,7 +987,7 @@ again:
                        err = perf_evlist__parse_sample(evlist, event, &sample);
                        if (err) {
                                fprintf(trace->output, "Can't parse sample, err = %d, skipping...\n", err);
-                                continue;
+                                goto next_event;
                        }
                        if (trace->base_time == 0)
@@ -1001,18 +1001,20 @@ again:
                        evsel = perf_evlist__id2evsel(evlist, sample.id);
                        if (evsel == NULL) {
                                fprintf(trace->output, "Unknown tp ID %" PRIu64 ", skipping...\n", sample.id);
-                                continue;
+                                goto next_event;
                        }
                        if (sample.raw_data == NULL) {
                                fprintf(trace->output, "%s sample with no payload for tid: %d, cpu %d, raw_size=%d, skipping...\n",
                                       perf_evsel__name(evsel), sample.tid,
                                       sample.cpu, sample.raw_size);
-                                continue;
+                                goto next_event;
                        }
                        handler = evsel->handler.func;
                        handler(trace, evsel, &sample);
+next_event:
+                        perf_evlist__mmap_consume(evlist, i);
                        if (done)
                                goto out_unmap_evlist;
diff --git a/tools/perf/tests/code-reading.c b/tools/perf/tests/code-reading.c
index 6fb781d5586c..e3fedfa2906e 100644
--- a/tools/perf/tests/code-reading.c
+++ b/tools/perf/tests/code-reading.c
@@ -290,6 +290,7 @@ static int process_events(struct machine *machine, struct perf_evlist *evlist,
        for (i = 0; i < evlist->nr_mmaps; i++) {
                while ((event = perf_evlist__mmap_read(evlist, i)) != NULL) {
                        ret = process_event(machine, evlist, event, state);
+                        perf_evlist__mmap_consume(evlist, i);
                        if (ret < 0)
                                return ret;
                }
diff --git a/tools/perf/tests/keep-tracking.c b/tools/perf/tests/keep-tracking.c
index d444ea2c47d9..376c35608534 100644
--- a/tools/perf/tests/keep-tracking.c
+++ b/tools/perf/tests/keep-tracking.c
@@ -36,6 +36,7 @@ static int find_comm(struct perf_evlist *evlist, const char *comm)
                            (pid_t)event->comm.tid == getpid() &&
                            strcmp(event->comm.comm, comm) == 0)
                                found += 1;
+                        perf_evlist__mmap_consume(evlist, i);
                }
        }
        return found;
diff --git a/tools/perf/tests/mmap-basic.c b/tools/perf/tests/mmap-basic.c
index c4185b9aeb80..a7232c204eb9 100644
--- a/tools/perf/tests/mmap-basic.c
+++ b/tools/perf/tests/mmap-basic.c
@@ -122,6 +122,7 @@ int test__basic_mmap(void)
                        goto out_munmap;
                }
                nr_events[evsel->idx]++;
+                perf_evlist__mmap_consume(evlist, 0);
        }
        err = 0;
diff --git a/tools/perf/tests/open-syscall-tp-fields.c b/tools/perf/tests/open-syscall-tp-fields.c
index fc5b9fca8b47..524b221b829b 100644
--- a/tools/perf/tests/open-syscall-tp-fields.c
+++ b/tools/perf/tests/open-syscall-tp-fields.c
@@ -77,8 +77,10 @@ int test__syscall_open_tp_fields(void)
                                ++nr_events;
-                                if (type != PERF_RECORD_SAMPLE)
+                                if (type != PERF_RECORD_SAMPLE) {
+                                        perf_evlist__mmap_consume(evlist, i);
                                        continue;
+                                }
                                err = perf_evsel__parse_sample(evsel, event, &sample);
                                if (err) {
diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c
index b8a7056519ac..7923b06ffc91 100644
--- a/tools/perf/tests/perf-record.c
+++ b/tools/perf/tests/perf-record.c
@@ -263,6 +263,8 @@ int test__PERF_RECORD(void)
                                                 type);
