271 files changed, 2490 insertions, 1325 deletions
diff --git a/.gitignore b/.gitignore
index 3b8b9b33be38..7e9932e55475 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,6 +29,7 @@ modules.builtin
 *.bz2
 *.lzma
 *.xz
+*.lz4
 *.lzo
 *.patch
 *.gcno
diff --git a/Documentation/DocBook/device-drivers.tmpl b/Documentation/DocBook/device-drivers.tmpl
index cbfdf5486639..fe397f90a34f 100644
--- a/Documentation/DocBook/device-drivers.tmpl
+++ b/Documentation/DocBook/device-drivers.tmpl
@@ -84,7 +84,7 @@ X!Iinclude/linux/kobject.h
     <sect1><title>Kernel utility functions</title>
 !Iinclude/linux/kernel.h
-!Ekernel/printk.c
+!Ekernel/printk/printk.c
 !Ekernel/panic.c
 !Ekernel/sys.c
 !Ekernel/rcupdate.c
diff --git a/MAINTAINERS b/MAINTAINERS
index a26b10e52aea..d83f70ffdbed 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2871,7 +2871,7 @@ F:	drivers/media/usb/dvb-usb-v2/dvb_usb*
 F:      drivers/media/usb/dvb-usb-v2/usb_urb.c
 DYNAMIC DEBUG
-M:      Jason Baron <jbaron@redhat.com>
+M:      Jason Baron <jbaron@akamai.com>
 S:      Maintained
 F:      lib/dynamic_debug.c
 F:      include/linux/dynamic_debug.h
diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h
index 8943c028d4bb..df57611652e5 100644
--- a/arch/arc/include/asm/entry.h
+++ b/arch/arc/include/asm/entry.h
@@ -38,6 +38,7 @@
 #include <asm/ptrace.h>
 #include <asm/processor.h>      /* For VMALLOC_START */
 #include <asm/thread_info.h>    /* For THREAD_SIZE */
+#include <asm/mmu.h>
 /* Note on the LD/ST addr modes with addr reg wback
 *
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 37c0f4e978d4..43594d5116ef 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -20,7 +20,6 @@ config ARM
        select GENERIC_STRNCPY_FROM_USER
        select GENERIC_STRNLEN_USER
        select HARDIRQS_SW_RESEND
-        select HAVE_AOUT
        select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL
        select HAVE_ARCH_KGDB
        select HAVE_ARCH_SECCOMP_FILTER
@@ -218,7 +217,8 @@ config VECTORS_BASE
        default DRAM_BASE if REMAP_VECTORS_TO_RAM
        default 0x00000000
        help
-          The base address of exception vectors.
+          The base address of exception vectors.  This must be two pages
+          in size.
 config ARM_PATCH_PHYS_VIRT
        bool "Patch physical to virtual translations at runtime" if EMBEDDED
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index e401a766c0bd..583f4a00ec32 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -804,9 +804,19 @@ config DEBUG_LL_INCLUDE
 config DEBUG_UNCOMPRESS
        bool
-        default y if ARCH_MULTIPLATFORM && DEBUG_LL && \
+        depends on ARCH_MULTIPLATFORM
-                     !DEBUG_OMAP2PLUS_UART && \
+        default y if DEBUG_LL && !DEBUG_OMAP2PLUS_UART && \
                     !DEBUG_TEGRA_UART
+        help
+          This option influences the normal decompressor output for
+          multiplatform kernels.  Normally, multiplatform kernels disable
+          decompressor output because it is not possible to know where to
+          send the decompressor output.
+          When this option is set, the selected DEBUG_LL output method
+          will be re-used for normal decompressor output on multiplatform
+          kernels.
+          
 config UNCOMPRESS_INCLUDE
        string
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index c0ac0f5e5e5c..6fd2ceae305a 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -153,6 +153,7 @@ machine-$(CONFIG_ARCH_DAVINCI)		+= davinci
 machine-$(CONFIG_ARCH_DOVE)             += dove
 machine-$(CONFIG_ARCH_EBSA110)          += ebsa110
 machine-$(CONFIG_ARCH_EP93XX)           += ep93xx
+machine-$(CONFIG_ARCH_EXYNOS)           += exynos
 machine-$(CONFIG_ARCH_GEMINI)           += gemini
 machine-$(CONFIG_ARCH_HIGHBANK)         += highbank
 machine-$(CONFIG_ARCH_INTEGRATOR)       += integrator
@@ -160,15 +161,16 @@ machine-$(CONFIG_ARCH_IOP13XX)		+= iop13xx
 machine-$(CONFIG_ARCH_IOP32X)           += iop32x
 machine-$(CONFIG_ARCH_IOP33X)           += iop33x
 machine-$(CONFIG_ARCH_IXP4XX)           += ixp4xx
+machine-$(CONFIG_ARCH_KEYSTONE)         += keystone
 machine-$(CONFIG_ARCH_KIRKWOOD)         += kirkwood
 machine-$(CONFIG_ARCH_KS8695)           += ks8695
 machine-$(CONFIG_ARCH_LPC32XX)          += lpc32xx
 machine-$(CONFIG_ARCH_MMP)              += mmp
 machine-$(CONFIG_ARCH_MSM)              += msm
 machine-$(CONFIG_ARCH_MV78XX0)          += mv78xx0
+machine-$(CONFIG_ARCH_MVEBU)            += mvebu
 machine-$(CONFIG_ARCH_MXC)              += imx
 machine-$(CONFIG_ARCH_MXS)              += mxs
-machine-$(CONFIG_ARCH_MVEBU)            += mvebu
 machine-$(CONFIG_ARCH_NETX)             += netx
 machine-$(CONFIG_ARCH_NOMADIK)          += nomadik
 machine-$(CONFIG_ARCH_NSPIRE)           += nspire
@@ -176,7 +178,6 @@ machine-$(CONFIG_ARCH_OMAP1)		+= omap1
 machine-$(CONFIG_ARCH_OMAP2PLUS)        += omap2
 machine-$(CONFIG_ARCH_ORION5X)          += orion5x
 machine-$(CONFIG_ARCH_PICOXCELL)        += picoxcell
-machine-$(CONFIG_ARCH_SIRF)             += prima2
 machine-$(CONFIG_ARCH_PXA)              += pxa
 machine-$(CONFIG_ARCH_REALVIEW)         += realview
 machine-$(CONFIG_ARCH_ROCKCHIP)         += rockchip
@@ -186,25 +187,24 @@ machine-$(CONFIG_ARCH_S3C64XX)		+= s3c64xx
 machine-$(CONFIG_ARCH_S5P64X0)          += s5p64x0
 machine-$(CONFIG_ARCH_S5PC100)          += s5pc100
 machine-$(CONFIG_ARCH_S5PV210)          += s5pv210
-machine-$(CONFIG_ARCH_EXYNOS)           += exynos
 machine-$(CONFIG_ARCH_SA1100)           += sa1100
 machine-$(CONFIG_ARCH_SHARK)            += shark
 machine-$(CONFIG_ARCH_SHMOBILE)         += shmobile
+machine-$(CONFIG_ARCH_SIRF)             += prima2
+machine-$(CONFIG_ARCH_SOCFPGA)          += socfpga
+machine-$(CONFIG_ARCH_STI)              += sti
+machine-$(CONFIG_ARCH_SUNXI)            += sunxi
 machine-$(CONFIG_ARCH_TEGRA)            += tegra
 machine-$(CONFIG_ARCH_U300)             += u300
 machine-$(CONFIG_ARCH_U8500)            += ux500
 machine-$(CONFIG_ARCH_VERSATILE)        += versatile
 machine-$(CONFIG_ARCH_VEXPRESS)         += vexpress
+machine-$(CONFIG_ARCH_VIRT)             += virt
 machine-$(CONFIG_ARCH_VT8500)           += vt8500
 machine-$(CONFIG_ARCH_W90X900)          += w90x900
+machine-$(CONFIG_ARCH_ZYNQ)             += zynq
 machine-$(CONFIG_FOOTBRIDGE)            += footbridge
-machine-$(CONFIG_ARCH_SOCFPGA)          += socfpga
 machine-$(CONFIG_PLAT_SPEAR)            += spear
-machine-$(CONFIG_ARCH_STI)              += sti
-machine-$(CONFIG_ARCH_VIRT)             += virt
-machine-$(CONFIG_ARCH_ZYNQ)             += zynq
-machine-$(CONFIG_ARCH_SUNXI)            += sunxi
-machine-$(CONFIG_ARCH_KEYSTONE)         += keystone
 # Platform directory name.  This list is sorted alphanumerically
 # by CONFIG_* macro name.
diff --git a/arch/arm/include/asm/a.out-core.h b/arch/arm/include/asm/a.out-core.h
deleted file mode 100644
index 92f10cb5c70c..000000000000
--- a/arch/arm/include/asm/a.out-core.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/* a.out coredump register dumper
- *
- * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public Licence
- * as published by the Free Software Foundation; either version
- * 2 of the Licence, or (at your option) any later version.
- */
-#ifndef _ASM_A_OUT_CORE_H
-#define _ASM_A_OUT_CORE_H
-#ifdef __KERNEL__
-#include <linux/user.h>
-#include <linux/elfcore.h>
-/*
- * fill in the user structure for an a.out core dump
- */
-static inline void aout_dump_thread(struct pt_regs *regs, struct user *dump)
-{
-        struct task_struct *tsk = current;
-        dump->magic = CMAGIC;
-        dump->start_code = tsk->mm->start_code;
-        dump->start_stack = regs->ARM_sp & ~(PAGE_SIZE - 1);
-        dump->u_tsize = (tsk->mm->end_code - tsk->mm->start_code) >> PAGE_SHIFT;
-        dump->u_dsize = (tsk->mm->brk - tsk->mm->start_data + PAGE_SIZE - 1) >> PAGE_SHIFT;
-        dump->u_ssize = 0;
-        memset(dump->u_debugreg, 0, sizeof(dump->u_debugreg));
-        if (dump->start_stack < 0x04000000)
-                dump->u_ssize = (0x04000000 - dump->start_stack) >> PAGE_SHIFT;
-        dump->regs = *regs;
-        dump->u_fpvalid = dump_fpu (regs, &dump->u_fp);
-}
-#endif /* __KERNEL__ */
-#endif /* _ASM_A_OUT_CORE_H */
diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
index 8c25dc4e9851..9672e978d50d 100644
--- a/arch/arm/include/asm/cputype.h
+++ b/arch/arm/include/asm/cputype.h
@@ -89,13 +89,18 @@ extern unsigned int processor_id;
                __val;                                                  \
        })
+/*
+ * The memory clobber prevents gcc 4.5 from reordering the mrc before
+ * any is_smp() tests, which can cause undefined instruction aborts on
+ * ARM1136 r0 due to the missing extended CP15 registers.
+ */
 #define read_cpuid_ext(ext_reg)                                         \
        ({                                                              \
                unsigned int __val;                                     \
                asm("mrc        p15, 0, %0, c0, " ext_reg               \
                    : "=r" (__val)                                      \
                    :                                                   \
-                    : "cc");                                            \
+                    : "memory");                                        \
                __val;                                                  \
        })
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
index 38050b1c4800..9c9b30717fda 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -130,4 +130,8 @@ struct mm_struct;
 extern unsigned long arch_randomize_brk(struct mm_struct *mm);
 #define arch_randomize_brk arch_randomize_brk
+#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
+struct linux_binprm;
+int arch_setup_additional_pages(struct linux_binprm *, int);
 #endif
diff --git a/arch/arm/include/asm/mmu.h b/arch/arm/include/asm/mmu.h
index e3d55547e755..6f18da09668b 100644
--- a/arch/arm/include/asm/mmu.h
+++ b/arch/arm/include/asm/mmu.h
@@ -6,8 +6,11 @@
 typedef struct {
 #ifdef CONFIG_CPU_HAS_ASID
        atomic64_t      id;
+#else
+        int             switch_pending;
 #endif
        unsigned int    vmalloc_seq;
+        unsigned long   sigpage;
 } mm_context_t;
 #ifdef CONFIG_CPU_HAS_ASID
diff --git a/arch/arm/include/asm/mmu_context.h b/arch/arm/include/asm/mmu_context.h
index b5792b7fd8d3..9b32f76bb0dd 100644
--- a/arch/arm/include/asm/mmu_context.h
+++ b/arch/arm/include/asm/mmu_context.h
@@ -56,7 +56,7 @@ static inline void check_and_switch_context(struct mm_struct *mm,
                 * on non-ASID CPUs, the old mm will remain valid until the
                 * finish_arch_post_lock_switch() call.
                 */
-                set_ti_thread_flag(task_thread_info(tsk), TIF_SWITCH_MM);
+                mm->context.switch_pending = 1;
        else
                cpu_switch_mm(mm->pgd, mm);
 }
@@ -65,9 +65,21 @@ static inline void check_and_switch_context(struct mm_struct *mm,
        finish_arch_post_lock_switch
 static inline void finish_arch_post_lock_switch(void)
 {
-        if (test_and_clear_thread_flag(TIF_SWITCH_MM)) {
+        struct mm_struct *mm = current->mm;
-                struct mm_struct *mm = current->mm;
-                cpu_switch_mm(mm->pgd, mm);
+        if (mm && mm->context.switch_pending) {
+                /*
+                 * Preemption must be disabled during cpu_switch_mm() as we
+                 * have some stateful cache flush implementations. Check
+                 * switch_pending again in case we were preempted and the
+                 * switch to this mm was already done.
+                 */
+                preempt_disable();
+                if (mm->context.switch_pending) {
+                        mm->context.switch_pending = 0;
+                        cpu_switch_mm(mm->pgd, mm);
+                }
+                preempt_enable_no_resched();
        }
 }
diff --git a/arch/arm/include/asm/page.h b/arch/arm/include/asm/page.h
index 6363f3d1d505..4355f0ec44d6 100644
--- a/arch/arm/include/asm/page.h
+++ b/arch/arm/include/asm/page.h
@@ -142,7 +142,9 @@ extern void __cpu_copy_user_highpage(struct page *to, struct page *from,
 #define clear_page(page)        memset((void *)(page), 0, PAGE_SIZE)
 extern void copy_page(void *to, const void *from);
+#ifdef CONFIG_KUSER_HELPERS
 #define __HAVE_ARCH_GATE_AREA 1
+#endif
 #ifdef CONFIG_ARM_LPAE
 #include <asm/pgtable-3level-types.h>
diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
index 06e7d509eaac..413f3876341c 100644
--- a/arch/arm/include/asm/processor.h
+++ b/arch/arm/include/asm/processor.h
@@ -54,7 +54,6 @@ struct thread_struct {
 #define start_thread(regs,pc,sp)                                        \
 ({                                                                      \
-        unsigned long *stack = (unsigned long *)sp;                     \
        memset(regs->uregs, 0, sizeof(regs->uregs));                    \
        if (current->personality & ADDR_LIMIT_32BIT)                    \
                regs->ARM_cpsr = USR_MODE;                              \
@@ -65,9 +64,6 @@ struct thread_struct {
        regs->ARM_cpsr |= PSR_ENDSTATE;                                 \
        regs->ARM_pc = pc & ~1;         /* pc */                        \
        regs->ARM_sp = sp;              /* sp */                        \
-        regs->ARM_r2 = stack[2];        /* r2 (envp) */                 \
-        regs->ARM_r1 = stack[1];        /* r1 (argv) */                 \
-        regs->ARM_r0 = stack[0];        /* r0 (argc) */                 \
        nommu_start_thread(regs);                                       \
 })
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index 214d4158089a..2b8114fcba09 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -156,7 +156,6 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
 #define TIF_USING_IWMMXT        17
 #define TIF_MEMDIE              18      /* is terminating due to OOM killer */
 #define TIF_RESTORE_SIGMASK     20
-#define TIF_SWITCH_MM           22      /* deferred switch_mm */
 #define _TIF_SIGPENDING         (1 << TIF_SIGPENDING)
 #define _TIF_NEED_RESCHED       (1 << TIF_NEED_RESCHED)
diff --git a/arch/arm/include/asm/tlbflush.h b/arch/arm/include/asm/tlbflush.h
index fdbb9e369745..f467e9b3f8d5 100644
--- a/arch/arm/include/asm/tlbflush.h
+++ b/arch/arm/include/asm/tlbflush.h
@@ -443,7 +443,18 @@ static inline void local_flush_bp_all(void)
                isb();
 }
+#include <asm/cputype.h>
 #ifdef CONFIG_ARM_ERRATA_798181
+static inline int erratum_a15_798181(void)
+{
+        unsigned int midr = read_cpuid_id();
+        /* Cortex-A15 r0p0..r3p2 affected */
+        if ((midr & 0xff0ffff0) != 0x410fc0f0 || midr > 0x413fc0f2)
+                return 0;
+        return 1;
+}
 static inline void dummy_flush_tlb_a15_erratum(void)
 {
        /*
@@ -453,6 +464,11 @@ static inline void dummy_flush_tlb_a15_erratum(void)
        dsb();
 }
 #else
+static inline int erratum_a15_798181(void)
+{
+        return 0;
+}
 static inline void dummy_flush_tlb_a15_erratum(void)
 {
 }
diff --git a/arch/arm/include/asm/virt.h b/arch/arm/include/asm/virt.h
index 50af92bac737..4371f45c5784 100644
--- a/arch/arm/include/asm/virt.h
+++ b/arch/arm/include/asm/virt.h
@@ -29,6 +29,7 @@
 #define BOOT_CPU_MODE_MISMATCH  PSR_N_BIT
 #ifndef __ASSEMBLY__
+#include <asm/cacheflush.h>
 #ifdef CONFIG_ARM_VIRT_EXT
 /*
@@ -41,10 +42,21 @@
 */
 extern int __boot_cpu_mode;
+static inline void sync_boot_mode(void)
+{
+        /*
+         * As secondaries write to __boot_cpu_mode with caches disabled, we
+         * must flush the corresponding cache entries to ensure the visibility
+         * of their writes.
+         */
+        sync_cache_r(&__boot_cpu_mode);
+}
 void __hyp_set_vectors(unsigned long phys_vector_base);
 unsigned long __hyp_get_vectors(void);
 #else
 #define __boot_cpu_mode (SVC_MODE)
+#define sync_boot_mode()
 #endif
 #ifndef ZIMAGE
diff --git a/arch/arm/include/uapi/asm/Kbuild b/arch/arm/include/uapi/asm/Kbuild
index 47bcb2d254af..18d76fd5a2af 100644
--- a/arch/arm/include/uapi/asm/Kbuild
+++ b/arch/arm/include/uapi/asm/Kbuild
@@ -1,7 +1,6 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
-header-y += a.out.h
 header-y += byteorder.h
 header-y += fcntl.h
 header-y += hwcap.h
diff --git a/arch/arm/include/uapi/asm/a.out.h b/arch/arm/include/uapi/asm/a.out.h
deleted file mode 100644
index 083894b2e3bc..000000000000
--- a/arch/arm/include/uapi/asm/a.out.h
+++ /dev/null
@@ -1,34 +0,0 @@
-#ifndef __ARM_A_OUT_H__
-#define __ARM_A_OUT_H__
-#include <linux/personality.h>
-#include <linux/types.h>
-struct exec
-{
-  __u32 a_info;         /* Use macros N_MAGIC, etc for access */
-  __u32 a_text;         /* length of text, in bytes */
-  __u32 a_data;         /* length of data, in bytes */
-  __u32 a_bss;          /* length of uninitialized data area for file, in bytes */
-  __u32 a_syms;         /* length of symbol table data in file, in bytes */
-  __u32 a_entry;        /* start address */
-  __u32 a_trsize;       /* length of relocation info for text, in bytes */
-  __u32 a_drsize;       /* length of relocation info for data, in bytes */
-};
-/*
- * This is always the same
- */
-#define N_TXTADDR(a)    (0x00008000)
-#define N_TRSIZE(a)     ((a).a_trsize)
-#define N_DRSIZE(a)     ((a).a_drsize)
-#define N_SYMSIZE(a)    ((a).a_syms)
-#define M_ARM 103
-#ifndef LIBRARY_START_TEXT
-#define LIBRARY_START_TEXT      (0x00c00000)
-#endif
-#endif /* __A_OUT_GNU_H__ */
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index a39cfc2a1f90..d40d0ef389db 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -742,6 +742,18 @@ ENDPROC(__switch_to)
 #endif
        .endm
+        .macro  kuser_pad, sym, size
+        .if     (. - \sym) & 3
+        .rept   4 - (. - \sym) & 3
+        .byte   0
+        .endr
+        .endif
+        .rept   (\size - (. - \sym)) / 4
+        .word   0xe7fddef1
+        .endr
+        .endm
+#ifdef CONFIG_KUSER_HELPERS
        .align  5
        .globl  __kuser_helper_start
 __kuser_helper_start:
@@ -832,18 +844,13 @@ kuser_cmpxchg64_fixup:
 #error "incoherent kernel configuration"
 #endif
-        /* pad to next slot */
+        kuser_pad __kuser_cmpxchg64, 64
-        .rept   (16 - (. - __kuser_cmpxchg64)/4)
-        .word   0
-        .endr
-        .align  5
 __kuser_memory_barrier:                         @ 0xffff0fa0
        smp_dmb arm
        usr_ret lr
-        .align  5
+        kuser_pad __kuser_memory_barrier, 32
 __kuser_cmpxchg:                                @ 0xffff0fc0
@@ -916,13 +923,14 @@ kuser_cmpxchg32_fixup:
 #endif
-        .align  5
+        kuser_pad __kuser_cmpxchg, 32
 __kuser_get_tls:                                @ 0xffff0fe0
        ldr     r0, [pc, #(16 - 8)]     @ read TLS, set in kuser_get_tls_init
        usr_ret lr
        mrc     p15, 0, r0, c13, c0, 3  @ 0xffff0fe8 hardware TLS code
-        .rep    4
+        kuser_pad __kuser_get_tls, 16
+        .rep    3
        .word   0                       @ 0xffff0ff0 software TLS value, then
        .endr                           @ pad up to __kuser_helper_version
@@ -932,14 +940,16 @@ __kuser_helper_version:				@ 0xffff0ffc
        .globl  __kuser_helper_end
 __kuser_helper_end:
+#endif
 THUMB( .thumb  )
 /*
 * Vector stubs.
 *
- * This code is copied to 0xffff0200 so we can use branches in the
+ * This code is copied to 0xffff1000 so we can use branches in the
- * vectors, rather than ldr's.  Note that this code must not
+ * vectors, rather than ldr's.  Note that this code must not exceed
- * exceed 0x300 bytes.
+ * a page size.
 *
 * Common stub entry macro:
 *   Enter in IRQ mode, spsr = SVC/USR CPSR, lr = SVC/USR PC
@@ -986,8 +996,17 @@ ENDPROC(vector_\name)
 1:
        .endm
-        .globl  __stubs_start
+        .section .stubs, "ax", %progbits
 __stubs_start:
+        @ This must be the first word
+        .word   vector_swi
+vector_rst:
+ ARM(   swi     SYS_ERROR0      )
+ THUMB( svc     #0              )
+ THUMB( nop                     )
+        b       vector_und
 /*
 * Interrupt dispatcher
 */
@@ -1082,6 +1101,16 @@ __stubs_start:
        .align  5
 /*=============================================================================
+ * Address exception handler
+ *-----------------------------------------------------------------------------
+ * These aren't too critical.
+ * (they're not supposed to happen, and won't happen in 32-bit data mode).
+ */
+vector_addrexcptn:
+        b       vector_addrexcptn
+/*=============================================================================
 * Undefined FIQs
 *-----------------------------------------------------------------------------
 * Enter in FIQ mode, spsr = ANY CPSR, lr = ANY PC
@@ -1094,45 +1123,19 @@ __stubs_start:
 vector_fiq:
        subs    pc, lr, #4
-/*=============================================================================
+        .globl  vector_fiq_offset
- * Address exception handler
+        .equ    vector_fiq_offset, vector_fiq
- *-----------------------------------------------------------------------------
- * These aren't too critical.
- * (they're not supposed to happen, and won't happen in 32-bit data mode).
- */
-vector_addrexcptn:
-        b       vector_addrexcptn
-/*
- * We group all the following data together to optimise
- * for CPUs with separate I & D caches.
- */
-        .align  5
-.LCvswi:
-        .word   vector_swi
-        .globl  __stubs_end
-__stubs_end:
-        .equ    stubs_offset, __vectors_start + 0x200 - __stubs_start
-        .globl  __vectors_start
+        .section .vectors, "ax", %progbits
 __vectors_start:
- ARM(   swi     SYS_ERROR0      )
+        W(b)    vector_rst
- THUMB( svc     #0              )
+        W(b)    vector_und
- THUMB( nop                     )
+        W(ldr)  pc, __vectors_start + 0x1000
-        W(b)    vector_und + stubs_offset
+        W(b)    vector_pabt
-        W(ldr)  pc, .LCvswi + stubs_offset
+        W(b)    vector_dabt
-        W(b)    vector_pabt + stubs_offset
+        W(b)    vector_addrexcptn
-        W(b)    vector_dabt + stubs_offset
+        W(b)    vector_irq
-        W(b)    vector_addrexcptn + stubs_offset
+        W(b)    vector_fiq
-        W(b)    vector_irq + stubs_offset
-        W(b)    vector_fiq + stubs_offset
-        .globl  __vectors_end
-__vectors_end:
        .data
diff --git a/arch/arm/kernel/entry-v7m.S b/arch/arm/kernel/entry-v7m.S
index e00621f1403f..52b26432c9a9 100644
--- a/arch/arm/kernel/entry-v7m.S
+++ b/arch/arm/kernel/entry-v7m.S
@@ -49,7 +49,7 @@ __irq_entry:
        mov     r1, sp
        stmdb   sp!, {lr}
        @ routine called with r0 = irq number, r1 = struct pt_regs *
-        bl      nvic_do_IRQ
+        bl      nvic_handle_irq
        pop     {lr}
        @
diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
index 2adda11f712f..25442f451148 100644
--- a/arch/arm/kernel/fiq.c
+++ b/arch/arm/kernel/fiq.c
@@ -47,6 +47,11 @@
 #include <asm/irq.h>
 #include <asm/traps.h>
+#define FIQ_OFFSET ({                                   \
+                extern void *vector_fiq_offset;         \
+                (unsigned)&vector_fiq_offset;           \
+        })
 static unsigned long no_fiq_insn;
 /* Default reacquire function
@@ -80,13 +85,16 @@ int show_fiq_list(struct seq_file *p, int prec)
 void set_fiq_handler(void *start, unsigned int length)
 {
 #if defined(CONFIG_CPU_USE_DOMAINS)
-        memcpy((void *)0xffff001c, start, length);
+        void *base = (void *)0xffff0000;
 #else
-        memcpy(vectors_page + 0x1c, start, length);
+        void *base = vectors_page;
 #endif
-        flush_icache_range(0xffff001c, 0xffff001c + length);
+        unsigned offset = FIQ_OFFSET;
+        memcpy(base + offset, start, length);
+        flush_icache_range(0xffff0000 + offset, 0xffff0000 + offset + length);
        if (!vectors_high())
-                flush_icache_range(0x1c, 0x1c + length);
+                flush_icache_range(offset, offset + length);
 }
 int claim_fiq(struct fiq_handler *f)
@@ -144,6 +152,7 @@ EXPORT_SYMBOL(disable_fiq);
 void __init init_FIQ(int start)
 {
-        no_fiq_insn = *(unsigned long *)0xffff001c;
+        unsigned offset = FIQ_OFFSET;
+        no_fiq_insn = *(unsigned long *)(0xffff0000 + offset);
        fiq_start = start;
 }
diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
index b361de143756..14235ba64a90 100644
--- a/arch/arm/kernel/head-nommu.S
+++ b/arch/arm/kernel/head-nommu.S
@@ -87,6 +87,7 @@ ENTRY(stext)
 ENDPROC(stext)
 #ifdef CONFIG_SMP
+        .text
 ENTRY(secondary_startup)
        /*
         * Common entry point for secondary CPUs.
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 9cf6063020ae..2c7cc1e03473 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -343,6 +343,7 @@ __turn_mmu_on_loc:
        .long   __turn_mmu_on_end
 #if defined(CONFIG_SMP)
+        .text
 ENTRY(secondary_startup)
        /*
         * Common entry point for secondary CPUs.
diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
index 4910232c4833..797b1a6a4906 100644
--- a/arch/arm/kernel/hyp-stub.S
+++ b/arch/arm/kernel/hyp-stub.S
@@ -56,8 +56,8 @@ ENTRY(__boot_cpu_mode)
        ldr     \reg3, [\reg2]
        ldr     \reg1, [\reg2, \reg3]
        cmp     \mode, \reg1            @ matches primary CPU boot mode?
-        orrne   r7, r7, #BOOT_CPU_MODE_MISMATCH
+        orrne   \reg1, \reg1, #BOOT_CPU_MODE_MISMATCH
-        strne   r7, [r5, r6]            @ record what happened and give up
+        strne   \reg1, [\reg2, \reg3]   @ record what happened and give up
        .endm
 #else   /* ZIMAGE */
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index d3ca4f6915af..16ed3f7c4980 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -197,6 +197,7 @@ void machine_shutdown(void)
 */
 void machine_halt(void)
 {
+        local_irq_disable();
        smp_send_stop();
        local_irq_disable();
@@ -211,6 +212,7 @@ void machine_halt(void)
 */
 void machine_power_off(void)
 {
+        local_irq_disable();
        smp_send_stop();
        if (pm_power_off)
@@ -230,6 +232,7 @@ void machine_power_off(void)
 */
 void machine_restart(char *cmd)
 {
+        local_irq_disable();
        smp_send_stop();
        arm_pm_restart(reboot_mode, cmd);
@@ -426,10 +429,11 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
 }
 #ifdef CONFIG_MMU
+#ifdef CONFIG_KUSER_HELPERS
 /*
 * The vectors page is always readable from user space for the
- * atomic helpers and the signal restart code. Insert it into the
+ * atomic helpers. Insert it into the gate_vma so that it is visible
- * gate_vma so that it is visible through ptrace and /proc/<pid>/mem.
+ * through ptrace and /proc/<pid>/mem.
 */
 static struct vm_area_struct gate_vma = {
        .vm_start       = 0xffff0000,
@@ -458,9 +462,47 @@ int in_gate_area_no_mm(unsigned long addr)
 {
        return in_gate_area(NULL, addr);
 }
+#define is_gate_vma(vma)        ((vma) = &gate_vma)
+#else
+#define is_gate_vma(vma)        0
+#endif
 const char *arch_vma_name(struct vm_area_struct *vma)
 {
-        return (vma == &gate_vma) ? "[vectors]" : NULL;
+        return is_gate_vma(vma) ? "[vectors]" :
+                (vma->vm_mm && vma->vm_start == vma->vm_mm->context.sigpage) ?
+                 "[sigpage]" : NULL;
+}
+extern struct page *get_signal_page(void);
+int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+{
+        struct mm_struct *mm = current->mm;
+        struct page *page;
+        unsigned long addr;
+        int ret;
+        page = get_signal_page();
+        if (!page)
+                return -ENOMEM;
+        down_write(&mm->mmap_sem);
+        addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
+        if (IS_ERR_VALUE(addr)) {
+                ret = addr;
+                goto up_fail;
+        }
+        ret = install_special_mapping(mm, addr, PAGE_SIZE,
+                VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC,
+                &page);
+        if (ret == 0)
+                mm->context.sigpage = addr;
+ up_fail:
+        up_write(&mm->mmap_sem);
+        return ret;
 }
 #endif
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 63af9a7ae512..afc2489ee13b 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -836,6 +836,8 @@ static int __init meminfo_cmp(const void *_a, const void *_b)
 void __init hyp_mode_check(void)
 {
 #ifdef CONFIG_ARM_VIRT_EXT
+        sync_boot_mode();
        if (is_hyp_mode_available()) {
                pr_info("CPU: All CPU(s) started in HYP mode.\n");
                pr_info("CPU: Virtualization extensions available.\n");
@@ -971,6 +973,7 @@ static const char *hwcap_str[] = {
        "vfpv4",
        "idiva",
        "idivt",
+        "vfpd32",
        "lpae",
        NULL
 };
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index 1c16c35c271a..0f17e06d51e6 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -8,6 +8,7 @@
 * published by the Free Software Foundation.
 */
 #include <linux/errno.h>
+#include <linux/random.h>
 #include <linux/signal.h>
 #include <linux/personality.h>
 #include <linux/uaccess.h>
@@ -15,12 +16,11 @@
 #include <asm/elf.h>
 #include <asm/cacheflush.h>
+#include <asm/traps.h>
 #include <asm/ucontext.h>
 #include <asm/unistd.h>
 #include <asm/vfp.h>
-#include "signal.h"
 /*
 * For ARM syscalls, we encode the syscall number into the instruction.
 */
@@ -40,11 +40,13 @@
 #define SWI_THUMB_SIGRETURN     (0xdf00 << 16 | 0x2700 | (__NR_sigreturn - __NR_SYSCALL_BASE))
 #define SWI_THUMB_RT_SIGRETURN  (0xdf00 << 16 | 0x2700 | (__NR_rt_sigreturn - __NR_SYSCALL_BASE))
-const unsigned long sigreturn_codes[7] = {
+static const unsigned long sigreturn_codes[7] = {
        MOV_R7_NR_SIGRETURN,    SWI_SYS_SIGRETURN,    SWI_THUMB_SIGRETURN,
        MOV_R7_NR_RT_SIGRETURN, SWI_SYS_RT_SIGRETURN, SWI_THUMB_RT_SIGRETURN,
 };
+static unsigned long signal_return_offset;
 #ifdef CONFIG_CRUNCH
 static int preserve_crunch_context(struct crunch_sigframe __user *frame)
 {
@@ -401,12 +403,15 @@ setup_return(struct pt_regs *regs, struct ksignal *ksig,
                        return 1;
                if ((cpsr & MODE32_BIT) && !IS_ENABLED(CONFIG_ARM_MPU)) {
+                        struct mm_struct *mm = current->mm;
                        /*
-                         * 32-bit code can use the new high-page
+                         * 32-bit code can use the signal return page
-                         * signal return code support except when the MPU has
+                         * except when the MPU has protected the vectors
-                         * protected the vectors page from PL0
+                         * page from PL0
                         */
-                        retcode = KERN_SIGRETURN_CODE + (idx << 2) + thumb;
+                        retcode = mm->context.sigpage + signal_return_offset +
+                                  (idx << 2) + thumb;
                } else {
                        /*
                         * Ensure that the instruction cache sees
@@ -608,3 +613,36 @@ do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
        } while (thread_flags & _TIF_WORK_MASK);
        return 0;
 }
+static struct page *signal_page;
+struct page *get_signal_page(void)
+{
+        if (!signal_page) {
+                unsigned long ptr;
+                unsigned offset;
+                void *addr;
+                signal_page = alloc_pages(GFP_KERNEL, 0);
+                if (!signal_page)
+                        return NULL;
+                addr = page_address(signal_page);
+                /* Give the signal return code some randomness */
+                offset = 0x200 + (get_random_int() & 0x7fc);
+                signal_return_offset = offset;
+                /*
+                 * Copy signal return handlers into the vector page, and
+                 * set sigreturn to be a pointer to these.
+                 */
+                memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
+                ptr = (unsigned long)addr + offset;
+                flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
+        }
+        return signal_page;
+}
diff --git a/arch/arm/kernel/signal.h b/arch/arm/kernel/signal.h
deleted file mode 100644
index 5ff067b7c752..000000000000
--- a/arch/arm/kernel/signal.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- *  linux/arch/arm/kernel/signal.h
- *
- *  Copyright (C) 2005-2009 Russell King.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#define KERN_SIGRETURN_CODE     (CONFIG_VECTORS_BASE + 0x00000500)
-extern const unsigned long sigreturn_codes[7];
diff --git a/arch/arm/kernel/smp_tlb.c b/arch/arm/kernel/smp_tlb.c
index a98b62dca2fa..c2edfff573c2 100644
--- a/arch/arm/kernel/smp_tlb.c
+++ b/arch/arm/kernel/smp_tlb.c
@@ -70,23 +70,6 @@ static inline void ipi_flush_bp_all(void *ignored)
        local_flush_bp_all();
 }
-#ifdef CONFIG_ARM_ERRATA_798181
-static int erratum_a15_798181(void)
-{
-        unsigned int midr = read_cpuid_id();
-        /* Cortex-A15 r0p0..r3p2 affected */
-        if ((midr & 0xff0ffff0) != 0x410fc0f0 || midr > 0x413fc0f2)
-                return 0;
-        return 1;
-}
-#else
-static int erratum_a15_798181(void)
-{
-        return 0;
-}
-#endif
 static void ipi_flush_tlb_a15_erratum(void *arg)
 {
        dmb();
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index cab094c234ee..ab517fcce21b 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -35,8 +35,6 @@
 #include <asm/tls.h>
 #include <asm/system_misc.h>
-#include "signal.h"
 static const char *handler[]= { "prefetch abort", "data abort", "address exception", "interrupt" };
 void *vectors_page;
@@ -800,15 +798,26 @@ void __init trap_init(void)
        return;
 }
-static void __init kuser_get_tls_init(unsigned long vectors)
+#ifdef CONFIG_KUSER_HELPERS
+static void __init kuser_init(void *vectors)
 {
+        extern char __kuser_helper_start[], __kuser_helper_end[];
+        int kuser_sz = __kuser_helper_end - __kuser_helper_start;
+        memcpy(vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz);
        /*
         * vectors + 0xfe0 = __kuser_get_tls
         * vectors + 0xfe8 = hardware TLS instruction at 0xffff0fe8
         */
        if (tls_emu || has_tls_reg)
-                memcpy((void *)vectors + 0xfe0, (void *)vectors + 0xfe8, 4);
+                memcpy(vectors + 0xfe0, vectors + 0xfe8, 4);
 }
+#else
+static void __init kuser_init(void *vectors)
+{
+}
+#endif
 void __init early_trap_init(void *vectors_base)
 {
@@ -816,33 +825,30 @@ void __init early_trap_init(void *vectors_base)
        unsigned long vectors = (unsigned long)vectors_base;
        extern char __stubs_start[], __stubs_end[];
        extern char __vectors_start[], __vectors_end[];
-        extern char __kuser_helper_start[], __kuser_helper_end[];
+        unsigned i;
-        int kuser_sz = __kuser_helper_end - __kuser_helper_start;
        vectors_page = vectors_base;
        /*
+         * Poison the vectors page with an undefined instruction.  This
+         * instruction is chosen to be undefined for both ARM and Thumb
+         * ISAs.  The Thumb version is an undefined instruction with a
+         * branch back to the undefined instruction.
+         */
+        for (i = 0; i < PAGE_SIZE / sizeof(u32); i++)
+                ((u32 *)vectors_base)[i] = 0xe7fddef1;
+        /*
         * Copy the vectors, stubs and kuser helpers (in entry-armv.S)
         * into the vector page, mapped at 0xffff0000, and ensure these
         * are visible to the instruction stream.
         */
        memcpy((void *)vectors, __vectors_start, __vectors_end - __vectors_start);
-        memcpy((void *)vectors + 0x200, __stubs_start, __stubs_end - __stubs_start);
+        memcpy((void *)vectors + 0x1000, __stubs_start, __stubs_end - __stubs_start);
-        memcpy((void *)vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz);
-        /*
+        kuser_init(vectors_base);
-         * Do processor specific fixups for the kuser helpers
-         */
-        kuser_get_tls_init(vectors);
-        /*
-         * Copy signal return handlers into the vector page, and
-         * set sigreturn to be a pointer to these.
-         */
-        memcpy((void *)(vectors + KERN_SIGRETURN_CODE - CONFIG_VECTORS_BASE),
-               sigreturn_codes, sizeof(sigreturn_codes));
-        flush_icache_range(vectors, vectors + PAGE_SIZE);
+        flush_icache_range(vectors, vectors + PAGE_SIZE * 2);
        modify_domain(DOMAIN_USER, DOMAIN_CLIENT);
 #else /* ifndef CONFIG_CPU_V7M */
        /*
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index fa25e4e425f6..7bcee5c9b604 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -148,6 +148,23 @@ SECTIONS
        . = ALIGN(PAGE_SIZE);
        __init_begin = .;
 #endif
+        /*
+         * The vectors and stubs are relocatable code, and the
+         * only thing that matters is their relative offsets
+         */
+        __vectors_start = .;
+        .vectors 0 : AT(__vectors_start) {
+                *(.vectors)
+        }
+        . = __vectors_start + SIZEOF(.vectors);
+        __vectors_end = .;
+        __stubs_start = .;
+        .stubs 0x1000 : AT(__stubs_start) {
+                *(.stubs)
+        }
+        . = __stubs_start + SIZEOF(.stubs);
+        __stubs_end = .;
        INIT_TEXT_SECTION(8)
        .exit.text : {
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 6cacdc8dd654..db5c2cab8fda 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -421,24 +421,28 @@ config CPU_32v3
        select CPU_USE_DOMAINS if MMU
        select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
        select TLS_REG_EMUL if SMP || !MMU
+        select NEED_KUSER_HELPERS
 config CPU_32v4
        bool
        select CPU_USE_DOMAINS if MMU
        select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
        select TLS_REG_EMUL if SMP || !MMU
+        select NEED_KUSER_HELPERS
 config CPU_32v4T
        bool
        select CPU_USE_DOMAINS if MMU
        select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
        select TLS_REG_EMUL if SMP || !MMU
+        select NEED_KUSER_HELPERS
 config CPU_32v5
        bool
        select CPU_USE_DOMAINS if MMU
        select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
        select TLS_REG_EMUL if SMP || !MMU
+        select NEED_KUSER_HELPERS
 config CPU_32v6
        bool
@@ -776,6 +780,7 @@ config CPU_BPREDICT_DISABLE
 config TLS_REG_EMUL
        bool
+        select NEED_KUSER_HELPERS
        help
          An SMP system using a pre-ARMv6 processor (there are apparently
          a few prototypes like that in existence) and therefore access to
@@ -783,11 +788,40 @@ config TLS_REG_EMUL
 config NEEDS_SYSCALL_FOR_CMPXCHG
        bool
+        select NEED_KUSER_HELPERS
        help
          SMP on a pre-ARMv6 processor?  Well OK then.
          Forget about fast user space cmpxchg support.
          It is just not possible.
+config NEED_KUSER_HELPERS
+        bool
+config KUSER_HELPERS
+        bool "Enable kuser helpers in vector page" if !NEED_KUSER_HELPERS
+        default y
+        help
+          Warning: disabling this option may break user programs.
+          Provide kuser helpers in the vector page.  The kernel provides
+          helper code to userspace in read only form at a fixed location
+          in the high vector page to allow userspace to be independent of
+          the CPU type fitted to the system.  This permits binaries to be
+          run on ARMv4 through to ARMv7 without modification.
+          However, the fixed address nature of these helpers can be used
+          by ROP (return orientated programming) authors when creating
+          exploits.
