[gentoo-commits] linux-patches r2455 - genpatches-2.6/trunk/3.10

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2013-07-29 00:39:20 +0000 (Mon, 29 Jul 2013)
New Revision: 2455

Added:
   genpatches-2.6/trunk/3.10/1003_linux-3.10.4.patch
Modified:
   genpatches-2.6/trunk/3.10/0000_README
Log:
Linux patch 3.10.4

Modified: genpatches-2.6/trunk/3.10/0000_README
===================================================================
--- genpatches-2.6/trunk/3.10/0000_README	2013-07-26 12:37:10 UTC (rev 2454)
+++ genpatches-2.6/trunk/3.10/0000_README	2013-07-29 00:39:20 UTC (rev 2455)
@@ -51,6 +51,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.10.3
 
+Patch:  1003_linux-3.10.4.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.10.4
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.10/1003_linux-3.10.4.patch
===================================================================
--- genpatches-2.6/trunk/3.10/1003_linux-3.10.4.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.10/1003_linux-3.10.4.patch	2013-07-29 00:39:20 UTC (rev 2455)
@@ -0,0 +1,3086 @@
+diff --git a/Makefile b/Makefile
+index b548552..b4df9b2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 3
++SUBLEVEL = 4
+ EXTRAVERSION =
+ NAME = Unicycling Gorilla
+ 
+diff --git a/arch/arm/mach-footbridge/dc21285.c b/arch/arm/mach-footbridge/dc21285.c
+index a7cd2cf..3490a24 100644
+--- a/arch/arm/mach-footbridge/dc21285.c
++++ b/arch/arm/mach-footbridge/dc21285.c
+@@ -276,8 +276,6 @@ int __init dc21285_setup(int nr, struct pci_sys_data *sys)
+ 
+ 	sys->mem_offset  = DC21285_PCI_MEM;
+ 
+-	pci_ioremap_io(0, DC21285_PCI_IO);
+-
+ 	pci_add_resource_offset(&sys->resources, &res[0], sys->mem_offset);
+ 	pci_add_resource_offset(&sys->resources, &res[1], sys->mem_offset);
+ 
+diff --git a/arch/arm/mach-s3c24xx/clock-s3c2410.c b/arch/arm/mach-s3c24xx/clock-s3c2410.c
+index 34fffdf..5645536 100644
+--- a/arch/arm/mach-s3c24xx/clock-s3c2410.c
++++ b/arch/arm/mach-s3c24xx/clock-s3c2410.c
+@@ -119,66 +119,101 @@ static struct clk init_clocks_off[] = {
+ 	}
+ };
+ 
+-static struct clk init_clocks[] = {
+-	{
+-		.name		= "lcd",
+-		.parent		= &clk_h,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_LCDC,
+-	}, {
+-		.name		= "gpio",
+-		.parent		= &clk_p,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_GPIO,
+-	}, {
+-		.name		= "usb-host",
+-		.parent		= &clk_h,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_USBH,
+-	}, {
+-		.name		= "usb-device",
+-		.parent		= &clk_h,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_USBD,
+-	}, {
+-		.name		= "timers",
+-		.parent		= &clk_p,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_PWMT,
+-	}, {
+-		.name		= "uart",
+-		.devname	= "s3c2410-uart.0",
+-		.parent		= &clk_p,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_UART0,
+-	}, {
+-		.name		= "uart",
+-		.devname	= "s3c2410-uart.1",
+-		.parent		= &clk_p,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_UART1,
+-	}, {
+-		.name		= "uart",
+-		.devname	= "s3c2410-uart.2",
+-		.parent		= &clk_p,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_UART2,
+-	}, {
+-		.name		= "rtc",
+-		.parent		= &clk_p,
+-		.enable		= s3c2410_clkcon_enable,
+-		.ctrlbit	= S3C2410_CLKCON_RTC,
+-	}, {
+-		.name		= "watchdog",
+-		.parent		= &clk_p,
+-		.ctrlbit	= 0,
+-	}, {
+-		.name		= "usb-bus-host",
+-		.parent		= &clk_usb_bus,
+-	}, {
+-		.name		= "usb-bus-gadget",
+-		.parent		= &clk_usb_bus,
+-	},
++static struct clk clk_lcd = {
++	.name		= "lcd",
++	.parent		= &clk_h,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_LCDC,
++};
++
++static struct clk clk_gpio = {
++	.name		= "gpio",
++	.parent		= &clk_p,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_GPIO,
++};
++
++static struct clk clk_usb_host = {
++	.name		= "usb-host",
++	.parent		= &clk_h,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_USBH,
++};
++
++static struct clk clk_usb_device = {
++	.name		= "usb-device",
++	.parent		= &clk_h,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_USBD,
++};
++
++static struct clk clk_timers = {
++	.name		= "timers",
++	.parent		= &clk_p,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_PWMT,
++};
++
++struct clk s3c24xx_clk_uart0 = {
++	.name		= "uart",
++	.devname	= "s3c2410-uart.0",
++	.parent		= &clk_p,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_UART0,
++};
++
++struct clk s3c24xx_clk_uart1 = {
++	.name		= "uart",
++	.devname	= "s3c2410-uart.1",
++	.parent		= &clk_p,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_UART1,
++};
++
++struct clk s3c24xx_clk_uart2 = {
++	.name		= "uart",
++	.devname	= "s3c2410-uart.2",
++	.parent		= &clk_p,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_UART2,
++};
++
++static struct clk clk_rtc = {
++	.name		= "rtc",
++	.parent		= &clk_p,
++	.enable		= s3c2410_clkcon_enable,
++	.ctrlbit	= S3C2410_CLKCON_RTC,
++};
++
++static struct clk clk_watchdog = {
++	.name		= "watchdog",
++	.parent		= &clk_p,
++	.ctrlbit	= 0,
++};
++
++static struct clk clk_usb_bus_host = {
++	.name		= "usb-bus-host",
++	.parent		= &clk_usb_bus,
++};
++
++static struct clk clk_usb_bus_gadget = {
++	.name		= "usb-bus-gadget",
++	.parent		= &clk_usb_bus,
++};
++
++static struct clk *init_clocks[] = {
++	&clk_lcd,
++	&clk_gpio,
++	&clk_usb_host,
++	&clk_usb_device,
++	&clk_timers,
++	&s3c24xx_clk_uart0,
++	&s3c24xx_clk_uart1,
++	&s3c24xx_clk_uart2,
++	&clk_rtc,
++	&clk_watchdog,
++	&clk_usb_bus_host,
++	&clk_usb_bus_gadget,
+ };
+ 
+ /* s3c2410_baseclk_add()
+@@ -195,7 +230,6 @@ int __init s3c2410_baseclk_add(void)
+ {
+ 	unsigned long clkslow = __raw_readl(S3C2410_CLKSLOW);
+ 	unsigned long clkcon  = __raw_readl(S3C2410_CLKCON);
+-	struct clk *clkp;
+ 	struct clk *xtal;
+ 	int ret;
+ 	int ptr;
+@@ -207,8 +241,9 @@ int __init s3c2410_baseclk_add(void)
+ 
+ 	/* register clocks from clock array */
+ 
+-	clkp = init_clocks;
+-	for (ptr = 0; ptr < ARRAY_SIZE(init_clocks); ptr++, clkp++) {
++	for (ptr = 0; ptr < ARRAY_SIZE(init_clocks); ptr++) {
++		struct clk *clkp = init_clocks[ptr];
++
+ 		/* ensure that we note the clock state */
+ 
+ 		clkp->usage = clkcon & clkp->ctrlbit ? 1 : 0;
+diff --git a/arch/arm/mach-s3c24xx/clock-s3c2440.c b/arch/arm/mach-s3c24xx/clock-s3c2440.c
+index 1069b56..aaf006d 100644
+--- a/arch/arm/mach-s3c24xx/clock-s3c2440.c
++++ b/arch/arm/mach-s3c24xx/clock-s3c2440.c
+@@ -166,6 +166,9 @@ static struct clk_lookup s3c2440_clk_lookup[] = {
+ 	CLKDEV_INIT(NULL, "clk_uart_baud1", &s3c24xx_uclk),
+ 	CLKDEV_INIT(NULL, "clk_uart_baud2", &clk_p),
+ 	CLKDEV_INIT(NULL, "clk_uart_baud3", &s3c2440_clk_fclk_n),
++	CLKDEV_INIT("s3c2440-uart.0", "uart", &s3c24xx_clk_uart0),
++	CLKDEV_INIT("s3c2440-uart.1", "uart", &s3c24xx_clk_uart1),
++	CLKDEV_INIT("s3c2440-uart.2", "uart", &s3c24xx_clk_uart2),
+ 	CLKDEV_INIT("s3c2440-camif", "camera", &s3c2440_clk_cam_upll),
+ };
+ 
+diff --git a/arch/arm/plat-samsung/include/plat/clock.h b/arch/arm/plat-samsung/include/plat/clock.h
+index a62753d..df45d6e 100644
+--- a/arch/arm/plat-samsung/include/plat/clock.h
++++ b/arch/arm/plat-samsung/include/plat/clock.h
+@@ -83,6 +83,11 @@ extern struct clk clk_ext;
+ extern struct clksrc_clk clk_epllref;
+ extern struct clksrc_clk clk_esysclk;
+ 
++/* S3C24XX UART clocks */
++extern struct clk s3c24xx_clk_uart0;
++extern struct clk s3c24xx_clk_uart1;
++extern struct clk s3c24xx_clk_uart2;
++
+ /* S3C64XX specific clocks */
+ extern struct clk clk_h2;
+ extern struct clk clk_27m;
+diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
+index 1e1e18c..2a75ff2 100644
+--- a/arch/mips/cavium-octeon/setup.c
++++ b/arch/mips/cavium-octeon/setup.c
+@@ -7,6 +7,7 @@
+  * Copyright (C) 2008, 2009 Wind River Systems
+  *   written by Ralf Baechle <ralf@××××××××××.org>
+  */
++#include <linux/compiler.h>
+ #include <linux/init.h>
+ #include <linux/kernel.h>
+ #include <linux/console.h>
+@@ -712,7 +713,7 @@ void __init prom_init(void)
+ 	if (cvmx_read_csr(CVMX_L2D_FUS3) & (3ull << 34)) {
+ 		pr_info("Skipping L2 locking due to reduced L2 cache size\n");
+ 	} else {
+-		uint32_t ebase = read_c0_ebase() & 0x3ffff000;
++		uint32_t __maybe_unused ebase = read_c0_ebase() & 0x3ffff000;
+ #ifdef CONFIG_CAVIUM_OCTEON_LOCK_L2_TLB
+ 		/* TLB refill */
+ 		cvmx_l2c_lock_mem_region(ebase, 0x100);
+diff --git a/arch/sparc/kernel/asm-offsets.c b/arch/sparc/kernel/asm-offsets.c
+index 961b87f..f76389a 100644
+--- a/arch/sparc/kernel/asm-offsets.c
++++ b/arch/sparc/kernel/asm-offsets.c
+@@ -49,6 +49,8 @@ int foo(void)
+ 	DEFINE(AOFF_task_thread, offsetof(struct task_struct, thread));
+ 	BLANK();
+ 	DEFINE(AOFF_mm_context, offsetof(struct mm_struct, context));
++	BLANK();
++	DEFINE(VMA_VM_MM,    offsetof(struct vm_area_struct, vm_mm));
+ 
+ 	/* DEFINE(NUM_USER_SEGMENTS, TASK_SIZE>>28); */
+ 	return 0;
+diff --git a/arch/sparc/mm/hypersparc.S b/arch/sparc/mm/hypersparc.S
+index 44aad32..969f964 100644
+--- a/arch/sparc/mm/hypersparc.S
++++ b/arch/sparc/mm/hypersparc.S
+@@ -74,7 +74,7 @@ hypersparc_flush_cache_mm_out:
+ 
+ 	/* The things we do for performance... */
+ hypersparc_flush_cache_range:
+-	ld	[%o0 + 0x0], %o0		/* XXX vma->vm_mm, GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ #ifndef CONFIG_SMP
+ 	ld	[%o0 + AOFF_mm_context], %g1
+ 	cmp	%g1, -1
+@@ -163,7 +163,7 @@ hypersparc_flush_cache_range_out:
+ 	 */
+ 	/* Verified, my ass... */
+ hypersparc_flush_cache_page:
+-	ld	[%o0 + 0x0], %o0		/* XXX vma->vm_mm, GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	ld	[%o0 + AOFF_mm_context], %g2
+ #ifndef CONFIG_SMP
+ 	cmp	%g2, -1
+@@ -284,7 +284,7 @@ hypersparc_flush_tlb_mm_out:
+ 	 sta	%g5, [%g1] ASI_M_MMUREGS
+ 
+ hypersparc_flush_tlb_range:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	mov	SRMMU_CTX_REG, %g1
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	lda	[%g1] ASI_M_MMUREGS, %g5
+@@ -307,7 +307,7 @@ hypersparc_flush_tlb_range_out:
+ 	 sta	%g5, [%g1] ASI_M_MMUREGS
+ 
+ hypersparc_flush_tlb_page:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	mov	SRMMU_CTX_REG, %g1
