Merge 3.11-rc4 into usb-next

We want those fixes in here also.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

385 files changed, 3840 insertions, 2189 deletions

diff --git a/.gitignore b/.gitignore
index 3b8b9b33be38..7e9932e55475 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,6 +29,7 @@ modules.builtin
 *.bz2
 *.lzma
 *.xz
+*.lz4
 *.lzo
 *.patch
 *.gcno
diff --git a/Documentation/DocBook/device-drivers.tmpl b/Documentation/DocBook/device-drivers.tmpl
index cbfdf5486639..fe397f90a34f 100644
--- a/Documentation/DocBook/device-drivers.tmpl
+++ b/Documentation/DocBook/device-drivers.tmpl
@@ -84,7 +84,7 @@ X!Iinclude/linux/kobject.h
 
      <sect1><title>Kernel utility functions</title>
 !Iinclude/linux/kernel.h
-!Ekernel/printk.c
+!Ekernel/printk/printk.c
 !Ekernel/panic.c
 !Ekernel/sys.c
 !Ekernel/rcupdate.c
diff --git a/Documentation/sysctl/net.txt b/Documentation/sysctl/net.txt
index 1c15043aaee4..d569f2a424d5 100644
--- a/Documentation/sysctl/net.txt
+++ b/Documentation/sysctl/net.txt
@@ -52,7 +52,7 @@ Default: 64
 
 busy_read
 ----------------
-Low latency busy poll timeout for socket reads. (needs CONFIG_NET_LL_RX_POLL)
+Low latency busy poll timeout for socket reads. (needs CONFIG_NET_RX_BUSY_POLL)
 Approximate time in us to busy loop waiting for packets on the device queue.
 This sets the default value of the SO_BUSY_POLL socket option.
 Can be set or overridden per socket by setting socket option SO_BUSY_POLL,
@@ -63,7 +63,7 @@ Default: 0 (off)
 
 busy_poll
 ----------------
-Low latency busy poll timeout for poll and select. (needs CONFIG_NET_LL_RX_POLL)
+Low latency busy poll timeout for poll and select. (needs CONFIG_NET_RX_BUSY_POLL)
 Approximate time in us to busy loop waiting for events.
 Recommended value depends on the number of sockets you poll on.
 For several sockets 50, for several hundreds 100.
diff --git a/MAINTAINERS b/MAINTAINERS
index 23d3d4f90702..3153ccabc38f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1406,7 +1406,7 @@ ATHEROS ATH6KL WIRELESS DRIVER
 M:      Kalle Valo <kvalo@qca.qualcomm.com>
 L:      linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org/en/users/Drivers/ath6kl
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath6kl.git
+T:      git git://github.com/kvalo/ath.git
 S:      Supported
 F:      drivers/net/wireless/ath/ath6kl/
 
@@ -2871,7 +2871,7 @@ F:	drivers/media/usb/dvb-usb-v2/dvb_usb*
 F:      drivers/media/usb/dvb-usb-v2/usb_urb.c
 
 DYNAMIC DEBUG
-M:      Jason Baron <jbaron@redhat.com>
+M:      Jason Baron <jbaron@akamai.com>
 S:      Maintained
 F:      lib/dynamic_debug.c
 F:      include/linux/dynamic_debug.h
@@ -6726,6 +6726,14 @@ T:	git git://linuxtv.org/anttip/media_tree.git
 S:      Maintained
 F:      drivers/media/tuners/qt1010*
 
+QUALCOMM ATHEROS ATH10K WIRELESS DRIVER
+M:      Kalle Valo <kvalo@qca.qualcomm.com>
+L:      ath10k@lists.infradead.org
+W:      http://wireless.kernel.org/en/users/Drivers/ath10k
+T:      git git://github.com/kvalo/ath.git
+S:      Supported
+F:      drivers/net/wireless/ath/ath10k/
+
 QUALCOMM HEXAGON ARCHITECTURE
 M:      Richard Kuo <rkuo@codeaurora.org>
 L:      linux-hexagon@vger.kernel.org
@@ -8270,7 +8278,7 @@ S:	Maintained
 F:      sound/soc/codecs/twl4030*
 
 TI WILINK WIRELESS DRIVERS
-M:      Luciano Coelho <coelho@ti.com>
+M:      Luciano Coelho <luca@coelho.fi>
 L:      linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org/en/users/Drivers/wl12xx
 W:      http://wireless.kernel.org/en/users/Drivers/wl1251
diff --git a/Makefile b/Makefile
index 95a8e55feceb..f93d4f7a90c2 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 11
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Linux for Workgroups
 
 # *DOCUMENTATION*
diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h
index 8943c028d4bb..df57611652e5 100644
--- a/arch/arc/include/asm/entry.h
+++ b/arch/arc/include/asm/entry.h
@@ -38,6 +38,7 @@
 #include <asm/ptrace.h>
 #include <asm/processor.h>      /* For VMALLOC_START */
 #include <asm/thread_info.h>    /* For THREAD_SIZE */
+#include <asm/mmu.h>
 
 /* Note on the LD/ST addr modes with addr reg wback
  *
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 37c0f4e978d4..43594d5116ef 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -20,7 +20,6 @@ config ARM
         select GENERIC_STRNCPY_FROM_USER
         select GENERIC_STRNLEN_USER
         select HARDIRQS_SW_RESEND
-        select HAVE_AOUT
         select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL
         select HAVE_ARCH_KGDB
         select HAVE_ARCH_SECCOMP_FILTER
@@ -218,7 +217,8 @@ config VECTORS_BASE
         default DRAM_BASE if REMAP_VECTORS_TO_RAM
         default 0x00000000
         help
-          The base address of exception vectors.
+          The base address of exception vectors.  This must be two pages
+          in size.
 
 config ARM_PATCH_PHYS_VIRT
         bool "Patch physical to virtual translations at runtime" if EMBEDDED
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index e401a766c0bd..583f4a00ec32 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -804,9 +804,19 @@ config DEBUG_LL_INCLUDE
 
 config DEBUG_UNCOMPRESS
         bool
-        default y if ARCH_MULTIPLATFORM && DEBUG_LL && \
-                     !DEBUG_OMAP2PLUS_UART && \
+        depends on ARCH_MULTIPLATFORM
+        default y if DEBUG_LL && !DEBUG_OMAP2PLUS_UART && \
                      !DEBUG_TEGRA_UART
+        help
+          This option influences the normal decompressor output for
+          multiplatform kernels.  Normally, multiplatform kernels disable
+          decompressor output because it is not possible to know where to
+          send the decompressor output.
+
+          When this option is set, the selected DEBUG_LL output method
+          will be re-used for normal decompressor output on multiplatform
+          kernels.
+          
 