+          If all of the binaries and libraries which run on your platform
+          are built specifically for your platform, and make no use of
+          these helpers, then you can turn this option off.  However,
+          when such an binary or library is run, it will receive a SIGILL
+          signal, which will terminate the program.
+          Say N here only if you are absolutely certain that you do not
+          need these helpers; otherwise, the safe option is to say Y.
 config DMA_CACHE_RWFO
        bool "Enable read/write for ownership DMA cache maintenance"
        depends on CPU_V6K && SMP
diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
index b55b1015724b..4a0544492f10 100644
--- a/arch/arm/mm/context.c
+++ b/arch/arm/mm/context.c
@@ -245,7 +245,8 @@ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk)
        if (cpumask_test_and_clear_cpu(cpu, &tlb_flush_pending)) {
                local_flush_bp_all();
                local_flush_tlb_all();
-                dummy_flush_tlb_a15_erratum();
+                if (erratum_a15_798181())
+                        dummy_flush_tlb_a15_erratum();
        }
        atomic64_set(&per_cpu(active_asids, cpu), asid);
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 4f56617a2392..53cdbd39ec8e 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -989,6 +989,7 @@ phys_addr_t arm_lowmem_limit __initdata = 0;
 void __init sanity_check_meminfo(void)
 {
+        phys_addr_t memblock_limit = 0;
        int i, j, highmem = 0;
        phys_addr_t vmalloc_limit = __pa(vmalloc_min - 1) + 1;
@@ -1052,9 +1053,32 @@ void __init sanity_check_meminfo(void)
                        bank->size = size_limit;
                }
 #endif
-                if (!bank->highmem && bank->start + bank->size > arm_lowmem_limit)
+                if (!bank->highmem) {
-                        arm_lowmem_limit = bank->start + bank->size;
+                        phys_addr_t bank_end = bank->start + bank->size;
+                        if (bank_end > arm_lowmem_limit)
+                                arm_lowmem_limit = bank_end;
+                        /*
+                         * Find the first non-section-aligned page, and point
+                         * memblock_limit at it. This relies on rounding the
+                         * limit down to be section-aligned, which happens at
+                         * the end of this function.
+                         *
+                         * With this algorithm, the start or end of almost any
+                         * bank can be non-section-aligned. The only exception
+                         * is that the start of the bank 0 must be section-
+                         * aligned, since otherwise memory would need to be
+                         * allocated when mapping the start of bank 0, which
+                         * occurs before any free memory is mapped.
+                         */
+                        if (!memblock_limit) {
+                                if (!IS_ALIGNED(bank->start, SECTION_SIZE))
+                                        memblock_limit = bank->start;
+                                else if (!IS_ALIGNED(bank_end, SECTION_SIZE))
+                                        memblock_limit = bank_end;
+                        }
+                }
                j++;
        }
 #ifdef CONFIG_HIGHMEM
@@ -1079,7 +1103,18 @@ void __init sanity_check_meminfo(void)
 #endif
        meminfo.nr_banks = j;
        high_memory = __va(arm_lowmem_limit - 1) + 1;
-        memblock_set_current_limit(arm_lowmem_limit);
+        /*
+         * Round the memblock limit down to a section size.  This
+         * helps to ensure that we will allocate memory from the
+         * last full section, which should be mapped.
+         */
+        if (memblock_limit)
+                memblock_limit = round_down(memblock_limit, SECTION_SIZE);
+        if (!memblock_limit)
+                memblock_limit = arm_lowmem_limit;
+        memblock_set_current_limit(memblock_limit);
 }
 static inline void prepare_page_table(void)
@@ -1160,7 +1195,7 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
        /*
         * Allocate the vector page early.
         */
-        vectors = early_alloc(PAGE_SIZE);
+        vectors = early_alloc(PAGE_SIZE * 2);
        early_trap_init(vectors);
@@ -1205,15 +1240,27 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
        map.pfn = __phys_to_pfn(virt_to_phys(vectors));
        map.virtual = 0xffff0000;
        map.length = PAGE_SIZE;
+#ifdef CONFIG_KUSER_HELPERS
        map.type = MT_HIGH_VECTORS;
+#else
+        map.type = MT_LOW_VECTORS;
+#endif
        create_mapping(&map);
        if (!vectors_high()) {
                map.virtual = 0;
+                map.length = PAGE_SIZE * 2;
                map.type = MT_LOW_VECTORS;
                create_mapping(&map);
        }
+        /* Now create a kernel read-only mapping */
+        map.pfn += 1;
+        map.virtual = 0xffff0000 + PAGE_SIZE;
+        map.length = PAGE_SIZE;
+        map.type = MT_LOW_VECTORS;
+        create_mapping(&map);
        /*
         * Ask the machine support to map in the statically mapped devices.
         */
@@ -1276,8 +1323,6 @@ void __init paging_init(struct machine_desc *mdesc)
 {
        void *zero_page;
-        memblock_set_current_limit(arm_lowmem_limit);
        build_mem_type_table();
        prepare_page_table();
        map_lowmem();
diff --git a/arch/arm/mm/proc-v7-2level.S b/arch/arm/mm/proc-v7-2level.S
index f64afb9f1bd5..bdd3be4be77a 100644
--- a/arch/arm/mm/proc-v7-2level.S
+++ b/arch/arm/mm/proc-v7-2level.S
@@ -110,7 +110,7 @@ ENTRY(cpu_v7_set_pte_ext)
 ARM(   str     r3, [r0, #2048]! )
 THUMB( add     r0, r0, #2048 )
 THUMB( str     r3, [r0] )
-        ALT_SMP(mov     pc,lr)
+        ALT_SMP(W(nop))
        ALT_UP (mcr     p15, 0, r0, c7, c10, 1)         @ flush_pte
 #endif
        mov     pc, lr
diff --git a/arch/arm/mm/proc-v7-3level.S b/arch/arm/mm/proc-v7-3level.S
index c36ac69488c8..01a719e18bb0 100644
--- a/arch/arm/mm/proc-v7-3level.S
+++ b/arch/arm/mm/proc-v7-3level.S
@@ -81,7 +81,7 @@ ENTRY(cpu_v7_set_pte_ext)
        tst     r3, #1 << (55 - 32)             @ L_PTE_DIRTY
        orreq   r2, #L_PTE_RDONLY
 1:      strd    r2, r3, [r0]
-        ALT_SMP(mov     pc, lr)
+        ALT_SMP(W(nop))
        ALT_UP (mcr     p15, 0, r0, c7, c10, 1)         @ flush_pte
 #endif
        mov     pc, lr
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 5c6d5a3050ea..73398bcf9bd8 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -75,13 +75,14 @@ ENTRY(cpu_v7_do_idle)
 ENDPROC(cpu_v7_do_idle)
 ENTRY(cpu_v7_dcache_clean_area)
-        ALT_SMP(mov     pc, lr)                 @ MP extensions imply L1 PTW
+        ALT_SMP(W(nop))                 @ MP extensions imply L1 PTW
-        ALT_UP(W(nop))
+        ALT_UP_B(1f)
-        dcache_line_size r2, r3
+        mov     pc, lr
-1:      mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
+1:      dcache_line_size r2, r3
+2:      mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
        add     r0, r0, r2
        subs    r1, r1, r2
-        bhi     1b
+        bhi     2b
        dsb
        mov     pc, lr
 ENDPROC(cpu_v7_dcache_clean_area)
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index f71c37edca26..c9770ba5c7df 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -172,7 +172,7 @@ static void __init xen_percpu_init(void *unused)
        enable_percpu_irq(xen_events_irq, 0);
 }
-static void xen_restart(char str, const char *cmd)
+static void xen_restart(enum reboot_mode reboot_mode, const char *cmd)
 {
        struct sched_shutdown r = { .reason = SHUTDOWN_reboot };
        int rc;
diff --git a/arch/ia64/configs/generic_defconfig b/arch/ia64/configs/generic_defconfig
index 7913695b2fcb..efbd2929aeb7 100644
--- a/arch/ia64/configs/generic_defconfig
+++ b/arch/ia64/configs/generic_defconfig
@@ -31,7 +31,7 @@ CONFIG_ACPI_FAN=m
 CONFIG_ACPI_DOCK=y
 CONFIG_ACPI_PROCESSOR=m
 CONFIG_ACPI_CONTAINER=m
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=m
 CONFIG_PACKET=y
 CONFIG_UNIX=y
diff --git a/arch/ia64/configs/gensparse_defconfig b/arch/ia64/configs/gensparse_defconfig
index f8e913365423..f64980dd20c3 100644
--- a/arch/ia64/configs/gensparse_defconfig
+++ b/arch/ia64/configs/gensparse_defconfig
@@ -25,7 +25,7 @@ CONFIG_ACPI_BUTTON=m
 CONFIG_ACPI_FAN=m
 CONFIG_ACPI_PROCESSOR=m
 CONFIG_ACPI_CONTAINER=m
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=m
 CONFIG_PACKET=y
 CONFIG_UNIX=y
diff --git a/arch/ia64/configs/tiger_defconfig b/arch/ia64/configs/tiger_defconfig
index a5a9e02e60a0..0f4e9e41f130 100644
--- a/arch/ia64/configs/tiger_defconfig
+++ b/arch/ia64/configs/tiger_defconfig
@@ -31,7 +31,7 @@ CONFIG_ACPI_BUTTON=m
 CONFIG_ACPI_FAN=m
 CONFIG_ACPI_PROCESSOR=m
 CONFIG_ACPI_CONTAINER=m
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=m
 CONFIG_PACKET=y
 CONFIG_UNIX=y
diff --git a/arch/ia64/configs/xen_domu_defconfig b/arch/ia64/configs/xen_domu_defconfig
index 37b9b422caad..b025acfde5c1 100644
--- a/arch/ia64/configs/xen_domu_defconfig
+++ b/arch/ia64/configs/xen_domu_defconfig
@@ -32,7 +32,7 @@ CONFIG_ACPI_BUTTON=m
 CONFIG_ACPI_FAN=m
 CONFIG_ACPI_PROCESSOR=m
 CONFIG_ACPI_CONTAINER=m
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=m
 CONFIG_PACKET=y
 CONFIG_UNIX=y
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index c3abed332301..e12764c2a9d0 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -114,6 +114,7 @@ config BCM47XX
        select FW_CFE
        select HW_HAS_PCI
        select IRQ_CPU
+        select SYS_HAS_CPU_MIPS32_R1
        select NO_EXCEPT_FILL
        select SYS_SUPPORTS_32BIT_KERNEL
        select SYS_SUPPORTS_LITTLE_ENDIAN
diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
index ba611927749b..2b8b118398c4 100644
--- a/arch/mips/bcm47xx/Kconfig
+++ b/arch/mips/bcm47xx/Kconfig
@@ -2,7 +2,6 @@ if BCM47XX
 config BCM47XX_SSB
        bool "SSB Support for Broadcom BCM47XX"
-        select SYS_HAS_CPU_MIPS32_R1
        select SSB
        select SSB_DRIVER_MIPS
        select SSB_DRIVER_EXTIF
diff --git a/arch/mips/include/asm/mach-generic/spaces.h b/arch/mips/include/asm/mach-generic/spaces.h
index 5b2f2e68e57f..9488fa5f8866 100644
--- a/arch/mips/include/asm/mach-generic/spaces.h
+++ b/arch/mips/include/asm/mach-generic/spaces.h
@@ -25,8 +25,12 @@
 #else
 #define CAC_BASE                _AC(0x80000000, UL)
 #endif
+#ifndef IO_BASE
 #define IO_BASE                 _AC(0xa0000000, UL)
+#endif
+#ifndef UNCAC_BASE
 #define UNCAC_BASE              _AC(0xa0000000, UL)
+#endif
 #ifndef MAP_BASE
 #ifdef CONFIG_KVM_GUEST
diff --git a/arch/mips/include/uapi/asm/siginfo.h b/arch/mips/include/uapi/asm/siginfo.h
index b7a23064841f..88e292b7719e 100644
--- a/arch/mips/include/uapi/asm/siginfo.h
+++ b/arch/mips/include/uapi/asm/siginfo.h
@@ -25,11 +25,12 @@ struct siginfo;
 /*
 * Careful to keep union _sifields from shifting ...
 */
-#if __SIZEOF_LONG__ == 4
+#if _MIPS_SZLONG == 32
 #define __ARCH_SI_PREAMBLE_SIZE (3 * sizeof(int))
-#endif
+#elif _MIPS_SZLONG == 64
-#if __SIZEOF_LONG__ == 8
 #define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int))
+#else
+#error _MIPS_SZLONG neither 32 nor 64
 #endif
 #include <asm-generic/siginfo.h>
diff --git a/arch/mips/kernel/bmips_vec.S b/arch/mips/kernel/bmips_vec.S
index f739aedcb509..bd79c4f9bff4 100644
--- a/arch/mips/kernel/bmips_vec.S
+++ b/arch/mips/kernel/bmips_vec.S
@@ -54,7 +54,11 @@ LEAF(bmips_smp_movevec)
        /* set up CPU1 CBR; move BASE to 0xa000_0000 */
        li      k0, 0xff400000
        mtc0    k0, $22, 6
-        li      k1, CKSEG1 | BMIPS_RELO_VECTOR_CONTROL_1
+        /* set up relocation vector address based on thread ID */
+        mfc0    k1, $22, 3
+        srl     k1, 16
+        andi    k1, 0x8000
+        or      k1, CKSEG1 | BMIPS_RELO_VECTOR_CONTROL_0
        or      k0, k1
        li      k1, 0xa0080000
        sw      k1, 0(k0)
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index c0bb4d59076a..159abc8842d2 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -79,15 +79,9 @@ static void __init bmips_smp_setup(void)
         * MIPS interrupts 0,1 (SW INT 0,1) cross over to the other thread
         * MIPS interrupt 2 (HW INT 0) is the CPU0 L1 controller output
         * MIPS interrupt 3 (HW INT 1) is the CPU1 L1 controller output
-         *
-         * If booting from TP1, leave the existing CMT interrupt routing
-         * such that TP0 responds to SW1 and TP1 responds to SW0.
         */
-        if (boot_cpu == 0)
+        change_c0_brcm_cmt_intr(0xf8018000,
-                change_c0_brcm_cmt_intr(0xf8018000,
                                        (0x02 << 27) | (0x03 << 15));
-        else
-                change_c0_brcm_cmt_intr(0xf8018000, (0x1d << 27));
        /* single core, 2 threads (2 pipelines) */
        max_cpus = 2;
@@ -202,9 +196,15 @@ static void bmips_init_secondary(void)
 #if defined(CONFIG_CPU_BMIPS4350) || defined(CONFIG_CPU_BMIPS4380)
        void __iomem *cbr = BMIPS_GET_CBR();
        unsigned long old_vec;
+        unsigned long relo_vector;
+        int boot_cpu;
+        boot_cpu = !!(read_c0_brcm_cmt_local() & (1 << 31));
+        relo_vector = boot_cpu ? BMIPS_RELO_VECTOR_CONTROL_0 :
+                          BMIPS_RELO_VECTOR_CONTROL_1;
-        old_vec = __raw_readl(cbr + BMIPS_RELO_VECTOR_CONTROL_1);
+        old_vec = __raw_readl(cbr + relo_vector);
-        __raw_writel(old_vec & ~0x20000000, cbr + BMIPS_RELO_VECTOR_CONTROL_1);
+        __raw_writel(old_vec & ~0x20000000, cbr + relo_vector);
        clear_c0_cause(smp_processor_id() ? C_SW1 : C_SW0);
 #elif defined(CONFIG_CPU_BMIPS5000)
diff --git a/arch/mips/powertv/asic/asic_devices.c b/arch/mips/powertv/asic/asic_devices.c
index 9f64c2387808..0238af1ba503 100644
--- a/arch/mips/powertv/asic/asic_devices.c
+++ b/arch/mips/powertv/asic/asic_devices.c
@@ -529,8 +529,7 @@ EXPORT_SYMBOL(asic_resource_get);
 */
 void platform_release_memory(void *ptr, int size)
 {
-        free_reserved_area((unsigned long)ptr, (unsigned long)(ptr + size),
+        free_reserved_area(ptr, ptr + size, -1, NULL);
-                           -1, NULL);
 }
 EXPORT_SYMBOL(platform_release_memory);
diff --git a/arch/parisc/configs/c8000_defconfig b/arch/parisc/configs/c8000_defconfig
new file mode 100644
index 000000000000..f11006361297
--- /dev/null
+++ b/arch/parisc/configs/c8000_defconfig
@@ -0,0 +1,279 @@
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_FHANDLE=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_RELAY=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_RD_BZIP2=y
+CONFIG_RD_LZMA=y
+CONFIG_RD_LZO=y
+CONFIG_EXPERT=y
+CONFIG_SYSCTL_SYSCALL=y
+CONFIG_SLAB=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_BLK_DEV_INTEGRITY=y
+CONFIG_PA8X00=y
+CONFIG_MLONGCALLS=y
+CONFIG_64BIT=y
+CONFIG_SMP=y
+CONFIG_PREEMPT=y
+# CONFIG_CROSS_MEMORY_ATTACH is not set
+CONFIG_IOMMU_CCIO=y
+CONFIG_PCI=y
+CONFIG_PCI_LBA=y
+# CONFIG_SUPERIO is not set
+# CONFIG_CHASSIS_LCD_LED is not set
+# CONFIG_PDC_CHASSIS is not set
+# CONFIG_PDC_CHASSIS_WARN is not set
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_BINFMT_MISC=m
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=m
+CONFIG_XFRM_SUB_POLICY=y
+CONFIG_NET_KEY=m
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NET_IPIP=m
+CONFIG_IP_MROUTE=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_DIAG=m
+# CONFIG_IPV6 is not set
+CONFIG_IP_DCCP=m
+# CONFIG_IP_DCCP_CCID3 is not set
+CONFIG_TIPC=m
+CONFIG_LLC2=m
+CONFIG_DNS_RESOLVER=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+# CONFIG_STANDALONE is not set
+CONFIG_PARPORT=y
+CONFIG_PARPORT_PC=y
+CONFIG_PARPORT_PC_FIFO=y
+CONFIG_BLK_DEV_UMEM=m
+CONFIG_BLK_DEV_LOOP=m
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_SX8=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_SIZE=6144
+CONFIG_CDROM_PKTCDVD=m
+CONFIG_CDROM_PKTCDVD_WCACHE=y
+CONFIG_ATA_OVER_ETH=m
+CONFIG_IDE=y
+CONFIG_BLK_DEV_IDECD=y
+CONFIG_BLK_DEV_PLATFORM=y
+CONFIG_BLK_DEV_GENERIC=y
+CONFIG_BLK_DEV_SIIMAGE=y
+CONFIG_SCSI=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_BLK_DEV_SR=m
+CONFIG_CHR_DEV_SG=y
+CONFIG_CHR_DEV_SCH=m
+CONFIG_SCSI_CONSTANTS=y
+CONFIG_SCSI_LOGGING=y
+CONFIG_SCSI_FC_ATTRS=y
+CONFIG_SCSI_SAS_LIBSAS=m
+CONFIG_ISCSI_TCP=m
+CONFIG_ISCSI_BOOT_SYSFS=m
+CONFIG_FUSION=y
+CONFIG_FUSION_SPI=y
+CONFIG_FUSION_SAS=y
+CONFIG_NETDEVICES=y
+CONFIG_DUMMY=m
+CONFIG_NETCONSOLE=m
+CONFIG_TUN=y
+CONFIG_E1000=y
+CONFIG_PPP=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_MPPE=m
+CONFIG_PPPOE=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+# CONFIG_WLAN is not set
+CONFIG_INPUT_FF_MEMLESS=m
+# CONFIG_KEYBOARD_ATKBD is not set
+# CONFIG_KEYBOARD_HIL_OLD is not set
+# CONFIG_KEYBOARD_HIL is not set
+CONFIG_MOUSE_PS2=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_CM109=m
+CONFIG_SERIO_SERPORT=m
+CONFIG_SERIO_PARKBD=m
+CONFIG_SERIO_GSCPS2=m
+# CONFIG_HP_SDC is not set
+CONFIG_SERIO_PCIPS2=m
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SERIO_RAW=m
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_NR_UARTS=8
+CONFIG_SERIAL_8250_RUNTIME_UARTS=8
+CONFIG_SERIAL_8250_EXTENDED=y
+# CONFIG_SERIAL_MUX is not set
+CONFIG_SERIAL_JSM=m
+CONFIG_PRINTER=y
+CONFIG_HW_RANDOM=y
+CONFIG_RAW_DRIVER=m
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_SSB=m
+CONFIG_SSB_DRIVER_PCICORE=y
+CONFIG_AGP=y
+CONFIG_AGP_PARISC=y
+CONFIG_DRM=y
+CONFIG_DRM_RADEON=y
+CONFIG_FIRMWARE_EDID=y
+CONFIG_FB_FOREIGN_ENDIAN=y
+CONFIG_FB_MODE_HELPERS=y
+CONFIG_FB_TILEBLITTING=y
+# CONFIG_FB_STI is not set
+CONFIG_BACKLIGHT_LCD_SUPPORT=y
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_GENERIC is not set
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_STI_CONSOLE is not set
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+# CONFIG_LOGO_LINUX_CLUT224 is not set
+CONFIG_SOUND=m
+CONFIG_SND=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_MIXER_OSS=m
+CONFIG_SND_PCM_OSS=m
+CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_VERBOSE_PRINTK=y
+CONFIG_SND_AD1889=m
+# CONFIG_SND_USB is not set
+# CONFIG_SND_GSC is not set
+CONFIG_HID_A4TECH=m
+CONFIG_HID_APPLE=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_CHERRY=m
+CONFIG_HID_CHICONY=m
+CONFIG_HID_CYPRESS=m
+CONFIG_HID_DRAGONRISE=m
+CONFIG_HID_EZKEY=m
+CONFIG_HID_KYE=m
+CONFIG_HID_GYRATION=m
+CONFIG_HID_TWINHAN=m
+CONFIG_HID_KENSINGTON=m
+CONFIG_HID_LOGITECH=m
+CONFIG_HID_LOGITECH_DJ=m
+CONFIG_HID_MICROSOFT=m
+CONFIG_HID_MONTEREY=m
+CONFIG_HID_NTRIG=m
+CONFIG_HID_ORTEK=m
+CONFIG_HID_PANTHERLORD=m
+CONFIG_HID_PETALYNX=m
+CONFIG_HID_SAMSUNG=m
+CONFIG_HID_SUNPLUS=m
+CONFIG_HID_GREENASIA=m
+CONFIG_HID_SMARTJOYPLUS=m
+CONFIG_HID_TOPSEED=m
+CONFIG_HID_THRUSTMASTER=m
+CONFIG_HID_ZEROPLUS=m
+CONFIG_USB_HID=m
+CONFIG_USB=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_STORAGE=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_XATTR=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT3_FS=y
+# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
+CONFIG_EXT4_FS=m
+CONFIG_REISERFS_FS=m
+CONFIG_REISERFS_PROC_INFO=y
+CONFIG_XFS_FS=m
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_QUOTA=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_AUTOFS4_FS=m
+CONFIG_FUSE_FS=m
+CONFIG_ISO9660_FS=y
+CONFIG_JOLIET=y
+CONFIG_MSDOS_FS=m
+CONFIG_VFAT_FS=m
+CONFIG_PROC_KCORE=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_XATTR=y
+CONFIG_NFS_FS=m
+CONFIG_NLS_CODEPAGE_437=m
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=m
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_NLS_UTF8=m
+CONFIG_UNUSED_SYMBOLS=y
+CONFIG_DEBUG_FS=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_SLAB=y
+CONFIG_DEBUG_SLAB_LEAK=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DEBUG_STACKOVERFLOW=y
+CONFIG_LOCKUP_DETECTOR=y
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_DEBUG_RT_MUTEXES=y
+CONFIG_RT_MUTEX_TESTER=y
+CONFIG_PROVE_RCU_DELAY=y
+CONFIG_DEBUG_BLOCK_EXT_DEVT=y
+CONFIG_LATENCYTOP=y
+CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
+CONFIG_KEYS=y
+# CONFIG_CRYPTO_HW is not set
+CONFIG_FONTS=y
diff --git a/arch/parisc/include/asm/parisc-device.h b/arch/parisc/include/asm/parisc-device.h
index 9afdad6c2ffb..eaf4dc1c7294 100644
--- a/arch/parisc/include/asm/parisc-device.h
+++ b/arch/parisc/include/asm/parisc-device.h
@@ -23,6 +23,7 @@ struct parisc_device {
        /* generic info returned from pdc_pat_cell_module() */
        unsigned long   mod_info;       /* PAT specific - Misc Module info */
        unsigned long   pmod_loc;       /* physical Module location */
+        unsigned long   mod0;
 #endif
        u64             dma_mask;       /* DMA mask for I/O */
        struct device   dev;
@@ -61,4 +62,6 @@ parisc_get_drvdata(struct parisc_device *d)
 extern struct bus_type parisc_bus_type;
+int iosapic_serial_irq(struct parisc_device *dev);
 #endif /*_ASM_PARISC_PARISC_DEVICE_H_*/
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index 2e65aa54bd10..c035673209f7 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -71,18 +71,27 @@ flush_cache_all_local(void)
 }
 EXPORT_SYMBOL(flush_cache_all_local);
+/* Virtual address of pfn.  */
+#define pfn_va(pfn)     __va(PFN_PHYS(pfn))
 void
 update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t *ptep)
 {
-        struct page *page = pte_page(*ptep);
+        unsigned long pfn = pte_pfn(*ptep);
+        struct page *page;
-        if (pfn_valid(page_to_pfn(page)) && page_mapping(page) &&
+        /* We don't have pte special.  As a result, we can be called with
-            test_bit(PG_dcache_dirty, &page->flags)) {
+           an invalid pfn and we don't need to flush the kernel dcache page.
+           This occurs with FireGL card in C8000.  */
+        if (!pfn_valid(pfn))
+                return;
-                flush_kernel_dcache_page(page);
+        page = pfn_to_page(pfn);
+        if (page_mapping(page) && test_bit(PG_dcache_dirty, &page->flags)) {
+                flush_kernel_dcache_page_addr(pfn_va(pfn));
                clear_bit(PG_dcache_dirty, &page->flags);
        } else if (parisc_requires_coherency())
-                flush_kernel_dcache_page(page);
+                flush_kernel_dcache_page_addr(pfn_va(pfn));
 }
 void
@@ -495,44 +504,42 @@ static inline pte_t *get_ptep(pgd_t *pgd, unsigned long addr)
 void flush_cache_mm(struct mm_struct *mm)
 {
+        struct vm_area_struct *vma;
+        pgd_t *pgd;
        /* Flushing the whole cache on each cpu takes forever on
           rp3440, etc.  So, avoid it if the mm isn't too big.  */
-        if (mm_total_size(mm) < parisc_cache_flush_threshold) {
+        if (mm_total_size(mm) >= parisc_cache_flush_threshold) {
-                struct vm_area_struct *vma;
+                flush_cache_all();
+                return;
-                if (mm->context == mfsp(3)) {
+        }
-                        for (vma = mm->mmap; vma; vma = vma->vm_next) {
-                                flush_user_dcache_range_asm(vma->vm_start,
+        if (mm->context == mfsp(3)) {
-                                        vma->vm_end);
+                for (vma = mm->mmap; vma; vma = vma->vm_next) {
-                                if (vma->vm_flags & VM_EXEC)
+                        flush_user_dcache_range_asm(vma->vm_start, vma->vm_end);
-                                        flush_user_icache_range_asm(
+                        if ((vma->vm_flags & VM_EXEC) == 0)
-                                          vma->vm_start, vma->vm_end);
+                                continue;
-                        }
+                        flush_user_icache_range_asm(vma->vm_start, vma->vm_end);
-                } else {
-                        pgd_t *pgd = mm->pgd;
-                        for (vma = mm->mmap; vma; vma = vma->vm_next) {
-                                unsigned long addr;
-                                for (addr = vma->vm_start; addr < vma->vm_end;
-                                     addr += PAGE_SIZE) {
-                                        pte_t *ptep = get_ptep(pgd, addr);
-                                        if (ptep != NULL) {
-                                                pte_t pte = *ptep;
-                                                __flush_cache_page(vma, addr,
-                                                  page_to_phys(pte_page(pte)));
-                                        }
-                                }
-                        }
                }
                return;
        }
-#ifdef CONFIG_SMP
+        pgd = mm->pgd;
-        flush_cache_all();
+        for (vma = mm->mmap; vma; vma = vma->vm_next) {
-#else
+                unsigned long addr;
-        flush_cache_all_local();
-#endif
+                for (addr = vma->vm_start; addr < vma->vm_end;
+                     addr += PAGE_SIZE) {
+                        unsigned long pfn;
+                        pte_t *ptep = get_ptep(pgd, addr);
+                        if (!ptep)
+                                continue;
+                        pfn = pte_pfn(*ptep);
+                        if (!pfn_valid(pfn))
+                                continue;
+                        __flush_cache_page(vma, addr, PFN_PHYS(pfn));
+                }
+        }
 }
 void
@@ -556,33 +563,32 @@ flush_user_icache_range(unsigned long start, unsigned long end)
 void flush_cache_range(struct vm_area_struct *vma,
                unsigned long start, unsigned long end)
 {
+        unsigned long addr;
+        pgd_t *pgd;
        BUG_ON(!vma->vm_mm->context);
-        if ((end - start) < parisc_cache_flush_threshold) {
+        if ((end - start) >= parisc_cache_flush_threshold) {
-                if (vma->vm_mm->context == mfsp(3)) {
-                        flush_user_dcache_range_asm(start, end);
-                        if (vma->vm_flags & VM_EXEC)
-                                flush_user_icache_range_asm(start, end);
-                } else {
-                        unsigned long addr;
-                        pgd_t *pgd = vma->vm_mm->pgd;
-                        for (addr = start & PAGE_MASK; addr < end;
-                             addr += PAGE_SIZE) {
-                                pte_t *ptep = get_ptep(pgd, addr);
-                                if (ptep != NULL) {
-                                        pte_t pte = *ptep;
-                                        flush_cache_page(vma,
-                                           addr, pte_pfn(pte));
-                                }
-                        }
-                }
-        } else {
-#ifdef CONFIG_SMP
                flush_cache_all();
-#else
+                return;
-                flush_cache_all_local();
+        }
-#endif
+        if (vma->vm_mm->context == mfsp(3)) {
+                flush_user_dcache_range_asm(start, end);
+                if (vma->vm_flags & VM_EXEC)
+                        flush_user_icache_range_asm(start, end);
+                return;
+        }
+        pgd = vma->vm_mm->pgd;
+        for (addr = start & PAGE_MASK; addr < end; addr += PAGE_SIZE) {
+                unsigned long pfn;
+                pte_t *ptep = get_ptep(pgd, addr);
+                if (!ptep)
+                        continue;
+                pfn = pte_pfn(*ptep);
+                if (pfn_valid(pfn))
+                        __flush_cache_page(vma, addr, PFN_PHYS(pfn));
        }
 }
@@ -591,9 +597,10 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
 {
        BUG_ON(!vma->vm_mm->context);
-        flush_tlb_page(vma, vmaddr);
+        if (pfn_valid(pfn)) {
-        __flush_cache_page(vma, vmaddr, page_to_phys(pfn_to_page(pfn)));
+                flush_tlb_page(vma, vmaddr);
+                __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
+        }
 }
 #ifdef CONFIG_PARISC_TMPALIAS
diff --git a/arch/parisc/kernel/inventory.c b/arch/parisc/kernel/inventory.c
index 3295ef4a185d..f0b6722fc706 100644
--- a/arch/parisc/kernel/inventory.c
+++ b/arch/parisc/kernel/inventory.c
@@ -211,6 +211,7 @@ pat_query_module(ulong pcell_loc, ulong mod_index)
        /* REVISIT: who is the consumer of this? not sure yet... */
        dev->mod_info = pa_pdc_cell->mod_info;  /* pass to PAT_GET_ENTITY() */
        dev->pmod_loc = pa_pdc_cell->mod_location;
+        dev->mod0 = pa_pdc_cell->mod[0];
        register_parisc_device(dev);    /* advertise device */
diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
index 940188d1942c..07349b002687 100644
--- a/arch/parisc/kernel/signal.c
+++ b/arch/parisc/kernel/signal.c
@@ -56,13 +56,6 @@
 #define A(__x)  ((unsigned long)(__x))
 /*
- * Atomically swap in the new signal mask, and wait for a signal.
- */
-#ifdef CONFIG_64BIT
-#include "sys32.h"
-#endif
-/*
 * Do a signal return - restore sigcontext.
 */
diff --git a/arch/parisc/kernel/signal32.c b/arch/parisc/kernel/signal32.c
index 33eca1b04926..6c6a271a6140 100644
--- a/arch/parisc/kernel/signal32.c
+++ b/arch/parisc/kernel/signal32.c
@@ -34,7 +34,6 @@
 #include <asm/uaccess.h>
 #include "signal32.h"
-#include "sys32.h"
 #define DEBUG_COMPAT_SIG 0 
 #define DEBUG_COMPAT_SIG_LEVEL 2
diff --git a/arch/parisc/kernel/sys32.h b/arch/parisc/kernel/sys32.h
deleted file mode 100644
index 60dd470f39f8..000000000000
--- a/arch/parisc/kernel/sys32.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/* 
- *    Copyright (C) 2002 Richard Hirst <rhirst at parisc-linux.org>
- *    Copyright (C) 2003 James Bottomley <jejb at parisc-linux.org>
- *    Copyright (C) 2003 Randolph Chung <tausq with parisc-linux.org>
- *
- *    This program is free software; you can redistribute it and/or modify
- *    it under the terms of the GNU General Public License as published by
- *    the Free Software Foundation; either version 2 of the License, or
- *    (at your option) any later version.
- *
- *    This program is distributed in the hope that it will be useful,
- *    but WITHOUT ANY WARRANTY; without even the implied warranty of
- *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *    GNU General Public License for more details.
- *
- *    You should have received a copy of the GNU General Public License
- *    along with this program; if not, write to the Free Software
- *    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-#ifndef _PARISC64_KERNEL_SYS32_H
-#define _PARISC64_KERNEL_SYS32_H
-#include <linux/compat.h>
-/* Call a kernel syscall which will use kernel space instead of user
- * space for its copy_to/from_user.
- */
-#define KERNEL_SYSCALL(ret, syscall, args...) \
-{ \
-    mm_segment_t old_fs = get_fs(); \
-    set_fs(KERNEL_DS); \
-    ret = syscall(args); \
-    set_fs (old_fs); \
-}
-#endif
diff --git a/arch/parisc/kernel/sys_parisc32.c b/arch/parisc/kernel/sys_parisc32.c
index a134ff4da12e..bb9f3b64de55 100644
--- a/arch/parisc/kernel/sys_parisc32.c
+++ b/arch/parisc/kernel/sys_parisc32.c
@@ -42,8 +42,6 @@
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
-#include "sys32.h"
 #undef DEBUG
 #ifdef DEBUG
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index c86fcb92358e..0e8cfd09da2f 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -58,7 +58,7 @@ CONFIG_SCHED_SMT=y
 CONFIG_PPC_DENORMALISATION=y
 CONFIG_PCCARD=y
 CONFIG_ELECTRA_CF=y
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_RPA=m
 CONFIG_HOTPLUG_PCI_RPA_DLPAR=m
 CONFIG_PACKET=y
diff --git a/arch/powerpc/configs/ppc64e_defconfig b/arch/powerpc/configs/ppc64e_defconfig
index 4b20f76172e2..0085dc4642c5 100644
--- a/arch/powerpc/configs/ppc64e_defconfig
+++ b/arch/powerpc/configs/ppc64e_defconfig
@@ -32,7 +32,7 @@ CONFIG_IRQ_ALL_CPUS=y
 CONFIG_SPARSEMEM_MANUAL=y
 CONFIG_PCI_MSI=y
 CONFIG_PCCARD=y
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_XFRM_USER=m
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index bea8587c3af5..1d4b9763895d 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -53,7 +53,7 @@ CONFIG_PPC_64K_PAGES=y
 CONFIG_PPC_SUBPAGE_PROT=y
 CONFIG_SCHED_SMT=y
 CONFIG_PPC_DENORMALISATION=y
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_RPA=m
 CONFIG_HOTPLUG_PCI_RPA_DLPAR=m
 CONFIG_PACKET=y
diff --git a/arch/powerpc/include/asm/perf_event_server.h b/arch/powerpc/include/asm/perf_event_server.h
index 2dd7bfc459be..8b2492644754 100644
--- a/arch/powerpc/include/asm/perf_event_server.h
+++ b/arch/powerpc/include/asm/perf_event_server.h
@@ -12,6 +12,7 @@
 #include <linux/types.h>
 #include <asm/hw_irq.h>
 #include <linux/device.h>
+#include <uapi/asm/perf_event.h>
 #define MAX_HWEVENTS            8
 #define MAX_EVENT_ALTERNATIVES  8
@@ -69,11 +70,6 @@ struct power_pmu {
 #define PPMU_LIMITED_PMC_REQD   2       /* have to put this on a limited PMC */
 #define PPMU_ONLY_COUNT_RUN     4       /* only counting in run state */
-/*
- * We use the event config bit 63 as a flag to request EBB.
- */
-#define EVENT_CONFIG_EBB_SHIFT  63
 extern int register_power_pmu(struct power_pmu *);
 struct pt_regs;
diff --git a/arch/powerpc/include/asm/smp.h b/arch/powerpc/include/asm/smp.h
index ffbaabebcdca..48cfc858abd6 100644
--- a/arch/powerpc/include/asm/smp.h
+++ b/arch/powerpc/include/asm/smp.h
@@ -145,6 +145,10 @@ extern void __cpu_die(unsigned int cpu);
 #define smp_setup_cpu_maps()
 static inline void inhibit_secondary_onlining(void) {}
 static inline void uninhibit_secondary_onlining(void) {}
+static inline const struct cpumask *cpu_sibling_mask(int cpu)
+{
+        return cpumask_of(cpu);
+}
 #endif /* CONFIG_SMP */
diff --git a/arch/powerpc/include/uapi/asm/Kbuild b/arch/powerpc/include/uapi/asm/Kbuild
index 5182c8622b54..48be855ef37b 100644
--- a/arch/powerpc/include/uapi/asm/Kbuild
+++ b/arch/powerpc/include/uapi/asm/Kbuild
@@ -20,6 +20,7 @@ header-y += mman.h
 header-y += msgbuf.h
 header-y += nvram.h
 header-y += param.h
+header-y += perf_event.h
 header-y += poll.h
 header-y += posix_types.h
 header-y += ps3fb.h
diff --git a/arch/powerpc/include/uapi/asm/perf_event.h b/arch/powerpc/include/uapi/asm/perf_event.h
new file mode 100644
index 000000000000..80a4d40cf5bc
--- /dev/null
+++ b/arch/powerpc/include/uapi/asm/perf_event.h
@@ -0,0 +1,18 @@
+/*
+ * Copyright 2013 Michael Ellerman, IBM Corp.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2 of the
+ * License.
+ */
+#ifndef _UAPI_ASM_POWERPC_PERF_EVENT_H
+#define _UAPI_ASM_POWERPC_PERF_EVENT_H
+/*
+ * We use bit 63 of perf_event_attr.config as a flag to request EBB.
+ */
+#define PERF_EVENT_CONFIG_EBB_SHIFT     63
+#endif /* _UAPI_ASM_POWERPC_PERF_EVENT_H */
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 2e51cde616d2..c69440cef7af 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -362,7 +362,7 @@ int arch_show_interrupts(struct seq_file *p, int prec)
                seq_printf(p, "%10u ", per_cpu(irq_stat, j).spurious_irqs);
        seq_printf(p, "  Spurious interrupts\n");
-        seq_printf(p, "%*s: ", prec, "CNT");
+        seq_printf(p, "%*s: ", prec, "PMI");
        for_each_online_cpu(j)
                seq_printf(p, "%10u ", per_cpu(irq_stat, j).pmu_irqs);
        seq_printf(p, "  Performance monitoring interrupts\n");
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 08397217e8ac..5850798826cd 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -27,6 +27,7 @@
 #include <linux/seq_file.h>
 #include <linux/uaccess.h>
 #include <linux/slab.h>
+#include <asm/cputhreads.h>
 #include <asm/sparsemem.h>
 #include <asm/prom.h>
 #include <asm/smp.h>
@@ -1318,7 +1319,8 @@ static int update_cpu_associativity_changes_mask(void)
                        }
                }
                if (changed) {
-                        cpumask_set_cpu(cpu, changes);
+                        cpumask_or(changes, changes, cpu_sibling_mask(cpu));
+                        cpu = cpu_last_thread_sibling(cpu);
                }
        }
@@ -1426,7 +1428,7 @@ static int update_cpu_topology(void *data)
        if (!data)
                return -EINVAL;
-        cpu = get_cpu();
+        cpu = smp_processor_id();
        for (update = data; update; update = update->next) {
                if (cpu != update->cpu)
@@ -1446,12 +1448,12 @@ static int update_cpu_topology(void *data)
 */
 int arch_update_cpu_topology(void)
 {
-        unsigned int cpu, changed = 0;
+        unsigned int cpu, sibling, changed = 0;
        struct topology_update_data *updates, *ud;
        unsigned int associativity[VPHN_ASSOC_BUFSIZE] = {0};
        cpumask_t updated_cpus;
        struct device *dev;
-        int weight, i = 0;
+        int weight, new_nid, i = 0;
        weight = cpumask_weight(&cpu_associativity_changes_mask);
        if (!weight)
@@ -1464,19 +1466,46 @@ int arch_update_cpu_topology(void)
        cpumask_clear(&updated_cpus);
        for_each_cpu(cpu, &cpu_associativity_changes_mask) {
-                ud = &updates[i++];
+                /*
-                ud->cpu = cpu;
+                 * If siblings aren't flagged for changes, updates list
-                vphn_get_associativity(cpu, associativity);
+                 * will be too short. Skip on this update and set for next
-                ud->new_nid = associativity_to_nid(associativity);
+                 * update.