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	andn	%o1, (PAGE_SIZE - 1), %o1
+diff --git a/arch/sparc/mm/swift.S b/arch/sparc/mm/swift.S
+index c801c39..5d2b88d 100644
+--- a/arch/sparc/mm/swift.S
++++ b/arch/sparc/mm/swift.S
+@@ -105,7 +105,7 @@ swift_flush_cache_mm_out:
+ 
+ 	.globl	swift_flush_cache_range
+ swift_flush_cache_range:
+-	ld	[%o0 + 0x0], %o0		/* XXX vma->vm_mm, GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	sub	%o2, %o1, %o2
+ 	sethi	%hi(4096), %o3
+ 	cmp	%o2, %o3
+@@ -116,7 +116,7 @@ swift_flush_cache_range:
+ 
+ 	.globl	swift_flush_cache_page
+ swift_flush_cache_page:
+-	ld	[%o0 + 0x0], %o0		/* XXX vma->vm_mm, GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 70:
+ 	ld	[%o0 + AOFF_mm_context], %g2
+ 	cmp	%g2, -1
+@@ -219,7 +219,7 @@ swift_flush_sig_insns:
+ 	.globl	swift_flush_tlb_range
+ 	.globl	swift_flush_tlb_all
+ swift_flush_tlb_range:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ swift_flush_tlb_mm:
+ 	ld	[%o0 + AOFF_mm_context], %g2
+ 	cmp	%g2, -1
+@@ -233,7 +233,7 @@ swift_flush_tlb_all_out:
+ 
+ 	.globl	swift_flush_tlb_page
+ swift_flush_tlb_page:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	mov	SRMMU_CTX_REG, %g1
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	andn	%o1, (PAGE_SIZE - 1), %o1
+diff --git a/arch/sparc/mm/tsunami.S b/arch/sparc/mm/tsunami.S
+index 4e55e8f..bf10a34 100644
+--- a/arch/sparc/mm/tsunami.S
++++ b/arch/sparc/mm/tsunami.S
+@@ -24,7 +24,7 @@
+ 	/* Sliiick... */
+ tsunami_flush_cache_page:
+ tsunami_flush_cache_range:
+-	ld	[%o0 + 0x0], %o0	/* XXX vma->vm_mm, GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ tsunami_flush_cache_mm:
+ 	ld	[%o0 + AOFF_mm_context], %g2
+ 	cmp	%g2, -1
+@@ -46,7 +46,7 @@ tsunami_flush_sig_insns:
+ 
+ 	/* More slick stuff... */
+ tsunami_flush_tlb_range:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ tsunami_flush_tlb_mm:
+ 	ld	[%o0 + AOFF_mm_context], %g2
+ 	cmp	%g2, -1
+@@ -65,7 +65,7 @@ tsunami_flush_tlb_out:
+ 
+ 	/* This one can be done in a fine grained manner... */
+ tsunami_flush_tlb_page:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	mov	SRMMU_CTX_REG, %g1
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	andn	%o1, (PAGE_SIZE - 1), %o1
+diff --git a/arch/sparc/mm/viking.S b/arch/sparc/mm/viking.S
+index bf8ee06..852257f 100644
+--- a/arch/sparc/mm/viking.S
++++ b/arch/sparc/mm/viking.S
+@@ -108,7 +108,7 @@ viking_mxcc_flush_page:
+ viking_flush_cache_page:
+ viking_flush_cache_range:
+ #ifndef CONFIG_SMP
+-	ld	[%o0 + 0x0], %o0		/* XXX vma->vm_mm, GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ #endif
+ viking_flush_cache_mm:
+ #ifndef CONFIG_SMP
+@@ -148,7 +148,7 @@ viking_flush_tlb_mm:
+ #endif
+ 
+ viking_flush_tlb_range:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	mov	SRMMU_CTX_REG, %g1
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	lda	[%g1] ASI_M_MMUREGS, %g5
+@@ -173,7 +173,7 @@ viking_flush_tlb_range:
+ #endif
+ 
+ viking_flush_tlb_page:
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	mov	SRMMU_CTX_REG, %g1
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	lda	[%g1] ASI_M_MMUREGS, %g5
+@@ -239,7 +239,7 @@ sun4dsmp_flush_tlb_range:
+ 	tst	%g5
+ 	bne	3f
+ 	 mov	SRMMU_CTX_REG, %g1
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	lda	[%g1] ASI_M_MMUREGS, %g5
+ 	sethi	%hi(~((1 << SRMMU_PGDIR_SHIFT) - 1)), %o4
+@@ -265,7 +265,7 @@ sun4dsmp_flush_tlb_page:
+ 	tst	%g5
+ 	bne	2f
+ 	 mov	SRMMU_CTX_REG, %g1
+-	ld	[%o0 + 0x00], %o0	/* XXX vma->vm_mm GROSS XXX */
++	ld	[%o0 + VMA_VM_MM], %o0
+ 	ld	[%o0 + AOFF_mm_context], %o3
+ 	lda	[%g1] ASI_M_MMUREGS, %g5
+ 	and	%o1, PAGE_MASK, %o1
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index 27e86d9..89e1090 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -48,6 +48,8 @@ static LIST_HEAD(mc_devices);
+  */
+ static void const *edac_mc_owner;
+ 
++static struct bus_type mc_bus[EDAC_MAX_MCS];
++
+ unsigned edac_dimm_info_location(struct dimm_info *dimm, char *buf,
+ 			         unsigned len)
+ {
+@@ -723,6 +725,11 @@ int edac_mc_add_mc(struct mem_ctl_info *mci)
+ 	int ret = -EINVAL;
+ 	edac_dbg(0, "\n");
+ 
++	if (mci->mc_idx >= EDAC_MAX_MCS) {
++		pr_warn_once("Too many memory controllers: %d\n", mci->mc_idx);
++		return -ENODEV;
++	}
++
+ #ifdef CONFIG_EDAC_DEBUG
+ 	if (edac_debug_level >= 3)
+ 		edac_mc_dump_mci(mci);
+@@ -762,6 +769,8 @@ int edac_mc_add_mc(struct mem_ctl_info *mci)
+ 	/* set load time so that error rate can be tracked */
+ 	mci->start_time = jiffies;
+ 
++	mci->bus = &mc_bus[mci->mc_idx];
++
+ 	if (edac_create_sysfs_mci_device(mci)) {
+ 		edac_mc_printk(mci, KERN_WARNING,
+ 			"failed to create sysfs device\n");
+diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
+index 67610a6..c4d700a 100644
+--- a/drivers/edac/edac_mc_sysfs.c
++++ b/drivers/edac/edac_mc_sysfs.c
+@@ -370,7 +370,7 @@ static int edac_create_csrow_object(struct mem_ctl_info *mci,
+ 		return -ENODEV;
+ 
+ 	csrow->dev.type = &csrow_attr_type;
+-	csrow->dev.bus = &mci->bus;
++	csrow->dev.bus = mci->bus;
+ 	device_initialize(&csrow->dev);
+ 	csrow->dev.parent = &mci->dev;
+ 	csrow->mci = mci;
+@@ -605,7 +605,7 @@ static int edac_create_dimm_object(struct mem_ctl_info *mci,
+ 	dimm->mci = mci;
+ 
+ 	dimm->dev.type = &dimm_attr_type;
+-	dimm->dev.bus = &mci->bus;
++	dimm->dev.bus = mci->bus;
+ 	device_initialize(&dimm->dev);
+ 
+ 	dimm->dev.parent = &mci->dev;
+@@ -975,11 +975,13 @@ int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
+ 	 * The memory controller needs its own bus, in order to avoid
+ 	 * namespace conflicts at /sys/bus/edac.
+ 	 */
+-	mci->bus.name = kasprintf(GFP_KERNEL, "mc%d", mci->mc_idx);
+-	if (!mci->bus.name)
++	mci->bus->name = kasprintf(GFP_KERNEL, "mc%d", mci->mc_idx);
++	if (!mci->bus->name)
+ 		return -ENOMEM;
+-	edac_dbg(0, "creating bus %s\n", mci->bus.name);
+-	err = bus_register(&mci->bus);
++
++	edac_dbg(0, "creating bus %s\n", mci->bus->name);
++
++	err = bus_register(mci->bus);
+ 	if (err < 0)
+ 		return err;
+ 
+@@ -988,7 +990,7 @@ int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
+ 	device_initialize(&mci->dev);
+ 
+ 	mci->dev.parent = mci_pdev;
+-	mci->dev.bus = &mci->bus;
++	mci->dev.bus = mci->bus;
+ 	dev_set_name(&mci->dev, "mc%d", mci->mc_idx);
+ 	dev_set_drvdata(&mci->dev, mci);
+ 	pm_runtime_forbid(&mci->dev);
+@@ -997,8 +999,8 @@ int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
+ 	err = device_add(&mci->dev);
+ 	if (err < 0) {
+ 		edac_dbg(1, "failure: create device %s\n", dev_name(&mci->dev));
+-		bus_unregister(&mci->bus);
+-		kfree(mci->bus.name);
++		bus_unregister(mci->bus);
++		kfree(mci->bus->name);
+ 		return err;
+ 	}
+ 
+@@ -1064,8 +1066,8 @@ fail:
+ 	}
+ fail2:
+ 	device_unregister(&mci->dev);
+-	bus_unregister(&mci->bus);
+-	kfree(mci->bus.name);
++	bus_unregister(mci->bus);
++	kfree(mci->bus->name);
+ 	return err;
+ }
+ 
+@@ -1098,8 +1100,8 @@ void edac_unregister_sysfs(struct mem_ctl_info *mci)
+ {
+ 	edac_dbg(1, "Unregistering device %s\n", dev_name(&mci->dev));
+ 	device_unregister(&mci->dev);
+-	bus_unregister(&mci->bus);
+-	kfree(mci->bus.name);
++	bus_unregister(mci->bus);
++	kfree(mci->bus->name);
+ }
+ 
+ static void mc_attr_release(struct device *dev)
+diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
+index 1b63517..157b934 100644
+--- a/drivers/edac/i5100_edac.c
++++ b/drivers/edac/i5100_edac.c
+@@ -974,7 +974,7 @@ static int i5100_setup_debugfs(struct mem_ctl_info *mci)
+ 	if (!i5100_debugfs)
+ 		return -ENODEV;
+ 
+-	priv->debugfs = debugfs_create_dir(mci->bus.name, i5100_debugfs);
++	priv->debugfs = debugfs_create_dir(mci->bus->name, i5100_debugfs);
+ 
+ 	if (!priv->debugfs)
+ 		return -ENOMEM;
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index d3e15b4..c42b14b 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -437,6 +437,7 @@ struct bcache_device {
+ 
+ 	/* If nonzero, we're detaching/unregistering from cache set */
+ 	atomic_t		detaching;
++	int			flush_done;
+ 
+ 	atomic_long_t		sectors_dirty;
+ 	unsigned long		sectors_dirty_gc;
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 7a5658f..7b687a6 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -1419,8 +1419,10 @@ static void btree_gc_start(struct cache_set *c)
+ 	for_each_cache(ca, c, i)
+ 		for_each_bucket(b, ca) {
+ 			b->gc_gen = b->gen;
+-			if (!atomic_read(&b->pin))
++			if (!atomic_read(&b->pin)) {
+ 				SET_GC_MARK(b, GC_MARK_RECLAIMABLE);
++				SET_GC_SECTORS_USED(b, 0);
++			}
+ 		}
+ 
+ 	for (d = c->devices;
+diff --git a/drivers/md/bcache/closure.c b/drivers/md/bcache/closure.c
+index bd05a9a..9aba201 100644
+--- a/drivers/md/bcache/closure.c
++++ b/drivers/md/bcache/closure.c
+@@ -66,16 +66,18 @@ static inline void closure_put_after_sub(struct closure *cl, int flags)
+ 		} else {
+ 			struct closure *parent = cl->parent;
+ 			struct closure_waitlist *wait = closure_waitlist(cl);
++			closure_fn *destructor = cl->fn;
+ 
+ 			closure_debug_destroy(cl);
+ 
++			smp_mb();
+ 			atomic_set(&cl->remaining, -1);
+ 
+ 			if (wait)
+ 				closure_wake_up(wait);
+ 
+-			if (cl->fn)
+-				cl->fn(cl);
++			if (destructor)
++				destructor(cl);
+ 
+ 			if (parent)
+ 				closure_put(parent);
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 8c8dfdc..8a54d3b 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -182,9 +182,14 @@ bsearch:
+ 		pr_debug("starting binary search, l %u r %u", l, r);
+ 
+ 		while (l + 1 < r) {
++			seq = list_entry(list->prev, struct journal_replay,
++					 list)->j.seq;
++
+ 			m = (l + r) >> 1;
++			read_bucket(m);
+ 
+-			if (read_bucket(m))
++			if (seq != list_entry(list->prev, struct journal_replay,
++					      list)->j.seq)
+ 				l = m;
+ 			else
+ 				r = m;
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index e5ff12e..2f36743 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -489,6 +489,12 @@ static void bch_insert_data_loop(struct closure *cl)
+ 		bch_queue_gc(op->c);
+ 	}
+ 
++	/*
++	 * Journal writes are marked REQ_FLUSH; if the original write was a
++	 * flush, it'll wait on the journal write.