 config UNCOMPRESS_INCLUDE
         string
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index c0ac0f5e5e5c..6fd2ceae305a 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -153,6 +153,7 @@ machine-$(CONFIG_ARCH_DAVINCI)		+= davinci
 machine-$(CONFIG_ARCH_DOVE)             += dove
 machine-$(CONFIG_ARCH_EBSA110)          += ebsa110
 machine-$(CONFIG_ARCH_EP93XX)           += ep93xx
+machine-$(CONFIG_ARCH_EXYNOS)           += exynos
 machine-$(CONFIG_ARCH_GEMINI)           += gemini
 machine-$(CONFIG_ARCH_HIGHBANK)         += highbank
 machine-$(CONFIG_ARCH_INTEGRATOR)       += integrator
@@ -160,15 +161,16 @@ machine-$(CONFIG_ARCH_IOP13XX)		+= iop13xx
 machine-$(CONFIG_ARCH_IOP32X)           += iop32x
 machine-$(CONFIG_ARCH_IOP33X)           += iop33x
 machine-$(CONFIG_ARCH_IXP4XX)           += ixp4xx
+machine-$(CONFIG_ARCH_KEYSTONE)         += keystone
 machine-$(CONFIG_ARCH_KIRKWOOD)         += kirkwood
 machine-$(CONFIG_ARCH_KS8695)           += ks8695
 machine-$(CONFIG_ARCH_LPC32XX)          += lpc32xx
 machine-$(CONFIG_ARCH_MMP)              += mmp
 machine-$(CONFIG_ARCH_MSM)              += msm
 machine-$(CONFIG_ARCH_MV78XX0)          += mv78xx0
+machine-$(CONFIG_ARCH_MVEBU)            += mvebu
 machine-$(CONFIG_ARCH_MXC)              += imx
 machine-$(CONFIG_ARCH_MXS)              += mxs
-machine-$(CONFIG_ARCH_MVEBU)            += mvebu
 machine-$(CONFIG_ARCH_NETX)             += netx
 machine-$(CONFIG_ARCH_NOMADIK)          += nomadik
 machine-$(CONFIG_ARCH_NSPIRE)           += nspire
@@ -176,7 +178,6 @@ machine-$(CONFIG_ARCH_OMAP1)		+= omap1
 machine-$(CONFIG_ARCH_OMAP2PLUS)        += omap2
 machine-$(CONFIG_ARCH_ORION5X)          += orion5x
 machine-$(CONFIG_ARCH_PICOXCELL)        += picoxcell
-machine-$(CONFIG_ARCH_SIRF)             += prima2
 machine-$(CONFIG_ARCH_PXA)              += pxa
 machine-$(CONFIG_ARCH_REALVIEW)         += realview
 machine-$(CONFIG_ARCH_ROCKCHIP)         += rockchip
@@ -186,25 +187,24 @@ machine-$(CONFIG_ARCH_S3C64XX)		+= s3c64xx
 machine-$(CONFIG_ARCH_S5P64X0)          += s5p64x0
 machine-$(CONFIG_ARCH_S5PC100)          += s5pc100
 machine-$(CONFIG_ARCH_S5PV210)          += s5pv210
-machine-$(CONFIG_ARCH_EXYNOS)           += exynos
 machine-$(CONFIG_ARCH_SA1100)           += sa1100
 machine-$(CONFIG_ARCH_SHARK)            += shark
 machine-$(CONFIG_ARCH_SHMOBILE)         += shmobile
+machine-$(CONFIG_ARCH_SIRF)             += prima2
+machine-$(CONFIG_ARCH_SOCFPGA)          += socfpga
+machine-$(CONFIG_ARCH_STI)              += sti
+machine-$(CONFIG_ARCH_SUNXI)            += sunxi
 machine-$(CONFIG_ARCH_TEGRA)            += tegra
 machine-$(CONFIG_ARCH_U300)             += u300
 machine-$(CONFIG_ARCH_U8500)            += ux500
 machine-$(CONFIG_ARCH_VERSATILE)        += versatile
 machine-$(CONFIG_ARCH_VEXPRESS)         += vexpress
+machine-$(CONFIG_ARCH_VIRT)             += virt
 machine-$(CONFIG_ARCH_VT8500)           += vt8500
 machine-$(CONFIG_ARCH_W90X900)          += w90x900
+machine-$(CONFIG_ARCH_ZYNQ)             += zynq
 machine-$(CONFIG_FOOTBRIDGE)            += footbridge
-machine-$(CONFIG_ARCH_SOCFPGA)          += socfpga
 machine-$(CONFIG_PLAT_SPEAR)            += spear
-machine-$(CONFIG_ARCH_STI)              += sti
-machine-$(CONFIG_ARCH_VIRT)             += virt
-machine-$(CONFIG_ARCH_ZYNQ)             += zynq
-machine-$(CONFIG_ARCH_SUNXI)            += sunxi
-machine-$(CONFIG_ARCH_KEYSTONE)         += keystone
 
 # Platform directory name.  This list is sorted alphanumerically
 # by CONFIG_* macro name.
diff --git a/arch/arm/include/asm/a.out-core.h b/arch/arm/include/asm/a.out-core.h
deleted file mode 100644
index 92f10cb5c70c..000000000000
--- a/arch/arm/include/asm/a.out-core.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/* a.out coredump register dumper
- *
- * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public Licence
- * as published by the Free Software Foundation; either version
- * 2 of the Licence, or (at your option) any later version.
- */
-
-#ifndef _ASM_A_OUT_CORE_H
-#define _ASM_A_OUT_CORE_H
-
-#ifdef __KERNEL__
-
-#include <linux/user.h>
-#include <linux/elfcore.h>
-
-/*
- * fill in the user structure for an a.out core dump
- */
-static inline void aout_dump_thread(struct pt_regs *regs, struct user *dump)
-{
-        struct task_struct *tsk = current;
-
-        dump->magic = CMAGIC;
-        dump->start_code = tsk->mm->start_code;
-        dump->start_stack = regs->ARM_sp & ~(PAGE_SIZE - 1);
-
-        dump->u_tsize = (tsk->mm->end_code - tsk->mm->start_code) >> PAGE_SHIFT;
-        dump->u_dsize = (tsk->mm->brk - tsk->mm->start_data + PAGE_SIZE - 1) >> PAGE_SHIFT;
-        dump->u_ssize = 0;
-
-        memset(dump->u_debugreg, 0, sizeof(dump->u_debugreg));
-
-        if (dump->start_stack < 0x04000000)
-                dump->u_ssize = (0x04000000 - dump->start_stack) >> PAGE_SHIFT;
-
-        dump->regs = *regs;
-        dump->u_fpvalid = dump_fpu (regs, &dump->u_fp);
-}
-
-#endif /* __KERNEL__ */
-#endif /* _ASM_A_OUT_CORE_H */
diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
index 8c25dc4e9851..9672e978d50d 100644
--- a/arch/arm/include/asm/cputype.h
+++ b/arch/arm/include/asm/cputype.h
@@ -89,13 +89,18 @@ extern unsigned int processor_id;
                 __val;                                                  \
         })
 
+/*
+ * The memory clobber prevents gcc 4.5 from reordering the mrc before
+ * any is_smp() tests, which can cause undefined instruction aborts on
+ * ARM1136 r0 due to the missing extended CP15 registers.
+ */
 #define read_cpuid_ext(ext_reg)                                         \
         ({                                                              \
                 unsigned int __val;                                     \
                 asm("mrc        p15, 0, %0, c0, " ext_reg               \
                     : "=r" (__val)                                      \
                     :                                                   \
-                    : "cc");                                            \
+                    : "memory");                                        \
                 __val;                                                  \
         })
 
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
index 38050b1c4800..56211f2084ef 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -130,4 +130,10 @@ struct mm_struct;
 extern unsigned long arch_randomize_brk(struct mm_struct *mm);
 #define arch_randomize_brk arch_randomize_brk
 
+#ifdef CONFIG_MMU
+#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
+struct linux_binprm;
+int arch_setup_additional_pages(struct linux_binprm *, int);
+#endif
+
 #endif
diff --git a/arch/arm/include/asm/mmu.h b/arch/arm/include/asm/mmu.h
index e3d55547e755..6f18da09668b 100644
--- a/arch/arm/include/asm/mmu.h
+++ b/arch/arm/include/asm/mmu.h
@@ -6,8 +6,11 @@
 typedef struct {
 #ifdef CONFIG_CPU_HAS_ASID
         atomic64_t      id;
+#else
+        int             switch_pending;
 #endif
         unsigned int    vmalloc_seq;
+        unsigned long   sigpage;
 } mm_context_t;
 
 #ifdef CONFIG_CPU_HAS_ASID
diff --git a/arch/arm/include/asm/mmu_context.h b/arch/arm/include/asm/mmu_context.h
index b5792b7fd8d3..9b32f76bb0dd 100644
--- a/arch/arm/include/asm/mmu_context.h
+++ b/arch/arm/include/asm/mmu_context.h
@@ -56,7 +56,7 @@ static inline void check_and_switch_context(struct mm_struct *mm,
                  * on non-ASID CPUs, the old mm will remain valid until the
                  * finish_arch_post_lock_switch() call.
                  */
-                set_ti_thread_flag(task_thread_info(tsk), TIF_SWITCH_MM);
+                mm->context.switch_pending = 1;
         else
                 cpu_switch_mm(mm->pgd, mm);
 }
@@ -65,9 +65,21 @@ static inline void check_and_switch_context(struct mm_struct *mm,
         finish_arch_post_lock_switch
 static inline void finish_arch_post_lock_switch(void)
 {
-        if (test_and_clear_thread_flag(TIF_SWITCH_MM)) {
-                struct mm_struct *mm = current->mm;
-                cpu_switch_mm(mm->pgd, mm);
+        struct mm_struct *mm = current->mm;
+
+        if (mm && mm->context.switch_pending) {
+                /*
+                 * Preemption must be disabled during cpu_switch_mm() as we
+                 * have some stateful cache flush implementations. Check
+                 * switch_pending again in case we were preempted and the
+                 * switch to this mm was already done.
+                 */
+                preempt_disable();
+                if (mm->context.switch_pending) {
+                        mm->context.switch_pending = 0;
+                        cpu_switch_mm(mm->pgd, mm);
+                }
+                preempt_enable_no_resched();
         }
 }
 
diff --git a/arch/arm/include/asm/page.h b/arch/arm/include/asm/page.h
index 6363f3d1d505..4355f0ec44d6 100644
--- a/arch/arm/include/asm/page.h
+++ b/arch/arm/include/asm/page.h
@@ -142,7 +142,9 @@ extern void __cpu_copy_user_highpage(struct page *to, struct page *from,
 #define clear_page(page)        memset((void *)(page), 0, PAGE_SIZE)
 extern void copy_page(void *to, const void *from);
 
+#ifdef CONFIG_KUSER_HELPERS
 #define __HAVE_ARCH_GATE_AREA 1
+#endif
 
 #ifdef CONFIG_ARM_LPAE
 #include <asm/pgtable-3level-types.h>
diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
index 06e7d509eaac..413f3876341c 100644
--- a/arch/arm/include/asm/processor.h
+++ b/arch/arm/include/asm/processor.h
@@ -54,7 +54,6 @@ struct thread_struct {
 