+                 */
-                if (ud->new_nid < 0 || !node_online(ud->new_nid))
+                if (!cpumask_subset(cpu_sibling_mask(cpu),
-                        ud->new_nid = first_online_node;
+                                        &cpu_associativity_changes_mask)) {
+                        pr_info("Sibling bits not set for associativity "
+                                        "change, cpu%d\n", cpu);
+                        cpumask_or(&cpu_associativity_changes_mask,
+                                        &cpu_associativity_changes_mask,
+                                        cpu_sibling_mask(cpu));
+                        cpu = cpu_last_thread_sibling(cpu);
+                        continue;
+                }
-                ud->old_nid = numa_cpu_lookup_table[cpu];
+                /* Use associativity from first thread for all siblings */
-                cpumask_set_cpu(cpu, &updated_cpus);
+                vphn_get_associativity(cpu, associativity);
+                new_nid = associativity_to_nid(associativity);
+                if (new_nid < 0 || !node_online(new_nid))
+                        new_nid = first_online_node;
+                if (new_nid == numa_cpu_lookup_table[cpu]) {
+                        cpumask_andnot(&cpu_associativity_changes_mask,
+                                        &cpu_associativity_changes_mask,
+                                        cpu_sibling_mask(cpu));
+                        cpu = cpu_last_thread_sibling(cpu);
+                        continue;
+                }
-                if (i < weight)
+                for_each_cpu(sibling, cpu_sibling_mask(cpu)) {
-                        ud->next = &updates[i];
+                        ud = &updates[i++];
+                        ud->cpu = sibling;
+                        ud->new_nid = new_nid;
+                        ud->old_nid = numa_cpu_lookup_table[sibling];
+                        cpumask_set_cpu(sibling, &updated_cpus);
+                        if (i < weight)
+                                ud->next = &updates[i];
+                }
+                cpu = cpu_last_thread_sibling(cpu);
        }
        stop_machine(update_cpu_topology, &updates[0], &updated_cpus);
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 24a45f91c65f..eeae308cf982 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -484,7 +484,7 @@ static bool is_ebb_event(struct perf_event *event)
         * use bit 63 of the event code for something else if they wish.
         */
        return (ppmu->flags & PPMU_EBB) &&
-               ((event->attr.config >> EVENT_CONFIG_EBB_SHIFT) & 1);
+               ((event->attr.config >> PERF_EVENT_CONFIG_EBB_SHIFT) & 1);
 }
 static int ebb_event_check(struct perf_event *event)
diff --git a/arch/powerpc/perf/power8-pmu.c b/arch/powerpc/perf/power8-pmu.c
index 7466374d2787..2ee4a707f0df 100644
--- a/arch/powerpc/perf/power8-pmu.c
+++ b/arch/powerpc/perf/power8-pmu.c
@@ -118,7 +118,7 @@
         (EVENT_UNIT_MASK      << EVENT_UNIT_SHIFT)             |       \
         (EVENT_COMBINE_MASK   << EVENT_COMBINE_SHIFT)          |       \
         (EVENT_MARKED_MASK    << EVENT_MARKED_SHIFT)           |       \
-         (EVENT_EBB_MASK       << EVENT_CONFIG_EBB_SHIFT)       |       \
+         (EVENT_EBB_MASK       << PERF_EVENT_CONFIG_EBB_SHIFT)  |       \
          EVENT_PSEL_MASK)
 /* MMCRA IFM bits - POWER8 */
@@ -233,10 +233,10 @@ static int power8_get_constraint(u64 event, unsigned long *maskp, unsigned long
        pmc   = (event >> EVENT_PMC_SHIFT)        & EVENT_PMC_MASK;
        unit  = (event >> EVENT_UNIT_SHIFT)       & EVENT_UNIT_MASK;
        cache = (event >> EVENT_CACHE_SEL_SHIFT)  & EVENT_CACHE_SEL_MASK;
-        ebb   = (event >> EVENT_CONFIG_EBB_SHIFT) & EVENT_EBB_MASK;
+        ebb   = (event >> PERF_EVENT_CONFIG_EBB_SHIFT) & EVENT_EBB_MASK;
        /* Clear the EBB bit in the event, so event checks work below */
-        event &= ~(EVENT_EBB_MASK << EVENT_CONFIG_EBB_SHIFT);
+        event &= ~(EVENT_EBB_MASK << PERF_EVENT_CONFIG_EBB_SHIFT);
        if (pmc) {
                if (pmc > 6)
diff --git a/arch/sh/configs/sh03_defconfig b/arch/sh/configs/sh03_defconfig
index 2051821724c6..0cf4097b71e8 100644
--- a/arch/sh/configs/sh03_defconfig
+++ b/arch/sh/configs/sh03_defconfig
@@ -22,7 +22,7 @@ CONFIG_PREEMPT=y
 CONFIG_CMDLINE_OVERWRITE=y
 CONFIG_CMDLINE="console=ttySC1,115200 mem=64M root=/dev/nfs"
 CONFIG_PCI=y
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_BINFMT_MISC=y
 CONFIG_NET=y
 CONFIG_PACKET=y
diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c
index e2703520d120..c370e1c4468b 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
+++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
@@ -111,8 +111,8 @@ static struct severity {
 #ifdef  CONFIG_MEMORY_FAILURE
        MCESEV(
                KEEP, "Action required but unaffected thread is continuable",
-                SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR|MCACOD, MCI_UC_SAR|MCI_ADDR),
+                SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR, MCI_UC_SAR|MCI_ADDR),
-                MCGMASK(MCG_STATUS_RIPV, MCG_STATUS_RIPV)
+                MCGMASK(MCG_STATUS_RIPV|MCG_STATUS_EIPV, MCG_STATUS_RIPV)
                ),
        MCESEV(
                AR, "Action required: data load error in a user process",
diff --git a/arch/x86/platform/ce4100/ce4100.c b/arch/x86/platform/ce4100/ce4100.c
index 643b8b5eee86..8244f5ec2f4c 100644
--- a/arch/x86/platform/ce4100/ce4100.c
+++ b/arch/x86/platform/ce4100/ce4100.c
@@ -12,6 +12,7 @@
 #include <linux/kernel.h>
 #include <linux/irq.h>
 #include <linux/module.h>
+#include <linux/reboot.h>
 #include <linux/serial_reg.h>
 #include <linux/serial_8250.h>
 #include <linux/reboot.h>
diff --git a/drivers/accessibility/braille/braille_console.c b/drivers/accessibility/braille/braille_console.c
index d21167bfc865..dc34a5b8bcee 100644
--- a/drivers/accessibility/braille/braille_console.c
+++ b/drivers/accessibility/braille/braille_console.c
@@ -359,6 +359,9 @@ int braille_register_console(struct console *console, int index,
                char *console_options, char *braille_options)
 {
        int ret;
+        if (!(console->flags & CON_BRL))
+                return 0;
        if (!console_options)
                /* Only support VisioBraille for now */
                console_options = "57600o8";
@@ -374,15 +377,17 @@ int braille_register_console(struct console *console, int index,
        braille_co = console;
        register_keyboard_notifier(&keyboard_notifier_block);
        register_vt_notifier(&vt_notifier_block);
-        return 0;
+        return 1;
 }
 int braille_unregister_console(struct console *console)
 {
        if (braille_co != console)
                return -EINVAL;
+        if (!(console->flags & CON_BRL))
+                return 0;
        unregister_keyboard_notifier(&keyboard_notifier_block);
        unregister_vt_notifier(&vt_notifier_block);
        braille_co = NULL;
-        return 0;
+        return 1;
 }
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 082b4dd252a8..d405fbad406a 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -117,6 +117,7 @@ struct acpi_battery {
        struct acpi_device *device;
        struct notifier_block pm_nb;
        unsigned long update_time;
+        int revision;
        int rate_now;
        int capacity_now;
        int voltage_now;
@@ -359,6 +360,7 @@ static struct acpi_offsets info_offsets[] = {
 };
 static struct acpi_offsets extended_info_offsets[] = {
+        {offsetof(struct acpi_battery, revision), 0},
        {offsetof(struct acpi_battery, power_unit), 0},
        {offsetof(struct acpi_battery, design_capacity), 0},
        {offsetof(struct acpi_battery, full_charge_capacity), 0},
diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
index bf5d2477cb77..15f2e7025b78 100644
--- a/drivers/char/agp/parisc-agp.c
+++ b/drivers/char/agp/parisc-agp.c
@@ -129,7 +129,8 @@ parisc_agp_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
        off_t j, io_pg_start;
        int io_pg_count;
-        if (type != 0 || mem->type != 0) {
+        if (type != mem->type ||
+                agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type)) {
                return -EINVAL;
        }
@@ -175,7 +176,8 @@ parisc_agp_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
        struct _parisc_agp_info *info = &parisc_agp_info;
        int i, io_pg_start, io_pg_count;
-        if (type != 0 || mem->type != 0) {
+        if (type != mem->type ||
+                agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type)) {
                return -EINVAL;
        }
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index a4ad7339588d..f0a5e2b0eb8a 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1177,14 +1177,11 @@ static int __cpufreq_remove_dev(struct device *dev,
                                __func__, cpu_dev->id, cpu);
        }
-        if ((cpus == 1) && (cpufreq_driver->target))
-                __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
-        pr_debug("%s: removing link, cpu: %d\n", __func__, cpu);
-        cpufreq_cpu_put(data);
        /* If cpu is last user of policy, free policy */
        if (cpus == 1) {
+                if (cpufreq_driver->target)
+                        __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
                lock_policy_rwsem_read(cpu);
                kobj = &data->kobj;
                cmp = &data->kobj_unregister;
@@ -1205,9 +1202,13 @@ static int __cpufreq_remove_dev(struct device *dev,
                free_cpumask_var(data->related_cpus);
                free_cpumask_var(data->cpus);
                kfree(data);
-        } else if (cpufreq_driver->target) {
+        } else {
-                __cpufreq_governor(data, CPUFREQ_GOV_START);
+                pr_debug("%s: removing link, cpu: %d\n", __func__, cpu);
-                __cpufreq_governor(data, CPUFREQ_GOV_LIMITS);
+                cpufreq_cpu_put(data);
+                if (cpufreq_driver->target) {
+                        __cpufreq_governor(data, CPUFREQ_GOV_START);
+                        __cpufreq_governor(data, CPUFREQ_GOV_LIMITS);
+                }
        }
        per_cpu(cpufreq_policy_cpu, cpu) = -1;
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index fe343a06b7da..bc580b67a652 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -28,13 +28,6 @@
 #define MAX_INTERESTING 50000
 #define STDDEV_THRESH 400
-/* 60 * 60 > STDDEV_THRESH * INTERVALS = 400 * 8 */
-#define MAX_DEVIATION 60
-static DEFINE_PER_CPU(struct hrtimer, menu_hrtimer);
-static DEFINE_PER_CPU(int, hrtimer_status);
-/* menu hrtimer mode */
-enum {MENU_HRTIMER_STOP, MENU_HRTIMER_REPEAT, MENU_HRTIMER_GENERAL};
 /*
 * Concepts and ideas behind the menu governor
@@ -116,13 +109,6 @@ enum {MENU_HRTIMER_STOP, MENU_HRTIMER_REPEAT, MENU_HRTIMER_GENERAL};
 *
 */
-/*
- * The C-state residency is so long that is is worthwhile to exit
- * from the shallow C-state and re-enter into a deeper C-state.
- */
-static unsigned int perfect_cstate_ms __read_mostly = 30;
-module_param(perfect_cstate_ms, uint, 0000);
 struct menu_device {
        int             last_state_idx;
        int             needs_update;
@@ -205,52 +191,17 @@ static u64 div_round64(u64 dividend, u32 divisor)
        return div_u64(dividend + (divisor / 2), divisor);
 }
-/* Cancel the hrtimer if it is not triggered yet */
-void menu_hrtimer_cancel(void)
-{
-        int cpu = smp_processor_id();
-        struct hrtimer *hrtmr = &per_cpu(menu_hrtimer, cpu);
-        /* The timer is still not time out*/
-        if (per_cpu(hrtimer_status, cpu)) {
-                hrtimer_cancel(hrtmr);
-                per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_STOP;
-        }
-}
-EXPORT_SYMBOL_GPL(menu_hrtimer_cancel);
-/* Call back for hrtimer is triggered */
-static enum hrtimer_restart menu_hrtimer_notify(struct hrtimer *hrtimer)
-{
-        int cpu = smp_processor_id();
-        struct menu_device *data = &per_cpu(menu_devices, cpu);
-        /* In general case, the expected residency is much larger than
-         *  deepest C-state target residency, but prediction logic still
-         *  predicts a small predicted residency, so the prediction
-         *  history is totally broken if the timer is triggered.
-         *  So reset the correction factor.
-         */
-        if (per_cpu(hrtimer_status, cpu) == MENU_HRTIMER_GENERAL)
-                data->correction_factor[data->bucket] = RESOLUTION * DECAY;
-        per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_STOP;
-        return HRTIMER_NORESTART;
-}
 /*
 * Try detecting repeating patterns by keeping track of the last 8
 * intervals, and checking if the standard deviation of that set
 * of points is below a threshold. If it is... then use the
 * average of these 8 points as the estimated value.
 */
-static u32 get_typical_interval(struct menu_device *data)
+static void get_typical_interval(struct menu_device *data)
 {
        int i = 0, divisor = 0;
        uint64_t max = 0, avg = 0, stddev = 0;
        int64_t thresh = LLONG_MAX; /* Discard outliers above this value. */
-        unsigned int ret = 0;
 again:
@@ -291,16 +242,13 @@ again:
        if (((avg > stddev * 6) && (divisor * 4 >= INTERVALS * 3))
                                                        || stddev <= 20) {
                data->predicted_us = avg;
-                ret = 1;
+                return;
-                return ret;
        } else if ((divisor * 4) > INTERVALS * 3) {
                /* Exclude the max interval */
                thresh = max - 1;
                goto again;
        }
-        return ret;
 }
 /**
@@ -315,9 +263,6 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
        int i;
        int multiplier;
        struct timespec t;
-        int repeat = 0, low_predicted = 0;
-        int cpu = smp_processor_id();
-        struct hrtimer *hrtmr = &per_cpu(menu_hrtimer, cpu);
        if (data->needs_update) {
                menu_update(drv, dev);
@@ -352,7 +297,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
        data->predicted_us = div_round64(data->expected_us * data->correction_factor[data->bucket],
                                         RESOLUTION * DECAY);
-        repeat = get_typical_interval(data);
+        get_typical_interval(data);
        /*
         * We want to default to C1 (hlt), not to busy polling
@@ -373,10 +318,8 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
                if (s->disabled || su->disable)
                        continue;
-                if (s->target_residency > data->predicted_us) {
+                if (s->target_residency > data->predicted_us)
-                        low_predicted = 1;
                        continue;
-                }
                if (s->exit_latency > latency_req)
                        continue;
                if (s->exit_latency * multiplier > data->predicted_us)
@@ -386,44 +329,6 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
                data->exit_us = s->exit_latency;
        }
-        /* not deepest C-state chosen for low predicted residency */
-        if (low_predicted) {
-                unsigned int timer_us = 0;
-                unsigned int perfect_us = 0;
-                /*
-                 * Set a timer to detect whether this sleep is much
-                 * longer than repeat mode predicted.  If the timer
-                 * triggers, the code will evaluate whether to put
-                 * the CPU into a deeper C-state.
-                 * The timer is cancelled on CPU wakeup.
-                 */
-                timer_us = 2 * (data->predicted_us + MAX_DEVIATION);
-                perfect_us = perfect_cstate_ms * 1000;
-                if (repeat && (4 * timer_us < data->expected_us)) {
-                        RCU_NONIDLE(hrtimer_start(hrtmr,
-                                ns_to_ktime(1000 * timer_us),
-                                HRTIMER_MODE_REL_PINNED));
-                        /* In repeat case, menu hrtimer is started */
-                        per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_REPEAT;
-                } else if (perfect_us < data->expected_us) {
-                        /*
-                         * The next timer is long. This could be because
-                         * we did not make a useful prediction.
-                         * In that case, it makes sense to re-enter
-                         * into a deeper C-state after some time.
-                         */
-                        RCU_NONIDLE(hrtimer_start(hrtmr,
-                                ns_to_ktime(1000 * timer_us),
-                                HRTIMER_MODE_REL_PINNED));
-                        /* In general case, menu hrtimer is started */
-                        per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_GENERAL;
-                }
-        }
        return data->last_state_idx;
 }
@@ -514,9 +419,6 @@ static int menu_enable_device(struct cpuidle_driver *drv,
                                struct cpuidle_device *dev)
 {
        struct menu_device *data = &per_cpu(menu_devices, dev->cpu);
-        struct hrtimer *t = &per_cpu(menu_hrtimer, dev->cpu);
-        hrtimer_init(t, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
-        t->function = menu_hrtimer_notify;
        memset(data, 0, sizeof(struct menu_device));
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 7ef316fdc4d9..ac1b43a04285 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -54,6 +54,7 @@
 #define FW_CDEV_KERNEL_VERSION                  5
 #define FW_CDEV_VERSION_EVENT_REQUEST2          4
 #define FW_CDEV_VERSION_ALLOCATE_REGION_END     4
+#define FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW 5
 struct client {
        u32 version;
@@ -1005,6 +1006,8 @@ static int ioctl_create_iso_context(struct client *client, union ioctl_arg *arg)
                        a->channel, a->speed, a->header_size, cb, client);
        if (IS_ERR(context))
                return PTR_ERR(context);
+        if (client->version < FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW)
+                context->drop_overflow_headers = true;
        /* We only support one context at this time. */
        spin_lock_irq(&client->lock);
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 9e1db6490b9a..afb701ec90ca 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2749,8 +2749,11 @@ static void copy_iso_headers(struct iso_context *ctx, const u32 *dma_hdr)
 {
        u32 *ctx_hdr;
-        if (ctx->header_length + ctx->base.header_size > PAGE_SIZE)
+        if (ctx->header_length + ctx->base.header_size > PAGE_SIZE) {
+                if (ctx->base.drop_overflow_headers)
+                        return;
                flush_iso_completions(ctx);
+        }
        ctx_hdr = ctx->header + ctx->header_length;
        ctx->last_timestamp = (u16)le32_to_cpu((__force __le32)dma_hdr[0]);
@@ -2910,8 +2913,11 @@ static int handle_it_packet(struct context *context,
        sync_it_packet_for_cpu(context, d);
-        if (ctx->header_length + 4 > PAGE_SIZE)
+        if (ctx->header_length + 4 > PAGE_SIZE) {
+                if (ctx->base.drop_overflow_headers)
+                        return 1;
                flush_iso_completions(ctx);
+        }
        ctx_hdr = ctx->header + ctx->header_length;
        ctx->last_timestamp = le16_to_cpu(last->res_count);
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index eb760a218da4..232fa8fce26a 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -419,6 +419,13 @@ static void __init dmi_format_ids(char *buf, size_t len)
                            dmi_get_system_info(DMI_BIOS_DATE));
 }
+/*
+ * Check for DMI/SMBIOS headers in the system firmware image.  Any
+ * SMBIOS header must start 16 bytes before the DMI header, so take a
+ * 32 byte buffer and check for DMI at offset 16 and SMBIOS at offset
+ * 0.  If the DMI header is present, set dmi_ver accordingly (SMBIOS
+ * takes precedence) and return 0.  Otherwise return 1.
+ */
 static int __init dmi_present(const u8 *buf)
 {
        int smbios_ver;
@@ -506,6 +513,13 @@ void __init dmi_scan_machine(void)
                if (p == NULL)
                        goto error;
+                /*
+                 * Iterate over all possible DMI header addresses q.
+                 * Maintain the 32 bytes around q in buf.  On the
+                 * first iteration, substitute zero for the
+                 * out-of-range bytes so there is no chance of falsely
+                 * detecting an SMBIOS header.
+                 */
                memset(buf, 0, 16);
                for (q = p; q < p + 0x10000; q += 16) {
                        memcpy_fromio(buf + 16, q, 16);
diff --git a/drivers/gpu/drm/exynos/exynos_ddc.c b/drivers/gpu/drm/exynos/exynos_ddc.c
index 95c75edef01a..30ef41bcd7b8 100644
--- a/drivers/gpu/drm/exynos/exynos_ddc.c
+++ b/drivers/gpu/drm/exynos/exynos_ddc.c
@@ -15,7 +15,6 @@
 #include <linux/kernel.h>
 #include <linux/i2c.h>
-#include <linux/module.h>
 #include "exynos_drm_drv.h"
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
index 61b094f689a7..6e047bd53e2f 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
@@ -12,7 +12,6 @@
 *
 */
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/mfd/syscon.h>
 #include <linux/regmap.h>
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 3e106beca5b6..1c263dac3c1c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -14,7 +14,6 @@
 #include <drm/drmP.h>
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
 #include <linux/of_device.h>
@@ -130,7 +129,6 @@ static const struct of_device_id fimd_driver_dt_match[] = {
          .data = &exynos5_fimd_driver_data },
        {},
 };
-MODULE_DEVICE_TABLE(of, fimd_driver_dt_match);
 #endif
 static inline struct fimd_driver_data *drm_fimd_get_driver_data(
@@ -1082,7 +1080,6 @@ static struct platform_device_id fimd_driver_ids[] = {
        },
        {},
 };
-MODULE_DEVICE_TABLE(platform, fimd_driver_ids);
 static const struct dev_pm_ops fimd_pm_ops = {
        SET_SYSTEM_SLEEP_PM_OPS(fimd_suspend, fimd_resume)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 42a5a5466075..eddea4941483 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -8,7 +8,6 @@
 */
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/interrupt.h>
@@ -806,9 +805,20 @@ static void g2d_dma_start(struct g2d_data *g2d,
        struct g2d_cmdlist_node *node =
                                list_first_entry(&runqueue_node->run_cmdlist,
                                                struct g2d_cmdlist_node, list);
+        int ret;
+        ret = pm_runtime_get_sync(g2d->dev);
+        if (ret < 0) {
+                dev_warn(g2d->dev, "failed pm power on.\n");
+                return;
+        }
-        pm_runtime_get_sync(g2d->dev);
+        ret = clk_prepare_enable(g2d->gate_clk);
-        clk_enable(g2d->gate_clk);
+        if (ret < 0) {
+                dev_warn(g2d->dev, "failed to enable clock.\n");
+                pm_runtime_put_sync(g2d->dev);
+                return;
+        }
        writel_relaxed(node->dma_addr, g2d->regs + G2D_DMA_SFR_BASE_ADDR);
        writel_relaxed(G2D_DMA_START, g2d->regs + G2D_DMA_COMMAND);
@@ -861,7 +871,7 @@ static void g2d_runqueue_worker(struct work_struct *work)
                                            runqueue_work);
        mutex_lock(&g2d->runqueue_mutex);
-        clk_disable(g2d->gate_clk);
+        clk_disable_unprepare(g2d->gate_clk);
        pm_runtime_put_sync(g2d->dev);
        complete(&g2d->runqueue_node->complete);
@@ -1521,7 +1531,6 @@ static const struct of_device_id exynos_g2d_match[] = {
        { .compatible = "samsung,exynos5250-g2d" },
        {},
 };
-MODULE_DEVICE_TABLE(of, exynos_g2d_match);
 #endif
 struct platform_driver g2d_driver = {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
index 472e3b25e7f2..90b8a1a5344c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -12,7 +12,6 @@
 *
 */
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
 #include <linux/pm_runtime.h>
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
index aaa550d622f0..8d3bc01d6834 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
@@ -15,7 +15,6 @@
 #include <linux/kernel.h>
 #include <linux/wait.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
diff --git a/drivers/gpu/drm/exynos/exynos_drm_ipp.c b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
index b1ef8e7ff9c9..d2b6ab4def93 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_ipp.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
@@ -12,7 +12,6 @@
 *
 */
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/types.h>
 #include <linux/clk.h>
@@ -342,10 +341,10 @@ int exynos_drm_ipp_get_property(struct drm_device *drm_dev, void *data,
                 */
                ippdrv = ipp_find_obj(&ctx->ipp_idr, &ctx->ipp_lock,
                                                prop_list->ipp_id);
-                if (!ippdrv) {
+                if (IS_ERR(ippdrv)) {
                        DRM_ERROR("not found ipp%d driver.\n",
                                        prop_list->ipp_id);
-                        return -EINVAL;
+                        return PTR_ERR(ippdrv);
                }
                prop_list = ippdrv->prop_list;
@@ -970,9 +969,9 @@ int exynos_drm_ipp_queue_buf(struct drm_device *drm_dev, void *data,
        /* find command node */
        c_node = ipp_find_obj(&ctx->prop_idr, &ctx->prop_lock,
                qbuf->prop_id);
-        if (!c_node) {
+        if (IS_ERR(c_node)) {
                DRM_ERROR("failed to get command node.\n");
-                return -EFAULT;
+                return PTR_ERR(c_node);
        }
        /* buffer control */
@@ -1106,9 +1105,9 @@ int exynos_drm_ipp_cmd_ctrl(struct drm_device *drm_dev, void *data,
        c_node = ipp_find_obj(&ctx->prop_idr, &ctx->prop_lock,
                cmd_ctrl->prop_id);
-        if (!c_node) {
+        if (IS_ERR(c_node)) {
                DRM_ERROR("invalid command node list.\n");
-                return -EINVAL;
+                return PTR_ERR(c_node);
        }
        if (!exynos_drm_ipp_check_valid(ippdrv->dev, cmd_ctrl->ctrl,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index 427640aa5148..49669aa24c45 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -10,7 +10,6 @@
 */
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/err.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 41cc74d83e4e..c57c56519add 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -13,7 +13,6 @@
 #include <drm/drmP.h>
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <drm/exynos_drm.h>
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 62ef5971ac3c..2f5c6942c968 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -24,7 +24,6 @@
 #include <linux/spinlock.h>
 #include <linux/wait.h>
 #include <linux/i2c.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
diff --git a/drivers/gpu/drm/exynos/exynos_hdmiphy.c b/drivers/gpu/drm/exynos/exynos_hdmiphy.c
index ef04255076c7..6e320ae9afed 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmiphy.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmiphy.c
@@ -15,7 +15,6 @@
 #include <linux/kernel.h>
 #include <linux/i2c.h>
-#include <linux/module.h>
 #include "exynos_drm_drv.h"
 #include "exynos_hdmi.h"
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 42ffb71c63bc..c9a137caea41 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -23,7 +23,6 @@
 #include <linux/spinlock.h>
 #include <linux/wait.h>
 #include <linux/i2c.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 66c63808fa35..f4669802a0fb 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1594,6 +1594,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        intel_detect_pch(dev);
        intel_irq_init(dev);
+        intel_pm_init(dev);
        intel_gt_sanitize(dev);
        intel_gt_init(dev);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index d2ee3343c943..1929bffc1c77 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1582,6 +1582,7 @@ void i915_hangcheck_elapsed(unsigned long data);
 void i915_handle_error(struct drm_device *dev, bool wedged);
 extern void intel_irq_init(struct drm_device *dev);
+extern void intel_pm_init(struct drm_device *dev);
 extern void intel_hpd_init(struct drm_device *dev);
 extern void intel_gt_init(struct drm_device *dev);
 extern void intel_gt_sanitize(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 51a2a60f5bfc..f895d1508df8 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -5536,6 +5536,12 @@ void intel_gt_init(struct drm_device *dev)
                dev_priv->gt.force_wake_get = __gen6_gt_force_wake_get;
                dev_priv->gt.force_wake_put = __gen6_gt_force_wake_put;
        }
+}
+void intel_pm_init(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
        INIT_DELAYED_WORK(&dev_priv->rps.delayed_resume_work,
                          intel_gen6_powersave_work);
 }
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index 251784aa2225..503a414cbdad 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -29,6 +29,7 @@ static void mga_crtc_load_lut(struct drm_crtc *crtc)
        struct mga_crtc *mga_crtc = to_mga_crtc(crtc);
        struct drm_device *dev = crtc->dev;
        struct mga_device *mdev = dev->dev_private;
+        struct drm_framebuffer *fb = crtc->fb;
        int i;
        if (!crtc->enabled)
@@ -36,6 +37,28 @@ static void mga_crtc_load_lut(struct drm_crtc *crtc)
        WREG8(DAC_INDEX + MGA1064_INDEX, 0);
+        if (fb && fb->bits_per_pixel == 16) {
+                int inc = (fb->depth == 15) ? 8 : 4;
+                u8 r, b;
+                for (i = 0; i < MGAG200_LUT_SIZE; i += inc) {
+                        if (fb->depth == 16) {
+                                if (i > (MGAG200_LUT_SIZE >> 1)) {
+                                        r = b = 0;
+                                } else {
+                                        r = mga_crtc->lut_r[i << 1];
+                                        b = mga_crtc->lut_b[i << 1];
+                                }
+                        } else {
+                                r = mga_crtc->lut_r[i];
+                                b = mga_crtc->lut_b[i];
+                        }
+                        /* VGA registers */
+                        WREG8(DAC_INDEX + MGA1064_COL_PAL, r);
+                        WREG8(DAC_INDEX + MGA1064_COL_PAL, mga_crtc->lut_g[i]);
+                        WREG8(DAC_INDEX + MGA1064_COL_PAL, b);
+                }
+                return;
+        }
        for (i = 0; i < MGAG200_LUT_SIZE; i++) {
                /* VGA registers */
                WREG8(DAC_INDEX + MGA1064_COL_PAL, mga_crtc->lut_r[i]);
@@ -877,7 +900,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
        pitch = crtc->fb->pitches[0] / (crtc->fb->bits_per_pixel / 8);
        if (crtc->fb->bits_per_pixel == 24)
-                pitch = pitch >> (4 - bppshift);
+                pitch = (pitch * 3) >> (4 - bppshift);
        else
                pitch = pitch >> (4 - bppshift);
@@ -1251,6 +1274,24 @@ static void mga_crtc_destroy(struct drm_crtc *crtc)
        kfree(mga_crtc);
 }
+static void mga_crtc_disable(struct drm_crtc *crtc)
+{
+        int ret;
+        DRM_DEBUG_KMS("\n");
+        mga_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
+        if (crtc->fb) {
+                struct mga_framebuffer *mga_fb = to_mga_framebuffer(crtc->fb);
+                struct drm_gem_object *obj = mga_fb->obj;
+                struct mgag200_bo *bo = gem_to_mga_bo(obj);
+                ret = mgag200_bo_reserve(bo, false);
+                if (ret)
+                        return;
+                mgag200_bo_push_sysram(bo);
+                mgag200_bo_unreserve(bo);
+        }
+        crtc->fb = NULL;
+}
 /* These provide the minimum set of functions required to handle a CRTC */
 static const struct drm_crtc_funcs mga_crtc_funcs = {
        .cursor_set = mga_crtc_cursor_set,
@@ -1261,6 +1302,7 @@ static const struct drm_crtc_funcs mga_crtc_funcs = {
 };
 static const struct drm_crtc_helper_funcs mga_helper_funcs = {
+        .disable = mga_crtc_disable,
        .dpms = mga_crtc_dpms,
        .mode_fixup = mga_crtc_mode_fixup,
        .mode_set = mga_crtc_mode_set,
@@ -1581,6 +1623,8 @@ static struct drm_connector *mga_vga_init(struct drm_device *dev)
        drm_connector_helper_add(connector, &mga_vga_connector_helper_funcs);
+        drm_sysfs_connector_add(connector);
        mga_connector->i2c = mgag200_i2c_create(dev);
        if (!mga_connector->i2c)
                DRM_ERROR("failed to add ddc bus\n");
diff --git a/drivers/gpu/drm/mgag200/mgag200_ttm.c b/drivers/gpu/drm/mgag200/mgag200_ttm.c
index 3acb2b044c7b..13878d5de063 100644
--- a/drivers/gpu/drm/mgag200/mgag200_ttm.c
+++ b/drivers/gpu/drm/mgag200/mgag200_ttm.c
@@ -353,6 +353,7 @@ int mgag200_bo_pin(struct mgag200_bo *bo, u32 pl_flag, u64 *gpu_addr)
                bo->pin_count++;
                if (gpu_addr)
                        *gpu_addr = mgag200_bo_gpu_offset(bo);
+                return 0;
        }
        mgag200_ttm_placement(bo, pl_flag);
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c b/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c
index 373dbcc523b2..a19e7d79b847 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c
@@ -36,6 +36,8 @@ nva3_hda_eld(struct nv50_disp_priv *priv, int or, u8 *data, u32 size)
        if (data && data[0]) {
                for (i = 0; i < size; i++)
                        nv_wr32(priv, 0x61c440 + soff, (i << 8) | data[i]);
+                for (; i < 0x60; i++)
+                        nv_wr32(priv, 0x61c440 + soff, (i << 8));
                nv_mask(priv, 0x61c448 + soff, 0x80000003, 0x80000003);
        } else
        if (data) {
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c b/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c
index dc57e24fc1df..717639386ced 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c
@@ -41,6 +41,8 @@ nvd0_hda_eld(struct nv50_disp_priv *priv, int or, u8 *data, u32 size)
        if (data && data[0]) {
                for (i = 0; i < size; i++)
                        nv_wr32(priv, 0x10ec00 + soff, (i << 8) | data[i]);
+                for (; i < 0x60; i++)
+                        nv_wr32(priv, 0x10ec00 + soff, (i << 8));
                nv_mask(priv, 0x10ec10 + soff, 0x80000003, 0x80000003);
        } else
        if (data) {
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
index ab1e918469a8..526b75242899 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
@@ -47,14 +47,8 @@ int
 nv50_sor_mthd(struct nouveau_object *object, u32 mthd, void *args, u32 size)
 {
        struct nv50_disp_priv *priv = (void *)object->engine;
-        struct nouveau_bios *bios = nouveau_bios(priv);
-        const u16 type = (mthd & NV50_DISP_SOR_MTHD_TYPE) >> 12;
        const u8  head = (mthd & NV50_DISP_SOR_MTHD_HEAD) >> 3;
-        const u8  link = (mthd & NV50_DISP_SOR_MTHD_LINK) >> 2;
        const u8    or = (mthd & NV50_DISP_SOR_MTHD_OR);
-        const u16 mask = (0x0100 << head) | (0x0040 << link) | (0x0001 << or);
-        struct dcb_output outp;
-        u8  ver, hdr;
        u32 data;
        int ret = -EINVAL;
@@ -62,8 +56,6 @@ nv50_sor_mthd(struct nouveau_object *object, u32 mthd, void *args, u32 size)
                return -EINVAL;
        data = *(u32 *)args;
-        if (type && !dcb_outp_match(bios, type, mask, &ver, &hdr, &outp))
-                return -ENODEV;
        switch (mthd & ~0x3f) {
        case NV50_DISP_SOR_PWR:
diff --git a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv31.c b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv31.c
index 49ecbb859b25..c19004301309 100644
--- a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv31.c
+++ b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv31.c
@@ -265,8 +265,8 @@ nv31_mpeg_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
 int
 nv31_mpeg_init(struct nouveau_object *object)
 {
-        struct nouveau_engine *engine = nv_engine(object->engine);
+        struct nouveau_engine *engine = nv_engine(object);
-        struct nv31_mpeg_priv *priv = (void *)engine;
+        struct nv31_mpeg_priv *priv = (void *)object;
        struct nouveau_fb *pfb = nouveau_fb(object);
        int ret, i;
@@ -284,7 +284,10 @@ nv31_mpeg_init(struct nouveau_object *object)
        /* PMPEG init */
        nv_wr32(priv, 0x00b32c, 0x00000000);
        nv_wr32(priv, 0x00b314, 0x00000100);
-        nv_wr32(priv, 0x00b220, nv44_graph_class(priv) ? 0x00000044 : 0x00000031);
+        if (nv_device(priv)->chipset >= 0x40 && nv44_graph_class(priv))
+                nv_wr32(priv, 0x00b220, 0x00000044);
+        else
+                nv_wr32(priv, 0x00b220, 0x00000031);
        nv_wr32(priv, 0x00b300, 0x02001ec1);
        nv_mask(priv, 0x00b32c, 0x00000001, 0x00000001);
diff --git a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
index f7c581ad1991..dd6196072e9c 100644
--- a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
+++ b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
@@ -61,6 +61,7 @@ nv40_mpeg_context_ctor(struct nouveau_object *parent,
        if (ret)
                return ret;
+        nv_wo32(&chan->base.base, 0x78, 0x02001ec1);
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/engine/xtensa.c b/drivers/gpu/drm/nouveau/core/engine/xtensa.c
index 0639bc59d0a5..5f6ede7c4892 100644
--- a/drivers/gpu/drm/nouveau/core/engine/xtensa.c
+++ b/drivers/gpu/drm/nouveau/core/engine/xtensa.c
@@ -118,7 +118,13 @@ _nouveau_xtensa_init(struct nouveau_object *object)
                        return ret;
                }
-                ret = nouveau_gpuobj_new(object, NULL, fw->size, 0x1000, 0,
+                if (fw->size > 0x40000) {
+                        nv_warn(xtensa, "firmware %s too large\n", name);
+                        release_firmware(fw);
+                        return -EINVAL;
+                }
+                ret = nouveau_gpuobj_new(object, NULL, 0x40000, 0x1000, 0,
                                         &xtensa->gpu_fw);
                if (ret) {
                        release_firmware(fw);
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/vm.h b/drivers/gpu/drm/nouveau/core/include/subdev/vm.h
index f2e87b105666..fcf57fa309bf 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/vm.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/vm.h