++	 */
++	bio->bi_rw &= ~(REQ_FLUSH|REQ_FUA);
++
+ 	do {
+ 		unsigned i;
+ 		struct bkey *k;
+@@ -716,7 +722,7 @@ static struct search *search_alloc(struct bio *bio, struct bcache_device *d)
+ 	s->task			= current;
+ 	s->orig_bio		= bio;
+ 	s->write		= (bio->bi_rw & REQ_WRITE) != 0;
+-	s->op.flush_journal	= (bio->bi_rw & REQ_FLUSH) != 0;
++	s->op.flush_journal	= (bio->bi_rw & (REQ_FLUSH|REQ_FUA)) != 0;
+ 	s->op.skip		= (bio->bi_rw & REQ_DISCARD) != 0;
+ 	s->recoverable		= 1;
+ 	s->start_time		= jiffies;
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index f88e2b6..b4713ce 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -704,7 +704,8 @@ static void bcache_device_detach(struct bcache_device *d)
+ 		atomic_set(&d->detaching, 0);
+ 	}
+ 
+-	bcache_device_unlink(d);
++	if (!d->flush_done)
++		bcache_device_unlink(d);
+ 
+ 	d->c->devices[d->id] = NULL;
+ 	closure_put(&d->c->caching);
+@@ -781,6 +782,8 @@ static int bcache_device_init(struct bcache_device *d, unsigned block_size)
+ 	set_bit(QUEUE_FLAG_NONROT,	&d->disk->queue->queue_flags);
+ 	set_bit(QUEUE_FLAG_DISCARD,	&d->disk->queue->queue_flags);
+ 
++	blk_queue_flush(q, REQ_FLUSH|REQ_FUA);
++
+ 	return 0;
+ }
+ 
+@@ -1014,6 +1017,14 @@ static void cached_dev_flush(struct closure *cl)
+ 	struct cached_dev *dc = container_of(cl, struct cached_dev, disk.cl);
+ 	struct bcache_device *d = &dc->disk;
+ 
++	mutex_lock(&bch_register_lock);
++	d->flush_done = 1;
++
++	if (d->c)
++		bcache_device_unlink(d);
++
++	mutex_unlock(&bch_register_lock);
++
+ 	bch_cache_accounting_destroy(&dc->accounting);
+ 	kobject_del(&d->kobj);
+ 
+@@ -1303,18 +1314,22 @@ static void cache_set_flush(struct closure *cl)
+ static void __cache_set_unregister(struct closure *cl)
+ {
+ 	struct cache_set *c = container_of(cl, struct cache_set, caching);
+-	struct cached_dev *dc, *t;
++	struct cached_dev *dc;
+ 	size_t i;
+ 
+ 	mutex_lock(&bch_register_lock);
+ 
+-	if (test_bit(CACHE_SET_UNREGISTERING, &c->flags))
+-		list_for_each_entry_safe(dc, t, &c->cached_devs, list)
+-			bch_cached_dev_detach(dc);
+-
+ 	for (i = 0; i < c->nr_uuids; i++)
+-		if (c->devices[i] && UUID_FLASH_ONLY(&c->uuids[i]))
+-			bcache_device_stop(c->devices[i]);
++		if (c->devices[i]) {
++			if (!UUID_FLASH_ONLY(&c->uuids[i]) &&
++			    test_bit(CACHE_SET_UNREGISTERING, &c->flags)) {
++				dc = container_of(c->devices[i],
++						  struct cached_dev, disk);
++				bch_cached_dev_detach(dc);
++			} else {
++				bcache_device_stop(c->devices[i]);
++			}
++		}
+ 
+ 	mutex_unlock(&bch_register_lock);
+ 
+diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
+index a1a3a51..0b4616b 100644
+--- a/drivers/media/dvb-core/dmxdev.c
++++ b/drivers/media/dvb-core/dmxdev.c
+@@ -377,10 +377,8 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
+ 		ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer, buffer2,
+ 					      buffer2_len);
+ 	}
+-	if (ret < 0) {
+-		dvb_ringbuffer_flush(&dmxdevfilter->buffer);
++	if (ret < 0)
+ 		dmxdevfilter->buffer.error = ret;
+-	}
+ 	if (dmxdevfilter->params.sec.flags & DMX_ONESHOT)
+ 		dmxdevfilter->state = DMXDEV_STATE_DONE;
+ 	spin_unlock(&dmxdevfilter->dev->lock);
+@@ -416,10 +414,8 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
+ 	ret = dvb_dmxdev_buffer_write(buffer, buffer1, buffer1_len);
+ 	if (ret == buffer1_len)
+ 		ret = dvb_dmxdev_buffer_write(buffer, buffer2, buffer2_len);
+-	if (ret < 0) {
+-		dvb_ringbuffer_flush(buffer);
++	if (ret < 0)
+ 		buffer->error = ret;
+-	}
+ 	spin_unlock(&dmxdevfilter->dev->lock);
+ 	wake_up(&buffer->queue);
+ 	return 0;
+diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c
+index 10460fd..dbcdfbf 100644
+--- a/drivers/media/pci/saa7134/saa7134-alsa.c
++++ b/drivers/media/pci/saa7134/saa7134-alsa.c
+@@ -172,7 +172,9 @@ static void saa7134_irq_alsa_done(struct saa7134_dev *dev,
+ 		dprintk("irq: overrun [full=%d/%d] - Blocks in %d\n",dev->dmasound.read_count,
+ 			dev->dmasound.bufsize, dev->dmasound.blocks);
+ 		spin_unlock(&dev->slock);
++		snd_pcm_stream_lock(dev->dmasound.substream);
+ 		snd_pcm_stop(dev->dmasound.substream,SNDRV_PCM_STATE_XRUN);
++		snd_pcm_stream_unlock(dev->dmasound.substream);
+ 		return;
+ 	}
+ 
+diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
+index 42aa54a..b710c6b 100644
+--- a/drivers/net/dummy.c
++++ b/drivers/net/dummy.c
+@@ -185,6 +185,8 @@ static int __init dummy_init_module(void)
+ 
+ 	rtnl_lock();
+ 	err = __rtnl_link_register(&dummy_link_ops);
++	if (err < 0)
++		goto out;
+ 
+ 	for (i = 0; i < numdummies && !err; i++) {
+ 		err = dummy_init_one();
+@@ -192,6 +194,8 @@ static int __init dummy_init_module(void)
+ 	}
+ 	if (err < 0)
+ 		__rtnl_link_unregister(&dummy_link_ops);
++
++out:
+ 	rtnl_unlock();
+ 
+ 	return err;
+diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
+index 418de8b..d30085c 100644
+--- a/drivers/net/ethernet/atheros/alx/main.c
++++ b/drivers/net/ethernet/atheros/alx/main.c
+@@ -1303,6 +1303,8 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 
+ 	SET_NETDEV_DEV(netdev, &pdev->dev);
+ 	alx = netdev_priv(netdev);
++	spin_lock_init(&alx->hw.mdio_lock);
++	spin_lock_init(&alx->irq_lock);
+ 	alx->dev = netdev;
+ 	alx->hw.pdev = pdev;
+ 	alx->msg_enable = NETIF_MSG_LINK | NETIF_MSG_HW | NETIF_MSG_IFUP |
+@@ -1385,9 +1387,6 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 
+ 	INIT_WORK(&alx->link_check_wk, alx_link_check);
+ 	INIT_WORK(&alx->reset_wk, alx_reset);
+-	spin_lock_init(&alx->hw.mdio_lock);
+-	spin_lock_init(&alx->irq_lock);
+-
+ 	netif_carrier_off(netdev);
+ 
+ 	err = register_netdev(netdev);
+diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+index 0688bb8..c23bb02 100644
+--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+@@ -1665,8 +1665,8 @@ check_sum:
+ 	return 0;
+ }
+ 
+-static void atl1e_tx_map(struct atl1e_adapter *adapter,
+-		      struct sk_buff *skb, struct atl1e_tpd_desc *tpd)
++static int atl1e_tx_map(struct atl1e_adapter *adapter,
++			struct sk_buff *skb, struct atl1e_tpd_desc *tpd)
+ {
+ 	struct atl1e_tpd_desc *use_tpd = NULL;
+ 	struct atl1e_tx_buffer *tx_buffer = NULL;
+@@ -1677,6 +1677,8 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
+ 	u16 nr_frags;
+ 	u16 f;
+ 	int segment;
++	int ring_start = adapter->tx_ring.next_to_use;
++	int ring_end;
+ 
+ 	nr_frags = skb_shinfo(skb)->nr_frags;
+ 	segment = (tpd->word3 >> TPD_SEGMENT_EN_SHIFT) & TPD_SEGMENT_EN_MASK;
+@@ -1689,6 +1691,9 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
+ 		tx_buffer->length = map_len;
+ 		tx_buffer->dma = pci_map_single(adapter->pdev,
+ 					skb->data, hdr_len, PCI_DMA_TODEVICE);
++		if (dma_mapping_error(&adapter->pdev->dev, tx_buffer->dma))
++			return -ENOSPC;
++
+ 		ATL1E_SET_PCIMAP_TYPE(tx_buffer, ATL1E_TX_PCIMAP_SINGLE);
+ 		mapped_len += map_len;
+ 		use_tpd->buffer_addr = cpu_to_le64(tx_buffer->dma);
+@@ -1715,6 +1720,22 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
+ 		tx_buffer->dma =
+ 			pci_map_single(adapter->pdev, skb->data + mapped_len,
+ 					map_len, PCI_DMA_TODEVICE);
++
++		if (dma_mapping_error(&adapter->pdev->dev, tx_buffer->dma)) {
++			/* We need to unwind the mappings we've done */
++			ring_end = adapter->tx_ring.next_to_use;
++			adapter->tx_ring.next_to_use = ring_start;
++			while (adapter->tx_ring.next_to_use != ring_end) {
++				tpd = atl1e_get_tpd(adapter);
++				tx_buffer = atl1e_get_tx_buffer(adapter, tpd);
++				pci_unmap_single(adapter->pdev, tx_buffer->dma,
++						 tx_buffer->length, PCI_DMA_TODEVICE);
++			}
++			/* Reset the tx rings next pointer */
++			adapter->tx_ring.next_to_use = ring_start;
++			return -ENOSPC;
++		}
++
+ 		ATL1E_SET_PCIMAP_TYPE(tx_buffer, ATL1E_TX_PCIMAP_SINGLE);
+ 		mapped_len  += map_len;
+ 		use_tpd->buffer_addr = cpu_to_le64(tx_buffer->dma);
+@@ -1750,6 +1771,23 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
+ 							  (i * MAX_TX_BUF_LEN),
+ 							  tx_buffer->length,
+ 							  DMA_TO_DEVICE);
++
++			if (dma_mapping_error(&adapter->pdev->dev, tx_buffer->dma)) {
++				/* We need to unwind the mappings we've done */
++				ring_end = adapter->tx_ring.next_to_use;
++				adapter->tx_ring.next_to_use = ring_start;
++				while (adapter->tx_ring.next_to_use != ring_end) {
++					tpd = atl1e_get_tpd(adapter);
++					tx_buffer = atl1e_get_tx_buffer(adapter, tpd);
++					dma_unmap_page(&adapter->pdev->dev, tx_buffer->dma,
++						       tx_buffer->length, DMA_TO_DEVICE);
++				}
++
++				/* Reset the ring next to use pointer */
++				adapter->tx_ring.next_to_use = ring_start;
++				return -ENOSPC;
++			}
++
+ 			ATL1E_SET_PCIMAP_TYPE(tx_buffer, ATL1E_TX_PCIMAP_PAGE);
+ 			use_tpd->buffer_addr = cpu_to_le64(tx_buffer->dma);
+ 			use_tpd->word2 = (use_tpd->word2 & (~TPD_BUFLEN_MASK)) |
+@@ -1767,6 +1805,7 @@ static void atl1e_tx_map(struct atl1e_adapter *adapter,
+ 	/* The last buffer info contain the skb address,
+ 	   so it will be free after unmap */
+ 	tx_buffer->skb = skb;
++	return 0;
+ }
+ 
+ static void atl1e_tx_queue(struct atl1e_adapter *adapter, u16 count,
+@@ -1834,10 +1873,15 @@ static netdev_tx_t atl1e_xmit_frame(struct sk_buff *skb,
+ 		return NETDEV_TX_OK;
+ 	}
+ 
+-	atl1e_tx_map(adapter, skb, tpd);
++	if (atl1e_tx_map(adapter, skb, tpd)) {
++		dev_kfree_skb_any(skb);
++		goto out;
++	}
++
+ 	atl1e_tx_queue(adapter, tpd_req, tpd);
+ 
+ 	netdev->trans_start = jiffies; /* NETIF_F_LLTX driver :( */
++out:
+ 	spin_unlock_irqrestore(&adapter->tx_lock, flags);
+ 	return NETDEV_TX_OK;
+ }
+diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
+index c89aa41..b4e0dc8 100644
+--- a/drivers/net/ethernet/cadence/macb.c
++++ b/drivers/net/ethernet/cadence/macb.c
+@@ -1070,7 +1070,7 @@ static void macb_configure_dma(struct macb *bp)
+ static void macb_configure_caps(struct macb *bp)
+ {
+ 	if (macb_is_gem(bp)) {
+-		if (GEM_BF(IRQCOR, gem_readl(bp, DCFG1)) == 0)
++		if (GEM_BFEXT(IRQCOR, gem_readl(bp, DCFG1)) == 0)
+ 			bp->caps |= MACB_CAPS_ISR_CLEAR_ON_WRITE;
+ 	}
+ }
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index a0b4be5..6e43426 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -782,16 +782,22 @@ static struct sk_buff *be_insert_vlan_in_pkt(struct be_adapter *adapter,
+ 
+ 	if (vlan_tx_tag_present(skb))
+ 		vlan_tag = be_get_tx_vlan_tag(adapter, skb);
+-	else if (qnq_async_evt_rcvd(adapter) && adapter->pvid)
+-		vlan_tag = adapter->pvid;
++
++	if (qnq_async_evt_rcvd(adapter) && adapter->pvid) {
++		if (!vlan_tag)
++			vlan_tag = adapter->pvid;
++		/* f/w workaround to set skip_hw_vlan = 1, informs the F/W to
++		 * skip VLAN insertion
++		 */
++		if (skip_hw_vlan)
++			*skip_hw_vlan = true;
++	}
+ 
+ 	if (vlan_tag) {
+ 		skb = __vlan_put_tag(skb, htons(ETH_P_8021Q), vlan_tag);
+ 		if (unlikely(!skb))
+ 			return skb;
+ 		skb->vlan_tci = 0;
+-		if (skip_hw_vlan)
+-			*skip_hw_vlan = true;
+ 	}
+ 
+ 	/* Insert the outer VLAN, if any */
+diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
+index a7dfe36..5173eaa 100644
+--- a/drivers/net/ethernet/sfc/rx.c
++++ b/drivers/net/ethernet/sfc/rx.c
+@@ -282,9 +282,9 @@ static void efx_fini_rx_buffer(struct efx_rx_queue *rx_queue,
+ }
+ 
+ /* Recycle the pages that are used by buffers that have just been received. */
+-static void efx_recycle_rx_buffers(struct efx_channel *channel,
+-				   struct efx_rx_buffer *rx_buf,
+-				   unsigned int n_frags)
++static void efx_recycle_rx_pages(struct efx_channel *channel,
++				 struct efx_rx_buffer *rx_buf,
++				 unsigned int n_frags)
+ {
+ 	struct efx_rx_queue *rx_queue = efx_channel_get_rx_queue(channel);
+ 
+@@ -294,6 +294,20 @@ static void efx_recycle_rx_buffers(struct efx_channel *channel,
+ 	} while (--n_frags);
+ }
+ 
++static void efx_discard_rx_packet(struct efx_channel *channel,
++				  struct efx_rx_buffer *rx_buf,
++				  unsigned int n_frags)
++{
++	struct efx_rx_queue *rx_queue = efx_channel_get_rx_queue(channel);
++
++	efx_recycle_rx_pages(channel, rx_buf, n_frags);
++
++	do {
++		efx_free_rx_buffer(rx_buf);
++		rx_buf = efx_rx_buf_next(rx_queue, rx_buf);
++	} while (--n_frags);
++}
++
+ /**
+  * efx_fast_push_rx_descriptors - push new RX descriptors quickly
+  * @rx_queue:		RX descriptor queue
+@@ -533,8 +547,7 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
+ 	 */
+ 	if (unlikely(rx_buf->flags & EFX_RX_PKT_DISCARD)) {
+ 		efx_rx_flush_packet(channel);
+-		put_page(rx_buf->page);
+-		efx_recycle_rx_buffers(channel, rx_buf, n_frags);
++		efx_discard_rx_packet(channel, rx_buf, n_frags);
+ 		return;
+ 	}
+ 
+@@ -570,9 +583,9 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
+ 		efx_sync_rx_buffer(efx, rx_buf, rx_buf->len);
+ 	}
+ 
+-	/* All fragments have been DMA-synced, so recycle buffers and pages. */
++	/* All fragments have been DMA-synced, so recycle pages. */
+ 	rx_buf = efx_rx_buffer(rx_queue, index);
+-	efx_recycle_rx_buffers(channel, rx_buf, n_frags);
++	efx_recycle_rx_pages(channel, rx_buf, n_frags);
+ 
+ 	/* Pipeline receives so that we give time for packet headers to be
+ 	 * prefetched into cache.
+diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
+index 1df0ff3..3df5684 100644
+--- a/drivers/net/ethernet/sun/sunvnet.c
++++ b/drivers/net/ethernet/sun/sunvnet.c
+@@ -1239,6 +1239,8 @@ static int vnet_port_remove(struct vio_dev *vdev)
+ 		dev_set_drvdata(&vdev->dev, NULL);
+ 
+ 		kfree(port);
++
++		unregister_netdev(vp->dev);
+ 	}
+ 	return 0;
+ }
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 4dccead..23a0fff 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -431,8 +431,8 @@ static int netvsc_probe(struct hv_device *dev,
+ 	net->netdev_ops = &device_ops;
+ 
+ 	/* TODO: Add GSO and Checksum offload */
+-	net->hw_features = NETIF_F_SG;
+-	net->features = NETIF_F_SG | NETIF_F_HW_VLAN_CTAG_TX;
++	net->hw_features = 0;
++	net->features = NETIF_F_HW_VLAN_CTAG_TX;
+ 
+ 	SET_ETHTOOL_OPS(net, &ethtool_ops);
+ 	SET_NETDEV_DEV(net, &dev->device);
+diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
+index dc9f6a4..a3bed28 100644
+--- a/drivers/net/ifb.c
++++ b/drivers/net/ifb.c
+@@ -291,11 +291,17 @@ static int __init ifb_init_module(void)
+ 
+ 	rtnl_lock();
+ 	err = __rtnl_link_register(&ifb_link_ops);
++	if (err < 0)
++		goto out;
+ 
+-	for (i = 0; i < numifbs && !err; i++)
++	for (i = 0; i < numifbs && !err; i++) {
+ 		err = ifb_init_one(i);
++		cond_resched();
++	}
+ 	if (err)
+ 		__rtnl_link_unregister(&ifb_link_ops);
++
++out:
+ 	rtnl_unlock();
+ 
+ 	return err;
+diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
+index b6dd6a7..523d6b2 100644
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -633,6 +633,28 @@ static int macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
+ 	return 0;
+ }
+ 
++static unsigned long iov_pages(const struct iovec *iv, int offset,
++			       unsigned long nr_segs)
++{
++	unsigned long seg, base;
++	int pages = 0, len, size;
++
++	while (nr_segs && (offset >= iv->iov_len)) {
++		offset -= iv->iov_len;
++		++iv;
++		--nr_segs;
++	}
++
++	for (seg = 0; seg < nr_segs; seg++) {
++		base = (unsigned long)iv[seg].iov_base + offset;
++		len = iv[seg].iov_len - offset;
++		size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
++		pages += size;
++		offset = 0;
++	}
++
++	return pages;
++}
+ 
+ /* Get packet from user space buffer */
+ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+@@ -647,6 +669,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+ 	int vnet_hdr_len = 0;
+ 	int copylen = 0;
+ 	bool zerocopy = false;
++	size_t linear;
+ 
+ 	if (q->flags & IFF_VNET_HDR) {
+ 		vnet_hdr_len = q->vnet_hdr_sz;
+@@ -678,42 +701,35 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+ 	if (unlikely(count > UIO_MAXIOV))
+ 		goto err;
+ 
+-	if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY))
+-		zerocopy = true;
++	if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY)) {
++		copylen = vnet_hdr.hdr_len ? vnet_hdr.hdr_len : GOODCOPY_LEN;
++		linear = copylen;
++		if (iov_pages(iv, vnet_hdr_len + copylen, count)
++		    <= MAX_SKB_FRAGS)
++			zerocopy = true;
++	}
+ 
+-	if (zerocopy) {
+-		/* Userspace may produce vectors with count greater than
+-		 * MAX_SKB_FRAGS, so we need to linearize parts of the skb
+-		 * to let the rest of data to be fit in the frags.