 #define start_thread(regs,pc,sp)                                        \
 ({                                                                      \
-        unsigned long *stack = (unsigned long *)sp;                     \
         memset(regs->uregs, 0, sizeof(regs->uregs));                    \
         if (current->personality & ADDR_LIMIT_32BIT)                    \
                 regs->ARM_cpsr = USR_MODE;                              \
@@ -65,9 +64,6 @@ struct thread_struct {
         regs->ARM_cpsr |= PSR_ENDSTATE;                                 \
         regs->ARM_pc = pc & ~1;         /* pc */                        \
         regs->ARM_sp = sp;              /* sp */                        \
-        regs->ARM_r2 = stack[2];        /* r2 (envp) */                 \
-        regs->ARM_r1 = stack[1];        /* r1 (argv) */                 \
-        regs->ARM_r0 = stack[0];        /* r0 (argc) */                 \
         nommu_start_thread(regs);                                       \
 })
 
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index 214d4158089a..2b8114fcba09 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -156,7 +156,6 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
 #define TIF_USING_IWMMXT        17
 #define TIF_MEMDIE              18      /* is terminating due to OOM killer */
 #define TIF_RESTORE_SIGMASK     20
-#define TIF_SWITCH_MM           22      /* deferred switch_mm */
 
 #define _TIF_SIGPENDING         (1 << TIF_SIGPENDING)
 #define _TIF_NEED_RESCHED       (1 << TIF_NEED_RESCHED)
diff --git a/arch/arm/include/asm/tlbflush.h b/arch/arm/include/asm/tlbflush.h
index fdbb9e369745..f467e9b3f8d5 100644
--- a/arch/arm/include/asm/tlbflush.h
+++ b/arch/arm/include/asm/tlbflush.h
@@ -443,7 +443,18 @@ static inline void local_flush_bp_all(void)
                 isb();
 }
 
+#include <asm/cputype.h>
 #ifdef CONFIG_ARM_ERRATA_798181
+static inline int erratum_a15_798181(void)
+{
+        unsigned int midr = read_cpuid_id();
+
+        /* Cortex-A15 r0p0..r3p2 affected */
+        if ((midr & 0xff0ffff0) != 0x410fc0f0 || midr > 0x413fc0f2)
+                return 0;
+        return 1;
+}
+
 static inline void dummy_flush_tlb_a15_erratum(void)
 {
         /*
@@ -453,6 +464,11 @@ static inline void dummy_flush_tlb_a15_erratum(void)
         dsb();
 }
 #else
+static inline int erratum_a15_798181(void)
+{
+        return 0;
+}
+
 static inline void dummy_flush_tlb_a15_erratum(void)
 {
 }
diff --git a/arch/arm/include/asm/virt.h b/arch/arm/include/asm/virt.h
index 50af92bac737..4371f45c5784 100644
--- a/arch/arm/include/asm/virt.h
+++ b/arch/arm/include/asm/virt.h
@@ -29,6 +29,7 @@
 #define BOOT_CPU_MODE_MISMATCH  PSR_N_BIT
 
 #ifndef __ASSEMBLY__
+#include <asm/cacheflush.h>
 
 #ifdef CONFIG_ARM_VIRT_EXT
 /*
@@ -41,10 +42,21 @@
  */
 extern int __boot_cpu_mode;
 
+static inline void sync_boot_mode(void)
+{
+        /*
+         * As secondaries write to __boot_cpu_mode with caches disabled, we
+         * must flush the corresponding cache entries to ensure the visibility
+         * of their writes.
+         */
+        sync_cache_r(&__boot_cpu_mode);
+}
+
 void __hyp_set_vectors(unsigned long phys_vector_base);
 unsigned long __hyp_get_vectors(void);
 #else
 #define __boot_cpu_mode (SVC_MODE)
+#define sync_boot_mode()
 #endif
 
 #ifndef ZIMAGE
diff --git a/arch/arm/include/uapi/asm/Kbuild b/arch/arm/include/uapi/asm/Kbuild
index 47bcb2d254af..18d76fd5a2af 100644
--- a/arch/arm/include/uapi/asm/Kbuild
+++ b/arch/arm/include/uapi/asm/Kbuild
@@ -1,7 +1,6 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
-header-y += a.out.h
 header-y += byteorder.h
 header-y += fcntl.h
 header-y += hwcap.h
diff --git a/arch/arm/include/uapi/asm/a.out.h b/arch/arm/include/uapi/asm/a.out.h
deleted file mode 100644
index 083894b2e3bc..000000000000
--- a/arch/arm/include/uapi/asm/a.out.h
+++ /dev/null
@@ -1,34 +0,0 @@
-#ifndef __ARM_A_OUT_H__
-#define __ARM_A_OUT_H__
-
-#include <linux/personality.h>
-#include <linux/types.h>
-
-struct exec
-{
-  __u32 a_info;         /* Use macros N_MAGIC, etc for access */
-  __u32 a_text;         /* length of text, in bytes */
-  __u32 a_data;         /* length of data, in bytes */
-  __u32 a_bss;          /* length of uninitialized data area for file, in bytes */
-  __u32 a_syms;         /* length of symbol table data in file, in bytes */
-  __u32 a_entry;        /* start address */
-  __u32 a_trsize;       /* length of relocation info for text, in bytes */
-  __u32 a_drsize;       /* length of relocation info for data, in bytes */
-};
-
-/*
- * This is always the same
- */
-#define N_TXTADDR(a)    (0x00008000)
-
-#define N_TRSIZE(a)     ((a).a_trsize)
-#define N_DRSIZE(a)     ((a).a_drsize)
-#define N_SYMSIZE(a)    ((a).a_syms)
-
-#define M_ARM 103
-
-#ifndef LIBRARY_START_TEXT
-#define LIBRARY_START_TEXT      (0x00c00000)
-#endif
-
-#endif /* __A_OUT_GNU_H__ */
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index a39cfc2a1f90..d40d0ef389db 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -742,6 +742,18 @@ ENDPROC(__switch_to)
 #endif
         .endm
 
+        .macro  kuser_pad, sym, size
+        .if     (. - \sym) & 3
+        .rept   4 - (. - \sym) & 3
+        .byte   0
+        .endr
+        .endif
+        .rept   (\size - (. - \sym)) / 4
+        .word   0xe7fddef1
+        .endr
+        .endm
+
+#ifdef CONFIG_KUSER_HELPERS
         .align  5
         .globl  __kuser_helper_start
 __kuser_helper_start:
@@ -832,18 +844,13 @@ kuser_cmpxchg64_fixup:
 #error "incoherent kernel configuration"
 #endif
 
-        /* pad to next slot */
-        .rept   (16 - (. - __kuser_cmpxchg64)/4)
-        .word   0
-        .endr
-
-        .align  5
+        kuser_pad __kuser_cmpxchg64, 64
 
 __kuser_memory_barrier:                         @ 0xffff0fa0
         smp_dmb arm
         usr_ret lr
 
-        .align  5
+        kuser_pad __kuser_memory_barrier, 32
 
 __kuser_cmpxchg:                                @ 0xffff0fc0
 
@@ -916,13 +923,14 @@ kuser_cmpxchg32_fixup:
 
 #endif
 
-        .align  5
+        kuser_pad __kuser_cmpxchg, 32
 
 __kuser_get_tls:                                @ 0xffff0fe0
         ldr     r0, [pc, #(16 - 8)]     @ read TLS, set in kuser_get_tls_init
         usr_ret lr
         mrc     p15, 0, r0, c13, c0, 3  @ 0xffff0fe8 hardware TLS code
-        .rep    4
+        kuser_pad __kuser_get_tls, 16
+        .rep    3
         .word   0                       @ 0xffff0ff0 software TLS value, then
         .endr                           @ pad up to __kuser_helper_version
 
@@ -932,14 +940,16 @@ __kuser_helper_version:				@ 0xffff0ffc
         .globl  __kuser_helper_end
 __kuser_helper_end:
 
+#endif
+
  THUMB( .thumb  )
 
 /*
  * Vector stubs.
  *
- * This code is copied to 0xffff0200 so we can use branches in the
- * vectors, rather than ldr's.  Note that this code must not
- * exceed 0x300 bytes.
+ * This code is copied to 0xffff1000 so we can use branches in the
+ * vectors, rather than ldr's.  Note that this code must not exceed
+ * a page size.
  *
  * Common stub entry macro:
  *   Enter in IRQ mode, spsr = SVC/USR CPSR, lr = SVC/USR PC
@@ -986,8 +996,17 @@ ENDPROC(vector_\name)
 1:
         .endm
 
-        .globl  __stubs_start
+        .section .stubs, "ax", %progbits
 __stubs_start:
+        @ This must be the first word
+        .word   vector_swi
+
+vector_rst:
+ ARM(   swi     SYS_ERROR0      )
+ THUMB( svc     #0              )
+ THUMB( nop                     )
+        b       vector_und
+
 /*
  * Interrupt dispatcher
  */
@@ -1082,6 +1101,16 @@ __stubs_start:
         .align  5
 