@@ -55,7 +55,7 @@ struct nouveau_vma {
 struct nouveau_vm {
        struct nouveau_vmmgr *vmm;
        struct nouveau_mm mm;
-        int refcount;
+        struct kref refcount;
        struct list_head pgd_list;
        atomic_t engref[NVDEV_SUBDEV_NR];
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/priv.h b/drivers/gpu/drm/nouveau/core/subdev/fb/priv.h
index 6c974dd83e8b..db9d6ddde52c 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/priv.h
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/priv.h
@@ -81,7 +81,7 @@ void nv44_fb_tile_prog(struct nouveau_fb *, int, struct nouveau_fb_tile *);
 void nv46_fb_tile_init(struct nouveau_fb *, int i, u32 addr, u32 size,
                       u32 pitch, u32 flags, struct nouveau_fb_tile *);
-void nv50_ram_put(struct nouveau_fb *, struct nouveau_mem **);
+void __nv50_ram_put(struct nouveau_fb *, struct nouveau_mem *);
 extern int nv50_fb_memtype[0x80];
 #endif
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv50.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv50.c
index af5aa7ee8ad9..903baff77fdd 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv50.c
@@ -27,17 +27,10 @@
 #include "priv.h"
 void
-nv50_ram_put(struct nouveau_fb *pfb, struct nouveau_mem **pmem)
+__nv50_ram_put(struct nouveau_fb *pfb, struct nouveau_mem *mem)
 {
        struct nouveau_mm_node *this;
-        struct nouveau_mem *mem;
-        mem = *pmem;
-        *pmem = NULL;
-        if (unlikely(mem == NULL))
-                return;
-        mutex_lock(&pfb->base.mutex);
        while (!list_empty(&mem->regions)) {
                this = list_first_entry(&mem->regions, typeof(*this), rl_entry);
@@ -46,6 +39,19 @@ nv50_ram_put(struct nouveau_fb *pfb, struct nouveau_mem **pmem)
        }
        nouveau_mm_free(&pfb->tags, &mem->tag);
+}
+void
+nv50_ram_put(struct nouveau_fb *pfb, struct nouveau_mem **pmem)
+{
+        struct nouveau_mem *mem = *pmem;
+        *pmem = NULL;
+        if (unlikely(mem == NULL))
+                return;
+        mutex_lock(&pfb->base.mutex);
+        __nv50_ram_put(pfb, mem);
        mutex_unlock(&pfb->base.mutex);
        kfree(mem);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvc0.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvc0.c
index 9c3634acbb9d..cf97c4de4a6b 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvc0.c
@@ -33,11 +33,19 @@ void
 nvc0_ram_put(struct nouveau_fb *pfb, struct nouveau_mem **pmem)
 {
        struct nouveau_ltcg *ltcg = nouveau_ltcg(pfb);
+        struct nouveau_mem *mem = *pmem;
-        if ((*pmem)->tag)
+        *pmem = NULL;
-                ltcg->tags_free(ltcg, &(*pmem)->tag);
+        if (unlikely(mem == NULL))
+                return;
-        nv50_ram_put(pfb, pmem);
+        mutex_lock(&pfb->base.mutex);
+        if (mem->tag)
+                ltcg->tags_free(ltcg, &mem->tag);
+        __nv50_ram_put(pfb, mem);
+        mutex_unlock(&pfb->base.mutex);
+        kfree(mem);
 }
 int
diff --git a/drivers/gpu/drm/nouveau/core/subdev/gpio/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/gpio/nv50.c
index bf489dcf46e2..c4c1d415e7fe 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/gpio/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/gpio/nv50.c
@@ -103,7 +103,7 @@ nv50_gpio_intr(struct nouveau_subdev *subdev)
        int i;
        intr0 = nv_rd32(priv, 0xe054) & nv_rd32(priv, 0xe050);
-        if (nv_device(priv)->chipset >= 0x90)
+        if (nv_device(priv)->chipset > 0x92)
                intr1 = nv_rd32(priv, 0xe074) & nv_rd32(priv, 0xe070);
        hi = (intr0 & 0x0000ffff) | (intr1 << 16);
@@ -115,7 +115,7 @@ nv50_gpio_intr(struct nouveau_subdev *subdev)
        }
        nv_wr32(priv, 0xe054, intr0);
-        if (nv_device(priv)->chipset >= 0x90)
+        if (nv_device(priv)->chipset > 0x92)
                nv_wr32(priv, 0xe074, intr1);
 }
@@ -146,7 +146,7 @@ nv50_gpio_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        int ret;
        ret = nouveau_gpio_create(parent, engine, oclass,
-                                  nv_device(parent)->chipset >= 0x90 ? 32 : 16,
+                                  nv_device(parent)->chipset > 0x92 ? 32 : 16,
                                  &priv);
        *pobject = nv_object(priv);
        if (ret)
@@ -182,7 +182,7 @@ nv50_gpio_init(struct nouveau_object *object)
        /* disable, and ack any pending gpio interrupts */
        nv_wr32(priv, 0xe050, 0x00000000);
        nv_wr32(priv, 0xe054, 0xffffffff);
-        if (nv_device(priv)->chipset >= 0x90) {
+        if (nv_device(priv)->chipset > 0x92) {
                nv_wr32(priv, 0xe070, 0x00000000);
                nv_wr32(priv, 0xe074, 0xffffffff);
        }
@@ -195,7 +195,7 @@ nv50_gpio_fini(struct nouveau_object *object, bool suspend)
 {
        struct nv50_gpio_priv *priv = (void *)object;
        nv_wr32(priv, 0xe050, 0x00000000);
-        if (nv_device(priv)->chipset >= 0x90)
+        if (nv_device(priv)->chipset > 0x92)
                nv_wr32(priv, 0xe070, 0x00000000);
        return nouveau_gpio_fini(&priv->base, suspend);
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
index 0cb322a5e72c..f25fc5fc7dd1 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
@@ -41,7 +41,7 @@ nv50_mc_intr[] = {
        { 0x04000000, NVDEV_ENGINE_DISP },
        { 0x10000000, NVDEV_SUBDEV_BUS },
        { 0x80000000, NVDEV_ENGINE_SW },
-        { 0x0000d101, NVDEV_SUBDEV_FB },
+        { 0x0002d101, NVDEV_SUBDEV_FB },
        {},
 };
diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
index 67fcb6c852ac..ef3133e7575c 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
@@ -361,7 +361,7 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
        INIT_LIST_HEAD(&vm->pgd_list);
        vm->vmm = vmm;
-        vm->refcount = 1;
+        kref_init(&vm->refcount);
        vm->fpde = offset >> (vmm->pgt_bits + 12);
        vm->lpde = (offset + length - 1) >> (vmm->pgt_bits + 12);
@@ -441,8 +441,9 @@ nouveau_vm_unlink(struct nouveau_vm *vm, struct nouveau_gpuobj *mpgd)
 }
 static void
-nouveau_vm_del(struct nouveau_vm *vm)
+nouveau_vm_del(struct kref *kref)
 {
+        struct nouveau_vm *vm = container_of(kref, typeof(*vm), refcount);
        struct nouveau_vm_pgd *vpgd, *tmp;
        list_for_each_entry_safe(vpgd, tmp, &vm->pgd_list, head) {
@@ -458,27 +459,19 @@ int
 nouveau_vm_ref(struct nouveau_vm *ref, struct nouveau_vm **ptr,
               struct nouveau_gpuobj *pgd)
 {
-        struct nouveau_vm *vm;
+        if (ref) {
-        int ret;
+                int ret = nouveau_vm_link(ref, pgd);
-        vm = ref;
-        if (vm) {
-                ret = nouveau_vm_link(vm, pgd);
                if (ret)
                        return ret;
-                vm->refcount++;
+                kref_get(&ref->refcount);
        }
-        vm = *ptr;
+        if (*ptr) {
-        *ptr = ref;
+                nouveau_vm_unlink(*ptr, pgd);
+                kref_put(&(*ptr)->refcount, nouveau_vm_del);
-        if (vm) {
-                nouveau_vm_unlink(vm, pgd);
-                if (--vm->refcount == 0)
-                        nouveau_vm_del(vm);
        }
+        *ptr = ref;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 4e7ee5f4155c..af20fba3a1a4 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -198,7 +198,12 @@ nouveau_bo_new(struct drm_device *dev, int size, int align,
        size_t acc_size;
        int ret;
        int type = ttm_bo_type_device;
-        int max_size = INT_MAX & ~((1 << drm->client.base.vm->vmm->lpg_shift) - 1);
+        int lpg_shift = 12;
+        int max_size;
+        if (drm->client.base.vm)
+                lpg_shift = drm->client.base.vm->vmm->lpg_shift;
+        max_size = INT_MAX & ~((1 << lpg_shift) - 1);
        if (size <= 0 || size > max_size) {
                nv_warn(drm, "skipped size %x\n", (u32)size);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 4c1bc061fae2..8f6d63d7edd3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -398,7 +398,8 @@ void
 nouveau_fbcon_output_poll_changed(struct drm_device *dev)
 {
        struct nouveau_drm *drm = nouveau_drm(dev);
-        drm_fb_helper_hotplug_event(&drm->fbcon->helper);
+        if (drm->fbcon)
+                drm_fb_helper_hotplug_event(&drm->fbcon->helper);
 }
 static int
diff --git a/drivers/gpu/drm/nouveau/nv17_fence.c b/drivers/gpu/drm/nouveau/nv17_fence.c
index 8e47a9bae8c3..22aa9963ea6f 100644
--- a/drivers/gpu/drm/nouveau/nv17_fence.c
+++ b/drivers/gpu/drm/nouveau/nv17_fence.c
@@ -76,7 +76,7 @@ nv17_fence_context_new(struct nouveau_channel *chan)
        struct ttm_mem_reg *mem = &priv->bo->bo.mem;
        struct nouveau_object *object;
        u32 start = mem->start * PAGE_SIZE;
-        u32 limit = mem->start + mem->size - 1;
+        u32 limit = start + mem->size - 1;
        int ret = 0;
        fctx = chan->fence = kzalloc(sizeof(*fctx), GFP_KERNEL);
diff --git a/drivers/gpu/drm/nouveau/nv50_fence.c b/drivers/gpu/drm/nouveau/nv50_fence.c
index f9701e567db8..0ee363840035 100644
--- a/drivers/gpu/drm/nouveau/nv50_fence.c
+++ b/drivers/gpu/drm/nouveau/nv50_fence.c
@@ -39,6 +39,8 @@ nv50_fence_context_new(struct nouveau_channel *chan)
        struct nv10_fence_chan *fctx;
        struct ttm_mem_reg *mem = &priv->bo->bo.mem;
        struct nouveau_object *object;
+        u32 start = mem->start * PAGE_SIZE;
+        u32 limit = start + mem->size - 1;
        int ret, i;
        fctx = chan->fence = kzalloc(sizeof(*fctx), GFP_KERNEL);
@@ -51,26 +53,28 @@ nv50_fence_context_new(struct nouveau_channel *chan)
        fctx->base.sync = nv17_fence_sync;
        ret = nouveau_object_new(nv_object(chan->cli), chan->handle,
-                                 NvSema, 0x0002,
+                                 NvSema, 0x003d,
                                 &(struct nv_dma_class) {
                                        .flags = NV_DMA_TARGET_VRAM |
                                                 NV_DMA_ACCESS_RDWR,
-                                        .start = mem->start * PAGE_SIZE,
+                                        .start = start,
-                                        .limit = mem->size - 1,
+                                        .limit = limit,
                                 }, sizeof(struct nv_dma_class),
                                 &object);
        /* dma objects for display sync channel semaphore blocks */
        for (i = 0; !ret && i < dev->mode_config.num_crtc; i++) {
                struct nouveau_bo *bo = nv50_display_crtc_sema(dev, i);
+                u32 start = bo->bo.mem.start * PAGE_SIZE;
+                u32 limit = start + bo->bo.mem.size - 1;
                ret = nouveau_object_new(nv_object(chan->cli), chan->handle,
                                         NvEvoSema0 + i, 0x003d,
                                         &(struct nv_dma_class) {
                                                .flags = NV_DMA_TARGET_VRAM |
                                                         NV_DMA_ACCESS_RDWR,
-                                                .start = bo->bo.offset,
+                                                .start = start,
-                                                .limit = bo->bo.offset + 0xfff,
+                                                .limit = limit,
                                         }, sizeof(struct nv_dma_class),
                                         &object);
        }
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index fb441a790f3d..15da7ef344a4 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -1222,12 +1222,17 @@ int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
        int r;
        mutex_lock(&ctx->mutex);
+        /* reset data block */
+        ctx->data_block = 0;
        /* reset reg block */
        ctx->reg_block = 0;
        /* reset fb window */
        ctx->fb_base = 0;
        /* reset io mode */
        ctx->io_mode = ATOM_IO_MM;
+        /* reset divmul */
+        ctx->divmul[0] = 0;
+        ctx->divmul[1] = 0;
        r = atom_execute_table_locked(ctx, index, params);
        mutex_unlock(&ctx->mutex);
        return r;
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index b0d3fb341417..bb9ea3641312 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -157,9 +157,9 @@ static void evergreen_audio_set_dto(struct drm_encoder *encoder, u32 clock)
         * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
         * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
         */
+        WREG32(DCCG_AUDIO_DTO_SOURCE, DCCG_AUDIO_DTO0_SOURCE_SEL(radeon_crtc->crtc_id));
        WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
        WREG32(DCCG_AUDIO_DTO0_MODULE, clock * 100);
-        WREG32(DCCG_AUDIO_DTO_SOURCE, DCCG_AUDIO_DTO0_SOURCE_SEL(radeon_crtc->crtc_id));
 }
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 559cf24d51af..4f9b9bc20daa 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -1054,10 +1054,6 @@ static int ni_restrict_performance_levels_before_switch(struct radeon_device *rd
 int ni_dpm_force_performance_level(struct radeon_device *rdev,
                                   enum radeon_dpm_forced_level level)
 {
-        struct radeon_ps *rps = rdev->pm.dpm.current_ps;
-        struct ni_ps *ps = ni_get_ps(rps);
-        u32 levels;
        if (level == RADEON_DPM_FORCED_LEVEL_HIGH) {
                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 0) != PPSMC_Result_OK)
                        return -EINVAL;
@@ -1068,8 +1064,7 @@ int ni_dpm_force_performance_level(struct radeon_device *rdev,
                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
                        return -EINVAL;
-                levels = ps->performance_level_count - 1;
+                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 1) != PPSMC_Result_OK)
-                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
                        return -EINVAL;
        } else if (level == RADEON_DPM_FORCED_LEVEL_AUTO) {
                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index e3f3e8841789..4ccd61f60eb6 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2782,7 +2782,7 @@ int radeon_atom_get_clock_dividers(struct radeon_device *rdev,
                                                             ATOM_PLL_CNTL_FLAG_PLL_POST_DIV_EN) ? true : false;
                                dividers->enable_dithen = (args.v3.ucCntlFlag &
                                                           ATOM_PLL_CNTL_FLAG_FRACTION_DISABLE) ? false : true;
-                                dividers->fb_div = le16_to_cpu(args.v3.ulFbDiv.usFbDiv);
+                                dividers->whole_fb_div = le16_to_cpu(args.v3.ulFbDiv.usFbDiv);
                                dividers->frac_fb_div = le16_to_cpu(args.v3.ulFbDiv.usFbDivFrac);
                                dividers->ref_div = args.v3.ucRefDiv;
                                dividers->vco_mode = (args.v3.ucCntlFlag &
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index d325280e2f9f..6ca904673a4f 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -5215,14 +5215,12 @@ static void si_enable_mc_ls(struct radeon_device *rdev,
 static void si_init_cg(struct radeon_device *rdev)
 {
-        bool has_uvd = true;
        si_enable_mgcg(rdev, true);
-        si_enable_cgcg(rdev, true);
+        si_enable_cgcg(rdev, false);
        /* disable MC LS on Tahiti */
        if (rdev->family == CHIP_TAHITI)
                si_enable_mc_ls(rdev, false);
-        if (has_uvd) {
+        if (rdev->has_uvd) {
                si_enable_uvd_mgcg(rdev, true);
                si_init_uvd_internal_cg(rdev);
        }
@@ -5230,9 +5228,7 @@ static void si_init_cg(struct radeon_device *rdev)
 static void si_fini_cg(struct radeon_device *rdev)
 {
-        bool has_uvd = true;
+        if (rdev->has_uvd)
-        if (has_uvd)
                si_enable_uvd_mgcg(rdev, false);
        si_enable_cgcg(rdev, false);
        si_enable_mgcg(rdev, false);
@@ -5241,11 +5237,11 @@ static void si_fini_cg(struct radeon_device *rdev)
 static void si_init_pg(struct radeon_device *rdev)
 {
        bool has_pg = false;
+#if 0
        /* only cape verde supports PG */
        if (rdev->family == CHIP_VERDE)
                has_pg = true;
+#endif
        if (has_pg) {
                si_init_ao_cu_mask(rdev);
                si_init_dma_pg(rdev);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 73aaa2e4c312..7ad22e87cd62 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -37,8 +37,6 @@
 #define SMC_RAM_END                 0x20000
-#define DDR3_DRAM_ROWS              0x2000
 #define SCLK_MIN_DEEPSLEEP_FREQ     1350
 static const struct si_cac_config_reg cac_weights_tahiti[] =
@@ -1767,8 +1765,9 @@ static void si_calculate_leakage_for_v_and_t_formula(const struct ni_leakage_coe
 {
        s64 kt, kv, leakage_w, i_leakage, vddc;
        s64 temperature, t_slope, t_intercept, av, bv, t_ref;
+        s64 tmp;
-        i_leakage = drm_int2fixp(ileakage / 100);
+        i_leakage = drm_int2fixp(ileakage) / 100;
        vddc = div64_s64(drm_int2fixp(v), 1000);
        temperature = div64_s64(drm_int2fixp(t), 1000);
@@ -1778,8 +1777,9 @@ static void si_calculate_leakage_for_v_and_t_formula(const struct ni_leakage_coe
        bv = div64_s64(drm_int2fixp(coeff->bv), 100000000);
        t_ref = drm_int2fixp(coeff->t_ref);
-        kt = drm_fixp_div(drm_fixp_exp(drm_fixp_mul(drm_fixp_mul(t_slope, vddc) + t_intercept, temperature)),
+        tmp = drm_fixp_mul(t_slope, vddc) + t_intercept;
-                          drm_fixp_exp(drm_fixp_mul(drm_fixp_mul(t_slope, vddc) + t_intercept, t_ref)));
+        kt = drm_fixp_exp(drm_fixp_mul(tmp, temperature));
+        kt = drm_fixp_div(kt, drm_fixp_exp(drm_fixp_mul(tmp, t_ref)));
        kv = drm_fixp_mul(av, drm_fixp_exp(drm_fixp_mul(bv, vddc)));
        leakage_w = drm_fixp_mul(drm_fixp_mul(drm_fixp_mul(i_leakage, kt), kv), vddc);
@@ -1931,6 +1931,7 @@ static void si_initialize_powertune_defaults(struct radeon_device *rdev)
                        si_pi->cac_override = cac_override_pitcairn;
                        si_pi->powertune_data = &powertune_data_pitcairn;
                        si_pi->dte_data = dte_data_pitcairn;
+                        break;
                }
        } else if (rdev->family == CHIP_VERDE) {
                si_pi->lcac_config = lcac_cape_verde;
@@ -1941,6 +1942,7 @@ static void si_initialize_powertune_defaults(struct radeon_device *rdev)
                case 0x683B:
                case 0x683F:
                case 0x6829:
+                case 0x6835:
                        si_pi->cac_weights = cac_weights_cape_verde_pro;
                        si_pi->dte_data = dte_data_cape_verde;
                        break;
@@ -3237,10 +3239,10 @@ int si_dpm_force_performance_level(struct radeon_device *rdev,
 {
        struct radeon_ps *rps = rdev->pm.dpm.current_ps;
        struct ni_ps *ps = ni_get_ps(rps);
-        u32 levels;
+        u32 levels = ps->performance_level_count;
        if (level == RADEON_DPM_FORCED_LEVEL_HIGH) {
-                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 0) != PPSMC_Result_OK)
+                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
                        return -EINVAL;
                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 1) != PPSMC_Result_OK)
@@ -3249,14 +3251,13 @@ int si_dpm_force_performance_level(struct radeon_device *rdev,
                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
                        return -EINVAL;
-                levels = ps->performance_level_count - 1;
+                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 1) != PPSMC_Result_OK)
-                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
                        return -EINVAL;
        } else if (level == RADEON_DPM_FORCED_LEVEL_AUTO) {
                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
                        return -EINVAL;
-                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 0) != PPSMC_Result_OK)
+                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
                        return -EINVAL;
        }
@@ -3620,8 +3621,12 @@ static void si_enable_display_gap(struct radeon_device *rdev)
 {
        u32 tmp = RREG32(CG_DISPLAY_GAP_CNTL);
+        tmp &= ~(DISP1_GAP_MASK | DISP2_GAP_MASK);
+        tmp |= (DISP1_GAP(R600_PM_DISPLAY_GAP_IGNORE) |
+                DISP2_GAP(R600_PM_DISPLAY_GAP_IGNORE));
        tmp &= ~(DISP1_GAP_MCHG_MASK | DISP2_GAP_MCHG_MASK);
-        tmp |= (DISP1_GAP_MCHG(R600_PM_DISPLAY_GAP_IGNORE) |
+        tmp |= (DISP1_GAP_MCHG(R600_PM_DISPLAY_GAP_VBLANK) |
                DISP2_GAP_MCHG(R600_PM_DISPLAY_GAP_IGNORE));
        WREG32(CG_DISPLAY_GAP_CNTL, tmp);
 }
@@ -4036,16 +4041,15 @@ static int si_force_switch_to_arb_f0(struct radeon_device *rdev)
 static u32 si_calculate_memory_refresh_rate(struct radeon_device *rdev,
                                            u32 engine_clock)
 {
-        struct rv7xx_power_info *pi = rv770_get_pi(rdev);
        u32 dram_rows;
        u32 dram_refresh_rate;
        u32 mc_arb_rfsh_rate;
        u32 tmp = (RREG32(MC_ARB_RAMCFG) & NOOFROWS_MASK) >> NOOFROWS_SHIFT;
-        if (pi->mem_gddr5)
+        if (tmp >= 4)
-                dram_rows = 1 << (tmp + 10);
+                dram_rows = 16384;
        else
-                dram_rows = DDR3_DRAM_ROWS;
+                dram_rows = 1 << (tmp + 10);
        dram_refresh_rate = 1 << ((RREG32(MC_SEQ_MISC0) & 0x3) + 3);
        mc_arb_rfsh_rate = ((engine_clock * 10) * dram_refresh_rate / dram_rows - 32) / 64;
@@ -6013,16 +6017,11 @@ int si_dpm_set_power_state(struct radeon_device *rdev)
                return ret;
        }
-#if 0
-        /* XXX */
        ret = si_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
        if (ret) {
                DRM_ERROR("si_dpm_force_performance_level failed\n");
                return ret;
        }
-#else
-        rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
-#endif
        return 0;
 }
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 5207591a598c..7a5764843bfb 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -192,6 +192,7 @@ static struct hid_ll_driver logi_dj_ll_driver;
 static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
                                        size_t count,
                                        unsigned char report_type);
+static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev);
 static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev,
                                                struct dj_report *dj_report)
@@ -232,6 +233,7 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
        if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] &
            SPFUNCTION_DEVICE_LIST_EMPTY) {
                dbg_hid("%s: device list is empty\n", __func__);
+                djrcv_dev->querying_devices = false;
                return;
        }
@@ -242,6 +244,12 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
                return;
        }
+        if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
+                /* The device is already known. No need to reallocate it. */
+                dbg_hid("%s: device is already known\n", __func__);
+                return;
+        }
        dj_hiddev = hid_allocate_device();
        if (IS_ERR(dj_hiddev)) {
                dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
@@ -305,6 +313,7 @@ static void delayedwork_callback(struct work_struct *work)
        struct dj_report dj_report;
        unsigned long flags;
        int count;
+        int retval;
        dbg_hid("%s\n", __func__);
@@ -337,6 +346,25 @@ static void delayedwork_callback(struct work_struct *work)
                logi_dj_recv_destroy_djhid_device(djrcv_dev, &dj_report);
                break;
        default:
+        /* A normal report (i. e. not belonging to a pair/unpair notification)
+         * arriving here, means that the report arrived but we did not have a
+         * paired dj_device associated to the report's device_index, this
+         * means that the original "device paired" notification corresponding
+         * to this dj_device never arrived to this driver. The reason is that
+         * hid-core discards all packets coming from a device while probe() is
+         * executing. */
+        if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) {
+                /* ok, we don't know the device, just re-ask the
+                 * receiver for the list of connected devices. */
+                retval = logi_dj_recv_query_paired_devices(djrcv_dev);
+                if (!retval) {
+                        /* everything went fine, so just leave */
+                        break;
+                }
+                dev_err(&djrcv_dev->hdev->dev,
+                        "%s:logi_dj_recv_query_paired_devices "
+                        "error:%d\n", __func__, retval);
+                }
                dbg_hid("%s: unexpected report type\n", __func__);
        }
 }
@@ -367,6 +395,12 @@ static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
        if (!djdev) {
                dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
                        " is NULL, index %d\n", dj_report->device_index);
+                kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+                if (schedule_work(&djrcv_dev->work) == 0) {
+                        dbg_hid("%s: did not schedule the work item, was already "
+                        "queued\n", __func__);
+                }
                return;
        }
@@ -397,6 +431,12 @@ static void logi_dj_recv_forward_report(struct dj_receiver_dev *djrcv_dev,
        if (dj_device == NULL) {
                dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
                        " is NULL, index %d\n", dj_report->device_index);
+                kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+                if (schedule_work(&djrcv_dev->work) == 0) {
+                        dbg_hid("%s: did not schedule the work item, was already "
+                        "queued\n", __func__);
+                }
                return;
        }
@@ -444,6 +484,12 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
        struct dj_report *dj_report;
        int retval;
+        /* no need to protect djrcv_dev->querying_devices */
+        if (djrcv_dev->querying_devices)
+                return 0;
+        djrcv_dev->querying_devices = true;
        dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
        if (!dj_report)
                return -ENOMEM;
@@ -455,6 +501,7 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
        return retval;
 }
 static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
                                          unsigned timeout)
 {
diff --git a/drivers/hid/hid-logitech-dj.h b/drivers/hid/hid-logitech-dj.h
index fd28a5e0ca3b..4a4000340ce1 100644
--- a/drivers/hid/hid-logitech-dj.h
+++ b/drivers/hid/hid-logitech-dj.h
@@ -101,6 +101,7 @@ struct dj_receiver_dev {
        struct work_struct work;
        struct kfifo notif_fifo;
        spinlock_t lock;
+        bool querying_devices;
 };
 struct dj_device {
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index ecbc74923d06..87fbe2924cfa 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -369,7 +369,8 @@ static int sony_mapping(struct hid_device *hdev, struct hid_input *hi,
        if (sc->quirks & PS3REMOTE)
                return ps3remote_mapping(hdev, hi, field, usage, bit, max);
-        return -1;
+        /* Let hid-core decide for the others */
+        return 0;
 }
 /*
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index a7451632ceb4..6f1feb2c2e97 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -518,7 +518,6 @@ int hidraw_connect(struct hid_device *hid)
                goto out;
        }
-        mutex_unlock(&minors_lock);
        init_waitqueue_head(&dev->wait);
        INIT_LIST_HEAD(&dev->list);
@@ -528,6 +527,7 @@ int hidraw_connect(struct hid_device *hid)
        dev->exist = 1;
        hid->hidraw = dev;
+        mutex_unlock(&minors_lock);
 out:
        return result;
diff --git a/drivers/macintosh/windfarm_rm31.c b/drivers/macintosh/windfarm_rm31.c
index 0b9a79b2f48a..82fc86a90c1a 100644
--- a/drivers/macintosh/windfarm_rm31.c
+++ b/drivers/macintosh/windfarm_rm31.c
@@ -439,15 +439,15 @@ static void backside_setup_pid(void)
 /* Slots fan */
 static const struct wf_pid_param slots_param = {
-        .interval       = 5,
+        .interval       = 1,
-        .history_len    = 2,
+        .history_len    = 20,
-        .gd             = 30 << 20,
+        .gd             = 0,
-        .gp             = 5 << 20,
+        .gp             = 0,
-        .gr             = 0,
+        .gr             = 0x00100000,
-        .itarget        = 40 << 16,
+        .itarget        = 3200000,
-        .additive       = 1,
+        .additive       = 0,
-        .min            = 300,
+        .min            = 20,
-        .max            = 4000,
+        .max            = 100,
 };
 static void slots_fan_tick(void)
diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
index a746ba272f04..a956053608f9 100644
--- a/drivers/net/arcnet/arcnet.c
+++ b/drivers/net/arcnet/arcnet.c
@@ -1007,7 +1007,7 @@ static void arcnet_rx(struct net_device *dev, int bufnum)
        soft = &pkt.soft.rfc1201;
-        lp->hw.copy_from_card(dev, bufnum, 0, &pkt, sizeof(ARC_HDR_SIZE));
+        lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE);
        if (pkt.hard.offset[0]) {
                ofs = pkt.hard.offset[0];
                length = 256 - ofs;
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 6aa7b3266c80..ac6177d3befc 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -412,10 +412,20 @@ static void esd_usb2_read_bulk_callback(struct urb *urb)
                switch (msg->msg.hdr.cmd) {
                case CMD_CAN_RX:
+                        if (msg->msg.rx.net >= dev->net_count) {
+                                dev_err(dev->udev->dev.parent, "format error\n");
+                                break;
+                        }
                        esd_usb2_rx_can_msg(dev->nets[msg->msg.rx.net], msg);
                        break;
                case CMD_CAN_TX:
+                        if (msg->msg.txdone.net >= dev->net_count) {
+                                dev_err(dev->udev->dev.parent, "format error\n");
+                                break;
+                        }
                        esd_usb2_tx_done_msg(dev->nets[msg->msg.txdone.net],
                                             msg);
                        break;
diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index cbd388eea682..8becd3d838b5 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -779,6 +779,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
                        usb_unanchor_urb(urb);
                        usb_free_coherent(priv->udev, RX_BUFFER_SIZE, buf,
                                          urb->transfer_dma);
+                        usb_free_urb(urb);
                        break;
                }
diff --git a/drivers/net/ethernet/allwinner/Kconfig b/drivers/net/ethernet/allwinner/Kconfig
index 53ad213e865b..d8d95d4cd45a 100644
--- a/drivers/net/ethernet/allwinner/Kconfig
+++ b/drivers/net/ethernet/allwinner/Kconfig
@@ -3,19 +3,20 @@
 #
 config NET_VENDOR_ALLWINNER
-       bool "Allwinner devices"
+        bool "Allwinner devices"
-       default y
+        default y
-       depends on ARCH_SUNXI
-       ---help---
-         If you have a network (Ethernet) card belonging to this
-         class, say Y and read the Ethernet-HOWTO, available from
-         <http://www.tldp.org/docs.html#howto>.
-         Note that the answer to this question doesn't directly
+        depends on ARCH_SUNXI
-         affect the kernel: saying N will just cause the configurator
+        ---help---
-         to skip all the questions about Allwinner cards. If you say Y,
+          If you have a network (Ethernet) card belonging to this
-         you will be asked for your specific card in the following
+          class, say Y and read the Ethernet-HOWTO, available from
-         questions.
+          <http://www.tldp.org/docs.html#howto>.
+          Note that the answer to this question doesn't directly
+          affect the kernel: saying N will just cause the configurator
+          to skip all the questions about Allwinner cards. If you say Y,
+          you will be asked for your specific card in the following
+          questions.
 if NET_VENDOR_ALLWINNER
@@ -26,6 +27,7 @@ config SUN4I_EMAC
        select CRC32
        select MII
        select PHYLIB
+        select MDIO_SUN4I
        ---help---
          Support for Allwinner A10 EMAC ethernet driver.
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c.h b/drivers/net/ethernet/atheros/atl1c/atl1c.h
index b2bf324631dc..0f0556526ba9 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c.h
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c.h
@@ -520,6 +520,9 @@ struct atl1c_adapter {
        struct net_device   *netdev;
        struct pci_dev      *pdev;
        struct napi_struct  napi;
+        struct page         *rx_page;
+        unsigned int        rx_page_offset;
+        unsigned int        rx_frag_size;
        struct atl1c_hw        hw;
        struct atl1c_hw_stats  hw_stats;
        struct mii_if_info  mii;    /* MII interface info */
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 786a87483298..a36a760ada28 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -481,10 +481,15 @@ static int atl1c_set_mac_addr(struct net_device *netdev, void *p)
 static void atl1c_set_rxbufsize(struct atl1c_adapter *adapter,
                                struct net_device *dev)
 {
+        unsigned int head_size;
        int mtu = dev->mtu;
        adapter->rx_buffer_len = mtu > AT_RX_BUF_SIZE ?
                roundup(mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN, 8) : AT_RX_BUF_SIZE;
+        head_size = SKB_DATA_ALIGN(adapter->rx_buffer_len + NET_SKB_PAD) +
+                    SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+        adapter->rx_frag_size = roundup_pow_of_two(head_size);
 }
 static netdev_features_t atl1c_fix_features(struct net_device *netdev,
@@ -952,6 +957,10 @@ static void atl1c_free_ring_resources(struct atl1c_adapter *adapter)
                kfree(adapter->tpd_ring[0].buffer_info);
                adapter->tpd_ring[0].buffer_info = NULL;
        }
+        if (adapter->rx_page) {
+                put_page(adapter->rx_page);
+                adapter->rx_page = NULL;
+        }
 }
 /**
@@ -1639,6 +1648,35 @@ static inline void atl1c_rx_checksum(struct atl1c_adapter *adapter,
        skb_checksum_none_assert(skb);
 }
+static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter)
+{
+        struct sk_buff *skb;
+        struct page *page;
+        if (adapter->rx_frag_size > PAGE_SIZE)
+                return netdev_alloc_skb(adapter->netdev,
+                                        adapter->rx_buffer_len);
+        page = adapter->rx_page;
+        if (!page) {
+                adapter->rx_page = page = alloc_page(GFP_ATOMIC);
+                if (unlikely(!page))
+                        return NULL;
+                adapter->rx_page_offset = 0;
+        }
+        skb = build_skb(page_address(page) + adapter->rx_page_offset,
+                        adapter->rx_frag_size);
+        if (likely(skb)) {
+                adapter->rx_page_offset += adapter->rx_frag_size;
+                if (adapter->rx_page_offset >= PAGE_SIZE)
+                        adapter->rx_page = NULL;
+                else
+                        get_page(page);
+        }
+        return skb;
+}
 static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
 {
        struct atl1c_rfd_ring *rfd_ring = &adapter->rfd_ring;
@@ -1660,7 +1698,7 @@ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
        while (next_info->flags & ATL1C_BUFFER_FREE) {
                rfd_desc = ATL1C_RFD_DESC(rfd_ring, rfd_next_to_use);
-                skb = netdev_alloc_skb(adapter->netdev, adapter->rx_buffer_len);
+                skb = atl1c_alloc_skb(adapter);
                if (unlikely(!skb)) {
                        if (netif_msg_rx_err(adapter))
                                dev_warn(&pdev->dev, "alloc rx buffer failed\n");
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index d964f302ac94..ddebc7a5dda0 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -17625,7 +17625,8 @@ err_out_free_res:
        pci_release_regions(pdev);
 err_out_disable_pdev:
-        pci_disable_device(pdev);
+        if (pci_is_enabled(pdev))
+                pci_disable_device(pdev);
        pci_set_drvdata(pdev, NULL);
        return err;
 }
@@ -17773,7 +17774,8 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
        rtnl_lock();
-        if (!netif_running(netdev))
+        /* We probably don't have netdev yet */
+        if (!netdev || !netif_running(netdev))
                goto done;
        tg3_phy_stop(tp);
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index 2b0a0ea4f8e7..ae236009f1a8 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -259,6 +259,7 @@ struct bufdesc_ex {
 struct fec_enet_delayed_work {
        struct delayed_work delay_work;
        bool timeout;
+        bool trig_tx;
 };
 /* The FEC buffer descriptors track the ring buffers.  The rx_bd_base and
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index d3ad5ea711d3..77ea0db0bbfc 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -93,6 +93,20 @@ static void set_multicast_list(struct net_device *ndev);
 #define FEC_QUIRK_HAS_CSUM              (1 << 5)
 /* Controller has hardware vlan support */
 #define FEC_QUIRK_HAS_VLAN              (1 << 6)
+/* ENET IP errata ERR006358
+ *
+ * If the ready bit in the transmit buffer descriptor (TxBD[R]) is previously
+ * detected as not set during a prior frame transmission, then the
+ * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
+ * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
+ * If the ready bit in the transmit buffer descriptor (TxBD[R]) is previously
+ * detected as not set during a prior frame transmission, then the
+ * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
+ * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
+ * frames not being transmitted until there is a 0-to-1 transition on
+ * ENET_TDAR[TDAR].