                                        ++errs;
                                }
+                                perf_evlist__mmap_consume(evlist, i);
                        }
                }
diff --git a/tools/perf/tests/perf-time-to-tsc.c b/tools/perf/tests/perf-time-to-tsc.c
index 0ab61b1f408e..4ca1b938f6a6 100644
--- a/tools/perf/tests/perf-time-to-tsc.c
+++ b/tools/perf/tests/perf-time-to-tsc.c
@@ -122,7 +122,7 @@ int test__perf_time_to_tsc(void)
                        if (event->header.type != PERF_RECORD_COMM ||
                            (pid_t)event->comm.pid != getpid() ||
                            (pid_t)event->comm.tid != getpid())
-                                continue;
+                                goto next_event;
                        if (strcmp(event->comm.comm, comm1) == 0) {
                                CHECK__(perf_evsel__parse_sample(evsel, event,
@@ -134,6 +134,8 @@ int test__perf_time_to_tsc(void)
                                                                 &sample));
                                comm2_time = sample.time;
                        }
+next_event:
+                        perf_evlist__mmap_consume(evlist, i);
                }
        }
diff --git a/tools/perf/tests/sw-clock.c b/tools/perf/tests/sw-clock.c
index 2e41e2d32ccc..6e2b44ec0749 100644
--- a/tools/perf/tests/sw-clock.c
+++ b/tools/perf/tests/sw-clock.c
@@ -78,7 +78,7 @@ static int __test__sw_clock_freq(enum perf_sw_ids clock_id)
                struct perf_sample sample;
                if (event->header.type != PERF_RECORD_SAMPLE)
-                        continue;
+                        goto next_event;
                err = perf_evlist__parse_sample(evlist, event, &sample);
                if (err < 0) {
@@ -88,6 +88,8 @@ static int __test__sw_clock_freq(enum perf_sw_ids clock_id)
                total_periods += sample.period;
                nr_samples++;
+next_event:
+                perf_evlist__mmap_consume(evlist, 0);
        }
        if ((u64) nr_samples == total_periods) {
diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c
index 28fe5894b061..a3e64876e940 100644
--- a/tools/perf/tests/task-exit.c
+++ b/tools/perf/tests/task-exit.c
@@ -96,10 +96,10 @@ int test__task_exit(void)
 retry:
        while ((event = perf_evlist__mmap_read(evlist, 0)) != NULL) {
-                if (event->header.type != PERF_RECORD_EXIT)
+                if (event->header.type == PERF_RECORD_EXIT)
-                        continue;
+                        nr_exit++;
-                nr_exit++;
+                perf_evlist__mmap_consume(evlist, 0);
        }
        if (!exited || !nr_exit) {
diff --git a/tools/perf/ui/stdio/hist.c b/tools/perf/ui/stdio/hist.c
index 194e2f42ff5d..6c152686e837 100644
--- a/tools/perf/ui/stdio/hist.c
+++ b/tools/perf/ui/stdio/hist.c
@@ -315,8 +315,7 @@ static inline void advance_hpp(struct perf_hpp *hpp, int inc)
 }
 static int hist_entry__period_snprintf(struct perf_hpp *hpp,
-                                       struct hist_entry *he,
+                                       struct hist_entry *he)
-                                       bool color)
 {
        const char *sep = symbol_conf.field_sep;
        struct perf_hpp_fmt *fmt;
@@ -338,7 +337,7 @@ static int hist_entry__period_snprintf(struct perf_hpp *hpp,
                } else
                        first = false;
-                if (color && fmt->color)
+                if (perf_hpp__use_color() && fmt->color)
                        ret = fmt->color(fmt, hpp, he);
                else
                        ret = fmt->entry(fmt, hpp, he);
@@ -358,12 +357,11 @@ static int hist_entry__fprintf(struct hist_entry *he, size_t size,
                .buf            = bf,
                .size           = size,
        };
-        bool color = !symbol_conf.field_sep;
        if (size == 0 || size > bfsz)
                size = hpp.size = bfsz;
-        ret = hist_entry__period_snprintf(&hpp, he, color);
+        ret = hist_entry__period_snprintf(&hpp, he);
        hist_entry__sort_snprintf(he, bf + ret, size - ret, hists);
        ret = fprintf(fp, "%s\n", bf);
@@ -482,6 +480,7 @@ size_t hists__fprintf(struct hists *hists, bool show_header, int max_rows,