 /*=============================================================================
+ * Address exception handler
+ *-----------------------------------------------------------------------------
+ * These aren't too critical.
+ * (they're not supposed to happen, and won't happen in 32-bit data mode).
+ */
+
+vector_addrexcptn:
+        b       vector_addrexcptn
+
+/*=============================================================================
  * Undefined FIQs
  *-----------------------------------------------------------------------------
  * Enter in FIQ mode, spsr = ANY CPSR, lr = ANY PC
@@ -1094,45 +1123,19 @@ __stubs_start:
 vector_fiq:
         subs    pc, lr, #4
 
-/*=============================================================================
- * Address exception handler
- *-----------------------------------------------------------------------------
- * These aren't too critical.
- * (they're not supposed to happen, and won't happen in 32-bit data mode).
- */
-
-vector_addrexcptn:
-        b       vector_addrexcptn
-
-/*
- * We group all the following data together to optimise
- * for CPUs with separate I & D caches.
- */
-        .align  5
-
-.LCvswi:
-        .word   vector_swi
-
-        .globl  __stubs_end
-__stubs_end:
-
-        .equ    stubs_offset, __vectors_start + 0x200 - __stubs_start
+        .globl  vector_fiq_offset
+        .equ    vector_fiq_offset, vector_fiq
 
-        .globl  __vectors_start
+        .section .vectors, "ax", %progbits
 __vectors_start:
- ARM(   swi     SYS_ERROR0      )
- THUMB( svc     #0              )
- THUMB( nop                     )
-        W(b)    vector_und + stubs_offset
-        W(ldr)  pc, .LCvswi + stubs_offset
-        W(b)    vector_pabt + stubs_offset
-        W(b)    vector_dabt + stubs_offset
-        W(b)    vector_addrexcptn + stubs_offset
-        W(b)    vector_irq + stubs_offset
-        W(b)    vector_fiq + stubs_offset
-
-        .globl  __vectors_end
-__vectors_end:
+        W(b)    vector_rst
+        W(b)    vector_und
+        W(ldr)  pc, __vectors_start + 0x1000
+        W(b)    vector_pabt
+        W(b)    vector_dabt
+        W(b)    vector_addrexcptn
+        W(b)    vector_irq
+        W(b)    vector_fiq
 
         .data
 
diff --git a/arch/arm/kernel/entry-v7m.S b/arch/arm/kernel/entry-v7m.S
index e00621f1403f..52b26432c9a9 100644
--- a/arch/arm/kernel/entry-v7m.S
+++ b/arch/arm/kernel/entry-v7m.S
@@ -49,7 +49,7 @@ __irq_entry:
         mov     r1, sp
         stmdb   sp!, {lr}
         @ routine called with r0 = irq number, r1 = struct pt_regs *
-        bl      nvic_do_IRQ
+        bl      nvic_handle_irq
 
         pop     {lr}
         @
diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
index 2adda11f712f..25442f451148 100644
--- a/arch/arm/kernel/fiq.c
+++ b/arch/arm/kernel/fiq.c
@@ -47,6 +47,11 @@
 #include <asm/irq.h>
 #include <asm/traps.h>
 
+#define FIQ_OFFSET ({                                   \
+                extern void *vector_fiq_offset;         \
+                (unsigned)&vector_fiq_offset;           \
+        })
+
 static unsigned long no_fiq_insn;
 
 /* Default reacquire function
@@ -80,13 +85,16 @@ int show_fiq_list(struct seq_file *p, int prec)
 void set_fiq_handler(void *start, unsigned int length)
 {
 #if defined(CONFIG_CPU_USE_DOMAINS)
-        memcpy((void *)0xffff001c, start, length);
+        void *base = (void *)0xffff0000;
 #else
-        memcpy(vectors_page + 0x1c, start, length);
+        void *base = vectors_page;
 #endif
-        flush_icache_range(0xffff001c, 0xffff001c + length);
+        unsigned offset = FIQ_OFFSET;
+
+        memcpy(base + offset, start, length);
+        flush_icache_range(0xffff0000 + offset, 0xffff0000 + offset + length);
         if (!vectors_high())
-                flush_icache_range(0x1c, 0x1c + length);
+                flush_icache_range(offset, offset + length);
 }
 
 int claim_fiq(struct fiq_handler *f)
@@ -144,6 +152,7 @@ EXPORT_SYMBOL(disable_fiq);
 
 void __init init_FIQ(int start)
 {
-        no_fiq_insn = *(unsigned long *)0xffff001c;
+        unsigned offset = FIQ_OFFSET;
+        no_fiq_insn = *(unsigned long *)(0xffff0000 + offset);
         fiq_start = start;
 }
diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
index b361de143756..14235ba64a90 100644
--- a/arch/arm/kernel/head-nommu.S
+++ b/arch/arm/kernel/head-nommu.S
@@ -87,6 +87,7 @@ ENTRY(stext)
 ENDPROC(stext)
 
 #ifdef CONFIG_SMP
+        .text
 ENTRY(secondary_startup)
         /*
          * Common entry point for secondary CPUs.
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 9cf6063020ae..2c7cc1e03473 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -343,6 +343,7 @@ __turn_mmu_on_loc:
         .long   __turn_mmu_on_end
 
 #if defined(CONFIG_SMP)
+        .text
 ENTRY(secondary_startup)
         /*
          * Common entry point for secondary CPUs.
diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
index 4910232c4833..797b1a6a4906 100644
--- a/arch/arm/kernel/hyp-stub.S
+++ b/arch/arm/kernel/hyp-stub.S
@@ -56,8 +56,8 @@ ENTRY(__boot_cpu_mode)
         ldr     \reg3, [\reg2]
         ldr     \reg1, [\reg2, \reg3]
         cmp     \mode, \reg1            @ matches primary CPU boot mode?
-        orrne   r7, r7, #BOOT_CPU_MODE_MISMATCH
-        strne   r7, [r5, r6]            @ record what happened and give up
+        orrne   \reg1, \reg1, #BOOT_CPU_MODE_MISMATCH
+        strne   \reg1, [\reg2, \reg3]   @ record what happened and give up
         .endm
 
 #else   /* ZIMAGE */
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index d3ca4f6915af..536c85fe72a8 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -197,6 +197,7 @@ void machine_shutdown(void)
  */
 void machine_halt(void)
 {
+        local_irq_disable();
         smp_send_stop();
 
         local_irq_disable();
@@ -211,6 +212,7 @@ void machine_halt(void)
  */
 void machine_power_off(void)
 {
+        local_irq_disable();
         smp_send_stop();
 
         if (pm_power_off)
@@ -230,6 +232,7 @@ void machine_power_off(void)
  */
 void machine_restart(char *cmd)
 {
+        local_irq_disable();
         smp_send_stop();
 
         arm_pm_restart(reboot_mode, cmd);
@@ -426,10 +429,11 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
 }
 
 #ifdef CONFIG_MMU
+#ifdef CONFIG_KUSER_HELPERS
 /*
  * The vectors page is always readable from user space for the
- * atomic helpers and the signal restart code. Insert it into the
- * gate_vma so that it is visible through ptrace and /proc/<pid>/mem.
+ * atomic helpers. Insert it into the gate_vma so that it is visible
+ * through ptrace and /proc/<pid>/mem.
  */
 static struct vm_area_struct gate_vma = {
         .vm_start       = 0xffff0000,
@@ -458,9 +462,48 @@ int in_gate_area_no_mm(unsigned long addr)
 {
         return in_gate_area(NULL, addr);
 }
+#define is_gate_vma(vma)        ((vma) = &gate_vma)
+#else
+#define is_gate_vma(vma)        0
+#endif
 
 const char *arch_vma_name(struct vm_area_struct *vma)
 {
-        return (vma == &gate_vma) ? "[vectors]" : NULL;
+        return is_gate_vma(vma) ? "[vectors]" :
+                (vma->vm_mm && vma->vm_start == vma->vm_mm->context.sigpage) ?
+                 "[sigpage]" : NULL;
+}
+
+static struct page *signal_page;
+extern struct page *get_signal_page(void);
+
+int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+{
+        struct mm_struct *mm = current->mm;
+        unsigned long addr;
+        int ret;
+
+        if (!signal_page)
+                signal_page = get_signal_page();
+        if (!signal_page)
+                return -ENOMEM;
+
+        down_write(&mm->mmap_sem);
+        addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
+        if (IS_ERR_VALUE(addr)) {
+                ret = addr;
+                goto up_fail;
+        }
+
+        ret = install_special_mapping(mm, addr, PAGE_SIZE,
+                VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC,
+                &signal_page);
+
+        if (ret == 0)
+                mm->context.sigpage = addr;
+
+ up_fail:
+        up_write(&mm->mmap_sem);
+        return ret;
 }
 #endif
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 63af9a7ae512..afc2489ee13b 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -836,6 +836,8 @@ static int __init meminfo_cmp(const void *_a, const void *_b)
 void __init hyp_mode_check(void)
 {
 #ifdef CONFIG_ARM_VIRT_EXT
+        sync_boot_mode();
+
         if (is_hyp_mode_available()) {
                 pr_info("CPU: All CPU(s) started in HYP mode.\n");
                 pr_info("CPU: Virtualization extensions available.\n");
@@ -971,6 +973,7 @@ static const char *hwcap_str[] = {
         "vfpv4",
         "idiva",
         "idivt",
+        "vfpd32",
         "lpae",
         NULL
 };
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index 1c16c35c271a..ab3304225272 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -8,6 +8,7 @@
  * published by the Free Software Foundation.
  */
 #include <linux/errno.h>
+#include <linux/random.h>
 #include <linux/signal.h>
 #include <linux/personality.h>
 #include <linux/uaccess.h>
@@ -15,12 +16,11 @@
 