+ */
+#define FEC_QUIRK_ERR006358            (1 << 7)
 static struct platform_device_id fec_devtype[] = {
        {
@@ -112,7 +126,7 @@ static struct platform_device_id fec_devtype[] = {
                .name = "imx6q-fec",
                .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
                                FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
-                                FEC_QUIRK_HAS_VLAN,
+                                FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR006358,
        }, {
                .name = "mvf600-fec",
                .driver_data = FEC_QUIRK_ENET_MAC,
@@ -275,16 +289,11 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
        struct fec_enet_private *fep = netdev_priv(ndev);
        const struct platform_device_id *id_entry =
                                platform_get_device_id(fep->pdev);
-        struct bufdesc *bdp;
+        struct bufdesc *bdp, *bdp_pre;
        void *bufaddr;
        unsigned short  status;
        unsigned int index;
-        if (!fep->link) {
-                /* Link is down or auto-negotiation is in progress. */
-                return NETDEV_TX_BUSY;
-        }
        /* Fill in a Tx ring entry */
        bdp = fep->cur_tx;
@@ -370,6 +379,15 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                                ebdp->cbd_esc |= BD_ENET_TX_PINS;
                }
        }
+        bdp_pre = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
+        if ((id_entry->driver_data & FEC_QUIRK_ERR006358) &&
+            !(bdp_pre->cbd_sc & BD_ENET_TX_READY)) {
+                fep->delay_work.trig_tx = true;
+                schedule_delayed_work(&(fep->delay_work.delay_work),
+                                        msecs_to_jiffies(1));
+        }
        /* If this was the last BD in the ring, start at the beginning again. */
        if (status & BD_ENET_TX_WRAP)
                bdp = fep->tx_bd_base;
@@ -689,6 +707,11 @@ static void fec_enet_work(struct work_struct *work)
                fec_restart(fep->netdev, fep->full_duplex);
                netif_wake_queue(fep->netdev);
        }
+        if (fep->delay_work.trig_tx) {
+                fep->delay_work.trig_tx = false;
+                writel(0, fep->hwp + FEC_X_DES_ACTIVE);
+        }
 }
 static void
@@ -2279,4 +2302,5 @@ static struct platform_driver fec_driver = {
 module_platform_driver(fec_driver);
+MODULE_ALIAS("platform:"DRIVER_NAME);
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 6a0c1b66ce54..c1d72c03cb59 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -3739,9 +3739,8 @@ static void igb_set_rx_mode(struct net_device *netdev)
        rctl &= ~(E1000_RCTL_UPE | E1000_RCTL_MPE | E1000_RCTL_VFE);
        if (netdev->flags & IFF_PROMISC) {
-                u32 mrqc = rd32(E1000_MRQC);
                /* retain VLAN HW filtering if in VT mode */
-                if (mrqc & E1000_MRQC_ENABLE_VMDQ)
+                if (adapter->vfs_allocated_count)
                        rctl |= E1000_RCTL_VFE;
                rctl |= (E1000_RCTL_UPE | E1000_RCTL_MPE);
                vmolr |= (E1000_VMOLR_ROPE | E1000_VMOLR_MPME);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
index ac780770863d..7a77f37a7cbc 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
@@ -108,9 +108,8 @@ s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *hw,
        /* Enable arbiter */
        reg &= ~IXGBE_DPMCS_ARBDIS;
-        /* Enable DFP and Recycle mode */
-        reg |= (IXGBE_DPMCS_TDPAC | IXGBE_DPMCS_TRM);
        reg |= IXGBE_DPMCS_TSOEF;
        /* Configure Max TSO packet size 34KB including payload and headers */
        reg |= (0x4 << IXGBE_DPMCS_MTSOS_SHIFT);
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 712779fb12b7..b017818bccae 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -88,6 +88,8 @@
 #define      MVNETA_TX_IN_PRGRS                  BIT(1)
 #define      MVNETA_TX_FIFO_EMPTY                BIT(8)
 #define MVNETA_RX_MIN_FRAME_SIZE                 0x247c
+#define MVNETA_SGMII_SERDES_CFG                  0x24A0
+#define      MVNETA_SGMII_SERDES_PROTO           0x0cc7
 #define MVNETA_TYPE_PRIO                         0x24bc
 #define      MVNETA_FORCE_UNI                    BIT(21)
 #define MVNETA_TXQ_CMD_1                         0x24e4
@@ -655,6 +657,8 @@ static void mvneta_port_sgmii_config(struct mvneta_port *pp)
        val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
        val |= MVNETA_GMAC2_PSC_ENABLE;
        mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
+        mvreg_write(pp, MVNETA_SGMII_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO);
 }
 /* Start the Ethernet port RX and TX activity */
@@ -2728,28 +2732,24 @@ static int mvneta_probe(struct platform_device *pdev)
        pp = netdev_priv(dev);
-        pp->tx_done_timer.function = mvneta_tx_done_timer_callback;
-        init_timer(&pp->tx_done_timer);
-        clear_bit(MVNETA_F_TX_DONE_TIMER_BIT, &pp->flags);
        pp->weight = MVNETA_RX_POLL_WEIGHT;
        pp->phy_node = phy_node;
        pp->phy_interface = phy_mode;
-        pp->base = of_iomap(dn, 0);
-        if (pp->base == NULL) {
-                err = -ENOMEM;
-                goto err_free_irq;
-        }
        pp->clk = devm_clk_get(&pdev->dev, NULL);
        if (IS_ERR(pp->clk)) {
                err = PTR_ERR(pp->clk);
-                goto err_unmap;
+                goto err_free_irq;
        }
        clk_prepare_enable(pp->clk);
+        pp->base = of_iomap(dn, 0);
+        if (pp->base == NULL) {
+                err = -ENOMEM;
+                goto err_clk;
+        }
        dt_mac_addr = of_get_mac_address(dn);
        if (dt_mac_addr && is_valid_ether_addr(dt_mac_addr)) {
                mac_from = "device tree";
@@ -2766,6 +2766,9 @@ static int mvneta_probe(struct platform_device *pdev)
        }
        pp->tx_done_timer.data = (unsigned long)dev;
+        pp->tx_done_timer.function = mvneta_tx_done_timer_callback;
+        init_timer(&pp->tx_done_timer);
+        clear_bit(MVNETA_F_TX_DONE_TIMER_BIT, &pp->flags);
        pp->tx_ring_size = MVNETA_MAX_TXD;
        pp->rx_ring_size = MVNETA_MAX_RXD;
@@ -2776,7 +2779,7 @@ static int mvneta_probe(struct platform_device *pdev)
        err = mvneta_init(pp, phy_addr);
        if (err < 0) {
                dev_err(&pdev->dev, "can't init eth hal\n");
-                goto err_clk;
+                goto err_unmap;
        }
        mvneta_port_power_up(pp, phy_mode);
@@ -2806,10 +2809,10 @@ static int mvneta_probe(struct platform_device *pdev)
 err_deinit:
        mvneta_deinit(pp);
-err_clk:
-        clk_disable_unprepare(pp->clk);
 err_unmap:
        iounmap(pp->base);
+err_clk:
+        clk_disable_unprepare(pp->clk);
 err_free_irq:
        irq_dispose_mapping(dev->irq);
 err_free_netdev:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 205753a04cfc..40374063c01e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -1113,7 +1113,13 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, unsigned long vector)
        for (i = 0; i < (1 << cmd->log_sz); i++) {
                if (test_bit(i, &vector)) {
+                        struct semaphore *sem;
                        ent = cmd->ent_arr[i];
+                        if (ent->page_queue)
+                                sem = &cmd->pages_sem;
+                        else
+                                sem = &cmd->sem;
                        ktime_get_ts(&ent->ts2);
                        memcpy(ent->out->first.data, ent->lay->out, sizeof(ent->lay->out));
                        dump_command(dev, ent, 0);
@@ -1136,10 +1142,7 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, unsigned long vector)
                        } else {
                                complete(&ent->done);
                        }
-                        if (ent->page_queue)
+                        up(sem);
-                                up(&cmd->pages_sem);
-                        else
-                                up(&cmd->sem);
                }
        }
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/uar.c b/drivers/net/ethernet/mellanox/mlx5/core/uar.c
index 71d4a3937200..68f5d9c77c7b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/uar.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/uar.c
@@ -164,6 +164,7 @@ int mlx5_alloc_uuars(struct mlx5_core_dev *dev, struct mlx5_uuar_info *uuari)
                uuari->uars[i].map = ioremap(addr, PAGE_SIZE);
                if (!uuari->uars[i].map) {
                        mlx5_cmd_free_uar(dev, uuari->uars[i].index);
+                        err = -ENOMEM;
                        goto out_count;
                }
                mlx5_core_dbg(dev, "allocated uar index 0x%x, mmaped at %p\n",
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig b/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig
index cb22341a14a8..a588ffde9700 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig
@@ -4,7 +4,7 @@
 config PCH_GBE
        tristate "OKI SEMICONDUCTOR IOH(ML7223/ML7831) GbE"
-        depends on PCI
+        depends on PCI && (X86 || COMPILE_TEST)
        select MII
        select PTP_1588_CLOCK_PCH
        ---help---
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index b00cf5665eab..f4bb8f5d7453 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -1869,7 +1869,8 @@ static inline void qlcnic_free_mac_list(struct qlcnic_adapter *adapter)
 static inline void qlcnic_set_mac_filter_count(struct qlcnic_adapter *adapter)
 {
-        adapter->ahw->hw_ops->set_mac_filter_count(adapter);
+        if (adapter->ahw->hw_ops->set_mac_filter_count)
+                adapter->ahw->hw_ops->set_mac_filter_count(adapter);
 }
 static inline void qlcnic_dev_request_reset(struct qlcnic_adapter *adapter,
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 0913c623a67e..bc483e1881a3 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -3014,8 +3014,8 @@ int qlcnic_83xx_get_settings(struct qlcnic_adapter *adapter,
        }
        if (ahw->port_type == QLCNIC_XGBE) {
-                ecmd->supported = SUPPORTED_1000baseT_Full;
+                ecmd->supported = SUPPORTED_10000baseT_Full;
-                ecmd->advertising = ADVERTISED_1000baseT_Full;
+                ecmd->advertising = ADVERTISED_10000baseT_Full;
        } else {
                ecmd->supported = (SUPPORTED_10baseT_Half |
                                   SUPPORTED_10baseT_Full |
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index f41dfab1e9a3..51ab4b56fc91 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -2123,6 +2123,8 @@ int qlcnic_83xx_init(struct qlcnic_adapter *adapter, int pci_using_dac)
        set_bit(QLC_83XX_MBX_READY, &adapter->ahw->idc.status);
        qlcnic_83xx_clear_function_resources(adapter);
+        INIT_DELAYED_WORK(&adapter->idc_aen_work, qlcnic_83xx_idc_aen_work);
        /* register for NIC IDC AEN Events */
        qlcnic_83xx_register_nic_idc_func(adapter, 1);
@@ -2140,8 +2142,6 @@ int qlcnic_83xx_init(struct qlcnic_adapter *adapter, int pci_using_dac)
        if (adapter->nic_ops->init_driver(adapter))
                return -EIO;
-        INIT_DELAYED_WORK(&adapter->idc_aen_work, qlcnic_83xx_idc_aen_work);
        /* Periodically monitor device status */
        qlcnic_83xx_idc_poll_dev_state(&adapter->fw_work.work);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 700a46324d09..05a847e599c6 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -1540,7 +1540,7 @@ qlcnic_set_dump(struct net_device *netdev, struct ethtool_dump *val)
                return 0;
        case QLCNIC_SET_QUIESCENT:
        case QLCNIC_RESET_QUIESCENT:
-                state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
+                state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
                if (state == QLCNIC_DEV_FAILED || (state == QLCNIC_DEV_BADBAD))
                        netdev_info(netdev, "Device in FAILED state\n");
                return 0;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
index 5b5d2edf125d..4ed7e73d88d3 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
@@ -516,20 +516,18 @@ void __qlcnic_set_multi(struct net_device *netdev, u16 vlan)
        if (netdev->flags & IFF_PROMISC) {
                if (!(adapter->flags & QLCNIC_PROMISC_DISABLED))
                        mode = VPORT_MISS_MODE_ACCEPT_ALL;
-        } else if (netdev->flags & IFF_ALLMULTI) {
+        } else if ((netdev->flags & IFF_ALLMULTI) ||
-                if (netdev_mc_count(netdev) > ahw->max_mc_count) {
+                   (netdev_mc_count(netdev) > ahw->max_mc_count)) {
-                        mode = VPORT_MISS_MODE_ACCEPT_MULTI;
+                mode = VPORT_MISS_MODE_ACCEPT_MULTI;
-                } else if (!netdev_mc_empty(netdev) &&
+        } else if (!netdev_mc_empty(netdev) &&
-                           !qlcnic_sriov_vf_check(adapter)) {
+                   !qlcnic_sriov_vf_check(adapter)) {
-                                netdev_for_each_mc_addr(ha, netdev)
+                netdev_for_each_mc_addr(ha, netdev)
-                                        qlcnic_nic_add_mac(adapter, ha->addr,
+                        qlcnic_nic_add_mac(adapter, ha->addr, vlan);
-                                                           vlan);
-                }
-                if (mode != VPORT_MISS_MODE_ACCEPT_MULTI &&
-                    qlcnic_sriov_vf_check(adapter))
-                        qlcnic_vf_add_mc_list(netdev, vlan);
        }
+        if (qlcnic_sriov_vf_check(adapter))
+                qlcnic_vf_add_mc_list(netdev, vlan);
        /* configure unicast MAC address, if there is not sufficient space
         * to store all the unicast addresses then enable promiscuous mode
         */
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
index d28336fc65ab..a2023090e866 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
@@ -142,7 +142,7 @@ void qlcnic_release_tx_buffers(struct qlcnic_adapter *adapter)
                                         buffrag->length, PCI_DMA_TODEVICE);
                        buffrag->dma = 0ULL;
                }
-                for (j = 0; j < cmd_buf->frag_count; j++) {
+                for (j = 1; j < cmd_buf->frag_count; j++) {
                        buffrag++;
                        if (buffrag->dma) {
                                pci_unmap_page(adapter->pdev, buffrag->dma,
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 4528f8ec333b..cc78d3924c6a 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -1383,6 +1383,8 @@ qlcnic_request_irq(struct qlcnic_adapter *adapter)
        if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
                if (qlcnic_82xx_check(adapter))
                        handler = qlcnic_tmp_intr;
+                else
+                        handler = qlcnic_83xx_tmp_intr;
                if (!QLCNIC_IS_MSI_FAMILY(adapter))
                        flags |= IRQF_SHARED;
@@ -1531,12 +1533,12 @@ int __qlcnic_up(struct qlcnic_adapter *adapter, struct net_device *netdev)
        if (netdev->features & NETIF_F_LRO)
                qlcnic_config_hw_lro(adapter, QLCNIC_LRO_ENABLED);
+        set_bit(__QLCNIC_DEV_UP, &adapter->state);
        qlcnic_napi_enable(adapter);
        qlcnic_linkevent_request(adapter, 1);
        adapter->ahw->reset_context = 0;
-        set_bit(__QLCNIC_DEV_UP, &adapter->state);
        return 0;
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
index ab8a6744d402..79e54efe07b9 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
@@ -1084,7 +1084,7 @@ flash_temp:
        tmpl_hdr = ahw->fw_dump.tmpl_hdr;
        tmpl_hdr->drv_cap_mask = QLCNIC_DUMP_MASK_DEF;
-        if ((tmpl_hdr->version & 0xffffff) >= 0x20001)
+        if ((tmpl_hdr->version & 0xfffff) >= 0x20001)
                ahw->fw_dump.use_pex_dma = true;
        else
                ahw->fw_dump.use_pex_dma = false;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 62380ce89905..56e85f98117f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -762,6 +762,7 @@ static int qlcnic_sriov_alloc_bc_mbx_args(struct qlcnic_cmd_args *mbx, u32 type)
                        memset(mbx->rsp.arg, 0, sizeof(u32) * mbx->rsp.num);
                        mbx->req.arg[0] = (type | (mbx->req.num << 16) |
                                           (3 << 29));
+                        mbx->rsp.arg[0] = (type & 0xffff) | mbx->rsp.num << 16;
                        return 0;
                }
        }
@@ -813,6 +814,7 @@ static int qlcnic_sriov_prepare_bc_hdr(struct qlcnic_bc_trans *trans,
                cmd->req.num = trans->req_pay_size / 4;
                cmd->rsp.num = trans->rsp_pay_size / 4;
                hdr = trans->rsp_hdr;
+                cmd->op_type = trans->req_hdr->op_type;
        }
        trans->trans_id = seq;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index ee0c1d307966..eb49cd65378c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -635,12 +635,12 @@ static int qlcnic_sriov_pf_channel_cfg_cmd(struct qlcnic_bc_trans *trans,
                                           struct qlcnic_cmd_args *cmd)
 {
        struct qlcnic_vf_info *vf = trans->vf;
-        struct qlcnic_adapter *adapter = vf->adapter;
+        struct qlcnic_vport *vp = vf->vp;
-        int err;
+        struct qlcnic_adapter *adapter;
        u16 func = vf->pci_func;
+        int err;
-        cmd->rsp.arg[0] = trans->req_hdr->cmd_op;
+        adapter = vf->adapter;
-        cmd->rsp.arg[0] |= (1 << 16);
        if (trans->req_hdr->cmd_op == QLCNIC_BC_CMD_CHANNEL_INIT) {
                err = qlcnic_sriov_pf_config_vport(adapter, 1, func);
@@ -650,6 +650,8 @@ static int qlcnic_sriov_pf_channel_cfg_cmd(struct qlcnic_bc_trans *trans,
                                qlcnic_sriov_pf_config_vport(adapter, 0, func);
                }
        } else {
+                if (vp->vlan_mode == QLC_GUEST_VLAN_MODE)
+                        vp->vlan = 0;
                err = qlcnic_sriov_pf_config_vport(adapter, 0, func);
        }
@@ -1183,7 +1185,7 @@ static int qlcnic_sriov_pf_get_acl_cmd(struct qlcnic_bc_trans *trans,
        u8 cmd_op, mode = vp->vlan_mode;
        cmd_op = trans->req_hdr->cmd_op;
-        cmd->rsp.arg[0] = (cmd_op & 0xffff) | 14 << 16 | 1 << 25;
+        cmd->rsp.arg[0] |= 1 << 25;
        switch (mode) {
        case QLC_GUEST_VLAN_MODE:
@@ -1561,6 +1563,7 @@ void qlcnic_sriov_pf_handle_flr(struct qlcnic_sriov *sriov,
                                struct qlcnic_vf_info *vf)
 {
        struct net_device *dev = vf->adapter->netdev;
+        struct qlcnic_vport *vp = vf->vp;
        if (!test_and_clear_bit(QLC_BC_VF_STATE, &vf->state)) {
                clear_bit(QLC_BC_VF_FLR, &vf->state);
@@ -1573,6 +1576,9 @@ void qlcnic_sriov_pf_handle_flr(struct qlcnic_sriov *sriov,
                return;
        }
+        if (vp->vlan_mode == QLC_GUEST_VLAN_MODE)
+                vp->vlan = 0;
        qlcnic_sriov_schedule_flr(sriov, vf, qlcnic_sriov_pf_process_flr);
        netdev_info(dev, "FLR received for PCI func %d\n", vf->pci_func);
 }
@@ -1621,13 +1627,15 @@ int qlcnic_sriov_set_vf_mac(struct net_device *netdev, int vf, u8 *mac)
 {
        struct qlcnic_adapter *adapter = netdev_priv(netdev);
        struct qlcnic_sriov *sriov = adapter->ahw->sriov;
-        int i, num_vfs = sriov->num_vfs;
+        int i, num_vfs;
        struct qlcnic_vf_info *vf_info;
        u8 *curr_mac;
        if (!qlcnic_sriov_pf_check(adapter))
                return -EOPNOTSUPP;
+        num_vfs = sriov->num_vfs;
        if (!is_valid_ether_addr(mac) || vf >= num_vfs)
                return -EINVAL;
@@ -1741,6 +1749,7 @@ int qlcnic_sriov_set_vf_vlan(struct net_device *netdev, int vf,
        switch (vlan) {
        case 4095:
+                vp->vlan = 0;
                vp->vlan_mode = QLC_GUEST_VLAN_MODE;
                break;
        case 0:
@@ -1759,6 +1768,29 @@ int qlcnic_sriov_set_vf_vlan(struct net_device *netdev, int vf,
        return 0;
 }
+static inline __u32 qlcnic_sriov_get_vf_vlan(struct qlcnic_adapter *adapter,
+                                             struct qlcnic_vport *vp, int vf)
+{
+        __u32 vlan = 0;
+        switch (vp->vlan_mode) {
+        case QLC_PVID_MODE:
+                vlan = vp->vlan;
+                break;
+        case QLC_GUEST_VLAN_MODE:
+                vlan = MAX_VLAN_ID;
+                break;
+        case QLC_NO_VLAN_MODE:
+                vlan = 0;
+                break;
+        default:
+                netdev_info(adapter->netdev, "Invalid VLAN mode = %d for VF %d\n",
+                            vp->vlan_mode, vf);
+        }
+        return vlan;
+}
 int qlcnic_sriov_get_vf_config(struct net_device *netdev,
                               int vf, struct ifla_vf_info *ivi)
 {
@@ -1774,7 +1806,7 @@ int qlcnic_sriov_get_vf_config(struct net_device *netdev,
        vp = sriov->vf_info[vf].vp;
        memcpy(&ivi->mac, vp->mac, ETH_ALEN);
-        ivi->vlan = vp->vlan;
+        ivi->vlan = qlcnic_sriov_get_vf_vlan(adapter, vp, vf);
        ivi->qos = vp->qos;
        ivi->spoofchk = vp->spoofchk;
        if (vp->max_tx_bw == MAX_BW)
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 4106a743ca74..880015cae6a3 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -6468,6 +6468,8 @@ static int rtl8169_close(struct net_device *dev)
        rtl8169_down(dev);
        rtl_unlock_work(tp);
+        cancel_work_sync(&tp->wk.work);
        free_irq(pdev->irq, dev);
        dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
@@ -6793,8 +6795,6 @@ static void rtl_remove_one(struct pci_dev *pdev)
                rtl8168_driver_stop(tp);
        }
-        cancel_work_sync(&tp->wk.work);
        netif_napi_del(&tp->napi);
        unregister_netdev(dev);
diff --git a/drivers/net/ethernet/sfc/filter.c b/drivers/net/ethernet/sfc/filter.c
index b74a60ab9ac7..2a469b27a506 100644
--- a/drivers/net/ethernet/sfc/filter.c
+++ b/drivers/net/ethernet/sfc/filter.c
@@ -1209,7 +1209,9 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
        EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + 4 * ip->ihl + 4);
        ports = (const __be16 *)(skb->data + nhoff + 4 * ip->ihl);
-        efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT, 0, rxq_index);
+        efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT,
+                           efx->rx_scatter ? EFX_FILTER_FLAG_RX_SCATTER : 0,
+                           rxq_index);
        rc = efx_filter_set_ipv4_full(&spec, ip->protocol,
                                      ip->daddr, ports[1], ip->saddr, ports[0]);
        if (rc)
diff --git a/drivers/net/phy/mdio-sun4i.c b/drivers/net/phy/mdio-sun4i.c
index 61d3f4ebf52e..7f25e49ae37f 100644
--- a/drivers/net/phy/mdio-sun4i.c
+++ b/drivers/net/phy/mdio-sun4i.c
@@ -40,7 +40,7 @@ struct sun4i_mdio_data {
 static int sun4i_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
 {
        struct sun4i_mdio_data *data = bus->priv;
-        unsigned long start_jiffies;
+        unsigned long timeout_jiffies;
        int value;
        /* issue the phy address and reg */
@@ -49,10 +49,9 @@ static int sun4i_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
        writel(0x1, data->membase + EMAC_MAC_MCMD_REG);
        /* Wait read complete */
-        start_jiffies = jiffies;
+        timeout_jiffies = jiffies + MDIO_TIMEOUT;
        while (readl(data->membase + EMAC_MAC_MIND_REG) & 0x1) {
-                if (time_after(start_jiffies,
+                if (time_is_before_jiffies(timeout_jiffies))
-                               start_jiffies + MDIO_TIMEOUT))
                        return -ETIMEDOUT;
                msleep(1);
        }
@@ -69,7 +68,7 @@ static int sun4i_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
                            u16 value)
 {
        struct sun4i_mdio_data *data = bus->priv;
-        unsigned long start_jiffies;
+        unsigned long timeout_jiffies;
        /* issue the phy address and reg */
        writel((mii_id << 8) | regnum, data->membase + EMAC_MAC_MADR_REG);
@@ -77,10 +76,9 @@ static int sun4i_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
        writel(0x1, data->membase + EMAC_MAC_MCMD_REG);
        /* Wait read complete */
-        start_jiffies = jiffies;
+        timeout_jiffies = jiffies + MDIO_TIMEOUT;
        while (readl(data->membase + EMAC_MAC_MIND_REG) & 0x1) {
-                if (time_after(start_jiffies,
+                if (time_is_before_jiffies(timeout_jiffies))
-                               start_jiffies + MDIO_TIMEOUT))
                        return -ETIMEDOUT;
                msleep(1);
        }
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 1e3c302d94fe..2bc87e3a8141 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1029,10 +1029,10 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
        dev->mii.supports_gmii = 1;
        dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                              NETIF_F_RXCSUM;
        dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                                 NETIF_F_RXCSUM;
        /* Enable checksum offload */
        *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
@@ -1173,7 +1173,6 @@ ax88179_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
        if (((skb->len + 8) % frame_size) == 0)
                tx_hdr2 |= 0x80008000;  /* Enable padding */
-        skb_linearize(skb);
        headroom = skb_headroom(skb);
        tailroom = skb_tailroom(skb);
@@ -1317,10 +1316,10 @@ static int ax88179_reset(struct usbnet *dev)
                          1, 1, tmp);
        dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                              NETIF_F_RXCSUM;
        dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                                 NETIF_F_RXCSUM;
        /* Enable checksum offload */
        *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 75409748c774..66ebbacf066f 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -45,7 +45,6 @@
 #define EEPROM_MAC_OFFSET               (0x01)
 #define DEFAULT_TX_CSUM_ENABLE          (true)
 #define DEFAULT_RX_CSUM_ENABLE          (true)
-#define DEFAULT_TSO_ENABLE              (true)
 #define SMSC75XX_INTERNAL_PHY_ID        (1)
 #define SMSC75XX_TX_OVERHEAD            (8)
 #define MAX_RX_FIFO_SIZE                (20 * 1024)
@@ -1410,17 +1409,14 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
        INIT_WORK(&pdata->set_multicast, smsc75xx_deferred_multicast_write);
-        if (DEFAULT_TX_CSUM_ENABLE) {
+        if (DEFAULT_TX_CSUM_ENABLE)
                dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
-                if (DEFAULT_TSO_ENABLE)
-                        dev->net->features |= NETIF_F_SG |
-                                NETIF_F_TSO | NETIF_F_TSO6;
-        }
        if (DEFAULT_RX_CSUM_ENABLE)
                dev->net->features |= NETIF_F_RXCSUM;
        dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_RXCSUM;
+                                NETIF_F_RXCSUM;
        ret = smsc75xx_wait_ready(dev, 0);
        if (ret < 0) {
@@ -2200,8 +2196,6 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
 {
        u32 tx_cmd_a, tx_cmd_b;
-        skb_linearize(skb);
        if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
                struct sk_buff *skb2 =
                        skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index da866523cf20..eee1f19ef1e9 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -269,6 +269,7 @@ static void veth_setup(struct net_device *dev)
        dev->ethtool_ops = &veth_ethtool_ops;
        dev->features |= NETIF_F_LLTX;
        dev->features |= VETH_FEATURES;
+        dev->vlan_features = dev->features;
        dev->destructor = veth_dev_free;
        dev->hw_features = VETH_FEATURES;
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index a5ba8dd7e6be..f4c6db419ddb 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -136,7 +136,8 @@ struct vxlan_dev {
        u32               flags;        /* VXLAN_F_* below */
        struct work_struct sock_work;
-        struct work_struct igmp_work;
+        struct work_struct igmp_join;
+        struct work_struct igmp_leave;
        unsigned long     age_interval;
        struct timer_list age_timer;
@@ -736,7 +737,6 @@ static bool vxlan_snoop(struct net_device *dev,
        return false;
 }
 /* See if multicast group is already in use by other ID */
 static bool vxlan_group_used(struct vxlan_net *vn, __be32 remote_ip)
 {
@@ -770,12 +770,13 @@ static void vxlan_sock_release(struct vxlan_net *vn, struct vxlan_sock *vs)
        queue_work(vxlan_wq, &vs->del_work);
 }
-/* Callback to update multicast group membership.
+/* Callback to update multicast group membership when first VNI on
- * Scheduled when vxlan goes up/down.
+ * multicast asddress is brought up
+ * Done as workqueue because ip_mc_join_group acquires RTNL.
 */
-static void vxlan_igmp_work(struct work_struct *work)
+static void vxlan_igmp_join(struct work_struct *work)
 {
-        struct vxlan_dev *vxlan = container_of(work, struct vxlan_dev, igmp_work);
+        struct vxlan_dev *vxlan = container_of(work, struct vxlan_dev, igmp_join);
        struct vxlan_net *vn = net_generic(dev_net(vxlan->dev), vxlan_net_id);
        struct vxlan_sock *vs = vxlan->vn_sock;
        struct sock *sk = vs->sock->sk;
@@ -785,10 +786,27 @@ static void vxlan_igmp_work(struct work_struct *work)
        };
        lock_sock(sk);
-        if (vxlan_group_used(vn, vxlan->default_dst.remote_ip))
+        ip_mc_join_group(sk, &mreq);
-                ip_mc_join_group(sk, &mreq);
+        release_sock(sk);
-        else
-                ip_mc_leave_group(sk, &mreq);
+        vxlan_sock_release(vn, vs);
+        dev_put(vxlan->dev);
+}
+/* Inverse of vxlan_igmp_join when last VNI is brought down */
+static void vxlan_igmp_leave(struct work_struct *work)
+{
+        struct vxlan_dev *vxlan = container_of(work, struct vxlan_dev, igmp_leave);
+        struct vxlan_net *vn = net_generic(dev_net(vxlan->dev), vxlan_net_id);
+        struct vxlan_sock *vs = vxlan->vn_sock;
+        struct sock *sk = vs->sock->sk;
+        struct ip_mreqn mreq = {
+                .imr_multiaddr.s_addr   = vxlan->default_dst.remote_ip,
+                .imr_ifindex            = vxlan->default_dst.remote_ifindex,
+        };
+        lock_sock(sk);
+        ip_mc_leave_group(sk, &mreq);
        release_sock(sk);
        vxlan_sock_release(vn, vs);
@@ -1359,6 +1377,7 @@ static void vxlan_uninit(struct net_device *dev)
 /* Start ageing timer and join group when device is brought up */
 static int vxlan_open(struct net_device *dev)
 {
+        struct vxlan_net *vn = net_generic(dev_net(dev), vxlan_net_id);
        struct vxlan_dev *vxlan = netdev_priv(dev);
        struct vxlan_sock *vs = vxlan->vn_sock;
@@ -1366,10 +1385,11 @@ static int vxlan_open(struct net_device *dev)
        if (!vs)
                return -ENOTCONN;
-        if (IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip))) {
+        if (IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip)) &&
+            ! vxlan_group_used(vn, vxlan->default_dst.remote_ip)) {
                vxlan_sock_hold(vs);
                dev_hold(dev);
-                queue_work(vxlan_wq, &vxlan->igmp_work);
+                queue_work(vxlan_wq, &vxlan->igmp_join);
        }
        if (vxlan->age_interval)
@@ -1400,13 +1420,15 @@ static void vxlan_flush(struct vxlan_dev *vxlan)
 /* Cleanup timer and forwarding table on shutdown */
 static int vxlan_stop(struct net_device *dev)
 {
+        struct vxlan_net *vn = net_generic(dev_net(dev), vxlan_net_id);
        struct vxlan_dev *vxlan = netdev_priv(dev);
        struct vxlan_sock *vs = vxlan->vn_sock;
-        if (vs && IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip))) {
+        if (vs && IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip)) &&
+            ! vxlan_group_used(vn, vxlan->default_dst.remote_ip)) {
                vxlan_sock_hold(vs);
                dev_hold(dev);
-                queue_work(vxlan_wq, &vxlan->igmp_work);
+                queue_work(vxlan_wq, &vxlan->igmp_leave);
        }
        del_timer_sync(&vxlan->age_timer);
@@ -1471,7 +1493,8 @@ static void vxlan_setup(struct net_device *dev)
        INIT_LIST_HEAD(&vxlan->next);
        spin_lock_init(&vxlan->hash_lock);
-        INIT_WORK(&vxlan->igmp_work, vxlan_igmp_work);
+        INIT_WORK(&vxlan->igmp_join, vxlan_igmp_join);
+        INIT_WORK(&vxlan->igmp_leave, vxlan_igmp_leave);
        INIT_WORK(&vxlan->sock_work, vxlan_sock_work);
        init_timer_deferrable(&vxlan->age_timer);
@@ -1878,10 +1901,12 @@ static __net_exit void vxlan_exit_net(struct net *net)
 {
        struct vxlan_net *vn = net_generic(net, vxlan_net_id);
        struct vxlan_dev *vxlan;
+        LIST_HEAD(list);
        rtnl_lock();
        list_for_each_entry(vxlan, &vn->vxlan_list, next)
-                dev_close(vxlan->dev);
+                unregister_netdevice_queue(vxlan->dev, &list);
+        unregister_netdevice_many(&list);
        rtnl_unlock();
 }
diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
index 81b686c6a376..40825d43322e 100644
--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
@@ -325,7 +325,7 @@ ath5k_prepare_multicast(struct ieee80211_hw *hw,
        struct netdev_hw_addr *ha;
        mfilt[0] = 0;
-        mfilt[1] = 1;
+        mfilt[1] = 0;
        netdev_hw_addr_list_for_each(ha, mc_list) {
                /* calculate XOR of eight 6-bit values */
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index d1acfe98918a..1576d58291d4 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -610,7 +610,15 @@ static void ar5008_hw_override_ini(struct ath_hw *ah,
        REG_SET_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
        if (AR_SREV_9280_20_OR_LATER(ah)) {
-                val = REG_READ(ah, AR_PCU_MISC_MODE2);
+                /*
+                 * For AR9280 and above, there is a new feature that allows
+                 * Multicast search based on both MAC Address and Key ID.
+                 * By default, this feature is enabled. But since the driver
+                 * is not using this feature, we switch it off; otherwise
+                 * multicast search based on MAC addr only will fail.
+                 */
+                val = REG_READ(ah, AR_PCU_MISC_MODE2) &
+                        (~AR_ADHOC_MCAST_KEYID_ENABLE);
                if (!AR_SREV_9271(ah))
                        val &= ~AR_PCU_MISC_MODE2_HWWAR1;
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 9e582e14da74..5205a3625e84 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1082,7 +1082,7 @@ static void ath9k_hif_usb_firmware_fail(struct hif_device_usb *hif_dev)
        struct device *dev = &hif_dev->udev->dev;
        struct device *parent = dev->parent;
-        complete(&hif_dev->fw_done);
+        complete_all(&hif_dev->fw_done);
        if (parent)
                device_lock(parent);
@@ -1131,7 +1131,7 @@ static void ath9k_hif_usb_firmware_cb(const struct firmware *fw, void *context)
        release_firmware(fw);
        hif_dev->flags |= HIF_USB_READY;
-        complete(&hif_dev->fw_done);
+        complete_all(&hif_dev->fw_done);
        return;
@@ -1295,7 +1295,9 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
        usb_set_intfdata(interface, NULL);
-        if (!unplugged && (hif_dev->flags & HIF_USB_START))
+        /* If firmware was loaded we should drop it
+         * go back to first stage bootloader. */
+        if (!unplugged && (hif_dev->flags & HIF_USB_READY))
                ath9k_hif_usb_reboot(udev);
        kfree(hif_dev);
@@ -1316,7 +1318,10 @@ static int ath9k_hif_usb_suspend(struct usb_interface *interface,
        if (!(hif_dev->flags & HIF_USB_START))
                ath9k_htc_suspend(hif_dev->htc_handle);
-        ath9k_hif_usb_dealloc_urbs(hif_dev);
+        wait_for_completion(&hif_dev->fw_done);
+        if (hif_dev->flags & HIF_USB_READY)
+                ath9k_hif_usb_dealloc_urbs(hif_dev);
        return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 71a183ffc77f..c3676bf1d6c4 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -861,6 +861,7 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv,
        if (error != 0)
                goto err_rx;
+        ath9k_hw_disable(priv->ah);
 #ifdef CONFIG_MAC80211_LEDS
        /* must be initialized before ieee80211_register_hw */
        priv->led_cdev.default_trigger = ieee80211_create_tpt_led_trigger(priv->hw,
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index c59ae43b9b35..927992732620 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -146,6 +146,28 @@ static void ath_set_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
                               ARRAY_SIZE(bf->rates));
 }
+static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
+                             struct sk_buff *skb)
+{
+        int q;
+        q = skb_get_queue_mapping(skb);
+        if (txq == sc->tx.uapsdq)
+                txq = sc->tx.txq_map[q];
+        if (txq != sc->tx.txq_map[q])
+                return;
+        if (WARN_ON(--txq->pending_frames < 0))
+                txq->pending_frames = 0;
+        if (txq->stopped &&
+            txq->pending_frames < sc->tx.txq_max_pending[q]) {
+                ieee80211_wake_queue(sc->hw, q);
+                txq->stopped = false;
+        }
+}
 static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
 {
        struct ath_txq *txq = tid->ac->txq;
@@ -167,6 +189,7 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
                if (!bf) {
                        bf = ath_tx_setup_buffer(sc, txq, tid, skb);
                        if (!bf) {
+                                ath_txq_skb_done(sc, txq, skb);
                                ieee80211_free_txskb(sc->hw, skb);
                                continue;
                        }
@@ -811,6 +834,7 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
                if (!bf) {
                        __skb_unlink(skb, &tid->buf_q);
+                        ath_txq_skb_done(sc, txq, skb);
                        ieee80211_free_txskb(sc->hw, skb);
                        continue;
                }
@@ -1824,6 +1848,7 @@ static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_txq *txq,
        bf = ath_tx_setup_buffer(sc, txq, tid, skb);
        if (!bf) {
+                ath_txq_skb_done(sc, txq, skb);
                ieee80211_free_txskb(sc->hw, skb);
                return;
        }
@@ -2090,6 +2115,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
        bf = ath_tx_setup_buffer(sc, txq, tid, skb);
        if (!bf) {
+                ath_txq_skb_done(sc, txq, skb);
                if (txctl->paprd)
                        dev_kfree_skb_any(skb);
                else
@@ -2189,7 +2215,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
        struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
-        int q, padpos, padsize;
+        int padpos, padsize;
        unsigned long flags;
        ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
@@ -2225,21 +2251,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
        spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
        __skb_queue_tail(&txq->complete_q, skb);
+        ath_txq_skb_done(sc, txq, skb);
-        q = skb_get_queue_mapping(skb);
-        if (txq == sc->tx.uapsdq)
-                txq = sc->tx.txq_map[q];
-        if (txq == sc->tx.txq_map[q]) {
-                if (WARN_ON(--txq->pending_frames < 0))
-                        txq->pending_frames = 0;
-                if (txq->stopped &&
-                    txq->pending_frames < sc->tx.txq_max_pending[q]) {
-                        ieee80211_wake_queue(sc->hw, q);
-                        txq->stopped = false;
-                }
-        }
 }
 static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index e8308ec30970..ab636767fbde 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -145,7 +145,7 @@ static void wil_print_ring(struct seq_file *s, const char *prefix,
                                   le16_to_cpu(hdr.type), hdr.flags);
                        if (len <= MAX_MBOXITEM_SIZE) {
                                int n = 0;
-                                unsigned char printbuf[16 * 3 + 2];
+                                char printbuf[16 * 3 + 2];
                                unsigned char databuf[MAX_MBOXITEM_SIZE];
                                void __iomem *src = wmi_buffer(wil, d.addr) +
                                        sizeof(struct wil6210_mbox_hdr);
@@ -416,7 +416,7 @@ static int wil_txdesc_debugfs_show(struct seq_file *s, void *data)
                seq_printf(s, "  SKB = %p\n", skb);
                if (skb) {
-                        unsigned char printbuf[16 * 3 + 2];
+                        char printbuf[16 * 3 + 2];
                        int i = 0;
                        int len = le16_to_cpu(d->dma.length);
                        void *p = skb->data;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 8e8975562ec3..80099016d21f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -242,7 +242,7 @@ void brcmf_txflowblock_if(struct brcmf_if *ifp,
 {
        unsigned long flags;
-        if (!ifp)
+        if (!ifp || !ifp->ndev)
                return;
        brcmf_dbg(TRACE, "enter: idx=%d stop=0x%X reason=%d state=%d\n",
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index f0d9f7f6c83d..29b1f24c2d0f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -1744,13 +1744,14 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
        ulong flags;
        int fifo = BRCMF_FWS_FIFO_BCMC;
        bool multicast = is_multicast_ether_addr(eh->h_dest);
+        bool pae = eh->h_proto == htons(ETH_P_PAE);
        /* determine the priority */
        if (!skb->priority)
                skb->priority = cfg80211_classify8021d(skb);
        drvr->tx_multicast += !!multicast;
-        if (ntohs(eh->h_proto) == ETH_P_PAE)
+        if (pae)
                atomic_inc(&ifp->pend_8021x_cnt);
        if (!brcmf_fws_fc_active(fws)) {
@@ -1781,6 +1782,11 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
                brcmf_fws_schedule_deq(fws);
        } else {
                brcmf_err("drop skb: no hanger slot\n");
+                if (pae) {
+                        atomic_dec(&ifp->pend_8021x_cnt);
+                        if (waitqueue_active(&ifp->pend_8021x_wait))
+                                wake_up(&ifp->pend_8021x_wait);
+                }
                brcmu_pkt_buf_free_skb(skb);
        }
        brcmf_fws_unlock(drvr, flags);
diff --git a/drivers/net/wireless/cw1200/txrx.c b/drivers/net/wireless/cw1200/txrx.c
index 5862c373d714..e824d4d4a18d 100644
--- a/drivers/net/wireless/cw1200/txrx.c
+++ b/drivers/net/wireless/cw1200/txrx.c
@@ -1165,7 +1165,7 @@ void cw1200_rx_cb(struct cw1200_common *priv,
                if (cw1200_handle_action_rx(priv, skb))
                        return;
        } else if (ieee80211_is_beacon(frame->frame_control) &&
-                   !arg->status &&
+                   !arg->status && priv->vif &&
                   !memcmp(ieee80211_get_SA(frame), priv->vif->bss_conf.bssid,
                           ETH_ALEN)) {
                const u8 *tim_ie;
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 3952ddf2ddb2..1531a4fc0960 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -758,7 +758,7 @@ int iwl_alive_start(struct iwl_priv *priv)
                                         BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
                if (ret)
                        return ret;
-        } else {
+        } else if (priv->lib->bt_params) {
                /*
                 * default is 2-wire BT coexexistence support
                 */
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index e56ed2a84888..c24a744910ac 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -988,7 +988,11 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
        char buf[100];
-        if (!dbgfs_dir)
+        /*
+         * Check if debugfs directory already exist before creating it.
+         * This may happen when, for example, resetting hw or suspend-resume
+         */
+        if (!dbgfs_dir || mvmvif->dbgfs_dir)
                return;
        mvmvif->dbgfs_dir = debugfs_create_dir("iwlmvm", dbgfs_dir);
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index e08683b20531..1eedc424051c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -257,7 +257,11 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
        if (ret)
                return ret;
-        return ieee80211_register_hw(mvm->hw);
+        ret = ieee80211_register_hw(mvm->hw);
+        if (ret)
+                iwl_mvm_leds_exit(mvm);
+        return ret;
 }
 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
@@ -385,6 +389,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
        ieee80211_wake_queues(mvm->hw);
        mvm->vif_count = 0;
+        mvm->rx_ba_sessions = 0;
 }
 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
@@ -1006,6 +1011,21 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
        mutex_lock(&mvm->mutex);
        if (old_state == IEEE80211_STA_NOTEXIST &&
            new_state == IEEE80211_STA_NONE) {
+                /*
+                 * Firmware bug - it'll crash if the beacon interval is less
+                 * than 16. We can't avoid connecting at all, so refuse the
+                 * station state change, this will cause mac80211 to abandon
+                 * attempts to connect to this AP, and eventually wpa_s will
+                 * blacklist the AP...
+                 */
+                if (vif->type == NL80211_IFTYPE_STATION &&
+                    vif->bss_conf.beacon_int < 16) {
+                        IWL_ERR(mvm,
+                                "AP %pM beacon interval is %d, refusing due to firmware bug!\n",
+                                sta->addr, vif->bss_conf.beacon_int);
+                        ret = -EINVAL;
+                        goto out_unlock;
+                }
                ret = iwl_mvm_add_sta(mvm, vif, sta);
        } else if (old_state == IEEE80211_STA_NONE &&
                   new_state == IEEE80211_STA_AUTH) {
@@ -1038,6 +1058,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
        } else {
                ret = -EIO;
        }
+ out_unlock:
        mutex_unlock(&mvm->mutex);
        return ret;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index d40d7db185d6..420e82d379d9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -419,6 +419,7 @@ struct iwl_mvm {
        struct work_struct sta_drained_wk;
        unsigned long sta_drained[BITS_TO_LONGS(IWL_MVM_STATION_COUNT)];
        atomic_t pending_frames[IWL_MVM_STATION_COUNT];
+        u8 rx_ba_sessions;
        /* configured by mac80211 */
        u32 rts_threshold;
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 2157b0f8ced5..268f027b45b0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -137,8 +137,8 @@ static void iwl_mvm_scan_fill_ssids(struct iwl_scan_cmd *cmd,
 {
        int fw_idx, req_idx;
-        fw_idx = 0;
+        for (req_idx = req->n_ssids - 1, fw_idx = 0; req_idx > 0;
-        for (req_idx = req->n_ssids - 1; req_idx > 0; req_idx--) {
+             req_idx--, fw_idx++) {
                cmd->direct_scan[fw_idx].id = WLAN_EID_SSID;
                cmd->direct_scan[fw_idx].len = req->ssids[req_idx].ssid_len;
                memcpy(cmd->direct_scan[fw_idx].ssid,
@@ -153,7 +153,9 @@ static void iwl_mvm_scan_fill_ssids(struct iwl_scan_cmd *cmd,
 * just to notify that this scan is active and not passive.
 * In order to notify the FW of the number of SSIDs we wish to scan (including
 * the zero-length one), we need to set the corresponding bits in chan->type,
- * one for each SSID, and set the active bit (first).
+ * one for each SSID, and set the active bit (first). The first SSID is already
+ * included in the probe template, so we need to set only req->n_ssids - 1 bits
+ * in addition to the first bit.
 */
 static u16 iwl_mvm_get_active_dwell(enum ieee80211_band band, int n_ssids)
 {
@@ -179,7 +181,7 @@ static void iwl_mvm_scan_fill_channels(struct iwl_scan_cmd *cmd,
        __le32 chan_type_value;
        if (req->n_ssids > 0)
-                chan_type_value = cpu_to_le32(BIT(req->n_ssids + 1) - 1);
+                chan_type_value = cpu_to_le32(BIT(req->n_ssids) - 1);
        else
                chan_type_value = SCAN_CHANNEL_TYPE_PASSIVE;
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 62fe5209093b..85d4bbe52157 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -608,6 +608,8 @@ int iwl_mvm_rm_bcast_sta(struct iwl_mvm *mvm, struct iwl_mvm_int_sta *bsta)
        return ret;
 }
+#define IWL_MAX_RX_BA_SESSIONS 16
 int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                       int tid, u16 ssn, bool start)
 {
@@ -618,11 +620,20 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
        lockdep_assert_held(&mvm->mutex);
+        if (start && mvm->rx_ba_sessions >= IWL_MAX_RX_BA_SESSIONS) {
+                IWL_WARN(mvm, "Not enough RX BA SESSIONS\n");
+                return -ENOSPC;
+        }
        cmd.mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color);
        cmd.sta_id = mvm_sta->sta_id;
        cmd.add_modify = STA_MODE_MODIFY;
-        cmd.add_immediate_ba_tid = (u8) tid;
+        if (start) {
-        cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
+                cmd.add_immediate_ba_tid = (u8) tid;
+                cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
+        } else {
+                cmd.remove_immediate_ba_tid = (u8) tid;
+        }
        cmd.modify_mask = start ? STA_MODIFY_ADD_BA_TID :
                                  STA_MODIFY_REMOVE_BA_TID;
@@ -648,6 +659,14 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                break;
        }
+        if (!ret) {
+                if (start)
+                        mvm->rx_ba_sessions++;
+                else if (mvm->rx_ba_sessions > 0)
+                        /* check that restart flow didn't zero the counter */
+                        mvm->rx_ba_sessions--;
+        }
        return ret;
 }
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index caaf4bd56b30..2cf8b964e966 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -693,7 +693,7 @@ int mwifiex_dnld_fw(struct mwifiex_adapter *adapter,
                if (!ret) {
                        dev_notice(adapter->dev,
                                   "WLAN FW already running! Skip FW dnld\n");
-                        goto done;
+                        return 0;
                }
                poll_num = MAX_FIRMWARE_POLL_TRIES;
@@ -719,14 +719,8 @@ int mwifiex_dnld_fw(struct mwifiex_adapter *adapter,
 poll_fw:
        /* Check if the firmware is downloaded successfully or not */
        ret = adapter->if_ops.check_fw_status(adapter, poll_num);
-        if (ret) {
+        if (ret)
                dev_err(adapter->dev, "FW failed to be active in time\n");
-                return -1;
-        }
-done:
-        /* re-enable host interrupt for mwifiex after fw dnld is successful */
-        if (adapter->if_ops.enable_int)
-                adapter->if_ops.enable_int(adapter);
        return ret;
 }
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index e15ab72fb03d..1753431de361 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -427,6 +427,10 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
                                "Cal data request_firmware() failed\n");
        }
+        /* enable host interrupt after fw dnld is successful */
+        if (adapter->if_ops.enable_int)
+                adapter->if_ops.enable_int(adapter);
        adapter->init_wait_q_woken = false;
        ret = mwifiex_init_fw(adapter);
        if (ret == -1) {
@@ -478,6 +482,8 @@ err_add_intf:
        mwifiex_del_virtual_intf(adapter->wiphy, priv->wdev);
        rtnl_unlock();
 err_init_fw:
+        if (adapter->if_ops.disable_int)
+                adapter->if_ops.disable_int(adapter);
        pr_debug("info: %s: unregister device\n", __func__);
        adapter->if_ops.unregister_dev(adapter);
 done:
@@ -855,7 +861,7 @@ mwifiex_add_card(void *card, struct semaphore *sem,
        INIT_WORK(&adapter->main_work, mwifiex_main_work_queue);
        /* Register the device. Fill up the private data structure with relevant
-           information from the card and request for the required IRQ. */
+           information from the card. */
        if (adapter->if_ops.register_dev(adapter)) {
                pr_err("%s: failed to register mwifiex device\n", __func__);
                goto err_registerdev;
@@ -919,6 +925,11 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
        if (!adapter)
                goto exit_remove;
+        /* We can no longer handle interrupts once we start doing the teardown
+         * below. */
+        if (adapter->if_ops.disable_int)
+                adapter->if_ops.disable_int(adapter);
        adapter->surprise_removed = true;
        /* Stop data */
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 3da73d36acdf..253e0bd38e25 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -601,6 +601,7 @@ struct mwifiex_if_ops {
        int (*register_dev) (struct mwifiex_adapter *);
        void (*unregister_dev) (struct mwifiex_adapter *);
        int (*enable_int) (struct mwifiex_adapter *);
+        void (*disable_int) (struct mwifiex_adapter *);
        int (*process_int_status) (struct mwifiex_adapter *);
        int (*host_to_card) (struct mwifiex_adapter *, u8, struct sk_buff *,
                             struct mwifiex_tx_param *);
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 5ee5ed02eccd..5ef49f2e375a 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -51,6 +51,7 @@ static struct mwifiex_if_ops sdio_ops;
 static struct semaphore add_remove_card_sem;
 static int mwifiex_sdio_resume(struct device *dev);
+static void mwifiex_sdio_interrupt(struct sdio_func *func);
 /*
 * SDIO probe.
@@ -296,6 +297,15 @@ static struct sdio_driver mwifiex_sdio = {
        }
 };
+/* Write data into SDIO card register. Caller claims SDIO device. */
+static int
+mwifiex_write_reg_locked(struct sdio_func *func, u32 reg, u8 data)
+{
+        int ret = -1;
+        sdio_writeb(func, data, reg, &ret);
+        return ret;
+}
 /*
 * This function writes data into SDIO card register.
 */
@@ -303,10 +313,10 @@ static int
 mwifiex_write_reg(struct mwifiex_adapter *adapter, u32 reg, u8 data)
 {
        struct sdio_mmc_card *card = adapter->card;
-        int ret = -1;
+        int ret;
        sdio_claim_host(card->func);
-        sdio_writeb(card->func, data, reg, &ret);
+        ret = mwifiex_write_reg_locked(card->func, reg, data);
        sdio_release_host(card->func);
        return ret;
@@ -685,23 +695,15 @@ mwifiex_sdio_read_fw_status(struct mwifiex_adapter *adapter, u16 *dat)
 * The host interrupt mask is read, the disable bit is reset and
 * written back to the card host interrupt mask register.