 print_entries:
        linesz = hists__sort_list_width(hists) + 3 + 1;
+        linesz += perf_hpp__color_overhead();
        line = malloc(linesz);
        if (line == NULL) {
                ret = -1;
diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
index 2b585bc308cf..9e99060408ae 100644
--- a/tools/perf/util/callchain.h
+++ b/tools/perf/util/callchain.h
@@ -147,6 +147,9 @@ static inline void callchain_cursor_advance(struct callchain_cursor *cursor)
 struct option;
+int record_parse_callchain(const char *arg, struct perf_record_opts *opts);
 int record_parse_callchain_opt(const struct option *opt, const char *arg, int unset);
+int record_callchain_opt(const struct option *opt, const char *arg, int unset);
 extern const char record_callchain_help[];
 #endif  /* __PERF_CALLCHAIN_H */
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 9b393e7dca6f..49096ea58a15 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -187,7 +187,7 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
                return -1;
        }
-        event->header.type = PERF_RECORD_MMAP2;
+        event->header.type = PERF_RECORD_MMAP;
        /*
         * Just like the kernel, see __perf_event_mmap in kernel/perf_event.c
         */
@@ -198,7 +198,6 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
                char prot[5];
                char execname[PATH_MAX];
                char anonstr[] = "//anon";
-                unsigned int ino;
                size_t size;
                ssize_t n;
@@ -209,15 +208,12 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
                strcpy(execname, "");
                /* 00400000-0040c000 r-xp 00000000 fd:01 41038  /bin/cat */
-                n = sscanf(bf, "%"PRIx64"-%"PRIx64" %s %"PRIx64" %x:%x %u %s\n",
+                n = sscanf(bf, "%"PRIx64"-%"PRIx64" %s %"PRIx64" %*x:%*x %*u %s\n",
-                       &event->mmap2.start, &event->mmap2.len, prot,
+                       &event->mmap.start, &event->mmap.len, prot,
-                       &event->mmap2.pgoff, &event->mmap2.maj,
+                       &event->mmap.pgoff,
-                       &event->mmap2.min,
+                       execname);
-                       &ino, execname);
-                event->mmap2.ino = (u64)ino;
-                if (n != 8)
+                if (n != 5)
                        continue;
                if (prot[2] != 'x')
@@ -227,15 +223,15 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
                        strcpy(execname, anonstr);
                size = strlen(execname) + 1;
-                memcpy(event->mmap2.filename, execname, size);
+                memcpy(event->mmap.filename, execname, size);
                size = PERF_ALIGN(size, sizeof(u64));
-                event->mmap2.len -= event->mmap.start;
+                event->mmap.len -= event->mmap.start;
-                event->mmap2.header.size = (sizeof(event->mmap2) -
+                event->mmap.header.size = (sizeof(event->mmap) -
-                                        (sizeof(event->mmap2.filename) - size));
+                                        (sizeof(event->mmap.filename) - size));
-                memset(event->mmap2.filename + size, 0, machine->id_hdr_size);
+                memset(event->mmap.filename + size, 0, machine->id_hdr_size);
-                event->mmap2.header.size += machine->id_hdr_size;
+                event->mmap.header.size += machine->id_hdr_size;
-                event->mmap2.pid = tgid;
+                event->mmap.pid = tgid;
-                event->mmap2.tid = pid;
+                event->mmap.tid = pid;
                if (process(tool, event, &synth_sample, machine) != 0) {
                        rc = -1;
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index f9f77bee0b1b..e584cd30b0f2 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -545,12 +545,19 @@ union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx)
        md->prev = old;
-        if (!evlist->overwrite)
-                perf_mmap__write_tail(md, old);
        return event;
 }
+void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx)
+{
+        if (!evlist->overwrite) {