 #include <asm/elf.h>
 #include <asm/cacheflush.h>
+#include <asm/traps.h>
 #include <asm/ucontext.h>
 #include <asm/unistd.h>
 #include <asm/vfp.h>
 
-#include "signal.h"
-
 /*
  * For ARM syscalls, we encode the syscall number into the instruction.
  */
@@ -40,11 +40,13 @@
 #define SWI_THUMB_SIGRETURN     (0xdf00 << 16 | 0x2700 | (__NR_sigreturn - __NR_SYSCALL_BASE))
 #define SWI_THUMB_RT_SIGRETURN  (0xdf00 << 16 | 0x2700 | (__NR_rt_sigreturn - __NR_SYSCALL_BASE))
 
-const unsigned long sigreturn_codes[7] = {
+static const unsigned long sigreturn_codes[7] = {
         MOV_R7_NR_SIGRETURN,    SWI_SYS_SIGRETURN,    SWI_THUMB_SIGRETURN,
         MOV_R7_NR_RT_SIGRETURN, SWI_SYS_RT_SIGRETURN, SWI_THUMB_RT_SIGRETURN,
 };
 
+static unsigned long signal_return_offset;
+
 #ifdef CONFIG_CRUNCH
 static int preserve_crunch_context(struct crunch_sigframe __user *frame)
 {
@@ -400,14 +402,20 @@ setup_return(struct pt_regs *regs, struct ksignal *ksig,
                     __put_user(sigreturn_codes[idx+1], rc+1))
                         return 1;
 
-                if ((cpsr & MODE32_BIT) && !IS_ENABLED(CONFIG_ARM_MPU)) {
+#ifdef CONFIG_MMU
+                if (cpsr & MODE32_BIT) {
+                        struct mm_struct *mm = current->mm;
+
                         /*
-                         * 32-bit code can use the new high-page
-                         * signal return code support except when the MPU has
-                         * protected the vectors page from PL0
+                         * 32-bit code can use the signal return page
+                         * except when the MPU has protected the vectors
+                         * page from PL0
                          */
-                        retcode = KERN_SIGRETURN_CODE + (idx << 2) + thumb;
-                } else {
+                        retcode = mm->context.sigpage + signal_return_offset +
+                                  (idx << 2) + thumb;
+                } else
+#endif
+                {
                         /*
                          * Ensure that the instruction cache sees
                          * the return code written onto the stack.
@@ -608,3 +616,33 @@ do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
         } while (thread_flags & _TIF_WORK_MASK);
         return 0;
 }
+
+struct page *get_signal_page(void)
+{
+        unsigned long ptr;
+        unsigned offset;
+        struct page *page;
+        void *addr;
+
+        page = alloc_pages(GFP_KERNEL, 0);
+
+        if (!page)
+                return NULL;
+
+        addr = page_address(page);
+
+        /* Give the signal return code some randomness */
+        offset = 0x200 + (get_random_int() & 0x7fc);
+        signal_return_offset = offset;
+
+        /*
+         * Copy signal return handlers into the vector page, and
+         * set sigreturn to be a pointer to these.
+         */
+        memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
+
+        ptr = (unsigned long)addr + offset;
+        flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
+
+        return page;
+}
diff --git a/arch/arm/kernel/signal.h b/arch/arm/kernel/signal.h
deleted file mode 100644
index 5ff067b7c752..000000000000
--- a/arch/arm/kernel/signal.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- *  linux/arch/arm/kernel/signal.h
- *
- *  Copyright (C) 2005-2009 Russell King.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#define KERN_SIGRETURN_CODE     (CONFIG_VECTORS_BASE + 0x00000500)
-
-extern const unsigned long sigreturn_codes[7];
diff --git a/arch/arm/kernel/smp_tlb.c b/arch/arm/kernel/smp_tlb.c
index a98b62dca2fa..c2edfff573c2 100644
--- a/arch/arm/kernel/smp_tlb.c
+++ b/arch/arm/kernel/smp_tlb.c
@@ -70,23 +70,6 @@ static inline void ipi_flush_bp_all(void *ignored)
         local_flush_bp_all();
 }
 
-#ifdef CONFIG_ARM_ERRATA_798181
-static int erratum_a15_798181(void)
-{
-        unsigned int midr = read_cpuid_id();
-
-        /* Cortex-A15 r0p0..r3p2 affected */
-        if ((midr & 0xff0ffff0) != 0x410fc0f0 || midr > 0x413fc0f2)
-                return 0;
-        return 1;
-}
-#else
-static int erratum_a15_798181(void)
-{
-        return 0;
-}
-#endif
-
 static void ipi_flush_tlb_a15_erratum(void *arg)
 {
         dmb();
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index cab094c234ee..ab517fcce21b 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -35,8 +35,6 @@
 #include <asm/tls.h>
 #include <asm/system_misc.h>
 
-#include "signal.h"
-
 static const char *handler[]= { "prefetch abort", "data abort", "address exception", "interrupt" };
 
 void *vectors_page;
@@ -800,15 +798,26 @@ void __init trap_init(void)
         return;
 }
 
-static void __init kuser_get_tls_init(unsigned long vectors)
+#ifdef CONFIG_KUSER_HELPERS
+static void __init kuser_init(void *vectors)
 {
+        extern char __kuser_helper_start[], __kuser_helper_end[];
+        int kuser_sz = __kuser_helper_end - __kuser_helper_start;
+
+        memcpy(vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz);
+
         /*
          * vectors + 0xfe0 = __kuser_get_tls
          * vectors + 0xfe8 = hardware TLS instruction at 0xffff0fe8
          */
         if (tls_emu || has_tls_reg)
-                memcpy((void *)vectors + 0xfe0, (void *)vectors + 0xfe8, 4);
+                memcpy(vectors + 0xfe0, vectors + 0xfe8, 4);
 }
+#else
+static void __init kuser_init(void *vectors)
+{
+}
+#endif
 
 void __init early_trap_init(void *vectors_base)
 {
@@ -816,33 +825,30 @@ void __init early_trap_init(void *vectors_base)
         unsigned long vectors = (unsigned long)vectors_base;
         extern char __stubs_start[], __stubs_end[];
         extern char __vectors_start[], __vectors_end[];
-        extern char __kuser_helper_start[], __kuser_helper_end[];
-        int kuser_sz = __kuser_helper_end - __kuser_helper_start;
+        unsigned i;
 
         vectors_page = vectors_base;
 
         /*
+         * Poison the vectors page with an undefined instruction.  This
+         * instruction is chosen to be undefined for both ARM and Thumb
+         * ISAs.  The Thumb version is an undefined instruction with a
+         * branch back to the undefined instruction.
+         */
+        for (i = 0; i < PAGE_SIZE / sizeof(u32); i++)
+                ((u32 *)vectors_base)[i] = 0xe7fddef1;
+
+        /*
          * Copy the vectors, stubs and kuser helpers (in entry-armv.S)
          * into the vector page, mapped at 0xffff0000, and ensure these
          * are visible to the instruction stream.
          */
         memcpy((void *)vectors, __vectors_start, __vectors_end - __vectors_start);
-        memcpy((void *)vectors + 0x200, __stubs_start, __stubs_end - __stubs_start);
-        memcpy((void *)vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz);
+        memcpy((void *)vectors + 0x1000, __stubs_start, __stubs_end - __stubs_start);
 
-        /*
-         * Do processor specific fixups for the kuser helpers
-         */
-        kuser_get_tls_init(vectors);
-
-        /*
-         * Copy signal return handlers into the vector page, and
-         * set sigreturn to be a pointer to these.
-         */
-        memcpy((void *)(vectors + KERN_SIGRETURN_CODE - CONFIG_VECTORS_BASE),
-               sigreturn_codes, sizeof(sigreturn_codes));
+        kuser_init(vectors_base);
 