 */
-static int mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
+static void mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
 {
-        u8 host_int_mask, host_int_disable = HOST_INT_DISABLE;
+        struct sdio_mmc_card *card = adapter->card;
+        struct sdio_func *func = card->func;
-        /* Read back the host_int_mask register */
-        if (mwifiex_read_reg(adapter, HOST_INT_MASK_REG, &host_int_mask))
-                return -1;
-        /* Update with the mask and write back to the register */
-        host_int_mask &= ~host_int_disable;
-        if (mwifiex_write_reg(adapter, HOST_INT_MASK_REG, host_int_mask)) {
-                dev_err(adapter->dev, "disable host interrupt failed\n");
-                return -1;
-        }
-        return 0;
+        sdio_claim_host(func);
+        mwifiex_write_reg_locked(func, HOST_INT_MASK_REG, 0);
+        sdio_release_irq(func);
+        sdio_release_host(func);
 }
 /*
@@ -713,14 +715,29 @@ static int mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
 static int mwifiex_sdio_enable_host_int(struct mwifiex_adapter *adapter)
 {
        struct sdio_mmc_card *card = adapter->card;
+        struct sdio_func *func = card->func;
+        int ret;
+        sdio_claim_host(func);
+        /* Request the SDIO IRQ */
+        ret = sdio_claim_irq(func, mwifiex_sdio_interrupt);
+        if (ret) {
+                dev_err(adapter->dev, "claim irq failed: ret=%d\n", ret);
+                goto out;
+        }
        /* Simply write the mask to the register */
-        if (mwifiex_write_reg(adapter, HOST_INT_MASK_REG,
+        ret = mwifiex_write_reg_locked(func, HOST_INT_MASK_REG,
-                              card->reg->host_int_enable)) {
+                                       card->reg->host_int_enable);
+        if (ret) {
                dev_err(adapter->dev, "enable host interrupt failed\n");
-                return -1;
+                sdio_release_irq(func);
        }
-        return 0;
+out:
+        sdio_release_host(func);
+        return ret;
 }
 /*
@@ -997,9 +1014,6 @@ mwifiex_sdio_interrupt(struct sdio_func *func)
        }
        adapter = card->adapter;
-        if (adapter->surprise_removed)
-                return;
        if (!adapter->pps_uapsd_mode && adapter->ps_state == PS_STATE_SLEEP)
                adapter->ps_state = PS_STATE_AWAKE;
@@ -1728,9 +1742,7 @@ mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
        struct sdio_mmc_card *card = adapter->card;
        if (adapter->card) {
-                /* Release the SDIO IRQ */
                sdio_claim_host(card->func);
-                sdio_release_irq(card->func);
                sdio_disable_func(card->func);
                sdio_release_host(card->func);
                sdio_set_drvdata(card->func, NULL);
@@ -1744,7 +1756,7 @@ mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
 */
 static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
 {
-        int ret = 0;
+        int ret;
        struct sdio_mmc_card *card = adapter->card;
        struct sdio_func *func = card->func;
@@ -1753,22 +1765,14 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
        sdio_claim_host(func);
-        /* Request the SDIO IRQ */
-        ret = sdio_claim_irq(func, mwifiex_sdio_interrupt);
-        if (ret) {
-                pr_err("claim irq failed: ret=%d\n", ret);
-                goto disable_func;
-        }
        /* Set block size */
        ret = sdio_set_block_size(card->func, MWIFIEX_SDIO_BLOCK_SIZE);
+        sdio_release_host(func);
        if (ret) {
                pr_err("cannot set SDIO block size\n");
-                ret = -1;
+                return ret;
-                goto release_irq;
        }
-        sdio_release_host(func);
        sdio_set_drvdata(func, card);
        adapter->dev = &func->dev;
@@ -1776,15 +1780,6 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
        strcpy(adapter->fw_name, card->firmware);
        return 0;
-release_irq:
-        sdio_release_irq(func);
-disable_func:
-        sdio_disable_func(func);
-        sdio_release_host(func);
-        adapter->card = NULL;
-        return -1;
 }
 /*
@@ -1813,9 +1808,6 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
         */
        mwifiex_read_reg(adapter, HOST_INTSTATUS_REG, &sdio_ireg);
-        /* Disable host interrupt mask register for SDIO */
-        mwifiex_sdio_disable_host_int(adapter);
        /* Get SDIO ioport */
        mwifiex_init_sdio_ioport(adapter);
@@ -1957,6 +1949,7 @@ static struct mwifiex_if_ops sdio_ops = {
        .register_dev = mwifiex_register_dev,
        .unregister_dev = mwifiex_unregister_dev,
        .enable_int = mwifiex_sdio_enable_host_int,
+        .disable_int = mwifiex_sdio_disable_host_int,
        .process_int_status = mwifiex_process_int_status,
        .host_to_card = mwifiex_sdio_host_to_card,
        .wakeup = mwifiex_pm_wakeup_card,
diff --git a/drivers/net/wireless/mwifiex/sdio.h b/drivers/net/wireless/mwifiex/sdio.h
index 6d51dfdd8251..532ae0ac4dfb 100644
--- a/drivers/net/wireless/mwifiex/sdio.h
+++ b/drivers/net/wireless/mwifiex/sdio.h
@@ -92,9 +92,6 @@
 /* Host Control Registers : Download host interrupt mask */
 #define DN_LD_HOST_INT_MASK             (0x2U)
-/* Disable Host interrupt mask */
-#define HOST_INT_DISABLE                0xff
 /* Host Control Registers : Host interrupt status */
 #define HOST_INTSTATUS_REG              0x03
 /* Host Control Registers : Upload host interrupt status */
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 9b915d3a44be..3e60a31582f8 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -1,6 +1,6 @@
 menuconfig RT2X00
        tristate "Ralink driver support"
-        depends on MAC80211
+        depends on MAC80211 && HAS_DMA
        ---help---
          This will enable the support for the Ralink drivers,
          developed in the rt2x00 project <http://rt2x00.serialmonkey.com>.
diff --git a/drivers/net/wireless/rtlwifi/Kconfig b/drivers/net/wireless/rtlwifi/Kconfig
index 7253de3d8c66..c2ffce7a907c 100644
--- a/drivers/net/wireless/rtlwifi/Kconfig
+++ b/drivers/net/wireless/rtlwifi/Kconfig
@@ -1,27 +1,20 @@
-config RTLWIFI
+menuconfig RTL_CARDS
-        tristate "Realtek wireless card support"
+        tristate "Realtek rtlwifi family of devices"
-        depends on MAC80211
+        depends on MAC80211 && (PCI || USB)
-        select FW_LOADER
-        ---help---
-          This is common code for RTL8192CE/RTL8192CU/RTL8192SE/RTL8723AE
-          drivers.  This module does nothing by itself - the various front-end
-          drivers need to be enabled to support any desired devices.
-          If you choose to build as a module, it'll be called rtlwifi.
-config RTLWIFI_DEBUG
-        bool "Debugging output for rtlwifi driver family"
-        depends on RTLWIFI
        default y
        ---help---
-        To use the module option that sets the dynamic-debugging level for,
+          This option will enable support for the Realtek mac80211-based
-        the front-end driver, this parameter must be "Y". For memory-limited
+          wireless drivers. Drivers rtl8192ce, rtl8192cu, rtl8192se, rtl8192de,
-        systems, choose "N". If in doubt, choose "Y".
+          rtl8723eu, and rtl8188eu share some common code.
+if RTL_CARDS
 config RTL8192CE
        tristate "Realtek RTL8192CE/RTL8188CE Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
        select RTL8192C_COMMON
+        select RTLWIFI
+        select RTLWIFI_PCI
        ---help---
        This is the driver for Realtek RTL8192CE/RTL8188CE 802.11n PCIe
        wireless network adapters.
@@ -30,7 +23,9 @@ config RTL8192CE
 config RTL8192SE
        tristate "Realtek RTL8192SE/RTL8191SE PCIe Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
        ---help---
        This is the driver for Realtek RTL8192SE/RTL8191SE 802.11n PCIe
        wireless network adapters.
@@ -39,7 +34,9 @@ config RTL8192SE
 config RTL8192DE
        tristate "Realtek RTL8192DE/RTL8188DE PCIe Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
        ---help---
        This is the driver for Realtek RTL8192DE/RTL8188DE 802.11n PCIe
        wireless network adapters.
@@ -48,7 +45,9 @@ config RTL8192DE
 config RTL8723AE
        tristate "Realtek RTL8723AE PCIe Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
        ---help---
        This is the driver for Realtek RTL8723AE 802.11n PCIe
        wireless network adapters.
@@ -57,7 +56,9 @@ config RTL8723AE
 config RTL8188EE
        tristate "Realtek RTL8188EE Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
        ---help---
        This is the driver for Realtek RTL8188EE 802.11n PCIe
        wireless network adapters.
@@ -66,7 +67,9 @@ config RTL8188EE
 config RTL8192CU
        tristate "Realtek RTL8192CU/RTL8188CU USB Wireless Network Adapter"
-        depends on RTLWIFI && USB
+        depends on USB
+        select RTLWIFI
+        select RTLWIFI_USB
        select RTL8192C_COMMON
        ---help---
        This is the driver for Realtek RTL8192CU/RTL8188CU 802.11n USB
@@ -74,7 +77,28 @@ config RTL8192CU
        If you choose to build it as a module, it will be called rtl8192cu
+config RTLWIFI
+        tristate
+        select FW_LOADER
+config RTLWIFI_PCI
+        tristate
+config RTLWIFI_USB
+        tristate
+config RTLWIFI_DEBUG
+        bool "Debugging output for rtlwifi driver family"
+        depends on RTLWIFI
+        default y
+        ---help---
+        To use the module option that sets the dynamic-debugging level for,
+        the front-end driver, this parameter must be "Y". For memory-limited
+        systems, choose "N". If in doubt, choose "Y".
 config RTL8192C_COMMON
        tristate
        depends on RTL8192CE || RTL8192CU
-        default m
+        default y
+endif
diff --git a/drivers/net/wireless/rtlwifi/Makefile b/drivers/net/wireless/rtlwifi/Makefile
index ff02b874f8d8..d56f023a4b90 100644
--- a/drivers/net/wireless/rtlwifi/Makefile
+++ b/drivers/net/wireless/rtlwifi/Makefile
@@ -12,13 +12,11 @@ rtlwifi-objs	:=		\
 rtl8192c_common-objs +=         \
-ifneq ($(CONFIG_PCI),)
+obj-$(CONFIG_RTLWIFI_PCI)       += rtl_pci.o
-rtlwifi-objs    += pci.o
+rtl_pci-objs    :=              pci.o
-endif
-ifneq ($(CONFIG_USB),)
+obj-$(CONFIG_RTLWIFI_USB)       += rtl_usb.o
-rtlwifi-objs    += usb.o
+rtl_usb-objs    :=              usb.o
-endif
 obj-$(CONFIG_RTL8192C_COMMON)   += rtl8192c/
 obj-$(CONFIG_RTL8192CE)         += rtl8192ce/
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 9d558ac77b0c..7651f5acc14b 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -172,6 +172,7 @@ u8 rtl_tid_to_ac(u8 tid)
 {
        return tid_to_ac[tid];
 }
+EXPORT_SYMBOL_GPL(rtl_tid_to_ac);
 static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
                                  struct ieee80211_sta_ht_cap *ht_cap)
@@ -406,6 +407,7 @@ void rtl_deinit_deferred_work(struct ieee80211_hw *hw)
        cancel_delayed_work(&rtlpriv->works.ps_rfon_wq);
        cancel_delayed_work(&rtlpriv->works.fwevt_wq);
 }
+EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);
 void rtl_init_rfkill(struct ieee80211_hw *hw)
 {
@@ -439,6 +441,7 @@ void rtl_deinit_rfkill(struct ieee80211_hw *hw)
 {
        wiphy_rfkill_stop_polling(hw->wiphy);
 }
+EXPORT_SYMBOL_GPL(rtl_deinit_rfkill);
 int rtl_init_core(struct ieee80211_hw *hw)
 {
@@ -489,10 +492,12 @@ int rtl_init_core(struct ieee80211_hw *hw)
        return 0;
 }
+EXPORT_SYMBOL_GPL(rtl_init_core);
 void rtl_deinit_core(struct ieee80211_hw *hw)
 {
 }
+EXPORT_SYMBOL_GPL(rtl_deinit_core);
 void rtl_init_rx_config(struct ieee80211_hw *hw)
 {
@@ -501,6 +506,7 @@ void rtl_init_rx_config(struct ieee80211_hw *hw)
        rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_RCR, (u8 *) (&mac->rx_conf));
 }
+EXPORT_SYMBOL_GPL(rtl_init_rx_config);
 /*********************************************************
 *
@@ -879,6 +885,7 @@ bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb)
        return true;
 }
+EXPORT_SYMBOL_GPL(rtl_tx_mgmt_proc);
 void rtl_get_tcb_desc(struct ieee80211_hw *hw,
                      struct ieee80211_tx_info *info,
@@ -1052,6 +1059,7 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
        return true;
 }
+EXPORT_SYMBOL_GPL(rtl_action_proc);
 /*should call before software enc*/
 u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
@@ -1125,6 +1133,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
        return false;
 }
+EXPORT_SYMBOL_GPL(rtl_is_special_data);
 /*********************************************************
 *
@@ -1300,6 +1309,7 @@ void rtl_beacon_statistic(struct ieee80211_hw *hw, struct sk_buff *skb)
        rtlpriv->link_info.bcn_rx_inperiod++;
 }
+EXPORT_SYMBOL_GPL(rtl_beacon_statistic);
 void rtl_watchdog_wq_callback(void *data)
 {
@@ -1793,6 +1803,7 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len)
        mac->vendor = vendor;
 }
+EXPORT_SYMBOL_GPL(rtl_recognize_peer);
 /*********************************************************
 *
@@ -1849,6 +1860,7 @@ struct attribute_group rtl_attribute_group = {
        .name = "rtlsysfs",
        .attrs = rtl_sysfs_entries,
 };
+EXPORT_SYMBOL_GPL(rtl_attribute_group);
 MODULE_AUTHOR("lizhaoming       <chaoming_li@realsil.com.cn>");
 MODULE_AUTHOR("Realtek WlanFAE  <wlanfae@realtek.com>");
@@ -1856,7 +1868,8 @@ MODULE_AUTHOR("Larry Finger	<Larry.FInger@lwfinger.net>");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core");
-struct rtl_global_var global_var = {};
+struct rtl_global_var rtl_global_var = {};
+EXPORT_SYMBOL_GPL(rtl_global_var);
 static int __init rtl_core_module_init(void)
 {
@@ -1864,8 +1877,8 @@ static int __init rtl_core_module_init(void)
                pr_err("Unable to register rtl_rc, use default RC !!\n");
        /* init some global vars */
-        INIT_LIST_HEAD(&global_var.glb_priv_list);
+        INIT_LIST_HEAD(&rtl_global_var.glb_priv_list);
-        spin_lock_init(&global_var.glb_list_lock);
+        spin_lock_init(&rtl_global_var.glb_list_lock);
        return 0;
 }
diff --git a/drivers/net/wireless/rtlwifi/base.h b/drivers/net/wireless/rtlwifi/base.h
index 8576bc34b032..0e5fe0902daf 100644
--- a/drivers/net/wireless/rtlwifi/base.h
+++ b/drivers/net/wireless/rtlwifi/base.h
@@ -147,7 +147,7 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len);
 u8 rtl_tid_to_ac(u8 tid);
 extern struct attribute_group rtl_attribute_group;
 void rtl_easy_concurrent_retrytimer_callback(unsigned long data);
-extern struct rtl_global_var global_var;
+extern struct rtl_global_var rtl_global_var;
 int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
                         bool isht, u8 desc_rate, bool first_ampdu);
 bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb);
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index ee84844be008..733b7ce7f0e2 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -1330,3 +1330,4 @@ const struct ieee80211_ops rtl_ops = {
        .rfkill_poll = rtl_op_rfkill_poll,
        .flush = rtl_op_flush,
 };
+EXPORT_SYMBOL_GPL(rtl_ops);
diff --git a/drivers/net/wireless/rtlwifi/debug.c b/drivers/net/wireless/rtlwifi/debug.c
index 7d52d3d7769f..76e2086e137e 100644
--- a/drivers/net/wireless/rtlwifi/debug.c
+++ b/drivers/net/wireless/rtlwifi/debug.c
@@ -51,3 +51,4 @@ void rtl_dbgp_flag_init(struct ieee80211_hw *hw)
        /*Init Debug flag enable condition */
 }
+EXPORT_SYMBOL_GPL(rtl_dbgp_flag_init);
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index 9e3894178e77..838a1ed3f194 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -229,6 +229,7 @@ void read_efuse_byte(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf)
        *pbuf = (u8) (value32 & 0xff);
 }
+EXPORT_SYMBOL_GPL(read_efuse_byte);
 void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
 {
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index c97e9d327331..703f839af6ca 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -35,6 +35,13 @@
 #include "efuse.h"
 #include <linux/export.h>
 #include <linux/kmemleak.h>
+#include <linux/module.h>
+MODULE_AUTHOR("lizhaoming       <chaoming_li@realsil.com.cn>");
+MODULE_AUTHOR("Realtek WlanFAE  <wlanfae@realtek.com>");
+MODULE_AUTHOR("Larry Finger     <Larry.FInger@lwfinger.net>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("PCI basic driver for rtlwifi");
 static const u16 pcibridge_vendors[PCI_BRIDGE_VENDOR_MAX] = {
        PCI_VENDOR_ID_INTEL,
@@ -1008,19 +1015,6 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
        return;
 }
-static void rtl_lps_change_work_callback(struct work_struct *work)
-{
-        struct rtl_works *rtlworks =
-            container_of(work, struct rtl_works, lps_change_work);
-        struct ieee80211_hw *hw = rtlworks->hw;
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        if (rtlpriv->enter_ps)
-                rtl_lps_enter(hw);
-        else
-                rtl_lps_leave(hw);
-}
 static void _rtl_pci_init_trx_var(struct ieee80211_hw *hw)
 {
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
@@ -1899,7 +1893,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
        rtlpriv->rtlhal.interface = INTF_PCI;
        rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data);
        rtlpriv->intf_ops = &rtl_pci_ops;
-        rtlpriv->glb_var = &global_var;
+        rtlpriv->glb_var = &rtl_global_var;
        /*
         *init dbgp flags before all
diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
index 884bceae38a9..298b615964e8 100644
--- a/drivers/net/wireless/rtlwifi/ps.c
+++ b/drivers/net/wireless/rtlwifi/ps.c
@@ -269,6 +269,7 @@ void rtl_ips_nic_on(struct ieee80211_hw *hw)
        spin_unlock_irqrestore(&rtlpriv->locks.ips_lock, flags);
 }
+EXPORT_SYMBOL_GPL(rtl_ips_nic_on);
 /*for FW LPS*/
@@ -518,6 +519,7 @@ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
                         "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
        }
 }
+EXPORT_SYMBOL_GPL(rtl_swlps_beacon);
 void rtl_swlps_rf_awake(struct ieee80211_hw *hw)
 {
@@ -611,6 +613,19 @@ void rtl_swlps_rf_sleep(struct ieee80211_hw *hw)
                        MSECS(sleep_intv * mac->vif->bss_conf.beacon_int - 40));
 }
+void rtl_lps_change_work_callback(struct work_struct *work)
+{
+        struct rtl_works *rtlworks =
+            container_of(work, struct rtl_works, lps_change_work);
+        struct ieee80211_hw *hw = rtlworks->hw;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        if (rtlpriv->enter_ps)
+                rtl_lps_enter(hw);
+        else
+                rtl_lps_leave(hw);
+}
+EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);
 void rtl_swlps_wq_callback(void *data)
 {
@@ -922,3 +937,4 @@ void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len)
        else
                rtl_p2p_noa_ie(hw, data, len - FCS_LEN);
 }
+EXPORT_SYMBOL_GPL(rtl_p2p_info);
diff --git a/drivers/net/wireless/rtlwifi/ps.h b/drivers/net/wireless/rtlwifi/ps.h
index 4d682b753f50..88bd76ea88f7 100644
--- a/drivers/net/wireless/rtlwifi/ps.h
+++ b/drivers/net/wireless/rtlwifi/ps.h
@@ -49,5 +49,6 @@ void rtl_swlps_rf_awake(struct ieee80211_hw *hw);
 void rtl_swlps_rf_sleep(struct ieee80211_hw *hw);
 void rtl_p2p_ps_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
 void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len);
+void rtl_lps_change_work_callback(struct work_struct *work);
 #endif
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index a3532e077871..e56778cac9bf 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -32,6 +32,13 @@
 #include "ps.h"
 #include "rtl8192c/fw_common.h"
 #include <linux/export.h>
+#include <linux/module.h>
+MODULE_AUTHOR("lizhaoming       <chaoming_li@realsil.com.cn>");
+MODULE_AUTHOR("Realtek WlanFAE  <wlanfae@realtek.com>");
+MODULE_AUTHOR("Larry Finger     <Larry.FInger@lwfinger.net>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("USB basic driver for rtlwifi");
 #define REALTEK_USB_VENQT_READ                  0xC0
 #define REALTEK_USB_VENQT_WRITE                 0x40
@@ -1070,6 +1077,8 @@ int rtl_usb_probe(struct usb_interface *intf,
        spin_lock_init(&rtlpriv->locks.usb_lock);
        INIT_WORK(&rtlpriv->works.fill_h2c_cmd,
                  rtl_fill_h2c_cmd_work_callback);
+        INIT_WORK(&rtlpriv->works.lps_change_work,
+                  rtl_lps_change_work_callback);
        rtlpriv->usb_data_index = 0;
        init_completion(&rtlpriv->firmware_loading_complete);
diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
index e79e006eb9ab..9ee04b4b68bf 100644
--- a/drivers/parisc/iosapic.c
+++ b/drivers/parisc/iosapic.c
@@ -811,18 +811,28 @@ int iosapic_fixup_irq(void *isi_obj, struct pci_dev *pcidev)
        return pcidev->irq;
 }
-static struct iosapic_info *first_isi = NULL;
+static struct iosapic_info *iosapic_list;
 #ifdef CONFIG_64BIT
-int iosapic_serial_irq(int num)
+int iosapic_serial_irq(struct parisc_device *dev)
 {
-        struct iosapic_info *isi = first_isi;
+        struct iosapic_info *isi;
-        struct irt_entry *irte = NULL;  /* only used if PAT PDC */
+        struct irt_entry *irte;
        struct vector_info *vi;
-        int isi_line;   /* line used by device */
+        int cnt;
+        int intin;
+        intin = (dev->mod_info >> 24) & 15;
        /* lookup IRT entry for isi/slot/pin set */
-        irte = &irt_cell[num];
+        for (cnt = 0; cnt < irt_num_entry; cnt++) {
+                irte = &irt_cell[cnt];
+                if (COMPARE_IRTE_ADDR(irte, dev->mod0) &&
+                    irte->dest_iosapic_intin == intin)
+                        break;
+        }
+        if (cnt >= irt_num_entry)
+                return 0; /* no irq found, force polling */
        DBG_IRT("iosapic_serial_irq(): irte %p %x %x %x %x %x %x %x %x\n",
                irte,
@@ -834,11 +844,17 @@ int iosapic_serial_irq(int num)
                irte->src_seg_id,
                irte->dest_iosapic_intin,
                (u32) irte->dest_iosapic_addr);
-        isi_line = irte->dest_iosapic_intin;
+        /* search for iosapic */
+        for (isi = iosapic_list; isi; isi = isi->isi_next)
+                if (isi->isi_hpa == dev->mod0)
+                        break;
+        if (!isi)
+                return 0; /* no iosapic found, force polling */
        /* get vector info for this input line */
-        vi = isi->isi_vector + isi_line;
+        vi = isi->isi_vector + intin;
-        DBG_IRT("iosapic_serial_irq:  line %d vi 0x%p\n", isi_line, vi);
+        DBG_IRT("iosapic_serial_irq:  line %d vi 0x%p\n", iosapic_intin, vi);
        /* If this IRQ line has already been setup, skip it */
        if (vi->irte)
@@ -941,8 +957,8 @@ void *iosapic_register(unsigned long hpa)
                vip->irqline = (unsigned char) cnt;
                vip->iosapic = isi;
        }
-        if (!first_isi)
+        isi->isi_next = iosapic_list;
-                first_isi = isi;
+        iosapic_list = isi;
        return isi;
 }
diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index 13a633b1612e..7bf3926aecc0 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -86,10 +86,6 @@ struct mvebu_sw_pci_bridge {
        u16 secondary_status;
        u16 membase;
        u16 memlimit;
-        u16 prefmembase;
-        u16 prefmemlimit;
-        u32 prefbaseupper;
-        u32 preflimitupper;
        u16 iobaseupper;
        u16 iolimitupper;
        u8 cappointer;
@@ -419,15 +415,7 @@ static int mvebu_sw_pci_bridge_read(struct mvebu_pcie_port *port,
                break;
        case PCI_PREF_MEMORY_BASE:
-                *value = (bridge->prefmemlimit << 16 | bridge->prefmembase);
+                *value = 0;
-                break;
-        case PCI_PREF_BASE_UPPER32:
-                *value = bridge->prefbaseupper;
-                break;
-        case PCI_PREF_LIMIT_UPPER32:
-                *value = bridge->preflimitupper;
                break;
        case PCI_IO_BASE_UPPER16:
@@ -501,19 +489,6 @@ static int mvebu_sw_pci_bridge_write(struct mvebu_pcie_port *port,
                mvebu_pcie_handle_membase_change(port);
                break;
-        case PCI_PREF_MEMORY_BASE:
-                bridge->prefmembase = value & 0xffff;
-                bridge->prefmemlimit = value >> 16;
-                break;
-        case PCI_PREF_BASE_UPPER32:
-                bridge->prefbaseupper = value;
-                break;
-        case PCI_PREF_LIMIT_UPPER32:
-                bridge->preflimitupper = value;
-                break;
        case PCI_IO_BASE_UPPER16:
                bridge->iobaseupper = value & 0xffff;
                bridge->iolimitupper = value >> 16;
diff --git a/drivers/pci/hotplug/Kconfig b/drivers/pci/hotplug/Kconfig
index bb7ebb22db01..d85009de713d 100644
--- a/drivers/pci/hotplug/Kconfig
+++ b/drivers/pci/hotplug/Kconfig
@@ -3,16 +3,13 @@
 #
 menuconfig HOTPLUG_PCI
-        tristate "Support for PCI Hotplug"
+        bool "Support for PCI Hotplug"
        depends on PCI && SYSFS
        ---help---
          Say Y here if you have a motherboard with a PCI Hotplug controller.
          This allows you to add and remove PCI cards while the machine is
          powered up and running.
-          To compile this driver as a module, choose M here: the
-          module will be called pci_hotplug.
          When in doubt, say N.
 if HOTPLUG_PCI
diff --git a/drivers/pci/hotplug/pciehp_pci.c b/drivers/pci/hotplug/pciehp_pci.c
index aac7a40e4a4a..0e0d0f7f63fd 100644
--- a/drivers/pci/hotplug/pciehp_pci.c
+++ b/drivers/pci/hotplug/pciehp_pci.c
@@ -92,7 +92,14 @@ int pciehp_unconfigure_device(struct slot *p_slot)
        if (ret)
                presence = 0;
-        list_for_each_entry_safe(dev, temp, &parent->devices, bus_list) {
+        /*
+         * Stopping an SR-IOV PF device removes all the associated VFs,
+         * which will update the bus->devices list and confuse the
+         * iterator.  Therefore, iterate in reverse so we remove the VFs
+         * first, then the PF.  We do the same in pci_stop_bus_device().
+         */
+        list_for_each_entry_safe_reverse(dev, temp, &parent->devices,
+                                         bus_list) {
                pci_dev_get(dev);
                if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE && presence) {
                        pci_read_config_byte(dev, PCI_BRIDGE_CONTROL, &bctl);
diff --git a/drivers/pci/pcie/Kconfig b/drivers/pci/pcie/Kconfig
index 569f82fc9e22..3b94cfcfa03b 100644
--- a/drivers/pci/pcie/Kconfig
+++ b/drivers/pci/pcie/Kconfig
@@ -14,15 +14,12 @@ config PCIEPORTBUS
 # Include service Kconfig here
 #
 config HOTPLUG_PCI_PCIE
-        tristate "PCI Express Hotplug driver"
+        bool "PCI Express Hotplug driver"
        depends on HOTPLUG_PCI && PCIEPORTBUS
        help
          Say Y here if you have a motherboard that supports PCI Express Native
          Hotplug
-          To compile this driver as a module, choose M here: the
-          module will be called pciehp.
          When in doubt, say N.
 source "drivers/pci/pcie/aer/Kconfig"
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index d254e2379533..64a7de22d9af 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -300,6 +300,47 @@ static void assign_requested_resources_sorted(struct list_head *head,
        }
 }
+static unsigned long pci_fail_res_type_mask(struct list_head *fail_head)
+{
+        struct pci_dev_resource *fail_res;
+        unsigned long mask = 0;
+        /* check failed type */
+        list_for_each_entry(fail_res, fail_head, list)
+                mask |= fail_res->flags;
+        /*
+         * one pref failed resource will set IORESOURCE_MEM,
+         * as we can allocate pref in non-pref range.
+         * Will release all assigned non-pref sibling resources
+         * according to that bit.
+         */
+        return mask & (IORESOURCE_IO | IORESOURCE_MEM | IORESOURCE_PREFETCH);
+}
+static bool pci_need_to_release(unsigned long mask, struct resource *res)
+{
+        if (res->flags & IORESOURCE_IO)
+                return !!(mask & IORESOURCE_IO);
+        /* check pref at first */
+        if (res->flags & IORESOURCE_PREFETCH) {
+                if (mask & IORESOURCE_PREFETCH)
+                        return true;
+                /* count pref if its parent is non-pref */
+                else if ((mask & IORESOURCE_MEM) &&
+                         !(res->parent->flags & IORESOURCE_PREFETCH))
+                        return true;
+                else
+                        return false;
+        }
+        if (res->flags & IORESOURCE_MEM)
+                return !!(mask & IORESOURCE_MEM);
+        return false;   /* should not get here */
+}
 static void __assign_resources_sorted(struct list_head *head,
                                 struct list_head *realloc_head,
                                 struct list_head *fail_head)
@@ -312,11 +353,24 @@ static void __assign_resources_sorted(struct list_head *head,
         *  if could do that, could get out early.
         *  if could not do that, we still try to assign requested at first,
         *    then try to reassign add_size for some resources.
+         *
+         * Separate three resource type checking if we need to release
+         * assigned resource after requested + add_size try.
+         *      1. if there is io port assign fail, will release assigned
+         *         io port.
+         *      2. if there is pref mmio assign fail, release assigned
+         *         pref mmio.
+         *         if assigned pref mmio's parent is non-pref mmio and there
+         *         is non-pref mmio assign fail, will release that assigned
+         *         pref mmio.
+         *      3. if there is non-pref mmio assign fail or pref mmio
+         *         assigned fail, will release assigned non-pref mmio.
         */
        LIST_HEAD(save_head);
        LIST_HEAD(local_fail_head);
        struct pci_dev_resource *save_res;
-        struct pci_dev_resource *dev_res;
+        struct pci_dev_resource *dev_res, *tmp_res;
+        unsigned long fail_type;
        /* Check if optional add_size is there */
        if (!realloc_head || list_empty(realloc_head))
@@ -348,6 +402,19 @@ static void __assign_resources_sorted(struct list_head *head,
                return;
        }
+        /* check failed type */
+        fail_type = pci_fail_res_type_mask(&local_fail_head);
+        /* remove not need to be released assigned res from head list etc */
+        list_for_each_entry_safe(dev_res, tmp_res, head, list)
+                if (dev_res->res->parent &&
+                    !pci_need_to_release(fail_type, dev_res->res)) {
+                        /* remove it from realloc_head list */
+                        remove_from_list(realloc_head, dev_res->res);
+                        remove_from_list(&save_head, dev_res->res);
+                        list_del(&dev_res->list);
+                        kfree(dev_res);
+                }
        free_list(&local_fail_head);
        /* Release assigned resource */
        list_for_each_entry(dev_res, head, list)
diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c
index f4f30af2df68..2e8a20cac588 100644
--- a/drivers/rapidio/rio.c
+++ b/drivers/rapidio/rio.c
@@ -1715,11 +1715,13 @@ int rio_unregister_scan(int mport_id, struct rio_scan *scan_ops)
                    (mport_id == RIO_MPORT_ANY && port->nscan == scan_ops))
                        port->nscan = NULL;
-        list_for_each_entry(scan, &rio_scans, node)
+        list_for_each_entry(scan, &rio_scans, node) {
                if (scan->mport_id == mport_id) {
                        list_del(&scan->node);
                        kfree(scan);
+                        break;
                }
+        }
        mutex_unlock(&rio_mport_list_lock);
diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
index 02faf3c4e0d5..c2e80d7ca5e2 100644
--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -524,6 +524,8 @@ static int twl_rtc_probe(struct platform_device *pdev)
        if (ret < 0)
                goto out1;
+        device_init_wakeup(&pdev->dev, 1);
        rtc = rtc_device_register(pdev->name,
                                  &pdev->dev, &twl_rtc_ops, THIS_MODULE);
        if (IS_ERR(rtc)) {
@@ -542,7 +544,6 @@ static int twl_rtc_probe(struct platform_device *pdev)
        }
        platform_set_drvdata(pdev, rtc);
-        device_init_wakeup(&pdev->dev, 1);
        return 0;
 out2:
diff --git a/drivers/tty/serial/8250/8250_gsc.c b/drivers/tty/serial/8250/8250_gsc.c
index bb91b4713ebd..2e3ea1a70d7b 100644
--- a/drivers/tty/serial/8250/8250_gsc.c
+++ b/drivers/tty/serial/8250/8250_gsc.c
@@ -31,9 +31,8 @@ static int __init serial_init_chip(struct parisc_device *dev)
        int err;
 #ifdef CONFIG_64BIT
-        extern int iosapic_serial_irq(int cellnum);
        if (!dev->irq && (dev->id.sversion == 0xad))
-                dev->irq = iosapic_serial_irq(dev->mod_index-1);
+                dev->irq = iosapic_serial_irq(dev);
 #endif
        if (!dev->irq) {
diff --git a/drivers/tty/serial/arc_uart.c b/drivers/tty/serial/arc_uart.c
index cbf1d155b7b2..22f280aa4f2c 100644
--- a/drivers/tty/serial/arc_uart.c
+++ b/drivers/tty/serial/arc_uart.c
@@ -773,6 +773,6 @@ module_init(arc_serial_init);
 module_exit(arc_serial_exit);
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("plat-arcfpga/uart");
+MODULE_ALIAS("platform:" DRIVER_NAME);
 MODULE_AUTHOR("Vineet Gupta");
 MODULE_DESCRIPTION("ARC(Synopsys) On-Chip(fpga) serial driver");
diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
index 4f5f161896a1..f85b8e6d0346 100644
--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
@@ -678,11 +678,18 @@ static void mxs_auart_settermios(struct uart_port *u,
 static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
 {
-        u32 istatus, istat;
+        u32 istat;
        struct mxs_auart_port *s = context;
        u32 stat = readl(s->port.membase + AUART_STAT);
-        istatus = istat = readl(s->port.membase + AUART_INTR);
+        istat = readl(s->port.membase + AUART_INTR);
+        /* ack irq */
+        writel(istat & (AUART_INTR_RTIS
+                | AUART_INTR_TXIS
+                | AUART_INTR_RXIS
+                | AUART_INTR_CTSMIS),
+                        s->port.membase + AUART_INTR_CLR);
        if (istat & AUART_INTR_CTSMIS) {
                uart_handle_cts_change(&s->port, stat & AUART_STAT_CTS);
@@ -702,12 +709,6 @@ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
                istat &= ~AUART_INTR_TXIS;
        }
-        writel(istatus & (AUART_INTR_RTIS
-                | AUART_INTR_TXIS
-                | AUART_INTR_RXIS
-                | AUART_INTR_CTSMIS),
-                        s->port.membase + AUART_INTR_CLR);
        return IRQ_HANDLED;
 }
@@ -850,7 +851,7 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
        struct mxs_auart_port *s;
        struct uart_port *port;
        unsigned int old_ctrl0, old_ctrl2;
-        unsigned int to = 1000;
+        unsigned int to = 20000;
        if (co->index >= MXS_AUART_PORTS || co->index < 0)
                return;
@@ -871,18 +872,23 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
        uart_console_write(port, str, count, mxs_auart_console_putchar);
-        /*
+        /* Finally, wait for transmitter to become empty ... */
-         * Finally, wait for transmitter to become empty
-         * and restore the TCR
-         */
        while (readl(port->membase + AUART_STAT) & AUART_STAT_BUSY) {
+                udelay(1);
                if (!to--)
                        break;
-                udelay(1);
        }
-        writel(old_ctrl0, port->membase + AUART_CTRL0);
+        /*
-        writel(old_ctrl2, port->membase + AUART_CTRL2);
+         * ... and restore the TCR if we waited long enough for the transmitter
+         * to be idle. This might keep the transmitter enabled although it is
+         * unused, but that is better than to disable it while it is still
+         * transmitting.
+         */
+        if (!(readl(port->membase + AUART_STAT) & AUART_STAT_BUSY)) {
+                writel(old_ctrl0, port->membase + AUART_CTRL0);
+                writel(old_ctrl2, port->membase + AUART_CTRL2);
+        }
        clk_disable(s->clk);
 }
diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 121aeb9393e1..f597e88a705d 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -256,10 +256,9 @@ void tty_port_tty_hangup(struct tty_port *port, bool check_clocal)
 {
        struct tty_struct *tty = tty_port_tty_get(port);
-        if (tty && (!check_clocal || !C_CLOCAL(tty))) {
+        if (tty && (!check_clocal || !C_CLOCAL(tty)))
                tty_hangup(tty);
-                tty_kref_put(tty);
+        tty_kref_put(tty);
-        }
 }
 EXPORT_SYMBOL_GPL(tty_port_tty_hangup);
diff --git a/drivers/usb/chipidea/Kconfig b/drivers/usb/chipidea/Kconfig
index eb2aa2e5a842..d1bd8ef1f9c1 100644
--- a/drivers/usb/chipidea/Kconfig
+++ b/drivers/usb/chipidea/Kconfig
@@ -12,7 +12,7 @@ if USB_CHIPIDEA
 config USB_CHIPIDEA_UDC
        bool "ChipIdea device controller"
-        depends on USB_GADGET=y || USB_CHIPIDEA=m
+        depends on USB_GADGET=y || (USB_CHIPIDEA=m && USB_GADGET=m)
        help
          Say Y here to enable device controller functionality of the
          ChipIdea driver.
@@ -20,7 +20,7 @@ config USB_CHIPIDEA_UDC
 config USB_CHIPIDEA_HOST
        bool "ChipIdea host controller"
        depends on USB=y
-        depends on USB_EHCI_HCD=y || USB_CHIPIDEA=m
+        depends on USB_EHCI_HCD=y || (USB_CHIPIDEA=m && USB_EHCI_HCD=m)
        select USB_EHCI_ROOT_HUB_TT
        help
          Say Y here to enable host controller functionality of the
diff --git a/drivers/usb/chipidea/bits.h b/drivers/usb/chipidea/bits.h
index aefa0261220c..1b23e354f9fb 100644
--- a/drivers/usb/chipidea/bits.h
+++ b/drivers/usb/chipidea/bits.h
@@ -50,7 +50,7 @@
 #define PORTSC_PTC            (0x0FUL << 16)
 /* PTS and PTW for non lpm version only */
 #define PORTSC_PTS(d)                                           \
-        ((((d) & 0x3) << 30) | (((d) & 0x4) ? BIT(25) : 0))
+        (u32)((((d) & 0x3) << 30) | (((d) & 0x4) ? BIT(25) : 0))
 #define PORTSC_PTW            BIT(28)
 #define PORTSC_STS            BIT(29)
@@ -59,7 +59,7 @@
 #define DEVLC_PSPD_HS         (0x02UL << 25)
 #define DEVLC_PTW             BIT(27)
 #define DEVLC_STS             BIT(28)
-#define DEVLC_PTS(d)          (((d) & 0x7) << 29)
+#define DEVLC_PTS(d)          (u32)(((d) & 0x7) << 29)
 /* Encoding for DEVLC_PTS and PORTSC_PTS */
 #define PTS_UTMI              0
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index f48712ffe261..c1c113ef950c 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -449,14 +449,20 @@ fail:
 static int __exit eth_unbind(struct usb_composite_dev *cdev)
 {
-        if (has_rndis())
+        if (has_rndis()) {
+                usb_put_function(f_rndis);
                usb_put_function_instance(fi_rndis);
-        if (use_eem)
+        }
+        if (use_eem) {
+                usb_put_function(f_eem);
                usb_put_function_instance(fi_eem);
-        else if (can_support_ecm(cdev->gadget))
+        } else if (can_support_ecm(cdev->gadget)) {
+                usb_put_function(f_ecm);
                usb_put_function_instance(fi_ecm);
-        else
+        } else {
+                usb_put_function(f_geth);
                usb_put_function_instance(fi_geth);
+        }
        return 0;
 }
diff --git a/drivers/usb/gadget/f_phonet.c b/drivers/usb/gadget/f_phonet.c
index 1bf26e9f38cd..eb3aa817a662 100644
--- a/drivers/usb/gadget/f_phonet.c
+++ b/drivers/usb/gadget/f_phonet.c
@@ -488,7 +488,6 @@ static int pn_bind(struct usb_configuration *c, struct usb_function *f)
        struct usb_ep *ep;
        int status, i;
-#ifndef USBF_PHONET_INCLUDED
        struct f_phonet_opts *phonet_opts;
        phonet_opts = container_of(f->fi, struct f_phonet_opts, func_inst);
@@ -507,7 +506,6 @@ static int pn_bind(struct usb_configuration *c, struct usb_function *f)
                        return status;
                phonet_opts->bound = true;
        }
-#endif
        /* Reserve interface IDs */
        status = usb_interface_id(c, f);
diff --git a/drivers/usb/gadget/multi.c b/drivers/usb/gadget/multi.c
index 032b96a51ce4..2a1ebefd8f9e 100644
--- a/drivers/usb/gadget/multi.c
+++ b/drivers/usb/gadget/multi.c
@@ -160,10 +160,8 @@ static __init int rndis_do_config(struct usb_configuration *c)
                return ret;
        f_acm_rndis = usb_get_function(fi_acm);
-        if (IS_ERR(f_acm_rndis)) {
+        if (IS_ERR(f_acm_rndis))
-                ret = PTR_ERR(f_acm_rndis);
+                return PTR_ERR(f_acm_rndis);
-                goto err_func_acm;
-        }
        ret = usb_add_function(c, f_acm_rndis);
        if (ret)
@@ -178,7 +176,6 @@ err_fsg:
        usb_remove_function(c, f_acm_rndis);
 err_conf:
        usb_put_function(f_acm_rndis);
-err_func_acm:
        return ret;
 }
@@ -226,7 +223,7 @@ static __init int cdc_do_config(struct usb_configuration *c)
        /* implicit port_num is zero */
        f_acm_multi = usb_get_function(fi_acm);
        if (IS_ERR(f_acm_multi))
-                goto err_func_acm;
+                return PTR_ERR(f_acm_multi);
        ret = usb_add_function(c, f_acm_multi);
        if (ret)
@@ -241,7 +238,6 @@ err_fsg:
        usb_remove_function(c, f_acm_multi);
 err_conf:
        usb_put_function(f_acm_multi);
-err_func_acm:
        return ret;
 }
diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
index c28ac9872030..13e25f80fc20 100644
--- a/drivers/usb/gadget/udc-core.c
+++ b/drivers/usb/gadget/udc-core.c
@@ -109,7 +109,7 @@ void usb_gadget_set_state(struct usb_gadget *gadget,
                enum usb_device_state state)
 {
        gadget->state = state;
-        sysfs_notify(&gadget->dev.kobj, NULL, "status");
+        sysfs_notify(&gadget->dev.kobj, NULL, "state");
 }
 EXPORT_SYMBOL_GPL(usb_gadget_set_state);
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 6708a3b78ad8..f44e8b5e00c9 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -481,7 +481,7 @@ static u64 omap2430_dmamask = DMA_BIT_MASK(32);
 static int omap2430_probe(struct platform_device *pdev)
 {
-        struct resource                 musb_resources[2];
+        struct resource                 musb_resources[3];
        struct musb_hdrc_platform_data  *pdata = pdev->dev.platform_data;
        struct omap_musb_board_data     *data;
        struct platform_device          *musb;
@@ -581,6 +581,11 @@ static int omap2430_probe(struct platform_device *pdev)
        musb_resources[1].end = pdev->resource[1].end;
        musb_resources[1].flags = pdev->resource[1].flags;
+        musb_resources[2].name = pdev->resource[2].name;
+        musb_resources[2].start = pdev->resource[2].start;
+        musb_resources[2].end = pdev->resource[2].end;
+        musb_resources[2].flags = pdev->resource[2].flags;
        ret = platform_device_add_resources(musb, musb_resources,
                        ARRAY_SIZE(musb_resources));
        if (ret) {
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index 2c06a8969a9f..6f8a9ca96ae7 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -1156,7 +1156,7 @@ static u64 tusb_dmamask = DMA_BIT_MASK(32);
 static int tusb_probe(struct platform_device *pdev)
 {
-        struct resource musb_resources[2];
+        struct resource musb_resources[3];
        struct musb_hdrc_platform_data  *pdata = pdev->dev.platform_data;
        struct platform_device          *musb;
        struct tusb6010_glue            *glue;
@@ -1199,6 +1199,11 @@ static int tusb_probe(struct platform_device *pdev)
        musb_resources[1].end = pdev->resource[1].end;
        musb_resources[1].flags = pdev->resource[1].flags;
+        musb_resources[2].name = pdev->resource[2].name;
+        musb_resources[2].start = pdev->resource[2].start;
+        musb_resources[2].end = pdev->resource[2].end;
+        musb_resources[2].flags = pdev->resource[2].flags;
        ret = platform_device_add_resources(musb, musb_resources,
                        ARRAY_SIZE(musb_resources));
        if (ret) {
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index 8c3a42ea910c..7eef9b33fde6 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -719,6 +719,13 @@ config USB_SERIAL_FLASHLOADER
          To compile this driver as a module, choose M here: the
          module will be called flashloader.