+-		 */
+-		if (count > MAX_SKB_FRAGS) {
+-			copylen = iov_length(iv, count - MAX_SKB_FRAGS);
+-			if (copylen < vnet_hdr_len)
+-				copylen = 0;
+-			else
+-				copylen -= vnet_hdr_len;
+-		}
+-		/* There are 256 bytes to be copied in skb, so there is enough
+-		 * room for skb expand head in case it is used.
+-		 * The rest buffer is mapped from userspace.
+-		 */
+-		if (copylen < vnet_hdr.hdr_len)
+-			copylen = vnet_hdr.hdr_len;
+-		if (!copylen)
+-			copylen = GOODCOPY_LEN;
+-	} else
++	if (!zerocopy) {
+ 		copylen = len;
++		linear = vnet_hdr.hdr_len;
++	}
+ 
+ 	skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
+-				vnet_hdr.hdr_len, noblock, &err);
++				linear, noblock, &err);
+ 	if (!skb)
+ 		goto err;
+ 
+ 	if (zerocopy)
+ 		err = zerocopy_sg_from_iovec(skb, iv, vnet_hdr_len, count);
+-	else
++	else {
+ 		err = skb_copy_datagram_from_iovec(skb, 0, iv, vnet_hdr_len,
+ 						   len);
++		if (!err && m && m->msg_control) {
++			struct ubuf_info *uarg = m->msg_control;
++			uarg->callback(uarg, false);
++		}
++	}
++
+ 	if (err)
+ 		goto err_kfree;
+ 
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 9c61f87..2491eb2 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1037,6 +1037,29 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
+ 	return 0;
+ }
+ 
++static unsigned long iov_pages(const struct iovec *iv, int offset,
++			       unsigned long nr_segs)
++{
++	unsigned long seg, base;
++	int pages = 0, len, size;
++
++	while (nr_segs && (offset >= iv->iov_len)) {
++		offset -= iv->iov_len;
++		++iv;
++		--nr_segs;
++	}
++
++	for (seg = 0; seg < nr_segs; seg++) {
++		base = (unsigned long)iv[seg].iov_base + offset;
++		len = iv[seg].iov_len - offset;
++		size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
++		pages += size;
++		offset = 0;
++	}
++
++	return pages;
++}
++
+ /* Get packet from user space buffer */
+ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ 			    void *msg_control, const struct iovec *iv,
+@@ -1044,7 +1067,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ {
+ 	struct tun_pi pi = { 0, cpu_to_be16(ETH_P_IP) };
+ 	struct sk_buff *skb;
+-	size_t len = total_len, align = NET_SKB_PAD;
++	size_t len = total_len, align = NET_SKB_PAD, linear;
+ 	struct virtio_net_hdr gso = { 0 };
+ 	int offset = 0;
+ 	int copylen;
+@@ -1084,34 +1107,23 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ 			return -EINVAL;
+ 	}
+ 
+-	if (msg_control)
+-		zerocopy = true;
+-
+-	if (zerocopy) {
+-		/* Userspace may produce vectors with count greater than
+-		 * MAX_SKB_FRAGS, so we need to linearize parts of the skb
+-		 * to let the rest of data to be fit in the frags.
+-		 */
+-		if (count > MAX_SKB_FRAGS) {
+-			copylen = iov_length(iv, count - MAX_SKB_FRAGS);
+-			if (copylen < offset)
+-				copylen = 0;
+-			else
+-				copylen -= offset;
+-		} else
+-				copylen = 0;
+-		/* There are 256 bytes to be copied in skb, so there is enough
+-		 * room for skb expand head in case it is used.
++	if (msg_control) {
++		/* There are 256 bytes to be copied in skb, so there is
++		 * enough room for skb expand head in case it is used.
+ 		 * The rest of the buffer is mapped from userspace.
+ 		 */
+-		if (copylen < gso.hdr_len)
+-			copylen = gso.hdr_len;
+-		if (!copylen)
+-			copylen = GOODCOPY_LEN;
+-	} else
++		copylen = gso.hdr_len ? gso.hdr_len : GOODCOPY_LEN;
++		linear = copylen;
++		if (iov_pages(iv, offset + copylen, count) <= MAX_SKB_FRAGS)
++			zerocopy = true;
++	}
++
++	if (!zerocopy) {
+ 		copylen = len;
++		linear = gso.hdr_len;
++	}
+ 
+-	skb = tun_alloc_skb(tfile, align, copylen, gso.hdr_len, noblock);
++	skb = tun_alloc_skb(tfile, align, copylen, linear, noblock);
+ 	if (IS_ERR(skb)) {
+ 		if (PTR_ERR(skb) != -EAGAIN)
+ 			tun->dev->stats.rx_dropped++;
+@@ -1120,8 +1132,13 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ 
+ 	if (zerocopy)
+ 		err = zerocopy_sg_from_iovec(skb, iv, offset, count);
+-	else
++	else {
+ 		err = skb_copy_datagram_from_iovec(skb, 0, iv, offset, len);
++		if (!err && msg_control) {
++			struct ubuf_info *uarg = msg_control;
++			uarg->callback(uarg, false);
++		}
++	}
+ 
+ 	if (err) {
+ 		tun->dev->stats.rx_dropped++;
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index c9e0038..42d670a 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -602,7 +602,7 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
+ 		container_of(napi, struct receive_queue, napi);
+ 	struct virtnet_info *vi = rq->vq->vdev->priv;
+ 	void *buf;
+-	unsigned int len, received = 0;
++	unsigned int r, len, received = 0;
+ 
+ again:
+ 	while (received < budget &&
+@@ -619,8 +619,9 @@ again:
+ 
+ 	/* Out of packets? */
+ 	if (received < budget) {
++		r = virtqueue_enable_cb_prepare(rq->vq);
+ 		napi_complete(napi);
+-		if (unlikely(!virtqueue_enable_cb(rq->vq)) &&
++		if (unlikely(virtqueue_poll(rq->vq, r)) &&
+ 		    napi_schedule_prep(napi)) {
+ 			virtqueue_disable_cb(rq->vq);
+ 			__napi_schedule(napi);
+diff --git a/drivers/rapidio/switches/idt_gen2.c b/drivers/rapidio/switches/idt_gen2.c
+index 809b7a3..5d3b0f0 100644
+--- a/drivers/rapidio/switches/idt_gen2.c
++++ b/drivers/rapidio/switches/idt_gen2.c
+@@ -15,6 +15,8 @@
+ #include <linux/rio_drv.h>
+ #include <linux/rio_ids.h>
+ #include <linux/delay.h>
++
++#include <asm/page.h>
+ #include "../rio.h"
+ 
+ #define LOCAL_RTE_CONF_DESTID_SEL	0x010070
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 3a9ddae..89178b8 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -4852,10 +4852,12 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
+ 				    sense, sense_handle);
+ 	}
+ 
+-	for (i = 0; i < ioc->sge_count && kbuff_arr[i]; i++) {
+-		dma_free_coherent(&instance->pdev->dev,
+-				    kern_sge32[i].length,
+-				    kbuff_arr[i], kern_sge32[i].phys_addr);
++	for (i = 0; i < ioc->sge_count; i++) {
++		if (kbuff_arr[i])
++			dma_free_coherent(&instance->pdev->dev,
++					  kern_sge32[i].length,
++					  kbuff_arr[i],
++					  kern_sge32[i].phys_addr);
+ 	}
+ 
+ 	megasas_return_cmd(instance, cmd);
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index dcbf7c8..f8c4b85 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -1273,6 +1273,7 @@ _scsih_slave_alloc(struct scsi_device *sdev)
+ 	struct MPT3SAS_DEVICE *sas_device_priv_data;
+ 	struct scsi_target *starget;
+ 	struct _raid_device *raid_device;
++	struct _sas_device *sas_device;
+ 	unsigned long flags;
+ 
+ 	sas_device_priv_data = kzalloc(sizeof(struct scsi_device), GFP_KERNEL);
+@@ -1301,6 +1302,19 @@ _scsih_slave_alloc(struct scsi_device *sdev)
+ 		spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
+ 	}
+ 
++	if (!(sas_target_priv_data->flags & MPT_TARGET_FLAGS_VOLUME)) {
++		spin_lock_irqsave(&ioc->sas_device_lock, flags);
++		sas_device = mpt3sas_scsih_sas_device_find_by_sas_address(ioc,
++					sas_target_priv_data->sas_address);
++		if (sas_device && (sas_device->starget == NULL)) {
++			sdev_printk(KERN_INFO, sdev,
++			"%s : sas_device->starget set to starget @ %d\n",
++				__func__, __LINE__);
++			sas_device->starget = starget;
++		}
++		spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -6392,7 +6406,7 @@ _scsih_search_responding_sas_devices(struct MPT3SAS_ADAPTER *ioc)
+ 	    handle))) {
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
++		if (ioc_status != MPI2_IOCSTATUS_SUCCESS)
+ 			break;
+ 		handle = le16_to_cpu(sas_device_pg0.DevHandle);
+ 		device_info = le32_to_cpu(sas_device_pg0.DeviceInfo);
+@@ -6494,7 +6508,7 @@ _scsih_search_responding_raid_devices(struct MPT3SAS_ADAPTER *ioc)
+ 	    &volume_pg1, MPI2_RAID_VOLUME_PGAD_FORM_GET_NEXT_HANDLE, handle))) {
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
++		if (ioc_status != MPI2_IOCSTATUS_SUCCESS)
+ 			break;
+ 		handle = le16_to_cpu(volume_pg1.DevHandle);
+ 
+@@ -6518,7 +6532,7 @@ _scsih_search_responding_raid_devices(struct MPT3SAS_ADAPTER *ioc)
+ 		    phys_disk_num))) {
+ 			ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 			    MPI2_IOCSTATUS_MASK;
+-			if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
++			if (ioc_status != MPI2_IOCSTATUS_SUCCESS)
+ 				break;
+ 			phys_disk_num = pd_pg0.PhysDiskNum;
+ 			handle = le16_to_cpu(pd_pg0.DevHandle);
+@@ -6597,7 +6611,7 @@ _scsih_search_responding_expanders(struct MPT3SAS_ADAPTER *ioc)
+ 
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
++		if (ioc_status != MPI2_IOCSTATUS_SUCCESS)
+ 			break;
+ 
+ 		handle = le16_to_cpu(expander_pg0.DevHandle);
+@@ -6742,8 +6756,6 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc)
+ 	    MPI2_SAS_EXPAND_PGAD_FORM_GET_NEXT_HNDL, handle))) {
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
+-			break;
+ 		if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+ 			pr_info(MPT3SAS_FMT "\tbreak from expander scan: " \
+ 			    "ioc_status(0x%04x), loginfo(0x%08x)\n",
+@@ -6787,8 +6799,6 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc)
+ 	    phys_disk_num))) {
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
+-			break;
+ 		if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+ 			pr_info(MPT3SAS_FMT "\tbreak from phys disk scan: "\
+ 			    "ioc_status(0x%04x), loginfo(0x%08x)\n",
+@@ -6854,8 +6864,6 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc)
+ 	    &volume_pg1, MPI2_RAID_VOLUME_PGAD_FORM_GET_NEXT_HANDLE, handle))) {
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
+-			break;
+ 		if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+ 			pr_info(MPT3SAS_FMT "\tbreak from volume scan: " \
+ 			    "ioc_status(0x%04x), loginfo(0x%08x)\n",
+@@ -6914,8 +6922,6 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc)
+ 	    handle))) {
+ 		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+ 		    MPI2_IOCSTATUS_MASK;
+-		if (ioc_status == MPI2_IOCSTATUS_CONFIG_INVALID_PAGE)
+-			break;
+ 		if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+ 			pr_info(MPT3SAS_FMT "\tbreak from end device scan:"\
+ 			    " ioc_status(0x%04x), loginfo(0x%08x)\n",
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 2c65955..c90d960 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -53,6 +53,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
+ 	{ USB_DEVICE(0x0489, 0xE003) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
+ 	{ USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */
++	{ USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
+ 	{ USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
+ 	{ USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
+ 	{ USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
+@@ -118,6 +119,8 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
+ 	{ USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
+ 	{ USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
++	{ USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
++	{ USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+ 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ 	{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+@@ -148,6 +151,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
+ 	{ USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ 	{ USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
++	{ USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+ 	{ USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
+ 	{ USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
+ 	{ USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 5dd857d..1cf6f12 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -341,17 +341,12 @@ static void option_instat_callback(struct urb *urb);
+ #define OLIVETTI_VENDOR_ID			0x0b3c
+ #define OLIVETTI_PRODUCT_OLICARD100		0xc000
+ #define OLIVETTI_PRODUCT_OLICARD145		0xc003
++#define OLIVETTI_PRODUCT_OLICARD200		0xc005
+ 
+ /* Celot products */
+ #define CELOT_VENDOR_ID				0x211f
+ #define CELOT_PRODUCT_CT680M			0x6801
+ 
+-/* ONDA Communication vendor id */
+-#define ONDA_VENDOR_ID       0x1ee8
+-
+-/* ONDA MT825UP HSDPA 14.2 modem */
+-#define ONDA_MT825UP         0x000b
+-
+ /* Samsung products */
+ #define SAMSUNG_VENDOR_ID                       0x04e8
+ #define SAMSUNG_PRODUCT_GT_B3730                0x6889
+@@ -444,7 +439,8 @@ static void option_instat_callback(struct urb *urb);
+ 
+ /* Hyundai Petatel Inc. products */
+ #define PETATEL_VENDOR_ID			0x1ff4
+-#define PETATEL_PRODUCT_NP10T			0x600e
++#define PETATEL_PRODUCT_NP10T_600A		0x600a
++#define PETATEL_PRODUCT_NP10T_600E		0x600e
+ 
+ /* TP-LINK Incorporated products */
+ #define TPLINK_VENDOR_ID			0x2357
+@@ -782,6 +778,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) },
+ 	{ USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
++	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
+@@ -817,7 +814,8 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff),
+ 		.driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0018, 0xff, 0xff, 0xff) },
+-	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 0xff),
++		.driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0020, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0021, 0xff, 0xff, 0xff),
+ 		.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+@@ -1256,8 +1254,8 @@ static const struct usb_device_id option_ids[] = {
+ 
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
++	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200) },
+ 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
+-	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
+ 	{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
+ 	{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM610) },
+@@ -1329,9 +1327,12 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
+ 	{ USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
+-	{ USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T) },
++	{ USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) },
++	{ USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) },
+ 	{ USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
+ 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(TPLINK_VENDOR_ID, 0x9000),					/* TP-Link MA260 */
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ 	{ USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x02, 0x01) },	/* D-Link DWM-156 (variant) */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x00, 0x00) },	/* D-Link DWM-156 (variant) */
+@@ -1339,6 +1340,8 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+ 	{ } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index f80d3dd..8ca5ac7 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -150,6 +150,11 @@ static void vhost_net_ubuf_put_and_wait(struct vhost_net_ubuf_ref *ubufs)
+ {
+ 	kref_put(&ubufs->kref, vhost_net_zerocopy_done_signal);
+ 	wait_event(ubufs->wait, !atomic_read(&ubufs->kref.refcount));
++}
++
++static void vhost_net_ubuf_put_wait_and_free(struct vhost_net_ubuf_ref *ubufs)
++{
++	vhost_net_ubuf_put_and_wait(ubufs);
+ 	kfree(ubufs);
+ }
+ 
+@@ -948,7 +953,7 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
+ 	mutex_unlock(&vq->mutex);
+ 
+ 	if (oldubufs) {
+-		vhost_net_ubuf_put_and_wait(oldubufs);
++		vhost_net_ubuf_put_wait_and_free(oldubufs);
+ 		mutex_lock(&vq->mutex);
+ 		vhost_zerocopy_signal_used(n, vq);
+ 		mutex_unlock(&vq->mutex);
+@@ -966,7 +971,7 @@ err_used:
+ 	rcu_assign_pointer(vq->private_data, oldsock);
+ 	vhost_net_enable_vq(n, vq);
+ 	if (ubufs)
+-		vhost_net_ubuf_put_and_wait(ubufs);
++		vhost_net_ubuf_put_wait_and_free(ubufs);
+ err_ubufs:
+ 	fput(sock->file);
+ err_vq:
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 5217baf..37d58f8 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -607,19 +607,21 @@ void virtqueue_disable_cb(struct virtqueue *_vq)
+ EXPORT_SYMBOL_GPL(virtqueue_disable_cb);
+ 
+ /**
+- * virtqueue_enable_cb - restart callbacks after disable_cb.