-        flush_icache_range(vectors, vectors + PAGE_SIZE);
+        flush_icache_range(vectors, vectors + PAGE_SIZE * 2);
         modify_domain(DOMAIN_USER, DOMAIN_CLIENT);
 #else /* ifndef CONFIG_CPU_V7M */
         /*
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index fa25e4e425f6..7bcee5c9b604 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -148,6 +148,23 @@ SECTIONS
         . = ALIGN(PAGE_SIZE);
         __init_begin = .;
 #endif
+        /*
+         * The vectors and stubs are relocatable code, and the
+         * only thing that matters is their relative offsets
+         */
+        __vectors_start = .;
+        .vectors 0 : AT(__vectors_start) {
+                *(.vectors)
+        }
+        . = __vectors_start + SIZEOF(.vectors);
+        __vectors_end = .;
+
+        __stubs_start = .;
+        .stubs 0x1000 : AT(__stubs_start) {
+                *(.stubs)
+        }
+        . = __stubs_start + SIZEOF(.stubs);
+        __stubs_end = .;
 
         INIT_TEXT_SECTION(8)
         .exit.text : {
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 6cacdc8dd654..db5c2cab8fda 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -421,24 +421,28 @@ config CPU_32v3
         select CPU_USE_DOMAINS if MMU
         select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
         select TLS_REG_EMUL if SMP || !MMU
+        select NEED_KUSER_HELPERS
 
 config CPU_32v4
         bool
         select CPU_USE_DOMAINS if MMU
         select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
         select TLS_REG_EMUL if SMP || !MMU
+        select NEED_KUSER_HELPERS
 
 config CPU_32v4T
         bool
         select CPU_USE_DOMAINS if MMU
         select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
         select TLS_REG_EMUL if SMP || !MMU
+        select NEED_KUSER_HELPERS
 
 config CPU_32v5
         bool
         select CPU_USE_DOMAINS if MMU
         select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
         select TLS_REG_EMUL if SMP || !MMU
+        select NEED_KUSER_HELPERS
 
 config CPU_32v6
         bool
@@ -776,6 +780,7 @@ config CPU_BPREDICT_DISABLE
 
 config TLS_REG_EMUL
         bool
+        select NEED_KUSER_HELPERS
         help
           An SMP system using a pre-ARMv6 processor (there are apparently
           a few prototypes like that in existence) and therefore access to
@@ -783,11 +788,40 @@ config TLS_REG_EMUL
 
 config NEEDS_SYSCALL_FOR_CMPXCHG
         bool
+        select NEED_KUSER_HELPERS
         help
           SMP on a pre-ARMv6 processor?  Well OK then.
           Forget about fast user space cmpxchg support.
           It is just not possible.
 
+config NEED_KUSER_HELPERS
+        bool
+
+config KUSER_HELPERS
+        bool "Enable kuser helpers in vector page" if !NEED_KUSER_HELPERS
+        default y
+        help
+          Warning: disabling this option may break user programs.
+
+          Provide kuser helpers in the vector page.  The kernel provides
+          helper code to userspace in read only form at a fixed location
+          in the high vector page to allow userspace to be independent of
+          the CPU type fitted to the system.  This permits binaries to be
+          run on ARMv4 through to ARMv7 without modification.
+
+          However, the fixed address nature of these helpers can be used
+          by ROP (return orientated programming) authors when creating
+          exploits.
+
+          If all of the binaries and libraries which run on your platform
+          are built specifically for your platform, and make no use of
+          these helpers, then you can turn this option off.  However,
+          when such an binary or library is run, it will receive a SIGILL
+          signal, which will terminate the program.
+
+          Say N here only if you are absolutely certain that you do not
+          need these helpers; otherwise, the safe option is to say Y.
+
 config DMA_CACHE_RWFO
         bool "Enable read/write for ownership DMA cache maintenance"
         depends on CPU_V6K && SMP
diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
index b55b1015724b..4a0544492f10 100644
--- a/arch/arm/mm/context.c
+++ b/arch/arm/mm/context.c
@@ -245,7 +245,8 @@ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk)
         if (cpumask_test_and_clear_cpu(cpu, &tlb_flush_pending)) {
                 local_flush_bp_all();
                 local_flush_tlb_all();
-                dummy_flush_tlb_a15_erratum();
+                if (erratum_a15_798181())
+                        dummy_flush_tlb_a15_erratum();
         }
 
         atomic64_set(&per_cpu(active_asids, cpu), asid);
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 4f56617a2392..53cdbd39ec8e 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -989,6 +989,7 @@ phys_addr_t arm_lowmem_limit __initdata = 0;
 
 void __init sanity_check_meminfo(void)
 {
+        phys_addr_t memblock_limit = 0;
         int i, j, highmem = 0;
         phys_addr_t vmalloc_limit = __pa(vmalloc_min - 1) + 1;
 
@@ -1052,9 +1053,32 @@ void __init sanity_check_meminfo(void)
                         bank->size = size_limit;
                 }
 #endif
-                if (!bank->highmem && bank->start + bank->size > arm_lowmem_limit)
-                        arm_lowmem_limit = bank->start + bank->size;
+                if (!bank->highmem) {
+                        phys_addr_t bank_end = bank->start + bank->size;
 
+                        if (bank_end > arm_lowmem_limit)
+                                arm_lowmem_limit = bank_end;
+
+                        /*
+                         * Find the first non-section-aligned page, and point
+                         * memblock_limit at it. This relies on rounding the
+                         * limit down to be section-aligned, which happens at
+                         * the end of this function.
+                         *
+                         * With this algorithm, the start or end of almost any
+                         * bank can be non-section-aligned. The only exception
+                         * is that the start of the bank 0 must be section-
+                         * aligned, since otherwise memory would need to be
+                         * allocated when mapping the start of bank 0, which
+                         * occurs before any free memory is mapped.
+                         */
+                        if (!memblock_limit) {
+                                if (!IS_ALIGNED(bank->start, SECTION_SIZE))
+                                        memblock_limit = bank->start;
+                                else if (!IS_ALIGNED(bank_end, SECTION_SIZE))
+                                        memblock_limit = bank_end;
+                        }
+                }
                 j++;
         }
 #ifdef CONFIG_HIGHMEM
@@ -1079,7 +1103,18 @@ void __init sanity_check_meminfo(void)
 #endif
         meminfo.nr_banks = j;
         high_memory = __va(arm_lowmem_limit - 1) + 1;
-        memblock_set_current_limit(arm_lowmem_limit);
+
+        /*
+         * Round the memblock limit down to a section size.  This
+         * helps to ensure that we will allocate memory from the
+         * last full section, which should be mapped.
+         */
+        if (memblock_limit)
+                memblock_limit = round_down(memblock_limit, SECTION_SIZE);
+        if (!memblock_limit)
+                memblock_limit = arm_lowmem_limit;
+
+        memblock_set_current_limit(memblock_limit);
 }
 
 static inline void prepare_page_table(void)
@@ -1160,7 +1195,7 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
         /*
          * Allocate the vector page early.
          */
-        vectors = early_alloc(PAGE_SIZE);
+        vectors = early_alloc(PAGE_SIZE * 2);
 
         early_trap_init(vectors);
 
@@ -1205,15 +1240,27 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
         map.pfn = __phys_to_pfn(virt_to_phys(vectors));
         map.virtual = 0xffff0000;
         map.length = PAGE_SIZE;
+#ifdef CONFIG_KUSER_HELPERS
         map.type = MT_HIGH_VECTORS;
+#else
+        map.type = MT_LOW_VECTORS;
+#endif
         create_mapping(&map);
 
         if (!vectors_high()) {
                 map.virtual = 0;
+                map.length = PAGE_SIZE * 2;
                 map.type = MT_LOW_VECTORS;
                 create_mapping(&map);
         }
 
+        /* Now create a kernel read-only mapping */
+        map.pfn += 1;
+        map.virtual = 0xffff0000 + PAGE_SIZE;
+        map.length = PAGE_SIZE;
+        map.type = MT_LOW_VECTORS;
+        create_mapping(&map);
+
         /*
          * Ask the machine support to map in the statically mapped devices.
          */
@@ -1276,8 +1323,6 @@ void __init paging_init(struct machine_desc *mdesc)
 {
         void *zero_page;
 
-        memblock_set_current_limit(arm_lowmem_limit);
-
         build_mem_type_table();
         prepare_page_table();
         map_lowmem();
diff --git a/arch/arm/mm/proc-v7-2level.S b/arch/arm/mm/proc-v7-2level.S
index f64afb9f1bd5..bdd3be4be77a 100644
--- a/arch/arm/mm/proc-v7-2level.S
+++ b/arch/arm/mm/proc-v7-2level.S
@@ -110,7 +110,7 @@ ENTRY(cpu_v7_set_pte_ext)
  ARM(   str     r3, [r0, #2048]! )
  THUMB( add     r0, r0, #2048 )
  THUMB( str     r3, [r0] )
-        ALT_SMP(mov     pc,lr)
+        ALT_SMP(W(nop))
         ALT_UP (mcr     p15, 0, r0, c7, c10, 1)         @ flush_pte
 #endif
         mov     pc, lr
diff --git a/arch/arm/mm/proc-v7-3level.S b/arch/arm/mm/proc-v7-3level.S
index c36ac69488c8..01a719e18bb0 100644
--- a/arch/arm/mm/proc-v7-3level.S
+++ b/arch/arm/mm/proc-v7-3level.S
@@ -81,7 +81,7 @@ ENTRY(cpu_v7_set_pte_ext)
         tst     r3, #1 << (55 - 32)             @ L_PTE_DIRTY
         orreq   r2, #L_PTE_RDONLY
 1:      strd    r2, r3, [r0]
-        ALT_SMP(mov     pc, lr)
+        ALT_SMP(W(nop))
         ALT_UP (mcr     p15, 0, r0, c7, c10, 1)         @ flush_pte
 #endif
         mov     pc, lr
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 5c6d5a3050ea..73398bcf9bd8 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -75,13 +75,14 @@ ENTRY(cpu_v7_do_idle)
 ENDPROC(cpu_v7_do_idle)
 