+                struct perf_mmap *md = &evlist->mmap[idx];
+                unsigned int old = md->prev;
+                perf_mmap__write_tail(md, old);
+        }
+}
 static void __perf_evlist__munmap(struct perf_evlist *evlist, int idx)
 {
        if (evlist->mmap[idx].base != NULL) {
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 880d7139d2fb..206d09339306 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -89,6 +89,8 @@ struct perf_sample_id *perf_evlist__id2sid(struct perf_evlist *evlist, u64 id);
 union perf_event *perf_evlist__mmap_read(struct perf_evlist *self, int idx);
+void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx);
 int perf_evlist__open(struct perf_evlist *evlist);
 void perf_evlist__close(struct perf_evlist *evlist);
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 0ce9febf1ba0..9f1ef9bee2d0 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -678,7 +678,6 @@ void perf_evsel__config(struct perf_evsel *evsel,
                attr->sample_type       |= PERF_SAMPLE_WEIGHT;
        attr->mmap  = track;
-        attr->mmap2 = track && !perf_missing_features.mmap2;
        attr->comm  = track;
        /*
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index 1329b6b6ffe6..ce8dc61ce2c3 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -5,6 +5,7 @@
 #include <pthread.h>
 #include "callchain.h"
 #include "header.h"
+#include "color.h"
 extern struct callchain_param callchain_param;
@@ -175,6 +176,18 @@ void perf_hpp__init(void);
 void perf_hpp__column_register(struct perf_hpp_fmt *format);
 void perf_hpp__column_enable(unsigned col);
+static inline size_t perf_hpp__use_color(void)
+{
+        return !symbol_conf.field_sep;
+}
+static inline size_t perf_hpp__color_overhead(void)
+{
+        return perf_hpp__use_color() ?
+               (COLOR_MAXLEN + sizeof(PERF_COLOR_RESET)) * PERF_HPP__MAX_INDEX
+               : 0;
+}
 struct perf_evlist;
 struct hist_browser_timer {
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index c09e0a9fdf4c..f0692737ebf1 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -1357,10 +1357,10 @@ int debuginfo__find_probe_point(struct debuginfo *self, unsigned long addr,
                        goto post;
                }
+                fname = dwarf_decl_file(&spdie);
                if (addr == (unsigned long)baseaddr) {
                        /* Function entry - Relative line number is 0 */
                        lineno = baseline;
-                        fname = dwarf_decl_file(&spdie);
                        goto post;
                }
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 71b5412bbbb9..2ac4bc92bb1f 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -822,6 +822,8 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist,
                PyObject *pyevent = pyrf_event__new(event);
                struct pyrf_event *pevent = (struct pyrf_event *)pyevent;
+                perf_evlist__mmap_consume(evlist, cpu);
                if (pyevent == NULL)
                        return PyErr_NoMemory();
diff --git a/tools/perf/util/scripting-engines/trace-event-perl.c b/tools/perf/util/scripting-engines/trace-event-perl.c
index a85e4ae5f3ac..c0c9795c4f02 100644
--- a/tools/perf/util/scripting-engines/trace-event-perl.c
+++ b/tools/perf/util/scripting-engines/trace-event-perl.c
@@ -282,7 +282,7 @@ static void perl_process_tracepoint(union perf_event *perf_event __maybe_unused,
        event = find_cache_event(evsel);
        if (!event)
-                die("ug! no event found for type %" PRIu64, evsel->attr.config);
+                die("ug! no event found for type %" PRIu64, (u64)evsel->attr.config);
        pid = raw_field_value(event, "common_pid", data);
diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
index cc75a3cef388..95d91a0b23af 100644
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -56,6 +56,17 @@ static void handler_call_die(const char *handler_name)
        Py_FatalError("problem in Python trace event handler");
 }
+/*
+ * Insert val into into the dictionary and decrement the reference counter.
+ * This is necessary for dictionaries since PyDict_SetItemString() does not 
+ * steal a reference, as opposed to PyTuple_SetItem().