++ * virtqueue_enable_cb_prepare - restart callbacks after disable_cb
+  * @vq: the struct virtqueue we're talking about.
+  *
+- * This re-enables callbacks; it returns "false" if there are pending
+- * buffers in the queue, to detect a possible race between the driver
+- * checking for more work, and enabling callbacks.
++ * This re-enables callbacks; it returns current queue state
++ * in an opaque unsigned value. This value should be later tested by
++ * virtqueue_poll, to detect a possible race between the driver checking for
++ * more work, and enabling callbacks.
+  *
+  * Caller must ensure we don't call this with other virtqueue
+  * operations at the same time (except where noted).
+  */
+-bool virtqueue_enable_cb(struct virtqueue *_vq)
++unsigned virtqueue_enable_cb_prepare(struct virtqueue *_vq)
+ {
+ 	struct vring_virtqueue *vq = to_vvq(_vq);
++	u16 last_used_idx;
+ 
+ 	START_USE(vq);
+ 
+@@ -629,15 +631,45 @@ bool virtqueue_enable_cb(struct virtqueue *_vq)
+ 	 * either clear the flags bit or point the event index at the next
+ 	 * entry. Always do both to keep code simple. */
+ 	vq->vring.avail->flags &= ~VRING_AVAIL_F_NO_INTERRUPT;
+-	vring_used_event(&vq->vring) = vq->last_used_idx;
++	vring_used_event(&vq->vring) = last_used_idx = vq->last_used_idx;
++	END_USE(vq);
++	return last_used_idx;
++}
++EXPORT_SYMBOL_GPL(virtqueue_enable_cb_prepare);
++
++/**
++ * virtqueue_poll - query pending used buffers
++ * @vq: the struct virtqueue we're talking about.
++ * @last_used_idx: virtqueue state (from call to virtqueue_enable_cb_prepare).
++ *
++ * Returns "true" if there are pending used buffers in the queue.
++ *
++ * This does not need to be serialized.
++ */
++bool virtqueue_poll(struct virtqueue *_vq, unsigned last_used_idx)
++{
++	struct vring_virtqueue *vq = to_vvq(_vq);
++
+ 	virtio_mb(vq->weak_barriers);
+-	if (unlikely(more_used(vq))) {
+-		END_USE(vq);
+-		return false;
+-	}
++	return (u16)last_used_idx != vq->vring.used->idx;
++}
++EXPORT_SYMBOL_GPL(virtqueue_poll);
+ 
+-	END_USE(vq);
+-	return true;
++/**
++ * virtqueue_enable_cb - restart callbacks after disable_cb.
++ * @vq: the struct virtqueue we're talking about.
++ *
++ * This re-enables callbacks; it returns "false" if there are pending
++ * buffers in the queue, to detect a possible race between the driver
++ * checking for more work, and enabling callbacks.
++ *
++ * Caller must ensure we don't call this with other virtqueue
++ * operations at the same time (except where noted).
++ */
++bool virtqueue_enable_cb(struct virtqueue *_vq)
++{
++	unsigned last_used_idx = virtqueue_enable_cb_prepare(_vq);
++	return !virtqueue_poll(_vq, last_used_idx);
+ }
+ EXPORT_SYMBOL_GPL(virtqueue_enable_cb);
+ 
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 2091db8..85f5c85 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -58,17 +58,24 @@ static void bdev_inode_switch_bdi(struct inode *inode,
+ 			struct backing_dev_info *dst)
+ {
+ 	struct backing_dev_info *old = inode->i_data.backing_dev_info;
++	bool wakeup_bdi = false;
+ 
+ 	if (unlikely(dst == old))		/* deadlock avoidance */
+ 		return;
+ 	bdi_lock_two(&old->wb, &dst->wb);
+ 	spin_lock(&inode->i_lock);
+ 	inode->i_data.backing_dev_info = dst;
+-	if (inode->i_state & I_DIRTY)
++	if (inode->i_state & I_DIRTY) {
++		if (bdi_cap_writeback_dirty(dst) && !wb_has_dirty_io(&dst->wb))
++			wakeup_bdi = true;
+ 		list_move(&inode->i_wb_list, &dst->wb.b_dirty);
++	}
+ 	spin_unlock(&inode->i_lock);
+ 	spin_unlock(&old->wb.list_lock);
+ 	spin_unlock(&dst->wb.list_lock);
++
++	if (wakeup_bdi)
++		bdi_wakeup_thread_delayed(dst);
+ }
+ 
+ /* Kill _all_ buffers and pagecache , dirty or not.. */
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index e49da58..fddf3d9 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4386,9 +4386,20 @@ void ext4_ext_truncate(handle_t *handle, struct inode *inode)
+ 
+ 	last_block = (inode->i_size + sb->s_blocksize - 1)
+ 			>> EXT4_BLOCK_SIZE_BITS(sb);
++retry:
+ 	err = ext4_es_remove_extent(inode, last_block,
+ 				    EXT_MAX_BLOCKS - last_block);
++	if (err == ENOMEM) {
++		cond_resched();
++		congestion_wait(BLK_RW_ASYNC, HZ/50);
++		goto retry;
++	}
++	if (err) {
++		ext4_std_error(inode->i_sb, err);
++		return;
++	}
+ 	err = ext4_ext_remove_space(inode, last_block, EXT_MAX_BLOCKS - 1);
++	ext4_std_error(inode->i_sb, err);
+ }
+ 
+ static void ext4_falloc_update_inode(struct inode *inode,
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index f3f783d..5b12746 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1225,13 +1225,29 @@ static int fuse_direntplus_link(struct file *file,
+ 		if (name.name[1] == '.' && name.len == 2)
+ 			return 0;
+ 	}
++
++	if (invalid_nodeid(o->nodeid))
++		return -EIO;
++	if (!fuse_valid_type(o->attr.mode))
++		return -EIO;
++
+ 	fc = get_fuse_conn(dir);
+ 
+ 	name.hash = full_name_hash(name.name, name.len);
+ 	dentry = d_lookup(parent, &name);
+-	if (dentry && dentry->d_inode) {
++	if (dentry) {
+ 		inode = dentry->d_inode;
+-		if (get_node_id(inode) == o->nodeid) {
++		if (!inode) {
++			d_drop(dentry);
++		} else if (get_node_id(inode) != o->nodeid ||
++			   ((o->attr.mode ^ inode->i_mode) & S_IFMT)) {
++			err = d_invalidate(dentry);
++			if (err)
++				goto out;
++		} else if (is_bad_inode(inode)) {
++			err = -EIO;
++			goto out;
++		} else {
+ 			struct fuse_inode *fi;
+ 			fi = get_fuse_inode(inode);
+ 			spin_lock(&fc->lock);
+@@ -1244,9 +1260,6 @@ static int fuse_direntplus_link(struct file *file,
+ 			 */
+ 			goto found;
+ 		}
+-		err = d_invalidate(dentry);
+-		if (err)
+-			goto out;
+ 		dput(dentry);
+ 		dentry = NULL;
+ 	}
+@@ -1261,10 +1274,19 @@ static int fuse_direntplus_link(struct file *file,
+ 	if (!inode)
+ 		goto out;
+ 
+-	alias = d_materialise_unique(dentry, inode);
+-	err = PTR_ERR(alias);
+-	if (IS_ERR(alias))
+-		goto out;
++	if (S_ISDIR(inode->i_mode)) {
++		mutex_lock(&fc->inst_mutex);
++		alias = fuse_d_add_directory(dentry, inode);
++		mutex_unlock(&fc->inst_mutex);
++		err = PTR_ERR(alias);
++		if (IS_ERR(alias)) {
++			iput(inode);
++			goto out;
++		}
++	} else {
++		alias = d_splice_alias(inode, dentry);
++	}
++
+ 	if (alias) {
+ 		dput(dentry);
+ 		dentry = alias;
+diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
+index e703318..8ebd3f5 100644
+--- a/fs/lockd/svclock.c
++++ b/fs/lockd/svclock.c
+@@ -939,6 +939,7 @@ nlmsvc_retry_blocked(void)
+ 	unsigned long	timeout = MAX_SCHEDULE_TIMEOUT;
+ 	struct nlm_block *block;
+ 
++	spin_lock(&nlm_blocked_lock);
+ 	while (!list_empty(&nlm_blocked) && !kthread_should_stop()) {
+ 		block = list_entry(nlm_blocked.next, struct nlm_block, b_list);
+ 
+@@ -948,6 +949,7 @@ nlmsvc_retry_blocked(void)
+ 			timeout = block->b_when - jiffies;
+ 			break;
+ 		}
++		spin_unlock(&nlm_blocked_lock);
+ 
+ 		dprintk("nlmsvc_retry_blocked(%p, when=%ld)\n",
+ 			block, block->b_when);
+@@ -957,7 +959,9 @@ nlmsvc_retry_blocked(void)
+ 			retry_deferred_block(block);
+ 		} else
+ 			nlmsvc_grant_blocked(block);
++		spin_lock(&nlm_blocked_lock);
+ 	}
++	spin_unlock(&nlm_blocked_lock);
+ 
+ 	return timeout;
+ }
+diff --git a/include/linux/edac.h b/include/linux/edac.h
+index 0b76327..5c6d7fb 100644
+--- a/include/linux/edac.h
++++ b/include/linux/edac.h
+@@ -622,7 +622,7 @@ struct edac_raw_error_desc {
+  */
+ struct mem_ctl_info {
+ 	struct device			dev;
+-	struct bus_type			bus;
++	struct bus_type			*bus;
+ 
+ 	struct list_head link;	/* for global list of mem_ctl_info structs */
+ 
+@@ -742,4 +742,9 @@ struct mem_ctl_info {
+ #endif
+ };
+ 
++/*
++ * Maximum number of memory controllers in the coherent fabric.
++ */
++#define EDAC_MAX_MCS	16
++
+ #endif
+diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
+index 637fa71d..0b34988 100644
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -79,9 +79,8 @@ static inline int is_vlan_dev(struct net_device *dev)
+ }
+ 
+ #define vlan_tx_tag_present(__skb)	((__skb)->vlan_tci & VLAN_TAG_PRESENT)
+-#define vlan_tx_nonzero_tag_present(__skb) \
+-	(vlan_tx_tag_present(__skb) && ((__skb)->vlan_tci & VLAN_VID_MASK))
+ #define vlan_tx_tag_get(__skb)		((__skb)->vlan_tci & ~VLAN_TAG_PRESENT)
++#define vlan_tx_tag_get_id(__skb)	((__skb)->vlan_tci & VLAN_VID_MASK)
+ 
+ #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
+ 
+diff --git a/include/linux/virtio.h b/include/linux/virtio.h
+index 9ff8645..72398ee 100644
+--- a/include/linux/virtio.h
++++ b/include/linux/virtio.h
+@@ -70,6 +70,10 @@ void virtqueue_disable_cb(struct virtqueue *vq);
+ 
+ bool virtqueue_enable_cb(struct virtqueue *vq);
+ 
++unsigned virtqueue_enable_cb_prepare(struct virtqueue *vq);
++
++bool virtqueue_poll(struct virtqueue *vq, unsigned);
++
+ bool virtqueue_enable_cb_delayed(struct virtqueue *vq);
+ 
+ void *virtqueue_detach_unused_buf(struct virtqueue *vq);
+diff --git a/include/net/addrconf.h b/include/net/addrconf.h
+index 21f70270..01b1a1a 100644
+--- a/include/net/addrconf.h
++++ b/include/net/addrconf.h
+@@ -86,6 +86,9 @@ extern int			ipv6_dev_get_saddr(struct net *net,
+ 					       const struct in6_addr *daddr,
+ 					       unsigned int srcprefs,
+ 					       struct in6_addr *saddr);
++extern int			__ipv6_get_lladdr(struct inet6_dev *idev,
++						  struct in6_addr *addr,
++						  unsigned char banned_flags);
+ extern int			ipv6_get_lladdr(struct net_device *dev,
+ 						struct in6_addr *addr,
+ 						unsigned char banned_flags);
+diff --git a/include/net/udp.h b/include/net/udp.h
+index 065f379..ad99eed 100644
+--- a/include/net/udp.h
++++ b/include/net/udp.h
+@@ -181,6 +181,7 @@ extern int udp_get_port(struct sock *sk, unsigned short snum,
+ extern void udp_err(struct sk_buff *, u32);
+ extern int udp_sendmsg(struct kiocb *iocb, struct sock *sk,
+ 			    struct msghdr *msg, size_t len);
++extern int udp_push_pending_frames(struct sock *sk);
+ extern void udp_flush_pending_frames(struct sock *sk);
+ extern int udp_rcv(struct sk_buff *skb);
+ extern int udp_ioctl(struct sock *sk, int cmd, unsigned long arg);
+diff --git a/include/uapi/linux/if_pppox.h b/include/uapi/linux/if_pppox.h
+index 0b46fd5..e36a4ae 100644
+--- a/include/uapi/linux/if_pppox.h
++++ b/include/uapi/linux/if_pppox.h
+@@ -135,11 +135,11 @@ struct pppoe_tag {
+ 
+ struct pppoe_hdr {
+ #if defined(__LITTLE_ENDIAN_BITFIELD)
+-	__u8 ver : 4;
+ 	__u8 type : 4;
++	__u8 ver : 4;
+ #elif defined(__BIG_ENDIAN_BITFIELD)
+-	__u8 type : 4;
+ 	__u8 ver : 4;
++	__u8 type : 4;
+ #else
+ #error	"Please fix <asm/byteorder.h>"
+ #endif
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index fd4b13b..2288fbd 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -721,17 +721,20 @@ static int hrtimer_switch_to_hres(void)
+ 	return 1;
+ }
+ 
++static void clock_was_set_work(struct work_struct *work)
++{
++	clock_was_set();
++}
++
++static DECLARE_WORK(hrtimer_work, clock_was_set_work);
++
+ /*
+- * Called from timekeeping code to reprogramm the hrtimer interrupt
+- * device. If called from the timer interrupt context we defer it to
+- * softirq context.