 ENTRY(cpu_v7_dcache_clean_area)
-        ALT_SMP(mov     pc, lr)                 @ MP extensions imply L1 PTW
-        ALT_UP(W(nop))
-        dcache_line_size r2, r3
-1:      mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
+        ALT_SMP(W(nop))                 @ MP extensions imply L1 PTW
+        ALT_UP_B(1f)
+        mov     pc, lr
+1:      dcache_line_size r2, r3
+2:      mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
         add     r0, r0, r2
         subs    r1, r1, r2
-        bhi     1b
+        bhi     2b
         dsb
         mov     pc, lr
 ENDPROC(cpu_v7_dcache_clean_area)
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index f71c37edca26..c9770ba5c7df 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -172,7 +172,7 @@ static void __init xen_percpu_init(void *unused)
         enable_percpu_irq(xen_events_irq, 0);
 }
 
-static void xen_restart(char str, const char *cmd)
+static void xen_restart(enum reboot_mode reboot_mode, const char *cmd)
 {
         struct sched_shutdown r = { .reason = SHUTDOWN_reboot };
         int rc;
diff --git a/arch/ia64/configs/generic_defconfig b/arch/ia64/configs/generic_defconfig
index 7913695b2fcb..efbd2929aeb7 100644
--- a/arch/ia64/configs/generic_defconfig
+++ b/arch/ia64/configs/generic_defconfig
@@ -31,7 +31,7 @@ CONFIG_ACPI_FAN=m
 CONFIG_ACPI_DOCK=y
 CONFIG_ACPI_PROCESSOR=m
 CONFIG_ACPI_CONTAINER=m
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=m
 CONFIG_PACKET=y
 CONFIG_UNIX=y
diff --git a/arch/ia64/configs/gensparse_defconfig b/arch/ia64/configs/gensparse_defconfig
index f8e913365423..f64980dd20c3 100644
--- a/arch/ia64/configs/gensparse_defconfig
+++ b/arch/ia64/configs/gensparse_defconfig
@@ -25,7 +25,7 @@ CONFIG_ACPI_BUTTON=m
 CONFIG_ACPI_FAN=m
 CONFIG_ACPI_PROCESSOR=m
 CONFIG_ACPI_CONTAINER=m
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=m
 CONFIG_PACKET=y
 CONFIG_UNIX=y
diff --git a/arch/ia64/configs/tiger_defconfig b/arch/ia64/configs/tiger_defconfig
index a5a9e02e60a0..0f4e9e41f130 100644
--- a/arch/ia64/configs/tiger_defconfig
+++ b/arch/ia64/configs/tiger_defconfig
@@ -31,7 +31,7 @@ CONFIG_ACPI_BUTTON=m
 CONFIG_ACPI_FAN=m
 CONFIG_ACPI_PROCESSOR=m
 CONFIG_ACPI_CONTAINER=m
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=m
 CONFIG_PACKET=y
 CONFIG_UNIX=y
diff --git a/arch/ia64/configs/xen_domu_defconfig b/arch/ia64/configs/xen_domu_defconfig
index 37b9b422caad..b025acfde5c1 100644
--- a/arch/ia64/configs/xen_domu_defconfig
+++ b/arch/ia64/configs/xen_domu_defconfig
@@ -32,7 +32,7 @@ CONFIG_ACPI_BUTTON=m
 CONFIG_ACPI_FAN=m
 CONFIG_ACPI_PROCESSOR=m
 CONFIG_ACPI_CONTAINER=m
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=m
 CONFIG_PACKET=y
 CONFIG_UNIX=y
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index c3abed332301..e12764c2a9d0 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -114,6 +114,7 @@ config BCM47XX
         select FW_CFE
         select HW_HAS_PCI
         select IRQ_CPU
+        select SYS_HAS_CPU_MIPS32_R1
         select NO_EXCEPT_FILL
         select SYS_SUPPORTS_32BIT_KERNEL
         select SYS_SUPPORTS_LITTLE_ENDIAN
diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
index ba611927749b..2b8b118398c4 100644
--- a/arch/mips/bcm47xx/Kconfig
+++ b/arch/mips/bcm47xx/Kconfig
@@ -2,7 +2,6 @@ if BCM47XX
 
 config BCM47XX_SSB
         bool "SSB Support for Broadcom BCM47XX"
-        select SYS_HAS_CPU_MIPS32_R1
         select SSB
         select SSB_DRIVER_MIPS
         select SSB_DRIVER_EXTIF
diff --git a/arch/mips/include/asm/mach-generic/spaces.h b/arch/mips/include/asm/mach-generic/spaces.h
index 5b2f2e68e57f..9488fa5f8866 100644
--- a/arch/mips/include/asm/mach-generic/spaces.h
+++ b/arch/mips/include/asm/mach-generic/spaces.h
@@ -25,8 +25,12 @@
 #else
 #define CAC_BASE                _AC(0x80000000, UL)
 #endif
+#ifndef IO_BASE
 #define IO_BASE                 _AC(0xa0000000, UL)
+#endif
+#ifndef UNCAC_BASE
 #define UNCAC_BASE              _AC(0xa0000000, UL)
+#endif
 
 #ifndef MAP_BASE
 #ifdef CONFIG_KVM_GUEST
diff --git a/arch/mips/include/uapi/asm/siginfo.h b/arch/mips/include/uapi/asm/siginfo.h
index b7a23064841f..88e292b7719e 100644
--- a/arch/mips/include/uapi/asm/siginfo.h
+++ b/arch/mips/include/uapi/asm/siginfo.h
@@ -25,11 +25,12 @@ struct siginfo;
 /*
  * Careful to keep union _sifields from shifting ...
  */
-#if __SIZEOF_LONG__ == 4
+#if _MIPS_SZLONG == 32
 #define __ARCH_SI_PREAMBLE_SIZE (3 * sizeof(int))
-#endif
-#if __SIZEOF_LONG__ == 8
+#elif _MIPS_SZLONG == 64
 #define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int))
+#else
+#error _MIPS_SZLONG neither 32 nor 64
 #endif
 
 #include <asm-generic/siginfo.h>
diff --git a/arch/mips/kernel/bmips_vec.S b/arch/mips/kernel/bmips_vec.S
index f739aedcb509..bd79c4f9bff4 100644
--- a/arch/mips/kernel/bmips_vec.S
+++ b/arch/mips/kernel/bmips_vec.S
@@ -54,7 +54,11 @@ LEAF(bmips_smp_movevec)
         /* set up CPU1 CBR; move BASE to 0xa000_0000 */
         li      k0, 0xff400000
         mtc0    k0, $22, 6
-        li      k1, CKSEG1 | BMIPS_RELO_VECTOR_CONTROL_1
+        /* set up relocation vector address based on thread ID */
+        mfc0    k1, $22, 3
+        srl     k1, 16
+        andi    k1, 0x8000
+        or      k1, CKSEG1 | BMIPS_RELO_VECTOR_CONTROL_0
         or      k0, k1
         li      k1, 0xa0080000
         sw      k1, 0(k0)
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index c0bb4d59076a..159abc8842d2 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -79,15 +79,9 @@ static void __init bmips_smp_setup(void)
          * MIPS interrupts 0,1 (SW INT 0,1) cross over to the other thread
          * MIPS interrupt 2 (HW INT 0) is the CPU0 L1 controller output
          * MIPS interrupt 3 (HW INT 1) is the CPU1 L1 controller output
-         *
-         * If booting from TP1, leave the existing CMT interrupt routing
-         * such that TP0 responds to SW1 and TP1 responds to SW0.
          */
-        if (boot_cpu == 0)
-                change_c0_brcm_cmt_intr(0xf8018000,
+        change_c0_brcm_cmt_intr(0xf8018000,
                                         (0x02 << 27) | (0x03 << 15));
-        else
-                change_c0_brcm_cmt_intr(0xf8018000, (0x1d << 27));
 
         /* single core, 2 threads (2 pipelines) */
         max_cpus = 2;
@@ -202,9 +196,15 @@ static void bmips_init_secondary(void)
 #if defined(CONFIG_CPU_BMIPS4350) || defined(CONFIG_CPU_BMIPS4380)
         void __iomem *cbr = BMIPS_GET_CBR();
         unsigned long old_vec;
+        unsigned long relo_vector;
+        int boot_cpu;
+
+        boot_cpu = !!(read_c0_brcm_cmt_local() & (1 << 31));
+        relo_vector = boot_cpu ? BMIPS_RELO_VECTOR_CONTROL_0 :
+                          BMIPS_RELO_VECTOR_CONTROL_1;
 