+config USB_SERIAL_SUUNTO
+        tristate "USB Suunto ANT+ driver"
+        help
+          Say Y here if you want to use the Suunto ANT+ USB device.
+          To compile this driver as a module, choose M here: the
+          module will be called suunto.
 config USB_SERIAL_DEBUG
        tristate "USB Debugging Device"
diff --git a/drivers/usb/serial/Makefile b/drivers/usb/serial/Makefile
index f7130114488f..a14a870d993f 100644
--- a/drivers/usb/serial/Makefile
+++ b/drivers/usb/serial/Makefile
@@ -54,6 +54,7 @@ obj-$(CONFIG_USB_SERIAL_SIEMENS_MPI)		+= siemens_mpi.o
 obj-$(CONFIG_USB_SERIAL_SIERRAWIRELESS)         += sierra.o
 obj-$(CONFIG_USB_SERIAL_SPCP8X5)                += spcp8x5.o
 obj-$(CONFIG_USB_SERIAL_SSU100)                 += ssu100.o
+obj-$(CONFIG_USB_SERIAL_SUUNTO)                 += suunto.o
 obj-$(CONFIG_USB_SERIAL_SYMBOL)                 += symbolserial.o
 obj-$(CONFIG_USB_SERIAL_WWAN)                   += usb_wwan.o
 obj-$(CONFIG_USB_SERIAL_TI)                     += ti_usb_3410_5052.o
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 7260ec660347..b65e657c641d 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -735,9 +735,34 @@ static struct usb_device_id id_table_combined [] = {
        { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
                .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
        { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
-        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
-        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
-        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_RTS01_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29A_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29F_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S01_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29C_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_81B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_82B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5D_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K4Y_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5G_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S05_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_60_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_61_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_64_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_65_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92D_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_W5R_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_A5R_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_PW1_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
        { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 6dd79253205d..1b8af461b522 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -815,11 +815,35 @@
 /*
 * RT Systems programming cables for various ham radios
 */
-#define RTSYSTEMS_VID                   0x2100  /* Vendor ID */
+#define RTSYSTEMS_VID           0x2100  /* Vendor ID */
-#define RTSYSTEMS_SERIAL_VX7_PID        0x9e52  /* Serial converter for VX-7 Radios using FT232RL */
+#define RTSYSTEMS_USB_S03_PID   0x9001  /* RTS-03 USB to Serial Adapter */
-#define RTSYSTEMS_CT29B_PID             0x9e54  /* CT29B Radio Cable */
+#define RTSYSTEMS_USB_59_PID    0x9e50  /* USB-59 USB to 8 pin plug */
-#define RTSYSTEMS_RTS01_PID             0x9e57  /* USB-RTS01 Radio Cable */
+#define RTSYSTEMS_USB_57A_PID   0x9e51  /* USB-57A USB to 4pin 3.5mm plug */
+#define RTSYSTEMS_USB_57B_PID   0x9e52  /* USB-57B USB to extended 4pin 3.5mm plug */
+#define RTSYSTEMS_USB_29A_PID   0x9e53  /* USB-29A USB to 3.5mm stereo plug */
+#define RTSYSTEMS_USB_29B_PID   0x9e54  /* USB-29B USB to 6 pin mini din */
+#define RTSYSTEMS_USB_29F_PID   0x9e55  /* USB-29F USB to 6 pin modular plug */
+#define RTSYSTEMS_USB_62B_PID   0x9e56  /* USB-62B USB to 8 pin mini din plug*/
+#define RTSYSTEMS_USB_S01_PID   0x9e57  /* USB-RTS01 USB to 3.5 mm stereo plug*/
+#define RTSYSTEMS_USB_63_PID    0x9e58  /* USB-63 USB to 9 pin female*/
+#define RTSYSTEMS_USB_29C_PID   0x9e59  /* USB-29C USB to 4 pin modular plug*/
+#define RTSYSTEMS_USB_81B_PID   0x9e5A  /* USB-81 USB to 8 pin mini din plug*/
+#define RTSYSTEMS_USB_82B_PID   0x9e5B  /* USB-82 USB to 2.5 mm stereo plug*/
+#define RTSYSTEMS_USB_K5D_PID   0x9e5C  /* USB-K5D USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_K4Y_PID   0x9e5D  /* USB-K4Y USB to 2.5/3.5 mm plugs*/
+#define RTSYSTEMS_USB_K5G_PID   0x9e5E  /* USB-K5G USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_S05_PID   0x9e5F  /* USB-RTS05 USB to 2.5 mm stereo plug*/
+#define RTSYSTEMS_USB_60_PID    0x9e60  /* USB-60 USB to 6 pin din*/
+#define RTSYSTEMS_USB_61_PID    0x9e61  /* USB-61 USB to 6 pin mini din*/
+#define RTSYSTEMS_USB_62_PID    0x9e62  /* USB-62 USB to 8 pin mini din*/
+#define RTSYSTEMS_USB_63B_PID   0x9e63  /* USB-63 USB to 9 pin female*/
+#define RTSYSTEMS_USB_64_PID    0x9e64  /* USB-64 USB to 9 pin male*/
+#define RTSYSTEMS_USB_65_PID    0x9e65  /* USB-65 USB to 9 pin female null modem*/
+#define RTSYSTEMS_USB_92_PID    0x9e66  /* USB-92 USB to 12 pin plug*/
+#define RTSYSTEMS_USB_92D_PID   0x9e67  /* USB-92D USB to 12 pin plug data*/
+#define RTSYSTEMS_USB_W5R_PID   0x9e68  /* USB-W5R USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_A5R_PID   0x9e69  /* USB-A5R USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_PW1_PID   0x9e6A  /* USB-PW1 USB to 8 pin modular plug*/
 /*
 * Physik Instrumente
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 603fb70dde80..d953d674f222 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -183,7 +183,10 @@
 #define LED_ON_MS       500
 #define LED_OFF_MS      500
-static int device_type;
+enum mos7840_flag {
+        MOS7840_FLAG_CTRL_BUSY,
+        MOS7840_FLAG_LED_BUSY,
+};
 static const struct usb_device_id id_table[] = {
        {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
@@ -238,9 +241,12 @@ struct moschip_port {
        /* For device(s) with LED indicator */
        bool has_led;
-        bool led_flag;
        struct timer_list led_timer1;   /* Timer for LED on */
        struct timer_list led_timer2;   /* Timer for LED off */
+        struct urb *led_urb;
+        struct usb_ctrlrequest *led_dr;
+        unsigned long flags;
 };
 /*
@@ -460,10 +466,10 @@ static void mos7840_control_callback(struct urb *urb)
        case -ESHUTDOWN:
                /* this urb is terminated, clean up */
                dev_dbg(dev, "%s - urb shutting down with status: %d\n", __func__, status);
-                return;
+                goto out;
        default:
                dev_dbg(dev, "%s - nonzero urb status received: %d\n", __func__, status);
-                return;
+                goto out;
        }
        dev_dbg(dev, "%s urb buffer size is %d\n", __func__, urb->actual_length);
@@ -476,6 +482,8 @@ static void mos7840_control_callback(struct urb *urb)
                mos7840_handle_new_msr(mos7840_port, regval);
        else if (mos7840_port->MsrLsr == 1)
                mos7840_handle_new_lsr(mos7840_port, regval);
+out:
+        clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mos7840_port->flags);
 }
 static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
@@ -486,6 +494,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
        unsigned char *buffer = mcs->ctrl_buf;
        int ret;
+        if (test_and_set_bit_lock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags))
+                return -EBUSY;
        dr->bRequestType = MCS_RD_RTYPE;
        dr->bRequest = MCS_RDREQ;
        dr->wValue = cpu_to_le16(Wval); /* 0 */
@@ -497,6 +508,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
                             mos7840_control_callback, mcs);
        mcs->control_urb->transfer_buffer_length = 2;
        ret = usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
+        if (ret)
+                clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags);
        return ret;
 }
@@ -523,7 +537,7 @@ static void mos7840_set_led_async(struct moschip_port *mcs, __u16 wval,
                                __u16 reg)
 {
        struct usb_device *dev = mcs->port->serial->dev;
-        struct usb_ctrlrequest *dr = mcs->dr;
+        struct usb_ctrlrequest *dr = mcs->led_dr;
        dr->bRequestType = MCS_WR_RTYPE;
        dr->bRequest = MCS_WRREQ;
@@ -531,10 +545,10 @@ static void mos7840_set_led_async(struct moschip_port *mcs, __u16 wval,
        dr->wIndex = cpu_to_le16(reg);
        dr->wLength = cpu_to_le16(0);
-        usb_fill_control_urb(mcs->control_urb, dev, usb_sndctrlpipe(dev, 0),
+        usb_fill_control_urb(mcs->led_urb, dev, usb_sndctrlpipe(dev, 0),
                (unsigned char *)dr, NULL, 0, mos7840_set_led_callback, NULL);
-        usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
+        usb_submit_urb(mcs->led_urb, GFP_ATOMIC);
 }
 static void mos7840_set_led_sync(struct usb_serial_port *port, __u16 reg,
@@ -560,7 +574,19 @@ static void mos7840_led_flag_off(unsigned long arg)
 {
        struct moschip_port *mcs = (struct moschip_port *) arg;
-        mcs->led_flag = false;
+        clear_bit_unlock(MOS7840_FLAG_LED_BUSY, &mcs->flags);
+}
+static void mos7840_led_activity(struct usb_serial_port *port)
+{
+        struct moschip_port *mos7840_port = usb_get_serial_port_data(port);
+        if (test_and_set_bit_lock(MOS7840_FLAG_LED_BUSY, &mos7840_port->flags))
+                return;
+        mos7840_set_led_async(mos7840_port, 0x0301, MODEM_CONTROL_REGISTER);
+        mod_timer(&mos7840_port->led_timer1,
+                                jiffies + msecs_to_jiffies(LED_ON_MS));
 }
 /*****************************************************************************
@@ -758,14 +784,8 @@ static void mos7840_bulk_in_callback(struct urb *urb)
                return;
        }
-        /* Turn on LED */
+        if (mos7840_port->has_led)
-        if (mos7840_port->has_led && !mos7840_port->led_flag) {
+                mos7840_led_activity(port);
-                mos7840_port->led_flag = true;
-                mos7840_set_led_async(mos7840_port, 0x0301,
-                                        MODEM_CONTROL_REGISTER);
-                mod_timer(&mos7840_port->led_timer1,
-                                jiffies + msecs_to_jiffies(LED_ON_MS));
-        }
        mos7840_port->read_urb_busy = true;
        retval = usb_submit_urb(mos7840_port->read_urb, GFP_ATOMIC);
@@ -816,18 +836,6 @@ static void mos7840_bulk_out_data_callback(struct urb *urb)
 /************************************************************************/
 /*       D R I V E R  T T Y  I N T E R F A C E  F U N C T I O N S       */
 /************************************************************************/
-#ifdef MCSSerialProbe
-static int mos7840_serial_probe(struct usb_serial *serial,
-                                const struct usb_device_id *id)
-{
-        /*need to implement the mode_reg reading and updating\
-           structures usb_serial_ device_type\
-           (i.e num_ports, num_bulkin,bulkout etc) */
-        /* Also we can update the changes  attach */
-        return 1;
-}
-#endif
 /*****************************************************************************
 * mos7840_open
@@ -1454,13 +1462,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
        data1 = urb->transfer_buffer;
        dev_dbg(&port->dev, "bulkout endpoint is %d\n", port->bulk_out_endpointAddress);
-        /* Turn on LED */
+        if (mos7840_port->has_led)
-        if (mos7840_port->has_led && !mos7840_port->led_flag) {
+                mos7840_led_activity(port);
-                mos7840_port->led_flag = true;
-                mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0301);
-                mod_timer(&mos7840_port->led_timer1,
-                                jiffies + msecs_to_jiffies(LED_ON_MS));
-        }
        /* send it down the pipe */
        status = usb_submit_urb(urb, GFP_ATOMIC);
@@ -2187,38 +2190,48 @@ static int mos7810_check(struct usb_serial *serial)
        return 0;
 }
-static int mos7840_calc_num_ports(struct usb_serial *serial)
+static int mos7840_probe(struct usb_serial *serial,
+                                const struct usb_device_id *id)
 {
-        __u16 data = 0x00;
+        u16 product = serial->dev->descriptor.idProduct;
        u8 *buf;
-        int mos7840_num_ports;
+        int device_type;
+        if (product == MOSCHIP_DEVICE_ID_7810 ||
+                product == MOSCHIP_DEVICE_ID_7820) {
+                device_type = product;
+                goto out;
+        }
        buf = kzalloc(VENDOR_READ_LENGTH, GFP_KERNEL);
-        if (buf) {
+        if (!buf)
-                usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+                return -ENOMEM;
+        usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
                        MCS_RDREQ, MCS_RD_RTYPE, 0, GPIO_REGISTER, buf,
                        VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT);
-                data = *buf;
-                kfree(buf);
-        }
-        if (serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7810 ||
+        /* For a MCS7840 device GPIO0 must be set to 1 */
-                serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7820) {
+        if (buf[0] & 0x01)
-                device_type = serial->dev->descriptor.idProduct;
+                device_type = MOSCHIP_DEVICE_ID_7840;
-        } else {
+        else if (mos7810_check(serial))
-                /* For a MCS7840 device GPIO0 must be set to 1 */
+                device_type = MOSCHIP_DEVICE_ID_7810;
-                if ((data & 0x01) == 1)
+        else
-                        device_type = MOSCHIP_DEVICE_ID_7840;
+                device_type = MOSCHIP_DEVICE_ID_7820;
-                else if (mos7810_check(serial))
-                        device_type = MOSCHIP_DEVICE_ID_7810;
+        kfree(buf);
-                else
+out:
-                        device_type = MOSCHIP_DEVICE_ID_7820;
+        usb_set_serial_data(serial, (void *)(unsigned long)device_type);
-        }
+        return 0;
+}
+static int mos7840_calc_num_ports(struct usb_serial *serial)
+{
+        int device_type = (unsigned long)usb_get_serial_data(serial);
+        int mos7840_num_ports;
        mos7840_num_ports = (device_type >> 4) & 0x000F;
-        serial->num_bulk_in = mos7840_num_ports;
-        serial->num_bulk_out = mos7840_num_ports;
-        serial->num_ports = mos7840_num_ports;
        return mos7840_num_ports;
 }
@@ -2226,6 +2239,7 @@ static int mos7840_calc_num_ports(struct usb_serial *serial)
 static int mos7840_port_probe(struct usb_serial_port *port)
 {
        struct usb_serial *serial = port->serial;
+        int device_type = (unsigned long)usb_get_serial_data(serial);
        struct moschip_port *mos7840_port;
        int status;
        int pnum;
@@ -2401,6 +2415,14 @@ static int mos7840_port_probe(struct usb_serial_port *port)
        if (device_type == MOSCHIP_DEVICE_ID_7810) {
                mos7840_port->has_led = true;
+                mos7840_port->led_urb = usb_alloc_urb(0, GFP_KERNEL);
+                mos7840_port->led_dr = kmalloc(sizeof(*mos7840_port->led_dr),
+                                                                GFP_KERNEL);
+                if (!mos7840_port->led_urb || !mos7840_port->led_dr) {
+                        status = -ENOMEM;
+                        goto error;
+                }
                init_timer(&mos7840_port->led_timer1);
                mos7840_port->led_timer1.function = mos7840_led_off;
                mos7840_port->led_timer1.expires =
@@ -2413,8 +2435,6 @@ static int mos7840_port_probe(struct usb_serial_port *port)
                        jiffies + msecs_to_jiffies(LED_OFF_MS);
                mos7840_port->led_timer2.data = (unsigned long)mos7840_port;
-                mos7840_port->led_flag = false;
                /* Turn off LED */
                mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0300);
        }
@@ -2436,6 +2456,8 @@ out:
        }
        return 0;
 error:
+        kfree(mos7840_port->led_dr);
+        usb_free_urb(mos7840_port->led_urb);
        kfree(mos7840_port->dr);
        kfree(mos7840_port->ctrl_buf);
        usb_free_urb(mos7840_port->control_urb);
@@ -2456,6 +2478,10 @@ static int mos7840_port_remove(struct usb_serial_port *port)
                del_timer_sync(&mos7840_port->led_timer1);
                del_timer_sync(&mos7840_port->led_timer2);
+                usb_kill_urb(mos7840_port->led_urb);
+                usb_free_urb(mos7840_port->led_urb);
+                kfree(mos7840_port->led_dr);
        }
        usb_kill_urb(mos7840_port->control_urb);
        usb_free_urb(mos7840_port->control_urb);
@@ -2482,9 +2508,7 @@ static struct usb_serial_driver moschip7840_4port_device = {
        .throttle = mos7840_throttle,
        .unthrottle = mos7840_unthrottle,
        .calc_num_ports = mos7840_calc_num_ports,
-#ifdef MCSSerialProbe
+        .probe = mos7840_probe,
-        .probe = mos7840_serial_probe,
-#endif
        .ioctl = mos7840_ioctl,
        .set_termios = mos7840_set_termios,
        .break_ctl = mos7840_break,
diff --git a/drivers/usb/serial/suunto.c b/drivers/usb/serial/suunto.c
new file mode 100644
index 000000000000..2248e7a7d5ad
--- /dev/null
+++ b/drivers/usb/serial/suunto.c
@@ -0,0 +1,41 @@
+/*
+ * Suunto ANT+ USB Driver
+ *
+ * Copyright (C) 2013 Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+ * Copyright (C) 2013 Linux Foundation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation only.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/tty.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/usb/serial.h>
+#include <linux/uaccess.h>
+static const struct usb_device_id id_table[] = {
+        { USB_DEVICE(0x0fcf, 0x1008) },
+        { },
+};
+MODULE_DEVICE_TABLE(usb, id_table);
+static struct usb_serial_driver suunto_device = {
+        .driver = {
+                .owner =        THIS_MODULE,
+                .name =         KBUILD_MODNAME,
+        },
+        .id_table =             id_table,
+        .num_ports =            1,
+};
+static struct usb_serial_driver * const serial_drivers[] = {
+        &suunto_device,
+        NULL,
+};
+module_usb_serial_driver(serial_drivers, id_table);
+MODULE_LICENSE("GPL");
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index c5179e269df6..cef6002acbd4 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -137,8 +137,27 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev)
         */
        pci_write_config_word(pdev, PCI_COMMAND, PCI_COMMAND_INTX_DISABLE);
-        if (vdev->reset_works)
+        /*
-                __pci_reset_function(pdev);
+         * Careful, device_lock may already be held.  This is the case if
+         * a driver unbind is blocked.  Try to get the locks ourselves to
+         * prevent a deadlock.
+         */
+        if (vdev->reset_works) {
+                bool reset_done = false;
+                if (pci_cfg_access_trylock(pdev)) {
+                        if (device_trylock(&pdev->dev)) {
+                                __pci_reset_function_locked(pdev);
+                                reset_done = true;
+                                device_unlock(&pdev->dev);
+                        }
+                        pci_cfg_access_unlock(pdev);
+                }
+                if (!reset_done)
+                        pr_warn("%s: Unable to acquire locks for reset of %s\n",
+                                __func__, dev_name(&pdev->dev));
+        }
        pci_restore_state(pdev);
 }
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index c488da5db7c7..842f4507883e 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -494,27 +494,6 @@ static int vfio_group_nb_add_dev(struct vfio_group *group, struct device *dev)
        return 0;
 }
-static int vfio_group_nb_del_dev(struct vfio_group *group, struct device *dev)
-{
-        struct vfio_device *device;
-        /*
-         * Expect to fall out here.  If a device was in use, it would
-         * have been bound to a vfio sub-driver, which would have blocked
-         * in .remove at vfio_del_group_dev.  Sanity check that we no
-         * longer track the device, so it's safe to remove.
-         */
-        device = vfio_group_get_device(group, dev);
-        if (likely(!device))
-                return 0;
-        WARN("Device %s removed from live group %d!\n", dev_name(dev),
-             iommu_group_id(group->iommu_group));
-        vfio_device_put(device);
-        return 0;
-}
 static int vfio_group_nb_verify(struct vfio_group *group, struct device *dev)
 {
        /* We don't care what happens when the group isn't in use */
@@ -531,13 +510,11 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb,
        struct device *dev = data;
        /*
-         * Need to go through a group_lock lookup to get a reference or
+         * Need to go through a group_lock lookup to get a reference or we
-         * we risk racing a group being removed.  Leave a WARN_ON for
+         * risk racing a group being removed.  Ignore spurious notifies.
-         * debuging, but if the group no longer exists, a spurious notify
-         * is harmless.
         */
        group = vfio_group_try_get(group);
-        if (WARN_ON(!group))
+        if (!group)
                return NOTIFY_OK;
        switch (action) {
@@ -545,7 +522,13 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb,
                vfio_group_nb_add_dev(group, dev);
                break;
        case IOMMU_GROUP_NOTIFY_DEL_DEVICE:
-                vfio_group_nb_del_dev(group, dev);
+                /*
+                 * Nothing to do here.  If the device is in use, then the
+                 * vfio sub-driver should block the remove callback until
+                 * it is unused.  If the device is unused or attached to a
+                 * stub driver, then it should be released and we don't
+                 * care that it will be going away.
+                 */
                break;
        case IOMMU_GROUP_NOTIFY_BIND_DRIVER:
                pr_debug("%s: Device %s, group %d binding to driver\n",
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index a89c15de9f45..9b0f12c5c284 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -435,8 +435,8 @@ static int correct_chipset(struct atyfb_par *par)
        const char *name;
        int i;
-        for (i = ARRAY_SIZE(aty_chips); i > 0; i--)
+        for (i = (int)ARRAY_SIZE(aty_chips) - 1; i >= 0; i--)
-                if (par->pci_id == aty_chips[i - 1].pci_id)
+                if (par->pci_id == aty_chips[i].pci_id)
                        break;
        if (i < 0)
diff --git a/drivers/video/nuc900fb.c b/drivers/video/nuc900fb.c
index 8c527e5b293c..796e5112ceee 100644
--- a/drivers/video/nuc900fb.c
+++ b/drivers/video/nuc900fb.c
@@ -587,8 +587,7 @@ static int nuc900fb_probe(struct platform_device *pdev)
        fbinfo->flags                   = FBINFO_FLAG_DEFAULT;
        fbinfo->pseudo_palette          = &fbi->pseudo_pal;
-        ret = request_irq(irq, nuc900fb_irqhandler, 0,
+        ret = request_irq(irq, nuc900fb_irqhandler, 0, pdev->name, fbi);
-                          pdev->name, fbinfo);
        if (ret) {
                dev_err(&pdev->dev, "cannot register irq handler %d -err %d\n",
                        irq, ret);
diff --git a/drivers/video/sgivwfb.c b/drivers/video/sgivwfb.c
index b2a8912f6435..a9ac3ce2d0e9 100644
--- a/drivers/video/sgivwfb.c
+++ b/drivers/video/sgivwfb.c
@@ -713,7 +713,7 @@ static int sgivwfb_mmap(struct fb_info *info,
        r = vm_iomap_memory(vma, sgivwfb_mem_phys, sgivwfb_mem_size);
        printk(KERN_DEBUG "sgivwfb: mmap framebuffer P(%lx)->V(%lx)\n",
-               offset, vma->vm_start);
+                sgivwfb_mem_phys + (vma->vm_pgoff << PAGE_SHIFT), vma->vm_start);
        return r;
 }
diff --git a/drivers/video/sh7760fb.c b/drivers/video/sh7760fb.c
index a8c6c43a4658..1265b25f9f99 100644
--- a/drivers/video/sh7760fb.c
+++ b/drivers/video/sh7760fb.c
@@ -567,7 +567,7 @@ static int sh7760fb_remove(struct platform_device *dev)
        fb_dealloc_cmap(&info->cmap);
        sh7760fb_free_mem(info);
        if (par->irq >= 0)
-                free_irq(par->irq, par);
+                free_irq(par->irq, &par->vsync);
        iounmap(par->base);
        release_mem_region(par->ioarea->start, resource_size(par->ioarea));
        framebuffer_release(info);
diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c
index 830ded45fd47..2827333703d9 100644
--- a/drivers/video/vga16fb.c
+++ b/drivers/video/vga16fb.c
@@ -1265,7 +1265,6 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image
 static void vga16fb_destroy(struct fb_info *info)
 {
-        struct platform_device *dev = container_of(info->device, struct platform_device, dev);
        iounmap(info->screen_base);
        fb_dealloc_cmap(&info->cmap);
        /* XXX unshare VGA regions */
diff --git a/drivers/video/xilinxfb.c b/drivers/video/xilinxfb.c
index f3d4a69e1e4e..6629b29a8202 100644
--- a/drivers/video/xilinxfb.c
+++ b/drivers/video/xilinxfb.c
@@ -341,8 +341,8 @@ static int xilinxfb_assign(struct platform_device *pdev,
        if (drvdata->flags & BUS_ACCESS_FLAG) {
                /* Put a banner in the log (for DEBUG) */
-                dev_dbg(dev, "regs: phys=%x, virt=%p\n", drvdata->regs_phys,
+                dev_dbg(dev, "regs: phys=%pa, virt=%p\n",
-                                        drvdata->regs);
+                        &drvdata->regs_phys, drvdata->regs);
        }
        /* Put a banner in the log (for DEBUG) */
        dev_dbg(dev, "fb: phys=%llx, virt=%p, size=%x\n",
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index 9e02d60a364b..23eae5cb69c2 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -145,7 +145,7 @@ config SWIOTLB_XEN
 config XEN_TMEM
        tristate
-        depends on !ARM
+        depends on !ARM && !ARM64
        default m if (CLEANCACHE || FRONTSWAP)
        help
          Shim to interface in-kernel Transcendent Memory hooks
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index eabd0ee1c2bc..14fe79d8634a 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -1,9 +1,8 @@
-ifneq ($(CONFIG_ARM),y)
+ifeq ($(filter y, $(CONFIG_ARM) $(CONFIG_ARM64)),)
-obj-y   += manage.o
 obj-$(CONFIG_HOTPLUG_CPU)               += cpu_hotplug.o
 endif
 obj-$(CONFIG_X86)                       += fallback.o
-obj-y   += grant-table.o features.o events.o balloon.o
+obj-y   += grant-table.o features.o events.o balloon.o manage.o
 obj-y   += xenbus/
 nostackp := $(call cc-option, -fno-stack-protector)
diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
index 8feecf01d55c..b6165e047f48 100644
--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -379,18 +379,12 @@ static long evtchn_ioctl(struct file *file,
                if (unbind.port >= NR_EVENT_CHANNELS)
                        break;
-                spin_lock_irq(&port_user_lock);
                rc = -ENOTCONN;
-                if (get_port_user(unbind.port) != u) {
+                if (get_port_user(unbind.port) != u)
-                        spin_unlock_irq(&port_user_lock);
                        break;
-                }
                disable_irq(irq_from_evtchn(unbind.port));
-                spin_unlock_irq(&port_user_lock);
                evtchn_unbind_from_user(u, unbind.port);
                rc = 0;
@@ -490,26 +484,15 @@ static int evtchn_release(struct inode *inode, struct file *filp)
        int i;
        struct per_user_data *u = filp->private_data;
-        spin_lock_irq(&port_user_lock);
-        free_page((unsigned long)u->ring);
        for (i = 0; i < NR_EVENT_CHANNELS; i++) {
                if (get_port_user(i) != u)
                        continue;
                disable_irq(irq_from_evtchn(i));
-        }
-        spin_unlock_irq(&port_user_lock);
-        for (i = 0; i < NR_EVENT_CHANNELS; i++) {
-                if (get_port_user(i) != u)
-                        continue;
                evtchn_unbind_from_user(get_port_user(i), i);
        }
+        free_page((unsigned long)u->ring);
        kfree(u->name);
        kfree(u);
diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
index 6ed8a9df4472..34b20bfa4e8c 100644
--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
+++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
@@ -115,7 +115,6 @@ static int xenbus_frontend_dev_resume(struct device *dev)
                        return -EFAULT;
                }
-                INIT_WORK(&xdev->work, xenbus_frontend_delayed_resume);
                queue_work(xenbus_frontend_wq, &xdev->work);
                return 0;
@@ -124,6 +123,16 @@ static int xenbus_frontend_dev_resume(struct device *dev)
        return xenbus_dev_resume(dev);
 }
+static int xenbus_frontend_dev_probe(struct device *dev)
+{
+        if (xen_store_domain_type == XS_LOCAL) {
+                struct xenbus_device *xdev = to_xenbus_device(dev);
+                INIT_WORK(&xdev->work, xenbus_frontend_delayed_resume);
+        }
+        return xenbus_dev_probe(dev);
+}
 static const struct dev_pm_ops xenbus_pm_ops = {
        .suspend        = xenbus_dev_suspend,
        .resume         = xenbus_frontend_dev_resume,
@@ -142,7 +151,7 @@ static struct xen_bus_type xenbus_frontend = {
                .name           = "xen",
                .match          = xenbus_match,
                .uevent         = xenbus_uevent_frontend,
-                .probe          = xenbus_dev_probe,
+                .probe          = xenbus_frontend_dev_probe,
                .remove         = xenbus_dev_remove,
                .shutdown       = xenbus_dev_shutdown,
                .dev_attrs      = xenbus_dev_attrs,
@@ -474,7 +483,11 @@ static int __init xenbus_probe_frontend_init(void)
        register_xenstore_notifier(&xenstore_notifier);
-        xenbus_frontend_wq = create_workqueue("xenbus_frontend");
+        if (xen_store_domain_type == XS_LOCAL) {
+                xenbus_frontend_wq = create_workqueue("xenbus_frontend");
+                if (!xenbus_frontend_wq)
+                        pr_warn("create xenbus frontend workqueue failed, S3 resume is likely to fail\n");
+        }
        return 0;
 }
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 998b17eda09d..9f6b96a09615 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -2965,6 +2965,11 @@ int ocfs2_duplicate_clusters_by_page(handle_t *handle,
                        to = map_end & (PAGE_CACHE_SIZE - 1);
                page = find_or_create_page(mapping, page_index, GFP_NOFS);
+                if (!page) {
+                        ret = -ENOMEM;
+                        mlog_errno(ret);
+                        break;
+                }
                /*
                 * In case PAGE_CACHE_SIZE <= CLUSTER_SIZE, This page
diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h
index f5e1168c7647..d639049a613d 100644
--- a/include/drm/drm_fixed.h
+++ b/include/drm/drm_fixed.h
@@ -84,12 +84,12 @@ static inline int drm_fixp2int(int64_t a)
        return ((s64)a) >> DRM_FIXED_POINT;
 }
-static inline s64 drm_fixp_msbset(int64_t a)
+static inline unsigned drm_fixp_msbset(int64_t a)
 {
        unsigned shift, sign = (a >> 63) & 1;
        for (shift = 62; shift > 0; --shift)
-                if ((a >> shift) != sign)
+                if (((a >> shift) & 1) != sign)
                        return shift;
        return 0;
@@ -100,9 +100,9 @@ static inline s64 drm_fixp_mul(s64 a, s64 b)
        unsigned shift = drm_fixp_msbset(a) + drm_fixp_msbset(b);
        s64 result;
-        if (shift > 63) {
+        if (shift > 61) {
-                shift = shift - 63;
+                shift = shift - 61;
-                a >>= shift >> 1;
+                a >>= (shift >> 1) + (shift & 1);
                b >>= shift >> 1;
        } else
                shift = 0;
@@ -120,7 +120,7 @@ static inline s64 drm_fixp_mul(s64 a, s64 b)
 static inline s64 drm_fixp_div(s64 a, s64 b)
 {
-        unsigned shift = 63 - drm_fixp_msbset(a);
+        unsigned shift = 62 - drm_fixp_msbset(a);
        s64 result;
        a <<= shift;
@@ -154,7 +154,7 @@ static inline s64 drm_fixp_exp(s64 x)
        }
        if (x < 0)
-                sum = drm_fixp_div(1, sum);
+                sum = drm_fixp_div(DRM_FIXED_ONE, sum);
        return sum;
 }
diff --git a/include/linux/firewire.h b/include/linux/firewire.h
index 3b0e820375ab..5d7782e42b8f 100644
--- a/include/linux/firewire.h
+++ b/include/linux/firewire.h
@@ -436,6 +436,7 @@ struct fw_iso_context {
        int type;
        int channel;
        int speed;
+        bool drop_overflow_headers;
        size_t header_size;
        union {
                fw_iso_callback_t sc;
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index b62d4af6c667..45e921401b06 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -361,7 +361,8 @@ struct ssb_device_id {
        __u16   vendor;
        __u16   coreid;
        __u8    revision;
-};
+        __u8    __pad;
+} __attribute__((packed, aligned(2)));
 #define SSB_DEVICE(_vendor, _coreid, _revision)  \
        { .vendor = _vendor, .coreid = _coreid, .revision = _revision, }
 #define SSB_DEVTABLE_END  \
@@ -377,7 +378,7 @@ struct bcma_device_id {
        __u16   id;
        __u8    rev;
        __u8    class;
-};
+} __attribute__((packed,aligned(2)));
 #define BCMA_CORE(_manuf, _id, _rev, _class)  \
        { .manuf = _manuf, .id = _id, .rev = _rev, .class = _class, }
 #define BCMA_CORETABLE_END  \
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 50d04b92ceda..d722490da030 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1628,6 +1628,7 @@ extern void thread_group_cputime_adjusted(struct task_struct *p, cputime_t *ut,
 #define PF_MEMPOLICY    0x10000000      /* Non-default NUMA mempolicy */
 #define PF_MUTEX_TESTER 0x20000000      /* Thread belongs to the rt mutex tester */
 #define PF_FREEZER_SKIP 0x40000000      /* Freezer should not count it as freezable */
+#define PF_SUSPEND_TASK 0x80000000      /* this thread called freeze_processes and should not be frozen */
 /*
 * Only the _current_ task can read/write to tsk->flags, but other
diff --git a/include/linux/tick.h b/include/linux/tick.h
index 9180f4b85e6d..62bd8b72873c 100644
--- a/include/linux/tick.h
+++ b/include/linux/tick.h
@@ -174,10 +174,4 @@ static inline void tick_nohz_task_switch(struct task_struct *tsk) { }
 #endif
-# ifdef CONFIG_CPU_IDLE_GOV_MENU
-extern void menu_hrtimer_cancel(void);
-# else
-static inline void menu_hrtimer_cancel(void) {}
-# endif /* CONFIG_CPU_IDLE_GOV_MENU */
 #endif
diff --git a/include/linux/vmpressure.h b/include/linux/vmpressure.h
index 76be077340ea..7dc17e2456de 100644
--- a/include/linux/vmpressure.h
+++ b/include/linux/vmpressure.h
@@ -12,7 +12,7 @@ struct vmpressure {
        unsigned long scanned;
        unsigned long reclaimed;
        /* The lock is used to keep the scanned/reclaimed above in sync. */
-        struct mutex sr_lock;
+        struct spinlock sr_lock;
        /* The list of vmpressure_event structs. */
        struct list_head events;
@@ -30,6 +30,7 @@ extern void vmpressure(gfp_t gfp, struct mem_cgroup *memcg,
 extern void vmpressure_prio(gfp_t gfp, struct mem_cgroup *memcg, int prio);
 extern void vmpressure_init(struct vmpressure *vmpr);
+extern void vmpressure_cleanup(struct vmpressure *vmpr);
 extern struct vmpressure *memcg_to_vmpressure(struct mem_cgroup *memcg);
 extern struct cgroup_subsys_state *vmpressure_to_css(struct vmpressure *vmpr);
 extern struct vmpressure *css_to_vmpressure(struct cgroup_subsys_state *css);
diff --git a/include/uapi/linux/firewire-cdev.h b/include/uapi/linux/firewire-cdev.h
index d50036953497..1db453e4b550 100644
--- a/include/uapi/linux/firewire-cdev.h
+++ b/include/uapi/linux/firewire-cdev.h
@@ -215,8 +215,8 @@ struct fw_cdev_event_request2 {
 * with the %FW_CDEV_ISO_INTERRUPT bit set, when explicitly requested with
 * %FW_CDEV_IOC_FLUSH_ISO, or when there have been so many completed packets
 * without the interrupt bit set that the kernel's internal buffer for @header
- * is about to overflow.  (In the last case, kernels with ABI version < 5 drop
+ * is about to overflow.  (In the last case, ABI versions < 5 drop header data
- * header data up to the next interrupt packet.)
+ * up to the next interrupt packet.)
 *
 * Isochronous transmit events (context type %FW_CDEV_ISO_CONTEXT_TRANSMIT):
 *
diff --git a/kernel/Makefile b/kernel/Makefile
index 470839d1a30e..35ef1185e359 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the linux kernel.
 #
-obj-y     = fork.o exec_domain.o panic.o printk.o \
+obj-y     = fork.o exec_domain.o panic.o \
            cpu.o exit.o itimer.o time.o softirq.o resource.o \
            sysctl.o sysctl_binary.o capability.o ptrace.o timer.o user.o \
            signal.o sys.o kmod.o workqueue.o pid.o task_work.o \
@@ -24,6 +24,7 @@ endif
 obj-y += sched/
 obj-y += power/
+obj-y += printk/
 obj-y += cpu/
 obj-$(CONFIG_CHECKPOINT_RESTORE) += kcmp.o
diff --git a/kernel/freezer.c b/kernel/freezer.c
index 8b2afc1c9df0..b462fa197517 100644
--- a/kernel/freezer.c
+++ b/kernel/freezer.c
@@ -33,7 +33,7 @@ static DEFINE_SPINLOCK(freezer_lock);
 */
 bool freezing_slow_path(struct task_struct *p)
 {
-        if (p->flags & PF_NOFREEZE)
+        if (p->flags & (PF_NOFREEZE | PF_SUSPEND_TASK))
                return false;
        if (pm_nosig_freezing || cgroup_freezing(p))
diff --git a/kernel/power/process.c b/kernel/power/process.c
index fc0df8486449..06ec8869dbf1 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -109,6 +109,8 @@ static int try_to_freeze_tasks(bool user_only)
 /**
 * freeze_processes - Signal user space processes to enter the refrigerator.
+ * The current thread will not be frozen.  The same process that calls
+ * freeze_processes must later call thaw_processes.
 *
 * On success, returns 0.  On failure, -errno and system is fully thawed.