++ * Called from timekeeping and resume code to reprogramm the hrtimer
++ * interrupt device on all cpus.
+  */
+ void clock_was_set_delayed(void)
+ {
+-	struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
+-
+-	cpu_base->clock_was_set = 1;
+-	__raise_softirq_irqoff(HRTIMER_SOFTIRQ);
++	schedule_work(&hrtimer_work);
+ }
+ 
+ #else
+@@ -780,8 +783,10 @@ void hrtimers_resume(void)
+ 	WARN_ONCE(!irqs_disabled(),
+ 		  KERN_INFO "hrtimers_resume() called with IRQs enabled!");
+ 
++	/* Retrigger on the local CPU */
+ 	retrigger_next_event(NULL);
+-	timerfd_clock_was_set();
++	/* And schedule a retrigger for all others */
++	clock_was_set_delayed();
+ }
+ 
+ static inline void timer_stats_hrtimer_set_start_info(struct hrtimer *timer)
+@@ -1432,13 +1437,6 @@ void hrtimer_peek_ahead_timers(void)
+ 
+ static void run_hrtimer_softirq(struct softirq_action *h)
+ {
+-	struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
+-
+-	if (cpu_base->clock_was_set) {
+-		cpu_base->clock_was_set = 0;
+-		clock_was_set();
+-	}
+-
+ 	hrtimer_peek_ahead_timers();
+ }
+ 
+diff --git a/kernel/power/autosleep.c b/kernel/power/autosleep.c
+index c6422ff..9012ecf 100644
+--- a/kernel/power/autosleep.c
++++ b/kernel/power/autosleep.c
+@@ -32,7 +32,8 @@ static void try_to_suspend(struct work_struct *work)
+ 
+ 	mutex_lock(&autosleep_lock);
+ 
+-	if (!pm_save_wakeup_count(initial_count)) {
++	if (!pm_save_wakeup_count(initial_count) ||
++		system_state != SYSTEM_RUNNING) {
+ 		mutex_unlock(&autosleep_lock);
+ 		goto out;
+ 	}
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 566cf2b..74fdc5c 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -1272,7 +1272,7 @@ config FAULT_INJECTION_STACKTRACE_FILTER
+ 	depends on FAULT_INJECTION_DEBUG_FS && STACKTRACE_SUPPORT
+ 	depends on !X86_64
+ 	select STACKTRACE
+-	select FRAME_POINTER if !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND
++	select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND
+ 	help
+ 	  Provide stacktrace filter for fault-injection capabilities
+ 
+diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
+index 8a15eaa..4a78c4d 100644
+--- a/net/8021q/vlan_core.c
++++ b/net/8021q/vlan_core.c
+@@ -9,7 +9,7 @@ bool vlan_do_receive(struct sk_buff **skbp)
+ {
+ 	struct sk_buff *skb = *skbp;
+ 	__be16 vlan_proto = skb->vlan_proto;
+-	u16 vlan_id = skb->vlan_tci & VLAN_VID_MASK;
++	u16 vlan_id = vlan_tx_tag_get_id(skb);
+ 	struct net_device *vlan_dev;
+ 	struct vlan_pcpu_stats *rx_stats;
+ 
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 3a8c8fd..1cd3d2a 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -73,6 +73,8 @@ vlan_dev_get_egress_qos_mask(struct net_device *dev, struct sk_buff *skb)
+ {
+ 	struct vlan_priority_tci_mapping *mp;
+ 
++	smp_rmb(); /* coupled with smp_wmb() in vlan_dev_set_egress_priority() */
++
+ 	mp = vlan_dev_priv(dev)->egress_priority_map[(skb->priority & 0xF)];
+ 	while (mp) {
+ 		if (mp->priority == skb->priority) {
+@@ -249,6 +251,11 @@ int vlan_dev_set_egress_priority(const struct net_device *dev,
+ 	np->next = mp;
+ 	np->priority = skb_prio;
+ 	np->vlan_qos = vlan_qos;
++	/* Before inserting this element in hash table, make sure all its fields
++	 * are committed to memory.
++	 * coupled with smp_rmb() in vlan_dev_get_egress_qos_mask()
++	 */
++	smp_wmb();
+ 	vlan->egress_priority_map[skb_prio & 0xF] = np;
+ 	if (vlan_qos)
+ 		vlan->nr_egress_mappings++;
+diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c
+index de8df95..2ee3879 100644
+--- a/net/9p/trans_common.c
++++ b/net/9p/trans_common.c
+@@ -24,11 +24,11 @@
+  */
+ void p9_release_pages(struct page **pages, int nr_pages)
+ {
+-	int i = 0;
+-	while (pages[i] && nr_pages--) {
+-		put_page(pages[i]);
+-		i++;
+-	}
++	int i;
++
++	for (i = 0; i < nr_pages; i++)
++		if (pages[i])
++			put_page(pages[i]);
+ }
+ EXPORT_SYMBOL(p9_release_pages);
+ 
+diff --git a/net/core/dev.c b/net/core/dev.c
+index faebb39..7ddbb31 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3513,8 +3513,15 @@ ncls:
+ 		}
+ 	}
+ 
+-	if (vlan_tx_nonzero_tag_present(skb))
+-		skb->pkt_type = PACKET_OTHERHOST;
++	if (unlikely(vlan_tx_tag_present(skb))) {
++		if (vlan_tx_tag_get_id(skb))
++			skb->pkt_type = PACKET_OTHERHOST;
++		/* Note: we might in the future use prio bits
++		 * and set skb->priority like in vlan_do_receive()
++		 * For the time being, just ignore Priority Code Point
++		 */
++		skb->vlan_tci = 0;
++	}
+ 
+ 	/* deliver only exact match when indicated */
+ 	null_or_dev = deliver_exact ? skb->dev : NULL;
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 5c56b21..ce90b02 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -231,7 +231,7 @@ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
+ 				   we must kill timers etc. and move
+ 				   it to safe state.
+ 				 */
+-				skb_queue_purge(&n->arp_queue);
++				__skb_queue_purge(&n->arp_queue);
+ 				n->arp_queue_len_bytes = 0;
+ 				n->output = neigh_blackhole;
+ 				if (n->nud_state & NUD_VALID)
+@@ -286,7 +286,7 @@ static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device
+ 	if (!n)
+ 		goto out_entries;
+ 
+-	skb_queue_head_init(&n->arp_queue);
++	__skb_queue_head_init(&n->arp_queue);
+ 	rwlock_init(&n->lock);
+ 	seqlock_init(&n->ha_lock);
+ 	n->updated	  = n->used = now;
+@@ -708,7 +708,9 @@ void neigh_destroy(struct neighbour *neigh)
+ 	if (neigh_del_timer(neigh))
+ 		pr_warn("Impossible event\n");
+ 
+-	skb_queue_purge(&neigh->arp_queue);
++	write_lock_bh(&neigh->lock);
++	__skb_queue_purge(&neigh->arp_queue);
++	write_unlock_bh(&neigh->lock);
+ 	neigh->arp_queue_len_bytes = 0;
+ 
+ 	if (dev->netdev_ops->ndo_neigh_destroy)
+@@ -858,7 +860,7 @@ static void neigh_invalidate(struct neighbour *neigh)
+ 		neigh->ops->error_report(neigh, skb);
+ 		write_lock(&neigh->lock);
+ 	}
+-	skb_queue_purge(&neigh->arp_queue);
++	__skb_queue_purge(&neigh->arp_queue);
+ 	neigh->arp_queue_len_bytes = 0;
+ }
+ 
+@@ -1210,7 +1212,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ 
+ 			write_lock_bh(&neigh->lock);
+ 		}
+-		skb_queue_purge(&neigh->arp_queue);
++		__skb_queue_purge(&neigh->arp_queue);
+ 		neigh->arp_queue_len_bytes = 0;
+ 	}
+ out:
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 2a83591..855004f 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -503,10 +503,11 @@ static int ipgre_tunnel_ioctl(struct net_device *dev,
+ 
+ 	if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
+ 		return -EFAULT;
+-	if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE ||
+-	    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)) ||
+-	    ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING))) {
+-		return -EINVAL;
++	if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
++		if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE ||
++		    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)) ||
++		    ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING)))
++			return -EINVAL;
+ 	}
+ 	p.i_flags = gre_flags_to_tnl_flags(p.i_flags);
+ 	p.o_flags = gre_flags_to_tnl_flags(p.o_flags);
+diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
+index 3da817b..15e3e68 100644
+--- a/net/ipv4/ip_input.c
++++ b/net/ipv4/ip_input.c
+@@ -190,10 +190,7 @@ static int ip_local_deliver_finish(struct sk_buff *skb)
+ {
+ 	struct net *net = dev_net(skb->dev);
+ 
+-	__skb_pull(skb, ip_hdrlen(skb));
+-
+-	/* Point into the IP datagram, just past the header. */
+-	skb_reset_transport_header(skb);
++	__skb_pull(skb, skb_network_header_len(skb));
+ 
+ 	rcu_read_lock();
+ 	{
+@@ -437,6 +434,8 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
+ 		goto drop;
+ 	}
+ 
++	skb->transport_header = skb->network_header + iph->ihl*4;
++
+ 	/* Remove any debris in the socket control block */
+ 	memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+ 
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 7fa8f08..cbfc37f 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -486,6 +486,53 @@ drop:
+ }
+ EXPORT_SYMBOL_GPL(ip_tunnel_rcv);
+ 
++static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
++			    struct rtable *rt, __be16 df)
++{
++	struct ip_tunnel *tunnel = netdev_priv(dev);
++	int pkt_size = skb->len - tunnel->hlen - dev->hard_header_len;
++	int mtu;
++
++	if (df)
++		mtu = dst_mtu(&rt->dst) - dev->hard_header_len
++					- sizeof(struct iphdr) - tunnel->hlen;
++	else
++		mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
++
++	if (skb_dst(skb))
++		skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
++
++	if (skb->protocol == htons(ETH_P_IP)) {
++		if (!skb_is_gso(skb) &&
++		    (df & htons(IP_DF)) && mtu < pkt_size) {
++			icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
++			return -E2BIG;
++		}
++	}
++#if IS_ENABLED(CONFIG_IPV6)
++	else if (skb->protocol == htons(ETH_P_IPV6)) {
++		struct rt6_info *rt6 = (struct rt6_info *)skb_dst(skb);
++
++		if (rt6 && mtu < dst_mtu(skb_dst(skb)) &&
++			   mtu >= IPV6_MIN_MTU) {
++			if ((tunnel->parms.iph.daddr &&
++			    !ipv4_is_multicast(tunnel->parms.iph.daddr)) ||
++			    rt6->rt6i_dst.plen == 128) {
++				rt6->rt6i_flags |= RTF_MODIFIED;
++				dst_metric_set(skb_dst(skb), RTAX_MTU, mtu);
++			}
++		}
++
++		if (!skb_is_gso(skb) && mtu >= IPV6_MIN_MTU &&
++					mtu < pkt_size) {
++			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
++			return -E2BIG;
++		}
++	}
++#endif
++	return 0;
++}
++
+ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 		    const struct iphdr *tnl_params)
+ {
+@@ -499,7 +546,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 	struct net_device *tdev;	/* Device to other host */
+ 	unsigned int max_headroom;	/* The extra header space needed */
+ 	__be32 dst;
+-	int mtu;
+ 
+ 	inner_iph = (const struct iphdr *)skb_inner_network_header(skb);
+ 
+@@ -579,50 +625,11 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 		goto tx_error;
+ 	}
+ 
+-	df = tnl_params->frag_off;
+ 
+-	if (df)
+-		mtu = dst_mtu(&rt->dst) - dev->hard_header_len
+-					- sizeof(struct iphdr);
+-	else
+-		mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
+-
+-	if (skb_dst(skb))
+-		skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+-
+-	if (skb->protocol == htons(ETH_P_IP)) {
+-		df |= (inner_iph->frag_off&htons(IP_DF));
+-
+-		if (!skb_is_gso(skb) &&
+-		    (inner_iph->frag_off&htons(IP_DF)) &&
+-		     mtu < ntohs(inner_iph->tot_len)) {
+-			icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
+-			ip_rt_put(rt);
+-			goto tx_error;
+-		}
+-	}
+-#if IS_ENABLED(CONFIG_IPV6)
+-	else if (skb->protocol == htons(ETH_P_IPV6)) {
+-		struct rt6_info *rt6 = (struct rt6_info *)skb_dst(skb);
+-
+-		if (rt6 && mtu < dst_mtu(skb_dst(skb)) &&
+-		    mtu >= IPV6_MIN_MTU) {
+-			if ((tunnel->parms.iph.daddr &&
+-			    !ipv4_is_multicast(tunnel->parms.iph.daddr)) ||
+-			    rt6->rt6i_dst.plen == 128) {
+-				rt6->rt6i_flags |= RTF_MODIFIED;
+-				dst_metric_set(skb_dst(skb), RTAX_MTU, mtu);
+-			}
+-		}
+-
+-		if (!skb_is_gso(skb) && mtu >= IPV6_MIN_MTU &&
+-		    mtu < skb->len) {
+-			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+-			ip_rt_put(rt);
+-			goto tx_error;
+-		}
++	if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off)) {
++		ip_rt_put(rt);
++		goto tx_error;
+ 	}
+-#endif
+ 
+ 	if (tunnel->err_count > 0) {
+ 		if (time_before(jiffies,
+@@ -646,6 +653,10 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 			ttl = ip4_dst_hoplimit(&rt->dst);
+ 	}
+ 
++	df = tnl_params->frag_off;
++	if (skb->protocol == htons(ETH_P_IP))
++		df |= (inner_iph->frag_off&htons(IP_DF));
++
+ 	max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(struct iphdr)
+ 					       + rt->dst.header_len;
+ 	if (max_headroom > dev->needed_headroom) {
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index c118f6b..17cc0ff 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -606,17 +606,10 @@ static int __net_init vti_fb_tunnel_init(struct net_device *dev)
+ 	struct iphdr *iph = &tunnel->parms.iph;
+ 	struct vti_net *ipn = net_generic(dev_net(dev), vti_net_id);
+ 
+-	tunnel->dev = dev;
+-	strcpy(tunnel->parms.name, dev->name);
+-
+ 	iph->version		= 4;
+ 	iph->protocol		= IPPROTO_IPIP;
+ 	iph->ihl		= 5;
+ 
+-	dev->tstats = alloc_percpu(struct pcpu_tstats);
+-	if (!dev->tstats)
+-		return -ENOMEM;
+-
+ 	dev_hold(dev);
+ 	rcu_assign_pointer(ipn->tunnels_wc[0], tunnel);
+ 	return 0;
+diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
+index 77bfcce..7cfc456 100644
+--- a/net/ipv4/ipip.c
++++ b/net/ipv4/ipip.c
+@@ -240,11 +240,13 @@ ipip_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ 	if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
+ 		return -EFAULT;
+ 
+-	if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
+-			p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
+-		return -EINVAL;
+-	if (p.i_key || p.o_key || p.i_flags || p.o_flags)
+-		return -EINVAL;
++	if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
++		if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
++		    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
++			return -EINVAL;
++	}
++
++	p.i_key = p.o_key = p.i_flags = p.o_flags = 0;
+ 	if (p.iph.ttl)
+ 		p.iph.frag_off |= htons(IP_DF);
+ 
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 0bf5d39..93b731d 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -799,7 +799,7 @@ send:
+ /*
+  * Push out all pending data as one UDP datagram. Socket is locked.