+ */
+static void pydict_set_item_string_decref(PyObject *dict, const char *key, PyObject *val)
+{
+        PyDict_SetItemString(dict, key, val);
+        Py_DECREF(val);
+}
 static void define_value(enum print_arg_type field_type,
                         const char *ev_name,
                         const char *field_name,
@@ -279,11 +290,11 @@ static void python_process_tracepoint(union perf_event *perf_event
                PyTuple_SetItem(t, n++, PyInt_FromLong(pid));
                PyTuple_SetItem(t, n++, PyString_FromString(comm));
        } else {
-                PyDict_SetItemString(dict, "common_cpu", PyInt_FromLong(cpu));
+                pydict_set_item_string_decref(dict, "common_cpu", PyInt_FromLong(cpu));
-                PyDict_SetItemString(dict, "common_s", PyInt_FromLong(s));
+                pydict_set_item_string_decref(dict, "common_s", PyInt_FromLong(s));
-                PyDict_SetItemString(dict, "common_ns", PyInt_FromLong(ns));
+                pydict_set_item_string_decref(dict, "common_ns", PyInt_FromLong(ns));
-                PyDict_SetItemString(dict, "common_pid", PyInt_FromLong(pid));
+                pydict_set_item_string_decref(dict, "common_pid", PyInt_FromLong(pid));
-                PyDict_SetItemString(dict, "common_comm", PyString_FromString(comm));
+                pydict_set_item_string_decref(dict, "common_comm", PyString_FromString(comm));
        }
        for (field = event->format.fields; field; field = field->next) {
                if (field->flags & FIELD_IS_STRING) {
@@ -313,7 +324,7 @@ static void python_process_tracepoint(union perf_event *perf_event
                if (handler)
                        PyTuple_SetItem(t, n++, obj);
                else
-                        PyDict_SetItemString(dict, field->name, obj);
+                        pydict_set_item_string_decref(dict, field->name, obj);
        }
        if (!handler)
@@ -370,21 +381,21 @@ static void python_process_general_event(union perf_event *perf_event
        if (!handler || !PyCallable_Check(handler))
                goto exit;
-        PyDict_SetItemString(dict, "ev_name", PyString_FromString(perf_evsel__name(evsel)));
+        pydict_set_item_string_decref(dict, "ev_name", PyString_FromString(perf_evsel__name(evsel)));
-        PyDict_SetItemString(dict, "attr", PyString_FromStringAndSize(
+        pydict_set_item_string_decref(dict, "attr", PyString_FromStringAndSize(
                        (const char *)&evsel->attr, sizeof(evsel->attr)));
-        PyDict_SetItemString(dict, "sample", PyString_FromStringAndSize(
+        pydict_set_item_string_decref(dict, "sample", PyString_FromStringAndSize(
                        (const char *)sample, sizeof(*sample)));
-        PyDict_SetItemString(dict, "raw_buf", PyString_FromStringAndSize(
+        pydict_set_item_string_decref(dict, "raw_buf", PyString_FromStringAndSize(
                        (const char *)sample->raw_data, sample->raw_size));
-        PyDict_SetItemString(dict, "comm",
+        pydict_set_item_string_decref(dict, "comm",
                        PyString_FromString(thread->comm));
        if (al->map) {
-                PyDict_SetItemString(dict, "dso",
+                pydict_set_item_string_decref(dict, "dso",
                        PyString_FromString(al->map->dso->name));
        }
        if (al->sym) {
-                PyDict_SetItemString(dict, "symbol",
+                pydict_set_item_string_decref(dict, "symbol",
                        PyString_FromString(al->sym->name));
        }
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index a9dd682cf5e3..1cf9ccb01013 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3091,7 +3091,7 @@ static const struct file_operations *stat_fops[] = {
 static int kvm_init_debug(void)
 {
-        int r = -EFAULT;
+        int r = -EEXIST;
        struct kvm_stats_debugfs_item *p;
        kvm_debugfs_dir = debugfs_create_dir("kvm", NULL);