 */
@@ -120,6 +122,9 @@ int freeze_processes(void)
        if (error)
                return error;
+        /* Make sure this task doesn't get frozen */
+        current->flags |= PF_SUSPEND_TASK;
        if (!pm_freezing)
                atomic_inc(&system_freezing_cnt);
@@ -168,6 +173,7 @@ int freeze_kernel_threads(void)
 void thaw_processes(void)
 {
        struct task_struct *g, *p;
+        struct task_struct *curr = current;
        if (pm_freezing)
                atomic_dec(&system_freezing_cnt);
@@ -182,10 +188,15 @@ void thaw_processes(void)
        read_lock(&tasklist_lock);
        do_each_thread(g, p) {
+                /* No other threads should have PF_SUSPEND_TASK set */
+                WARN_ON((p != curr) && (p->flags & PF_SUSPEND_TASK));
                __thaw_task(p);
        } while_each_thread(g, p);
        read_unlock(&tasklist_lock);
+        WARN_ON(!(curr->flags & PF_SUSPEND_TASK));
+        curr->flags &= ~PF_SUSPEND_TASK;
        usermodehelper_enable();
        schedule();
diff --git a/kernel/printk/Makefile b/kernel/printk/Makefile
new file mode 100644
index 000000000000..85405bdcf2b3
--- /dev/null
+++ b/kernel/printk/Makefile
@@ -0,0 +1,2 @@
+obj-y   = printk.o
+obj-$(CONFIG_A11Y_BRAILLE_CONSOLE)      += braille.o
diff --git a/kernel/printk/braille.c b/kernel/printk/braille.c
new file mode 100644
index 000000000000..b51087fb9ace
--- /dev/null
+++ b/kernel/printk/braille.c
@@ -0,0 +1,48 @@
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/kernel.h>
+#include <linux/console.h>
+#include <linux/string.h>
+#include "console_cmdline.h"
+#include "braille.h"
+char *_braille_console_setup(char **str, char **brl_options)
+{
+        if (!memcmp(*str, "brl,", 4)) {
+                *brl_options = "";
+                *str += 4;
+        } else if (!memcmp(str, "brl=", 4)) {
+                *brl_options = *str + 4;
+                *str = strchr(*brl_options, ',');
+                if (!*str)
+                        pr_err("need port name after brl=\n");
+                else
+                        *((*str)++) = 0;
+        }
+        return *str;
+}
+int
+_braille_register_console(struct console *console, struct console_cmdline *c)
+{
+        int rtn = 0;
+        if (c->brl_options) {
+                console->flags |= CON_BRL;
+                rtn = braille_register_console(console, c->index, c->options,
+                                               c->brl_options);
+        }
+        return rtn;
+}
+int
+_braille_unregister_console(struct console *console)
+{
+        if (console->flags & CON_BRL)
+                return braille_unregister_console(console);
+        return 0;
+}
diff --git a/kernel/printk/braille.h b/kernel/printk/braille.h
new file mode 100644
index 000000000000..769d771145c8
--- /dev/null
+++ b/kernel/printk/braille.h
@@ -0,0 +1,48 @@
+#ifndef _PRINTK_BRAILLE_H
+#define _PRINTK_BRAILLE_H
+#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+static inline void
+braille_set_options(struct console_cmdline *c, char *brl_options)
+{
+        c->brl_options = brl_options;
+}
+char *
+_braille_console_setup(char **str, char **brl_options);
+int
+_braille_register_console(struct console *console, struct console_cmdline *c);
+int
+_braille_unregister_console(struct console *console);
+#else
+static inline void
+braille_set_options(struct console_cmdline *c, char *brl_options)
+{
+}
+static inline char *
+_braille_console_setup(char **str, char **brl_options)
+{
+        return NULL;
+}
+static inline int
+_braille_register_console(struct console *console, struct console_cmdline *c)
+{
+        return 0;
+}
+static inline int
+_braille_unregister_console(struct console *console)
+{
+        return 0;
+}
+#endif
+#endif
diff --git a/kernel/printk/console_cmdline.h b/kernel/printk/console_cmdline.h
new file mode 100644
index 000000000000..cbd69d842341
--- /dev/null
+++ b/kernel/printk/console_cmdline.h
@@ -0,0 +1,14 @@
+#ifndef _CONSOLE_CMDLINE_H
+#define _CONSOLE_CMDLINE_H
+struct console_cmdline
+{
+        char    name[8];                        /* Name of the driver       */
+        int     index;                          /* Minor dev. to use        */
+        char    *options;                       /* Options for the driver   */
+#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+        char    *brl_options;                   /* Options for braille driver */
+#endif
+};
+#endif
diff --git a/kernel/printk.c b/kernel/printk/printk.c
index 69b0890ed7e5..5b5a7080e2a5 100644
--- a/kernel/printk.c
+++ b/kernel/printk/printk.c
@@ -51,6 +51,9 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/printk.h>
+#include "console_cmdline.h"
+#include "braille.h"
 /* printk's without a loglevel use this.. */
 #define DEFAULT_MESSAGE_LOGLEVEL CONFIG_DEFAULT_MESSAGE_LOGLEVEL
@@ -105,19 +108,11 @@ static struct console *exclusive_console;
 /*
 *      Array of consoles built from command line options (console=)
 */
-struct console_cmdline
-{
-        char    name[8];                        /* Name of the driver       */
-        int     index;                          /* Minor dev. to use        */
-        char    *options;                       /* Options for the driver   */
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-        char    *brl_options;                   /* Options for braille driver */
-#endif
-};
 #define MAX_CMDLINECONSOLES 8
 static struct console_cmdline console_cmdline[MAX_CMDLINECONSOLES];
 static int selected_console = -1;
 static int preferred_console = -1;
 int console_set_on_cmdline;
@@ -178,7 +173,7 @@ static int console_may_schedule;
 *         67                           "g"
 *   0032     00 00 00                  padding to next message header
 *
- * The 'struct log' buffer header must never be directly exported to
+ * The 'struct printk_log' buffer header must never be directly exported to
 * userspace, it is a kernel-private implementation detail that might
 * need to be changed in the future, when the requirements change.
 *
@@ -200,7 +195,7 @@ enum log_flags {
        LOG_CONT        = 8,    /* text is a fragment of a continuation line */
 };
-struct log {
+struct printk_log {
        u64 ts_nsec;            /* timestamp in nanoseconds */
        u16 len;                /* length of entire record */
        u16 text_len;           /* length of text buffer */
@@ -248,7 +243,7 @@ static u32 clear_idx;
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
 #define LOG_ALIGN 4
 #else
-#define LOG_ALIGN __alignof__(struct log)
+#define LOG_ALIGN __alignof__(struct printk_log)
 #endif
 #define __LOG_BUF_LEN (1 << CONFIG_LOG_BUF_SHIFT)
 static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN);
@@ -259,35 +254,35 @@ static u32 log_buf_len = __LOG_BUF_LEN;
 static volatile unsigned int logbuf_cpu = UINT_MAX;
 /* human readable text of the record */
-static char *log_text(const struct log *msg)
+static char *log_text(const struct printk_log *msg)
 {
-        return (char *)msg + sizeof(struct log);
+        return (char *)msg + sizeof(struct printk_log);
 }
 /* optional key/value pair dictionary attached to the record */
-static char *log_dict(const struct log *msg)
+static char *log_dict(const struct printk_log *msg)
 {
-        return (char *)msg + sizeof(struct log) + msg->text_len;
+        return (char *)msg + sizeof(struct printk_log) + msg->text_len;
 }
 /* get record by index; idx must point to valid msg */
-static struct log *log_from_idx(u32 idx)
+static struct printk_log *log_from_idx(u32 idx)
 {
-        struct log *msg = (struct log *)(log_buf + idx);
+        struct printk_log *msg = (struct printk_log *)(log_buf + idx);
        /*
         * A length == 0 record is the end of buffer marker. Wrap around and
         * read the message at the start of the buffer.
         */
        if (!msg->len)
-                return (struct log *)log_buf;
+                return (struct printk_log *)log_buf;
        return msg;
 }
 /* get next record; idx must point to valid msg */
 static u32 log_next(u32 idx)
 {
-        struct log *msg = (struct log *)(log_buf + idx);
+        struct printk_log *msg = (struct printk_log *)(log_buf + idx);
        /* length == 0 indicates the end of the buffer; wrap */
        /*
@@ -296,7 +291,7 @@ static u32 log_next(u32 idx)
         * return the one after that.
         */
        if (!msg->len) {
-                msg = (struct log *)log_buf;
+                msg = (struct printk_log *)log_buf;
                return msg->len;
        }
        return idx + msg->len;
@@ -308,11 +303,11 @@ static void log_store(int facility, int level,
                      const char *dict, u16 dict_len,
                      const char *text, u16 text_len)
 {
-        struct log *msg;
+        struct printk_log *msg;
        u32 size, pad_len;
        /* number of '\0' padding bytes to next message */
-        size = sizeof(struct log) + text_len + dict_len;
+        size = sizeof(struct printk_log) + text_len + dict_len;
        pad_len = (-size) & (LOG_ALIGN - 1);
        size += pad_len;
@@ -324,7 +319,7 @@ static void log_store(int facility, int level,
                else
                        free = log_first_idx - log_next_idx;
-                if (free > size + sizeof(struct log))
+                if (free > size + sizeof(struct printk_log))
                        break;
                /* drop old messages until we have enough contiuous space */
@@ -332,18 +327,18 @@ static void log_store(int facility, int level,
                log_first_seq++;
        }
-        if (log_next_idx + size + sizeof(struct log) >= log_buf_len) {
+        if (log_next_idx + size + sizeof(struct printk_log) >= log_buf_len) {
                /*
                 * This message + an additional empty header does not fit
                 * at the end of the buffer. Add an empty header with len == 0
                 * to signify a wrap around.
                 */
-                memset(log_buf + log_next_idx, 0, sizeof(struct log));
+                memset(log_buf + log_next_idx, 0, sizeof(struct printk_log));
                log_next_idx = 0;
        }
        /* fill message */
-        msg = (struct log *)(log_buf + log_next_idx);
+        msg = (struct printk_log *)(log_buf + log_next_idx);
        memcpy(log_text(msg), text, text_len);
        msg->text_len = text_len;
        memcpy(log_dict(msg), dict, dict_len);
@@ -356,7 +351,7 @@ static void log_store(int facility, int level,
        else
                msg->ts_nsec = local_clock();
        memset(log_dict(msg) + dict_len, 0, pad_len);
-        msg->len = sizeof(struct log) + text_len + dict_len + pad_len;
+        msg->len = sizeof(struct printk_log) + text_len + dict_len + pad_len;
        /* insert message */
        log_next_idx += msg->len;
@@ -479,7 +474,7 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
                            size_t count, loff_t *ppos)
 {
        struct devkmsg_user *user = file->private_data;
-        struct log *msg;
+        struct printk_log *msg;
        u64 ts_usec;
        size_t i;
        char cont = '-';
@@ -724,14 +719,14 @@ void log_buf_kexec_setup(void)
        VMCOREINFO_SYMBOL(log_first_idx);
        VMCOREINFO_SYMBOL(log_next_idx);
        /*
-         * Export struct log size and field offsets. User space tools can
+         * Export struct printk_log size and field offsets. User space tools can
         * parse it and detect any changes to structure down the line.
         */
-        VMCOREINFO_STRUCT_SIZE(log);
+        VMCOREINFO_STRUCT_SIZE(printk_log);
-        VMCOREINFO_OFFSET(log, ts_nsec);
+        VMCOREINFO_OFFSET(printk_log, ts_nsec);
-        VMCOREINFO_OFFSET(log, len);
+        VMCOREINFO_OFFSET(printk_log, len);
-        VMCOREINFO_OFFSET(log, text_len);
+        VMCOREINFO_OFFSET(printk_log, text_len);
-        VMCOREINFO_OFFSET(log, dict_len);
+        VMCOREINFO_OFFSET(printk_log, dict_len);
 }
 #endif
@@ -884,7 +879,7 @@ static size_t print_time(u64 ts, char *buf)
                       (unsigned long)ts, rem_nsec / 1000);
 }
-static size_t print_prefix(const struct log *msg, bool syslog, char *buf)
+static size_t print_prefix(const struct printk_log *msg, bool syslog, char *buf)
 {
        size_t len = 0;
        unsigned int prefix = (msg->facility << 3) | msg->level;
@@ -907,7 +902,7 @@ static size_t print_prefix(const struct log *msg, bool syslog, char *buf)
        return len;
 }
-static size_t msg_print_text(const struct log *msg, enum log_flags prev,
+static size_t msg_print_text(const struct printk_log *msg, enum log_flags prev,
                             bool syslog, char *buf, size_t size)
 {
        const char *text = log_text(msg);
@@ -969,7 +964,7 @@ static size_t msg_print_text(const struct log *msg, enum log_flags prev,
 static int syslog_print(char __user *buf, int size)
 {
        char *text;
-        struct log *msg;
+        struct printk_log *msg;
        int len = 0;
        text = kmalloc(LOG_LINE_MAX + PREFIX_MAX, GFP_KERNEL);
@@ -1060,7 +1055,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                idx = clear_idx;
                prev = 0;
                while (seq < log_next_seq) {
-                        struct log *msg = log_from_idx(idx);
+                        struct printk_log *msg = log_from_idx(idx);
                        len += msg_print_text(msg, prev, true, NULL, 0);
                        prev = msg->flags;
@@ -1073,7 +1068,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                idx = clear_idx;
                prev = 0;
                while (len > size && seq < log_next_seq) {
-                        struct log *msg = log_from_idx(idx);
+                        struct printk_log *msg = log_from_idx(idx);
                        len -= msg_print_text(msg, prev, true, NULL, 0);
                        prev = msg->flags;
@@ -1087,7 +1082,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                len = 0;
                prev = 0;
                while (len >= 0 && seq < next_seq) {
-                        struct log *msg = log_from_idx(idx);
+                        struct printk_log *msg = log_from_idx(idx);
                        int textlen;
                        textlen = msg_print_text(msg, prev, true, text,
@@ -1233,7 +1228,7 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
                        error = 0;
                        while (seq < log_next_seq) {
-                                struct log *msg = log_from_idx(idx);
+                                struct printk_log *msg = log_from_idx(idx);
                                error += msg_print_text(msg, prev, true, NULL, 0);
                                idx = log_next(idx);
@@ -1719,10 +1714,10 @@ static struct cont {
        u8 level;
        bool flushed:1;
 } cont;
-static struct log *log_from_idx(u32 idx) { return NULL; }
+static struct printk_log *log_from_idx(u32 idx) { return NULL; }
 static u32 log_next(u32 idx) { return 0; }
 static void call_console_drivers(int level, const char *text, size_t len) {}
-static size_t msg_print_text(const struct log *msg, enum log_flags prev,
+static size_t msg_print_text(const struct printk_log *msg, enum log_flags prev,
                             bool syslog, char *buf, size_t size) { return 0; }
 static size_t cont_print_text(char *text, size_t size) { return 0; }
@@ -1761,23 +1756,23 @@ static int __add_preferred_console(char *name, int idx, char *options,
         *      See if this tty is not yet registered, and
         *      if we have a slot free.
         */
-        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; i++)
+        for (i = 0, c = console_cmdline;
-                if (strcmp(console_cmdline[i].name, name) == 0 &&
+             i < MAX_CMDLINECONSOLES && c->name[0];
-                          console_cmdline[i].index == idx) {
+             i++, c++) {
-                                if (!brl_options)
+                if (strcmp(c->name, name) == 0 && c->index == idx) {
-                                        selected_console = i;
+                        if (!brl_options)
-                                return 0;
+                                selected_console = i;
+                        return 0;
                }
+        }
        if (i == MAX_CMDLINECONSOLES)
                return -E2BIG;
        if (!brl_options)
                selected_console = i;
-        c = &console_cmdline[i];
        strlcpy(c->name, name, sizeof(c->name));
        c->options = options;
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+        braille_set_options(c, brl_options);
-        c->brl_options = brl_options;
-#endif
        c->index = idx;
        return 0;
 }
@@ -1790,20 +1785,8 @@ static int __init console_setup(char *str)
        char *s, *options, *brl_options = NULL;
        int idx;
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+        if (_braille_console_setup(&str, &brl_options))
-        if (!memcmp(str, "brl,", 4)) {
+                return 1;
-                brl_options = "";
-                str += 4;
-        } else if (!memcmp(str, "brl=", 4)) {
-                brl_options = str + 4;
-                str = strchr(brl_options, ',');
-                if (!str) {
-                        printk(KERN_ERR "need port name after brl=\n");
-                        return 1;
-                }
-                *(str++) = 0;
-        }
-#endif
        /*
         * Decode str into name, index, options.
@@ -1858,15 +1841,15 @@ int update_console_cmdline(char *name, int idx, char *name_new, int idx_new, cha
        struct console_cmdline *c;
        int i;
-        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; i++)
+        for (i = 0, c = console_cmdline;
-                if (strcmp(console_cmdline[i].name, name) == 0 &&
+             i < MAX_CMDLINECONSOLES && c->name[0];
-                          console_cmdline[i].index == idx) {
+             i++, c++)
-                                c = &console_cmdline[i];
+                if (strcmp(c->name, name) == 0 && c->index == idx) {
-                                strlcpy(c->name, name_new, sizeof(c->name));
+                        strlcpy(c->name, name_new, sizeof(c->name));
-                                c->name[sizeof(c->name) - 1] = 0;
+                        c->name[sizeof(c->name) - 1] = 0;
-                                c->options = options;
+                        c->options = options;
-                                c->index = idx_new;
+                        c->index = idx_new;
-                                return i;
+                        return i;
                }
        /* not found */
        return -1;
@@ -2046,7 +2029,7 @@ void console_unlock(void)
        console_cont_flush(text, sizeof(text));
 again:
        for (;;) {
-                struct log *msg;
+                struct printk_log *msg;
                size_t len;
                int level;
@@ -2241,6 +2224,7 @@ void register_console(struct console *newcon)
        int i;
        unsigned long flags;
        struct console *bcon = NULL;
+        struct console_cmdline *c;
        /*
         * before we register a new CON_BOOT console, make sure we don't
@@ -2288,30 +2272,25 @@ void register_console(struct console *newcon)
         *      See if this console matches one we selected on
         *      the command line.
         */
-        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0];
+        for (i = 0, c = console_cmdline;
-                        i++) {
+             i < MAX_CMDLINECONSOLES && c->name[0];
-                if (strcmp(console_cmdline[i].name, newcon->name) != 0)
+             i++, c++) {
+                if (strcmp(c->name, newcon->name) != 0)
                        continue;
                if (newcon->index >= 0 &&
-                    newcon->index != console_cmdline[i].index)
+                    newcon->index != c->index)
                        continue;
                if (newcon->index < 0)
-                        newcon->index = console_cmdline[i].index;
+                        newcon->index = c->index;
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-                if (console_cmdline[i].brl_options) {
+                if (_braille_register_console(newcon, c))
-                        newcon->flags |= CON_BRL;
-                        braille_register_console(newcon,
-                                        console_cmdline[i].index,
-                                        console_cmdline[i].options,
-                                        console_cmdline[i].brl_options);
                        return;
-                }
-#endif
                if (newcon->setup &&
                    newcon->setup(newcon, console_cmdline[i].options) != 0)
                        break;
                newcon->flags |= CON_ENABLED;
-                newcon->index = console_cmdline[i].index;
+                newcon->index = c->index;
                if (i == selected_console) {
                        newcon->flags |= CON_CONSDEV;
                        preferred_console = selected_console;
@@ -2394,13 +2373,13 @@ EXPORT_SYMBOL(register_console);
 int unregister_console(struct console *console)
 {
        struct console *a, *b;
-        int res = 1;
+        int res;
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+        res = _braille_unregister_console(console);
-        if (console->flags & CON_BRL)
+        if (res)
-                return braille_unregister_console(console);
+                return res;
-#endif
+        res = 1;
        console_lock();
        if (console_drivers == console) {
                console_drivers=console->next;
@@ -2666,7 +2645,7 @@ void kmsg_dump(enum kmsg_dump_reason reason)
 bool kmsg_dump_get_line_nolock(struct kmsg_dumper *dumper, bool syslog,
                               char *line, size_t size, size_t *len)
 {
-        struct log *msg;
+        struct printk_log *msg;
        size_t l = 0;
        bool ret = false;
@@ -2778,7 +2757,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
        idx = dumper->cur_idx;
        prev = 0;
        while (seq < dumper->next_seq) {
-                struct log *msg = log_from_idx(idx);
+                struct printk_log *msg = log_from_idx(idx);
                l += msg_print_text(msg, prev, true, NULL, 0);
                idx = log_next(idx);
@@ -2791,7 +2770,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
        idx = dumper->cur_idx;
        prev = 0;
        while (l > size && seq < dumper->next_seq) {
-                struct log *msg = log_from_idx(idx);
+                struct printk_log *msg = log_from_idx(idx);
                l -= msg_print_text(msg, prev, true, NULL, 0);
                idx = log_next(idx);
@@ -2806,7 +2785,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
        l = 0;
        prev = 0;
        while (seq < dumper->next_seq) {
-                struct log *msg = log_from_idx(idx);
+                struct printk_log *msg = log_from_idx(idx);
                l += msg_print_text(msg, prev, syslog, buf + l, size - l);
                idx = log_next(idx);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index bb456f44b7b1..9565645e3202 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -851,7 +851,7 @@ void task_numa_fault(int node, int pages, bool migrated)
 {
        struct task_struct *p = current;
-        if (!sched_feat_numa(NUMA))
+        if (!numabalancing_enabled)
                return;
        /* FIXME: Allocate task-specific structure for placement policy here */
@@ -5786,7 +5786,7 @@ static void task_tick_fair(struct rq *rq, struct task_struct *curr, int queued)
                entity_tick(cfs_rq, se, queued);
        }
-        if (sched_feat_numa(NUMA))
+        if (numabalancing_enabled)
                task_tick_numa(rq, curr);
        update_rq_runnable_avg(rq, 1);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index ac09d98490aa..07f6fc468e17 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2346,7 +2346,11 @@ static int do_proc_dointvec_ms_jiffies_conv(bool *negp, unsigned long *lvalp,
                                            int write, void *data)
 {
        if (write) {
-                *valp = msecs_to_jiffies(*negp ? -*lvalp : *lvalp);
+                unsigned long jif = msecs_to_jiffies(*negp ? -*lvalp : *lvalp);
+                if (jif > INT_MAX)
+                        return 1;
+                *valp = (int)jif;
        } else {
                int val = *valp;
                unsigned long lval;
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index e80183f4a6c4..e77edc97e036 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -827,13 +827,10 @@ void tick_nohz_irq_exit(void)
 {
        struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
-        if (ts->inidle) {
+        if (ts->inidle)
-                /* Cancel the timer because CPU already waken up from the C-states*/
-                menu_hrtimer_cancel();
                __tick_nohz_idle_enter(ts);
-        } else {
+        else
                tick_nohz_full_stop_tick(ts);
-        }
 }
 /**
@@ -931,8 +928,6 @@ void tick_nohz_idle_exit(void)
        ts->inidle = 0;
-        /* Cancel the timer because CPU already waken up from the C-states*/
-        menu_hrtimer_cancel();
        if (ts->idle_active || ts->tick_stopped)
                now = ktime_get();
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 243e710c6039..a92012a71702 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1620,7 +1620,9 @@ static void __split_huge_page_refcount(struct page *page,
                                     ((1L << PG_referenced) |
                                      (1L << PG_swapbacked) |
                                      (1L << PG_mlocked) |
-                                      (1L << PG_uptodate)));
+                                      (1L << PG_uptodate) |
+                                      (1L << PG_active) |
+                                      (1L << PG_unevictable)));
                page_tail->flags |= (1L << PG_dirty);
                /* clear PageTail before overwriting first_page */
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 00a7a664b9c1..c290a1cf3862 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -6335,6 +6335,7 @@ static void mem_cgroup_css_offline(struct cgroup *cont)
        mem_cgroup_invalidate_reclaim_iterators(memcg);
        mem_cgroup_reparent_charges(memcg);
        mem_cgroup_destroy_all_caches(memcg);
+        vmpressure_cleanup(&memcg->vmpressure);
 }
 static void mem_cgroup_css_free(struct cgroup *cont)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 74310017296e..4baf12e534d1 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -732,7 +732,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
                if (prev) {
                        vma = prev;
                        next = vma->vm_next;
-                        continue;
+                        if (mpol_equal(vma_policy(vma), new_pol))
+                                continue;
+                        /* vma_merge() joined vma && vma->next, case 8 */
+                        goto replace;
                }
                if (vma->vm_start != vmstart) {
                        err = split_vma(vma->vm_mm, vma, vmstart, 1);
@@ -744,6 +747,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
                        if (err)
                                goto out;
                }
+ replace:
                err = vma_replace_policy(vma, new_pol);
                if (err)
                        goto out;
diff --git a/mm/mmap.c b/mm/mmap.c
index fbad7b091090..1edbaa3136c3 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -865,7 +865,7 @@ again:			remove_next = 1 + (end > next->vm_end);
                if (next->anon_vma)
                        anon_vma_merge(vma, next);
                mm->map_count--;
-                vma_set_policy(vma, vma_policy(next));
+                mpol_put(vma_policy(next));
                kmem_cache_free(vm_area_cachep, next);
                /*
                 * In mprotect's case 6 (see comments on vma_merge),
diff --git a/mm/swap.c b/mm/swap.c
index 4a1d0d2c52fa..62b78a6e224f 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -512,12 +512,7 @@ EXPORT_SYMBOL(__lru_cache_add);
 */
 void lru_cache_add(struct page *page)
 {
-        if (PageActive(page)) {
+        VM_BUG_ON(PageActive(page) && PageUnevictable(page));
-                VM_BUG_ON(PageUnevictable(page));
-        } else if (PageUnevictable(page)) {
-                VM_BUG_ON(PageActive(page));
-        }
        VM_BUG_ON(PageLRU(page));
        __lru_cache_add(page);
 }
@@ -539,6 +534,7 @@ void add_page_to_unevictable_list(struct page *page)
        spin_lock_irq(&zone->lru_lock);
        lruvec = mem_cgroup_page_lruvec(page, zone);
+        ClearPageActive(page);
        SetPageUnevictable(page);
        SetPageLRU(page);
        add_page_to_lru_list(page, lruvec, LRU_UNEVICTABLE);
@@ -774,8 +770,6 @@ EXPORT_SYMBOL(__pagevec_release);
 void lru_add_page_tail(struct page *page, struct page *page_tail,
                       struct lruvec *lruvec, struct list_head *list)
 {
-        int uninitialized_var(active);
-        enum lru_list lru;
        const int file = 0;
        VM_BUG_ON(!PageHead(page));
@@ -787,20 +781,6 @@ void lru_add_page_tail(struct page *page, struct page *page_tail,
        if (!list)
                SetPageLRU(page_tail);
-        if (page_evictable(page_tail)) {
-                if (PageActive(page)) {
-                        SetPageActive(page_tail);
-                        active = 1;
-                        lru = LRU_ACTIVE_ANON;
-                } else {
-                        active = 0;
-                        lru = LRU_INACTIVE_ANON;
-                }
-        } else {
-                SetPageUnevictable(page_tail);
-                lru = LRU_UNEVICTABLE;
-        }
        if (likely(PageLRU(page)))
                list_add_tail(&page_tail->lru, &page->lru);
        else if (list) {
@@ -816,13 +796,13 @@ void lru_add_page_tail(struct page *page, struct page *page_tail,
                 * Use the standard add function to put page_tail on the list,
                 * but then correct its position so they all end up in order.
                 */
-                add_page_to_lru_list(page_tail, lruvec, lru);
+                add_page_to_lru_list(page_tail, lruvec, page_lru(page_tail));
                list_head = page_tail->lru.prev;
                list_move_tail(&page_tail->lru, list_head);
        }
        if (!PageUnevictable(page))
-                update_page_reclaim_stat(lruvec, file, active);
+                update_page_reclaim_stat(lruvec, file, PageActive(page_tail));
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
@@ -833,7 +813,6 @@ static void __pagevec_lru_add_fn(struct page *page, struct lruvec *lruvec,
        int active = PageActive(page);
        enum lru_list lru = page_lru(page);
-        VM_BUG_ON(PageUnevictable(page));
        VM_BUG_ON(PageLRU(page));
        SetPageLRU(page);
diff --git a/mm/vmpressure.c b/mm/vmpressure.c
index 736a6011c2c8..0c1e37d829fa 100644
--- a/mm/vmpressure.c
+++ b/mm/vmpressure.c
@@ -180,12 +180,12 @@ static void vmpressure_work_fn(struct work_struct *work)
        if (!vmpr->scanned)
                return;
-        mutex_lock(&vmpr->sr_lock);
+        spin_lock(&vmpr->sr_lock);
        scanned = vmpr->scanned;
        reclaimed = vmpr->reclaimed;
        vmpr->scanned = 0;
        vmpr->reclaimed = 0;
-        mutex_unlock(&vmpr->sr_lock);
+        spin_unlock(&vmpr->sr_lock);
        do {
                if (vmpressure_event(vmpr, scanned, reclaimed))
@@ -240,13 +240,13 @@ void vmpressure(gfp_t gfp, struct mem_cgroup *memcg,
        if (!scanned)
                return;
-        mutex_lock(&vmpr->sr_lock);
+        spin_lock(&vmpr->sr_lock);
        vmpr->scanned += scanned;
        vmpr->reclaimed += reclaimed;
        scanned = vmpr->scanned;
-        mutex_unlock(&vmpr->sr_lock);
+        spin_unlock(&vmpr->sr_lock);
-        if (scanned < vmpressure_win || work_pending(&vmpr->work))
+        if (scanned < vmpressure_win)
                return;
        schedule_work(&vmpr->work);
 }
@@ -367,8 +367,24 @@ void vmpressure_unregister_event(struct cgroup *cg, struct cftype *cft,
 */
 void vmpressure_init(struct vmpressure *vmpr)
 {
-        mutex_init(&vmpr->sr_lock);
+        spin_lock_init(&vmpr->sr_lock);
        mutex_init(&vmpr->events_lock);
        INIT_LIST_HEAD(&vmpr->events);
        INIT_WORK(&vmpr->work, vmpressure_work_fn);
 }
+/**
+ * vmpressure_cleanup() - shuts down vmpressure control structure
+ * @vmpr:       Structure to be cleaned up
+ *
+ * This function should be called before the structure in which it is
+ * embedded is cleaned up.
+ */
+void vmpressure_cleanup(struct vmpressure *vmpr)
+{
+        /*
+         * Make sure there is no pending work before eventfd infrastructure
+         * goes away.
+         */
+        flush_work(&vmpr->work);
+}
diff --git a/mm/zbud.c b/mm/zbud.c
index 9bb4710e3589..ad1e781284fd 100644
--- a/mm/zbud.c
+++ b/mm/zbud.c
@@ -257,7 +257,7 @@ int zbud_alloc(struct zbud_pool *pool, int size, gfp_t gfp,
        if (size <= 0 || gfp & __GFP_HIGHMEM)
                return -EINVAL;
-        if (size > PAGE_SIZE - ZHDR_SIZE_ALIGNED)
+        if (size > PAGE_SIZE - ZHDR_SIZE_ALIGNED - CHUNK_SIZE)
                return -ENOSPC;
        chunks = size_to_chunks(size);
        spin_lock(&pool->lock);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 69af490cce44..4b99c9a27044 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -619,6 +619,9 @@ rehash:
        mp->br = br;
        mp->addr = *group;
+        setup_timer(&mp->timer, br_multicast_group_expired,
+                    (unsigned long)mp);
        hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
        mdb->size++;
@@ -1126,7 +1129,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
        if (!mp)
                goto out;
-        setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
        mod_timer(&mp->timer, now + br->multicast_membership_interval);
        mp->timer_armed = true;
@@ -1204,7 +1206,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
        if (!mp)
                goto out;
-        setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
        mod_timer(&mp->timer, now + br->multicast_membership_interval);
        mp->timer_armed = true;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index b7de821f98df..9232c68941ab 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2767,6 +2767,7 @@ EXPORT_SYMBOL(neigh_app_ns);
 #ifdef CONFIG_SYSCTL
 static int zero;
+static int int_max = INT_MAX;
 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
 static int proc_unres_qlen(struct ctl_table *ctl, int write,
@@ -2819,19 +2820,25 @@ static struct neigh_sysctl_table {
                        .procname       = "mcast_solicit",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                [NEIGH_VAR_UCAST_PROBE] = {
                        .procname       = "ucast_solicit",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                [NEIGH_VAR_APP_PROBE] = {
                        .procname       = "app_solicit",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                [NEIGH_VAR_RETRANS_TIME] = {
                        .procname       = "retrans_time",
@@ -2874,7 +2881,9 @@ static struct neigh_sysctl_table {
                        .procname       = "proxy_qlen",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                [NEIGH_VAR_ANYCAST_DELAY] = {
                        .procname       = "anycast_delay",
@@ -2916,19 +2925,25 @@ static struct neigh_sysctl_table {
                        .procname       = "gc_thresh1",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                [NEIGH_VAR_GC_THRESH2] = {
                        .procname       = "gc_thresh2",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                [NEIGH_VAR_GC_THRESH3] = {
                        .procname       = "gc_thresh3",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                {},
        },
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 20e02d2605ec..3df4d4ccf440 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -309,7 +309,8 @@ EXPORT_SYMBOL(__alloc_skb);
 * @frag_size: size of fragment, or 0 if head was kmalloced
 *
 * Allocate a new &sk_buff. Caller provides space holding head and
- * skb_shared_info. @data must have been allocated by kmalloc()
+ * skb_shared_info. @data must have been allocated by kmalloc() only if
+ * @frag_size is 0, otherwise data should come from the page allocator.
 * The return is the new skb buffer.
 * On a failure the return is %NULL, and @data is not freed.
 * Notes :
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 49616fed9340..108a1e9c9eac 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2133,7 +2133,7 @@ static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat)
                max--;
        pointers = 0;
-        for (i = 1; i <= max; i++)
+        for (i = 1; i < max; i++)
                if (stat->nodesizes[i] != 0) {
                        seq_printf(seq, "  %u: %u",  i, stat->nodesizes[i]);
                        pointers += (1<<i) * stat->nodesizes[i];
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index b2c123c44d69..610e324348d1 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -36,6 +36,8 @@ static int tcp_adv_win_scale_min = -31;
 static int tcp_adv_win_scale_max = 31;
 static int ip_ttl_min = 1;
 static int ip_ttl_max = 255;
+static int tcp_syn_retries_min = 1;
+static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
 static int ip_ping_group_range_min[] = { 0, 0 };
 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
@@ -332,7 +334,9 @@ static struct ctl_table ipv4_table[] = {
                .data           = &sysctl_tcp_syn_retries,
                .maxlen         = sizeof(int),
                .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &tcp_syn_retries_min,
+                .extra2         = &tcp_syn_retries_max
        },
        {
                .procname       = "tcp_synack_retries",
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 583e8d435f9a..03986d31fa41 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -259,10 +259,12 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
 {
        struct mr6_table *mrt, *next;
+        rtnl_lock();
        list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
                list_del(&mrt->list);
                ip6mr_free_table(mrt);
        }
+        rtnl_unlock();
        fib_rules_unregister(net->ipv6.mr6_rules_ops);
 }
 #else
@@ -289,7 +291,10 @@ static int __net_init ip6mr_rules_init(struct net *net)
 static void __net_exit ip6mr_rules_exit(struct net *net)
 {
+        rtnl_lock();
        ip6mr_free_table(net->ipv6.mrt6);
+        net->ipv6.mrt6 = NULL;
+        rtnl_unlock();
 }
 #endif
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9da862070dd8..ab8bd2cabfa0 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2081,6 +2081,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy *
                        pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
        }
        pol->sadb_x_policy_dir = dir+1;
+        pol->sadb_x_policy_reserved = 0;
        pol->sadb_x_policy_id = xp->index;
        pol->sadb_x_policy_priority = xp->priority;
@@ -3137,7 +3138,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
        pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
        pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
        pol->sadb_x_policy_dir = XFRM_POLICY_OUT + 1;
+        pol->sadb_x_policy_reserved = 0;
        pol->sadb_x_policy_id = xp->index;
+        pol->sadb_x_policy_priority = xp->priority;
        /* Set sadb_comb's. */
        if (x->id.proto == IPPROTO_AH)
@@ -3525,6 +3528,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
        pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
        pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
        pol->sadb_x_policy_dir = dir + 1;
+        pol->sadb_x_policy_reserved = 0;
        pol->sadb_x_policy_id = 0;
        pol->sadb_x_policy_priority = 0;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 8184d121ff09..43dd7525bfcb 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -666,6 +666,8 @@ static void ieee80211_get_et_stats(struct wiphy *wiphy,
                        if (sta->sdata->dev != dev)
                                continue;
+                        sinfo.filled = 0;
+                        sta_set_sinfo(sta, &sinfo);
                        i = 0;
                        ADD_STA_STATS(sta);
                }
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index ac7ef5414bde..e6512e2ffd20 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
        struct minstrel_rate *msr, *mr;
        unsigned int ndx;
        bool mrr_capable;
-        bool prev_sample = mi->prev_sample;
+        bool prev_sample;
        int delta;
        int sampling_ratio;
@@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
                        (mi->sample_count + mi->sample_deferred / 2);
        /* delta < 0: no sampling required */
+        prev_sample = mi->prev_sample;
        mi->prev_sample = false;
        if (delta < 0 || (!mrr_capable && prev_sample))
                return;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 5b2d3012b983..f5aed963b22e 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -804,10 +804,18 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
        sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
        info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+        rate->count = 1;
+        if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
+                int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
+                rate->idx = mp->cck_rates[idx];
+                rate->flags = 0;
+                return;
+        }
        rate->idx = sample_idx % MCS_GROUP_RATES +
                    (sample_group->streams - 1) * MCS_GROUP_RATES;
        rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
-        rate->count = 1;
 }
 static void
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 23dbcfc69b3b..2c5a79bd3777 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -936,8 +936,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
-        /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
+        /*
-        if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
+         * Drop duplicate 802.11 retransmissions
+         * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
+         */
+        if (rx->skb->len >= 24 && rx->sta &&
+            !ieee80211_is_ctl(hdr->frame_control) &&
+            !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
+            !is_multicast_ether_addr(hdr->addr1)) {
                if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
                             rx->sta->last_seq_ctrl[rx->seqno_idx] ==
                             hdr->seq_ctrl)) {
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index c63b618cd619..4fd1ca94fd4a 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -293,6 +293,11 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
                       sizeof(exp->tuple.dst.u3) - len);
        exp->tuple.dst.u.all = *dst;
+#ifdef CONFIG_NF_NAT_NEEDED
+        memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
+        memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
+#endif
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_init);
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index f8b71911037a..20b15916f403 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -172,7 +172,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
                /* Ignore non-transparent sockets,
                   if XT_SOCKET_TRANSPARENT is used */
-                if (info && info->flags & XT_SOCKET_TRANSPARENT)
+                if (info->flags & XT_SOCKET_TRANSPARENT)
                        transparent = ((sk->sk_state != TCP_TIME_WAIT &&
                                        inet_sk(sk)->transparent) ||
                                       (sk->sk_state == TCP_TIME_WAIT &&
@@ -196,7 +196,11 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
 static bool
 socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par)
 {
-        return socket_match(skb, par, NULL);
+        static struct xt_socket_mtinfo1 xt_info_v0 = {
+                .flags = 0,
+        };
+        return socket_match(skb, par, &xt_info_v0);
 }
 static bool
@@ -314,7 +318,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
                /* Ignore non-transparent sockets,
                   if XT_SOCKET_TRANSPARENT is used */
-                if (info && info->flags & XT_SOCKET_TRANSPARENT)
+                if (info->flags & XT_SOCKET_TRANSPARENT)
                        transparent = ((sk->sk_state != TCP_TIME_WAIT &&
                                        inet_sk(sk)->transparent) ||
                                       (sk->sk_state == TCP_TIME_WAIT &&
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 2fd6dbea327a..512718adb0d5 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -571,7 +571,7 @@ static int genl_family_rcv_msg(struct genl_family *family,
            !capable(CAP_NET_ADMIN))
                return -EPERM;
-        if (nlh->nlmsg_flags & NLM_F_DUMP) {
+        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
                struct netlink_dump_control c = {
                        .dump = ops->dumpit,
                        .done = ops->done,
@@ -877,8 +877,10 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
 #ifdef CONFIG_MODULES
                if (res == NULL) {
                        genl_unlock();
+                        up_read(&cb_lock);
                        request_module("net-pf-%d-proto-%d-family-%s",
                                       PF_NETLINK, NETLINK_GENERIC, name);
+                        down_read(&cb_lock);
                        genl_lock();
                        res = genl_family_find_byname(name);
                }
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 71a568862557..7a42c81a19eb 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1465,6 +1465,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
        unsigned char *b = skb_tail_pointer(skb);
        struct tc_cbq_wrropt opt;
+        memset(&opt, 0, sizeof(opt));
        opt.flags = 0;
        opt.allot = cl->allot;
        opt.priority = cl->priority + 1;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 1cc47aca7f05..25d217d90807 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4770,9 +4770,9 @@ do {									    \
        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
                                  mask, NL80211_MESHCONF_FORWARDING,
                                  nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
                                  mask, NL80211_MESHCONF_RSSI_THRESHOLD,
-                                  nla_get_u32);
+                                  nla_get_s32);
        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
                                  mask, NL80211_MESHCONF_HT_OPMODE,
                                  nla_get_u16);
@@ -6613,12 +6613,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
 {
+        struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
        void *hdr = ((void **)skb->cb)[1];
        struct nlattr *data = ((void **)skb->cb)[2];
        nla_nest_end(skb, data);
        genlmsg_end(skb, hdr);
-        genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
+                                nl80211_testmode_mcgrp.id, gfp);
 }
 EXPORT_SYMBOL(cfg80211_testmode_event);
 #endif
@@ -10064,7 +10066,8 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
        return;
 nla_put_failure:
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 5a24c986f34b..5a950f36bae4 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2279,7 +2279,9 @@ void wiphy_regulatory_deregister(struct wiphy *wiphy)
 static void reg_timeout_work(struct work_struct *work)
 {
        REG_DBG_PRINT("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
+        rtnl_lock();
        restore_regulatory_settings(true);
+        rtnl_unlock();
 }
 int __init regulatory_init(void)
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 1d3cfb1a3f28..81c8a10d743c 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -34,8 +34,10 @@ struct cfg80211_conn {
                CFG80211_CONN_SCAN_AGAIN,
                CFG80211_CONN_AUTHENTICATE_NEXT,
                CFG80211_CONN_AUTHENTICATING,
+                CFG80211_CONN_AUTH_FAILED,
                CFG80211_CONN_ASSOCIATE_NEXT,
                CFG80211_CONN_ASSOCIATING,
+                CFG80211_CONN_ASSOC_FAILED,
                CFG80211_CONN_DEAUTH,
                CFG80211_CONN_CONNECTED,
        } state;
@@ -164,6 +166,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                          NULL, 0,
                                          params->key, params->key_len,
                                          params->key_idx, NULL, 0);
+        case CFG80211_CONN_AUTH_FAILED:
+                return -ENOTCONN;
        case CFG80211_CONN_ASSOCIATE_NEXT:
                BUG_ON(!rdev->ops->assoc);
                wdev->conn->state = CFG80211_CONN_ASSOCIATING;
@@ -188,10 +192,17 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                             WLAN_REASON_DEAUTH_LEAVING,
                                             false);
                return err;
+        case CFG80211_CONN_ASSOC_FAILED:
+                cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+                                     NULL, 0,
+                                     WLAN_REASON_DEAUTH_LEAVING, false);
+                return -ENOTCONN;
        case CFG80211_CONN_DEAUTH:
                cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
                                     NULL, 0,
                                     WLAN_REASON_DEAUTH_LEAVING, false);
+                /* free directly, disconnected event already sent */
+                cfg80211_sme_free(wdev);
                return 0;
        default:
                return 0;
@@ -371,7 +382,7 @@ bool cfg80211_sme_rx_assoc_resp(struct wireless_dev *wdev, u16 status)
                return true;
        }
-        wdev->conn->state = CFG80211_CONN_DEAUTH;
+        wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
        schedule_work(&rdev->conn_work);
        return false;
 }
@@ -383,7 +394,13 @@ void cfg80211_sme_deauth(struct wireless_dev *wdev)
 void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
 {
-        cfg80211_sme_free(wdev);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        if (!wdev->conn)
+                return;
+        wdev->conn->state = CFG80211_CONN_AUTH_FAILED;
+        schedule_work(&rdev->conn_work);
 }
 void cfg80211_sme_disassoc(struct wireless_dev *wdev)
@@ -399,7 +416,13 @@ void cfg80211_sme_disassoc(struct wireless_dev *wdev)
 void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
 {
-        cfg80211_sme_disassoc(wdev);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        if (!wdev->conn)
+                return;
+        wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
+        schedule_work(&rdev->conn_work);
 }
 static int cfg80211_sme_connect(struct wireless_dev *wdev,