+  */
+-static int udp_push_pending_frames(struct sock *sk)
++int udp_push_pending_frames(struct sock *sk)
+ {
+ 	struct udp_sock  *up = udp_sk(sk);
+ 	struct inet_sock *inet = inet_sk(sk);
+@@ -818,6 +818,7 @@ out:
+ 	up->pending = 0;
+ 	return err;
+ }
++EXPORT_SYMBOL(udp_push_pending_frames);
+ 
+ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+ 		size_t len)
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 4ab4c38..fb8c94c 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1448,6 +1448,23 @@ try_nextdev:
+ }
+ EXPORT_SYMBOL(ipv6_dev_get_saddr);
+ 
++int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
++		      unsigned char banned_flags)
++{
++	struct inet6_ifaddr *ifp;
++	int err = -EADDRNOTAVAIL;
++
++	list_for_each_entry(ifp, &idev->addr_list, if_list) {
++		if (ifp->scope == IFA_LINK &&
++		    !(ifp->flags & banned_flags)) {
++			*addr = ifp->addr;
++			err = 0;
++			break;
++		}
++	}
++	return err;
++}
++
+ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
+ 		    unsigned char banned_flags)
+ {
+@@ -1457,17 +1474,8 @@ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
+ 	rcu_read_lock();
+ 	idev = __in6_dev_get(dev);
+ 	if (idev) {
+-		struct inet6_ifaddr *ifp;
+-
+ 		read_lock_bh(&idev->lock);
+-		list_for_each_entry(ifp, &idev->addr_list, if_list) {
+-			if (ifp->scope == IFA_LINK &&
+-			    !(ifp->flags & banned_flags)) {
+-				*addr = ifp->addr;
+-				err = 0;
+-				break;
+-			}
+-		}
++		err = __ipv6_get_lladdr(idev, addr, banned_flags);
+ 		read_unlock_bh(&idev->lock);
+ 	}
+ 	rcu_read_unlock();
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index 192dd1a..5fc9c7a 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -632,6 +632,12 @@ insert_above:
+ 	return ln;
+ }
+ 
++static inline bool rt6_qualify_for_ecmp(struct rt6_info *rt)
++{
++	return (rt->rt6i_flags & (RTF_GATEWAY|RTF_ADDRCONF|RTF_DYNAMIC)) ==
++	       RTF_GATEWAY;
++}
++
+ /*
+  *	Insert routing information in a node.
+  */
+@@ -646,6 +652,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
+ 	int add = (!info->nlh ||
+ 		   (info->nlh->nlmsg_flags & NLM_F_CREATE));
+ 	int found = 0;
++	bool rt_can_ecmp = rt6_qualify_for_ecmp(rt);
+ 
+ 	ins = &fn->leaf;
+ 
+@@ -691,9 +698,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
+ 			 * To avoid long list, we only had siblings if the
+ 			 * route have a gateway.
+ 			 */
+-			if (rt->rt6i_flags & RTF_GATEWAY &&
+-			    !(rt->rt6i_flags & RTF_EXPIRES) &&
+-			    !(iter->rt6i_flags & RTF_EXPIRES))
++			if (rt_can_ecmp &&
++			    rt6_qualify_for_ecmp(iter))
+ 				rt->rt6i_nsiblings++;
+ 		}
+ 
+@@ -715,7 +721,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
+ 		/* Find the first route that have the same metric */
+ 		sibling = fn->leaf;
+ 		while (sibling) {
+-			if (sibling->rt6i_metric == rt->rt6i_metric) {
++			if (sibling->rt6i_metric == rt->rt6i_metric &&
++			    rt6_qualify_for_ecmp(sibling)) {
+ 				list_add_tail(&rt->rt6i_siblings,
+ 					      &sibling->rt6i_siblings);
+ 				break;
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index d5d20cd..6e3ddf8 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1098,11 +1098,12 @@ static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
+ 	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+ }
+ 
+-static void ip6_append_data_mtu(int *mtu,
++static void ip6_append_data_mtu(unsigned int *mtu,
+ 				int *maxfraglen,
+ 				unsigned int fragheaderlen,
+ 				struct sk_buff *skb,
+-				struct rt6_info *rt)
++				struct rt6_info *rt,
++				bool pmtuprobe)
+ {
+ 	if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
+ 		if (skb == NULL) {
+@@ -1114,7 +1115,9 @@ static void ip6_append_data_mtu(int *mtu,
+ 			 * this fragment is not first, the headers
+ 			 * space is regarded as data space.
+ 			 */
+-			*mtu = dst_mtu(rt->dst.path);
++			*mtu = min(*mtu, pmtuprobe ?
++				   rt->dst.dev->mtu :
++				   dst_mtu(rt->dst.path));
+ 		}
+ 		*maxfraglen = ((*mtu - fragheaderlen) & ~7)
+ 			      + fragheaderlen - sizeof(struct frag_hdr);
+@@ -1131,11 +1134,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+ 	struct ipv6_pinfo *np = inet6_sk(sk);
+ 	struct inet_cork *cork;
+ 	struct sk_buff *skb, *skb_prev = NULL;
+-	unsigned int maxfraglen, fragheaderlen;
++	unsigned int maxfraglen, fragheaderlen, mtu;
+ 	int exthdrlen;
+ 	int dst_exthdrlen;
+ 	int hh_len;
+-	int mtu;
+ 	int copy;
+ 	int err;
+ 	int offset = 0;
+@@ -1292,7 +1294,9 @@ alloc_new_skb:
+ 			/* update mtu and maxfraglen if necessary */
+ 			if (skb == NULL || skb_prev == NULL)
+ 				ip6_append_data_mtu(&mtu, &maxfraglen,
+-						    fragheaderlen, skb, rt);
++						    fragheaderlen, skb, rt,
++						    np->pmtudisc ==
++						    IPV6_PMTUDISC_PROBE);
+ 
+ 			skb_prev = skb;
+ 
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index bfa6cc3..c3998c2 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -1343,8 +1343,9 @@ static void ip6_mc_hdr(struct sock *sk, struct sk_buff *skb,
+ 	hdr->daddr = *daddr;
+ }
+ 
+-static struct sk_buff *mld_newpack(struct net_device *dev, int size)
++static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
+ {
++	struct net_device *dev = idev->dev;
+ 	struct net *net = dev_net(dev);
+ 	struct sock *sk = net->ipv6.igmp_sk;
+ 	struct sk_buff *skb;
+@@ -1369,7 +1370,7 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
+ 
+ 	skb_reserve(skb, hlen);
+ 
+-	if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
++	if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
+ 		/* <draft-ietf-magma-mld-source-05.txt>:
+ 		 * use unspecified address as the source address
+ 		 * when a valid link-local address is not available.
+@@ -1465,7 +1466,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
+ 	struct mld2_grec *pgr;
+ 
+ 	if (!skb)
+-		skb = mld_newpack(dev, dev->mtu);
++		skb = mld_newpack(pmc->idev, dev->mtu);
+ 	if (!skb)
+ 		return NULL;
+ 	pgr = (struct mld2_grec *)skb_put(skb, sizeof(struct mld2_grec));
+@@ -1485,7 +1486,8 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
+ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
+ 	int type, int gdeleted, int sdeleted)
+ {
+-	struct net_device *dev = pmc->idev->dev;
++	struct inet6_dev *idev = pmc->idev;
++	struct net_device *dev = idev->dev;
+ 	struct mld2_report *pmr;
+ 	struct mld2_grec *pgr = NULL;
+ 	struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list;
+@@ -1514,7 +1516,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
+ 		    AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
+ 			if (skb)
+ 				mld_sendpack(skb);
+-			skb = mld_newpack(dev, dev->mtu);
++			skb = mld_newpack(idev, dev->mtu);
+ 		}
+ 	}
+ 	first = 1;
+@@ -1541,7 +1543,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
+ 				pgr->grec_nsrcs = htons(scount);
+ 			if (skb)
+ 				mld_sendpack(skb);
+-			skb = mld_newpack(dev, dev->mtu);
++			skb = mld_newpack(idev, dev->mtu);
+ 			first = 1;
+ 			scount = 0;
+ 		}
+@@ -1596,8 +1598,8 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
+ 	struct sk_buff *skb = NULL;
+ 	int type;
+ 
++	read_lock_bh(&idev->lock);
+ 	if (!pmc) {
+-		read_lock_bh(&idev->lock);
+ 		for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
+ 			if (pmc->mca_flags & MAF_NOREPORT)
+ 				continue;
+@@ -1609,7 +1611,6 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
+ 			skb = add_grec(skb, pmc, type, 0, 0);
+ 			spin_unlock_bh(&pmc->mca_lock);
+ 		}
+-		read_unlock_bh(&idev->lock);
+ 	} else {
+ 		spin_lock_bh(&pmc->mca_lock);
+ 		if (pmc->mca_sfcount[MCAST_EXCLUDE])
+@@ -1619,6 +1620,7 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
+ 		skb = add_grec(skb, pmc, type, 0, 0);
+ 		spin_unlock_bh(&pmc->mca_lock);
+ 	}
++	read_unlock_bh(&idev->lock);
+ 	if (skb)
+ 		mld_sendpack(skb);
+ }
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index ad0aa6b..bacce6c 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -65,6 +65,12 @@
+ #include <linux/sysctl.h>
+ #endif
+ 
++enum rt6_nud_state {
++	RT6_NUD_FAIL_HARD = -2,
++	RT6_NUD_FAIL_SOFT = -1,
++	RT6_NUD_SUCCEED = 1
++};
++
+ static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
+ 				    const struct in6_addr *dest);
+ static struct dst_entry	*ip6_dst_check(struct dst_entry *dst, u32 cookie);
+@@ -527,26 +533,29 @@ static inline int rt6_check_dev(struct rt6_info *rt, int oif)
+ 	return 0;
+ }
+ 
+-static inline bool rt6_check_neigh(struct rt6_info *rt)
++static inline enum rt6_nud_state rt6_check_neigh(struct rt6_info *rt)
+ {
+ 	struct neighbour *neigh;
+-	bool ret = false;
++	enum rt6_nud_state ret = RT6_NUD_FAIL_HARD;
+ 
+ 	if (rt->rt6i_flags & RTF_NONEXTHOP ||
+ 	    !(rt->rt6i_flags & RTF_GATEWAY))
+-		return true;
++		return RT6_NUD_SUCCEED;
+ 
+ 	rcu_read_lock_bh();
+ 	neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
+ 	if (neigh) {
+ 		read_lock(&neigh->lock);
+ 		if (neigh->nud_state & NUD_VALID)
+-			ret = true;
++			ret = RT6_NUD_SUCCEED;
+ #ifdef CONFIG_IPV6_ROUTER_PREF
+ 		else if (!(neigh->nud_state & NUD_FAILED))
+-			ret = true;
++			ret = RT6_NUD_SUCCEED;
+ #endif
+ 		read_unlock(&neigh->lock);
++	} else {
++		ret = IS_ENABLED(CONFIG_IPV6_ROUTER_PREF) ?
++		      RT6_NUD_SUCCEED : RT6_NUD_FAIL_SOFT;
+ 	}
+ 	rcu_read_unlock_bh();
+ 
+@@ -560,43 +569,52 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
+ 
+ 	m = rt6_check_dev(rt, oif);
+ 	if (!m && (strict & RT6_LOOKUP_F_IFACE))
+-		return -1;
++		return RT6_NUD_FAIL_HARD;
+ #ifdef CONFIG_IPV6_ROUTER_PREF
+ 	m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
+ #endif
+-	if (!rt6_check_neigh(rt) && (strict & RT6_LOOKUP_F_REACHABLE))
+-		return -1;
++	if (strict & RT6_LOOKUP_F_REACHABLE) {
++		int n = rt6_check_neigh(rt);
++		if (n < 0)
++			return n;
++	}
+ 	return m;
+ }
+ 
+ static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
+-				   int *mpri, struct rt6_info *match)
++				   int *mpri, struct rt6_info *match,
++				   bool *do_rr)
+ {
+ 	int m;
++	bool match_do_rr = false;
+ 
+ 	if (rt6_check_expired(rt))
+ 		goto out;
+ 
+ 	m = rt6_score_route(rt, oif, strict);
+-	if (m < 0)
++	if (m == RT6_NUD_FAIL_SOFT && !IS_ENABLED(CONFIG_IPV6_ROUTER_PREF)) {
++		match_do_rr = true;
++		m = 0; /* lowest valid score */
++	} else if (m < 0) {
+ 		goto out;
++	}
++
++	if (strict & RT6_LOOKUP_F_REACHABLE)
++		rt6_probe(rt);
+ 
+ 	if (m > *mpri) {
+-		if (strict & RT6_LOOKUP_F_REACHABLE)
+-			rt6_probe(match);
++		*do_rr = match_do_rr;
+ 		*mpri = m;
+ 		match = rt;
+-	} else if (strict & RT6_LOOKUP_F_REACHABLE) {
+-		rt6_probe(rt);
+ 	}
+-
+ out:
+ 	return match;
+ }
+ 
+ static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
+ 				     struct rt6_info *rr_head,
+-				     u32 metric, int oif, int strict)
++				     u32 metric, int oif, int strict,
++				     bool *do_rr)
+ {
+ 	struct rt6_info *rt, *match;
+ 	int mpri = -1;
+@@ -604,10 +622,10 @@ static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
+ 	match = NULL;
+ 	for (rt = rr_head; rt && rt->rt6i_metric == metric;
+ 	     rt = rt->dst.rt6_next)
+-		match = find_match(rt, oif, strict, &mpri, match);
++		match = find_match(rt, oif, strict, &mpri, match, do_rr);
+ 	for (rt = fn->leaf; rt && rt != rr_head && rt->rt6i_metric == metric;
+ 	     rt = rt->dst.rt6_next)
+-		match = find_match(rt, oif, strict, &mpri, match);
++		match = find_match(rt, oif, strict, &mpri, match, do_rr);
+ 
+ 	return match;
+ }
+@@ -616,15 +634,16 @@ static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
+ {
+ 	struct rt6_info *match, *rt0;
+ 	struct net *net;
++	bool do_rr = false;
+ 
+ 	rt0 = fn->rr_ptr;
+ 	if (!rt0)
+ 		fn->rr_ptr = rt0 = fn->leaf;
+ 
+-	match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict);
++	match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict,
++			     &do_rr);
+ 
+-	if (!match &&
+-	    (strict & RT6_LOOKUP_F_REACHABLE)) {
++	if (do_rr) {
+ 		struct rt6_info *next = rt0->dst.rt6_next;
+ 
+ 		/* no entries matched; do round-robin */
+@@ -1074,10 +1093,13 @@ static void ip6_link_failure(struct sk_buff *skb)
+ 
+ 	rt = (struct rt6_info *) skb_dst(skb);
+ 	if (rt) {
+-		if (rt->rt6i_flags & RTF_CACHE)
+-			rt6_update_expires(rt, 0);
+-		else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT))
++		if (rt->rt6i_flags & RTF_CACHE) {
++			dst_hold(&rt->dst);
++			if (ip6_del_rt(rt))
++				dst_free(&rt->dst);
++		} else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT)) {
+ 			rt->rt6i_node->fn_sernum = -1;
++		}
+ 	}
+ }
+ 
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 3353634..60df36d 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -589,7 +589,7 @@ static int ipip6_rcv(struct sk_buff *skb)
+ 				tunnel->dev->stats.rx_errors++;
+ 				goto out;
+ 			}
+-		} else {
++		} else if (!(tunnel->dev->flags&IFF_POINTOPOINT)) {
+ 			if (is_spoofed_6rd(tunnel, iph->saddr,
+ 					   &ipv6_hdr(skb)->saddr) ||
+ 			    is_spoofed_6rd(tunnel, iph->daddr,
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 42923b1..e7b28f9 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -955,11 +955,16 @@ static int udp_v6_push_pending_frames(struct sock *sk)
+ 	struct udphdr *uh;
+ 	struct udp_sock  *up = udp_sk(sk);
+ 	struct inet_sock *inet = inet_sk(sk);
+-	struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
++	struct flowi6 *fl6;
+ 	int err = 0;
+ 	int is_udplite = IS_UDPLITE(sk);
+ 	__wsum csum = 0;
+ 
++	if (up->pending == AF_INET)
++		return udp_push_pending_frames(sk);
++
++	fl6 = &inet->cork.fl.u.ip6;
++
+ 	/* Grab the skbuff where UDP header space exists. */
+ 	if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
+ 		goto out;
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 8dec687..5ebee2d 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -1793,7 +1793,8 @@ static const struct proto_ops pppol2tp_ops = {
+ 
+ static const struct pppox_proto pppol2tp_proto = {
+ 	.create		= pppol2tp_create,
+-	.ioctl		= pppol2tp_ioctl
++	.ioctl		= pppol2tp_ioctl,
++	.owner		= THIS_MODULE,
+ };
+ 
+ #ifdef CONFIG_L2TP_V3
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index d51852b..5792252 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -113,7 +113,6 @@
+ 
+ #define FRAC_BITS		30	/* fixed point arithmetic */
+ #define ONE_FP			(1UL << FRAC_BITS)
+-#define IWSUM			(ONE_FP/QFQ_MAX_WSUM)
+ 
+ #define QFQ_MTU_SHIFT		16	/* to support TSO/GSO */
+ #define QFQ_MIN_LMAX		512	/* see qfq_slot_insert */
+@@ -189,6 +188,7 @@ struct qfq_sched {
+ 	struct qfq_aggregate	*in_serv_agg;   /* Aggregate being served. */
+ 	u32			num_active_agg; /* Num. of active aggregates */
+ 	u32			wsum;		/* weight sum */
++	u32			iwsum;		/* inverse weight sum */
+ 
+ 	unsigned long bitmaps[QFQ_MAX_STATE];	    /* Group bitmaps. */
+ 	struct qfq_group groups[QFQ_MAX_INDEX + 1]; /* The groups. */
+@@ -314,6 +314,7 @@ static void qfq_update_agg(struct qfq_sched *q, struct qfq_aggregate *agg,
+ 
+ 	q->wsum +=
+ 		(int) agg->class_weight * (new_num_classes - agg->num_classes);
++	q->iwsum = ONE_FP / q->wsum;
+ 
+ 	agg->num_classes = new_num_classes;
+ }
+@@ -340,6 +341,10 @@ static void qfq_destroy_agg(struct qfq_sched *q, struct qfq_aggregate *agg)
+ {
+ 	if (!hlist_unhashed(&agg->nonfull_next))
+ 		hlist_del_init(&agg->nonfull_next);
++	q->wsum -= agg->class_weight;
++	if (q->wsum != 0)
++		q->iwsum = ONE_FP / q->wsum;
++
+ 	if (q->in_serv_agg == agg)
+ 		q->in_serv_agg = qfq_choose_next_agg(q);
+ 	kfree(agg);
+@@ -827,38 +832,60 @@ static void qfq_make_eligible(struct qfq_sched *q)
+ 	}
+ }
+ 
+-
+ /*
+- * The index of the slot in which the aggregate is to be inserted must
+- * not be higher than QFQ_MAX_SLOTS-2. There is a '-2' and not a '-1'
+- * because the start time of the group may be moved backward by one
+- * slot after the aggregate has been inserted, and this would cause
+- * non-empty slots to be right-shifted by one position.
++ * The index of the slot in which the input aggregate agg is to be
++ * inserted must not be higher than QFQ_MAX_SLOTS-2. There is a '-2'
++ * and not a '-1' because the start time of the group may be moved
++ * backward by one slot after the aggregate has been inserted, and
++ * this would cause non-empty slots to be right-shifted by one
++ * position.
++ *
++ * QFQ+ fully satisfies this bound to the slot index if the parameters
++ * of the classes are not changed dynamically, and if QFQ+ never
++ * happens to postpone the service of agg unjustly, i.e., it never
++ * happens that the aggregate becomes backlogged and eligible, or just
++ * eligible, while an aggregate with a higher approximated finish time
++ * is being served. In particular, in this case QFQ+ guarantees that
++ * the timestamps of agg are low enough that the slot index is never
++ * higher than 2. Unfortunately, QFQ+ cannot provide the same
++ * guarantee if it happens to unjustly postpone the service of agg, or
++ * if the parameters of some class are changed.
++ *
++ * As for the first event, i.e., an out-of-order service, the
++ * upper bound to the slot index guaranteed by QFQ+ grows to
++ * 2 +
++ * QFQ_MAX_AGG_CLASSES * ((1<<QFQ_MTU_SHIFT)/QFQ_MIN_LMAX) *
++ * (current_max_weight/current_wsum) <= 2 + 8 * 128 * 1.
+  *
+- * If the weight and lmax (max_pkt_size) of the classes do not change,
+- * then QFQ+ does meet the above contraint according to the current
+- * values of its parameters. In fact, if the weight and lmax of the
+- * classes do not change, then, from the theory, QFQ+ guarantees that
+- * the slot index is never higher than
+- * 2 + QFQ_MAX_AGG_CLASSES * ((1<<QFQ_MTU_SHIFT)/QFQ_MIN_LMAX) *
+- * (QFQ_MAX_WEIGHT/QFQ_MAX_WSUM) = 2 + 8 * 128 * (1 / 64) = 18
++ * The following function deals with this problem by backward-shifting
++ * the timestamps of agg, if needed, so as to guarantee that the slot
++ * index is never higher than QFQ_MAX_SLOTS-2. This backward-shift may
++ * cause the service of other aggregates to be postponed, yet the
++ * worst-case guarantees of these aggregates are not violated.  In
++ * fact, in case of no out-of-order service, the timestamps of agg
++ * would have been even lower than they are after the backward shift,
++ * because QFQ+ would have guaranteed a maximum value equal to 2 for
++ * the slot index, and 2 < QFQ_MAX_SLOTS-2. Hence the aggregates whose
++ * service is postponed because of the backward-shift would have
++ * however waited for the service of agg before being served.
+  *
+- * When the weight of a class is increased or the lmax of the class is
+- * decreased, a new aggregate with smaller slot size than the original
+- * parent aggregate of the class may happen to be activated. The
+- * activation of this aggregate should be properly delayed to when the
+- * service of the class has finished in the ideal system tracked by
+- * QFQ+. If the activation of the aggregate is not delayed to this
+- * reference time instant, then this aggregate may be unjustly served
+- * before other aggregates waiting for service. This may cause the
+- * above bound to the slot index to be violated for some of these
+- * unlucky aggregates.
++ * The other event that may cause the slot index to be higher than 2
++ * for agg is a recent change of the parameters of some class. If the
++ * weight of a class is increased or the lmax (max_pkt_size) of the
++ * class is decreased, then a new aggregate with smaller slot size
++ * than the original parent aggregate of the class may happen to be
++ * activated. The activation of this aggregate should be properly
++ * delayed to when the service of the class has finished in the ideal
++ * system tracked by QFQ+. If the activation of the aggregate is not
++ * delayed to this reference time instant, then this aggregate may be
++ * unjustly served before other aggregates waiting for service. This
++ * may cause the above bound to the slot index to be violated for some
++ * of these unlucky aggregates.
+  *
+  * Instead of delaying the activation of the new aggregate, which is
+- * quite complex, the following inaccurate but simple solution is used:
+- * if the slot index is higher than QFQ_MAX_SLOTS-2, then the
+- * timestamps of the aggregate are shifted backward so as to let the
+- * slot index become equal to QFQ_MAX_SLOTS-2.
++ * quite complex, the above-discussed capping of the slot index is
++ * used to handle also the consequences of a change of the parameters
++ * of a class.
+  */
+ static void qfq_slot_insert(struct qfq_group *grp, struct qfq_aggregate *agg,
+ 			    u64 roundedS)
+@@ -1077,7 +1104,7 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
+ 	else
+ 		in_serv_agg->budget -= len;
+ 
+-	q->V += (u64)len * IWSUM;
++	q->V += (u64)len * q->iwsum;
+ 	pr_debug("qfq dequeue: len %u F %lld now %lld\n",
+ 		 len, (unsigned long long) in_serv_agg->F,
+ 		 (unsigned long long) q->V);
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 37ca969..22c88d2 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -1583,11 +1583,11 @@ out_cud_release:
+ 	case SIOCX25CALLACCPTAPPRV: {
+ 		rc = -EINVAL;
+ 		lock_sock(sk);
+-		if (sk->sk_state != TCP_CLOSE)
+-			break;
+-		clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
++		if (sk->sk_state == TCP_CLOSE) {
++			clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
++			rc = 0;
++		}
+ 		release_sock(sk);
+-		rc = 0;
+ 		break;
+ 	}
+ 
+@@ -1595,14 +1595,15 @@ out_cud_release:
+ 		rc = -EINVAL;
+ 		lock_sock(sk);
+ 		if (sk->sk_state != TCP_ESTABLISHED)
+-			break;
++			goto out_sendcallaccpt_release;
+ 		/* must call accptapprv above */
+ 		if (test_bit(X25_ACCPT_APPRV_FLAG, &x25->flags))
+-			break;
++			goto out_sendcallaccpt_release;
+ 		x25_write_internal(sk, X25_CALL_ACCEPTED);
+ 		x25->state = X25_STATE_3;
+-		release_sock(sk);
+ 		rc = 0;
++out_sendcallaccpt_release:
++		release_sock(sk);
+ 		break;
+ 	}
+ 
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 1d9d642..e849e1e 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -417,9 +417,11 @@ static void stac_update_outputs(struct hda_codec *codec)
+ 			val &= ~spec->eapd_mask;
+ 		else
+ 			val |= spec->eapd_mask;
+-		if (spec->gpio_data != val)
++		if (spec->gpio_data != val) {
++			spec->gpio_data = val;
+ 			stac_gpio_set(codec, spec->gpio_mask, spec->gpio_dir,
+ 				      val);
++		}
+ 	}
+ }
+ 
+@@ -3227,7 +3229,7 @@ static const struct hda_fixup stac927x_fixups[] = {
+ 			/* configure the analog microphone on some laptops */
+ 			{ 0x0c, 0x90a79130 },
+ 			/* correct the front output jack as a hp out */
+-			{ 0x0f, 0x0227011f },
++			{ 0x0f, 0x0221101f },
+ 			/* correct the front input jack as a mic */
+ 			{ 0x0e, 0x02a79130 },
+ 			{}
+@@ -3608,20 +3610,18 @@ static int stac_parse_auto_config(struct hda_codec *codec)
+ static int stac_init(struct hda_codec *codec)
+ {
+ 	struct sigmatel_spec *spec = codec->spec;
+-	unsigned int gpio;
+ 	int i;
+ 
+ 	/* override some hints */
+ 	stac_store_hints(codec);
+ 
+ 	/* set up GPIO */
+-	gpio = spec->gpio_data;
+ 	/* turn on EAPD statically when spec->eapd_switch isn't set.
+ 	 * otherwise, unsol event will turn it on/off dynamically
+ 	 */
+ 	if (!spec->eapd_switch)
+-		gpio |= spec->eapd_mask;
+-	stac_gpio_set(codec, spec->gpio_mask, spec->gpio_dir, gpio);
++		spec->gpio_data |= spec->eapd_mask;
++	stac_gpio_set(codec, spec->gpio_mask, spec->gpio_dir, spec->gpio_data);
+ 
+ 	snd_hda_gen_init(codec);
+ 
+@@ -3921,6 +3921,7 @@ static void stac_setup_gpio(struct hda_codec *codec)
+ {
+ 	struct sigmatel_spec *spec = codec->spec;
+ 
++	spec->gpio_mask |= spec->eapd_mask;
+ 	if (spec->gpio_led) {
+ 		if (!spec->vref_mute_led_nid) {
+ 			spec->gpio_mask |= spec->gpio_led;
+diff --git a/sound/usb/6fire/pcm.c b/sound/usb/6fire/pcm.c
+index 8221ff2..074aaf7 100644
+--- a/sound/usb/6fire/pcm.c
++++ b/sound/usb/6fire/pcm.c
+@@ -543,7 +543,7 @@ static snd_pcm_uframes_t usb6fire_pcm_pointer(
+ 	snd_pcm_uframes_t ret;
+ 
+ 	if (rt->panic || !sub)
+-		return SNDRV_PCM_STATE_XRUN;
++		return SNDRV_PCM_POS_XRUN;
+ 
+ 	spin_lock_irqsave(&sub->lock, flags);
+ 	ret = sub->dma_off;