-        old_vec = __raw_readl(cbr + BMIPS_RELO_VECTOR_CONTROL_1);
-        __raw_writel(old_vec & ~0x20000000, cbr + BMIPS_RELO_VECTOR_CONTROL_1);
+        old_vec = __raw_readl(cbr + relo_vector);
+        __raw_writel(old_vec & ~0x20000000, cbr + relo_vector);
 
         clear_c0_cause(smp_processor_id() ? C_SW1 : C_SW0);
 #elif defined(CONFIG_CPU_BMIPS5000)
diff --git a/arch/mips/powertv/asic/asic_devices.c b/arch/mips/powertv/asic/asic_devices.c
index 9f64c2387808..0238af1ba503 100644
--- a/arch/mips/powertv/asic/asic_devices.c
+++ b/arch/mips/powertv/asic/asic_devices.c
@@ -529,8 +529,7 @@ EXPORT_SYMBOL(asic_resource_get);
  */
 void platform_release_memory(void *ptr, int size)
 {
-        free_reserved_area((unsigned long)ptr, (unsigned long)(ptr + size),
-                           -1, NULL);
+        free_reserved_area(ptr, ptr + size, -1, NULL);
 }
 EXPORT_SYMBOL(platform_release_memory);
 
diff --git a/arch/parisc/configs/c8000_defconfig b/arch/parisc/configs/c8000_defconfig
new file mode 100644
index 000000000000..f11006361297
--- /dev/null
+++ b/arch/parisc/configs/c8000_defconfig
@@ -0,0 +1,279 @@
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_FHANDLE=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_RELAY=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_RD_BZIP2=y
+CONFIG_RD_LZMA=y
+CONFIG_RD_LZO=y
+CONFIG_EXPERT=y
+CONFIG_SYSCTL_SYSCALL=y
+CONFIG_SLAB=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_BLK_DEV_INTEGRITY=y
+CONFIG_PA8X00=y
+CONFIG_MLONGCALLS=y
+CONFIG_64BIT=y
+CONFIG_SMP=y
+CONFIG_PREEMPT=y
+# CONFIG_CROSS_MEMORY_ATTACH is not set
+CONFIG_IOMMU_CCIO=y
+CONFIG_PCI=y
+CONFIG_PCI_LBA=y
+# CONFIG_SUPERIO is not set
+# CONFIG_CHASSIS_LCD_LED is not set
+# CONFIG_PDC_CHASSIS is not set
+# CONFIG_PDC_CHASSIS_WARN is not set
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_BINFMT_MISC=m
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=m
+CONFIG_XFRM_SUB_POLICY=y
+CONFIG_NET_KEY=m
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NET_IPIP=m
+CONFIG_IP_MROUTE=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_DIAG=m
+# CONFIG_IPV6 is not set
+CONFIG_IP_DCCP=m
+# CONFIG_IP_DCCP_CCID3 is not set
+CONFIG_TIPC=m
+CONFIG_LLC2=m
+CONFIG_DNS_RESOLVER=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+# CONFIG_STANDALONE is not set
+CONFIG_PARPORT=y
+CONFIG_PARPORT_PC=y
+CONFIG_PARPORT_PC_FIFO=y
+CONFIG_BLK_DEV_UMEM=m
+CONFIG_BLK_DEV_LOOP=m
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_SX8=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_SIZE=6144
+CONFIG_CDROM_PKTCDVD=m
+CONFIG_CDROM_PKTCDVD_WCACHE=y
+CONFIG_ATA_OVER_ETH=m
+CONFIG_IDE=y
+CONFIG_BLK_DEV_IDECD=y
+CONFIG_BLK_DEV_PLATFORM=y
+CONFIG_BLK_DEV_GENERIC=y
+CONFIG_BLK_DEV_SIIMAGE=y
+CONFIG_SCSI=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_BLK_DEV_SR=m
+CONFIG_CHR_DEV_SG=y
+CONFIG_CHR_DEV_SCH=m
+CONFIG_SCSI_CONSTANTS=y
+CONFIG_SCSI_LOGGING=y
+CONFIG_SCSI_FC_ATTRS=y
+CONFIG_SCSI_SAS_LIBSAS=m
+CONFIG_ISCSI_TCP=m
+CONFIG_ISCSI_BOOT_SYSFS=m
+CONFIG_FUSION=y
+CONFIG_FUSION_SPI=y
+CONFIG_FUSION_SAS=y
+CONFIG_NETDEVICES=y
+CONFIG_DUMMY=m
+CONFIG_NETCONSOLE=m
+CONFIG_TUN=y
+CONFIG_E1000=y
+CONFIG_PPP=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_MPPE=m
+CONFIG_PPPOE=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+# CONFIG_WLAN is not set
+CONFIG_INPUT_FF_MEMLESS=m
+# CONFIG_KEYBOARD_ATKBD is not set
+# CONFIG_KEYBOARD_HIL_OLD is not set
+# CONFIG_KEYBOARD_HIL is not set
+CONFIG_MOUSE_PS2=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_CM109=m
+CONFIG_SERIO_SERPORT=m
+CONFIG_SERIO_PARKBD=m
+CONFIG_SERIO_GSCPS2=m
+# CONFIG_HP_SDC is not set
+CONFIG_SERIO_PCIPS2=m
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SERIO_RAW=m
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_NR_UARTS=8
+CONFIG_SERIAL_8250_RUNTIME_UARTS=8
+CONFIG_SERIAL_8250_EXTENDED=y
+# CONFIG_SERIAL_MUX is not set
+CONFIG_SERIAL_JSM=m
+CONFIG_PRINTER=y
+CONFIG_HW_RANDOM=y
+CONFIG_RAW_DRIVER=m
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_SSB=m
+CONFIG_SSB_DRIVER_PCICORE=y
+CONFIG_AGP=y
+CONFIG_AGP_PARISC=y
+CONFIG_DRM=y
+CONFIG_DRM_RADEON=y
+CONFIG_FIRMWARE_EDID=y
+CONFIG_FB_FOREIGN_ENDIAN=y
+CONFIG_FB_MODE_HELPERS=y
+CONFIG_FB_TILEBLITTING=y
+# CONFIG_FB_STI is not set
+CONFIG_BACKLIGHT_LCD_SUPPORT=y
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_GENERIC is not set
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_STI_CONSOLE is not set
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+# CONFIG_LOGO_LINUX_CLUT224 is not set
+CONFIG_SOUND=m
+CONFIG_SND=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_MIXER_OSS=m
+CONFIG_SND_PCM_OSS=m
+CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_VERBOSE_PRINTK=y
+CONFIG_SND_AD1889=m
+# CONFIG_SND_USB is not set
+# CONFIG_SND_GSC is not set
+CONFIG_HID_A4TECH=m
+CONFIG_HID_APPLE=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_CHERRY=m
+CONFIG_HID_CHICONY=m
+CONFIG_HID_CYPRESS=m
+CONFIG_HID_DRAGONRISE=m
+CONFIG_HID_EZKEY=m
+CONFIG_HID_KYE=m
+CONFIG_HID_GYRATION=m
+CONFIG_HID_TWINHAN=m
+CONFIG_HID_KENSINGTON=m
+CONFIG_HID_LOGITECH=m
+CONFIG_HID_LOGITECH_DJ=m
+CONFIG_HID_MICROSOFT=m
+CONFIG_HID_MONTEREY=m
+CONFIG_HID_NTRIG=m
+CONFIG_HID_ORTEK=m
+CONFIG_HID_PANTHERLORD=m
+CONFIG_HID_PETALYNX=m
+CONFIG_HID_SAMSUNG=m
+CONFIG_HID_SUNPLUS=m
+CONFIG_HID_GREENASIA=m
+CONFIG_HID_SMARTJOYPLUS=m
+CONFIG_HID_TOPSEED=m
+CONFIG_HID_THRUSTMASTER=m
+CONFIG_HID_ZEROPLUS=m
+CONFIG_USB_HID=m
+CONFIG_USB=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_STORAGE=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_XATTR=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT3_FS=y
+# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
+CONFIG_EXT4_FS=m
+CONFIG_REISERFS_FS=m
+CONFIG_REISERFS_PROC_INFO=y
+CONFIG_XFS_FS=m
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_QUOTA=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_AUTOFS4_FS=m
+CONFIG_FUSE_FS=m
+CONFIG_ISO9660_FS=y
+CONFIG_JOLIET=y
+CONFIG_MSDOS_FS=m
+CONFIG_VFAT_FS=m
+CONFIG_PROC_KCORE=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_XATTR=y
+CONFIG_NFS_FS=m
+CONFIG_NLS_CODEPAGE_437=m
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=m
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_NLS_UTF8=m
+CONFIG_UNUSED_SYMBOLS=y
+CONFIG_DEBUG_FS=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_SLAB=y
+CONFIG_DEBUG_SLAB_LEAK=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DEBUG_STACKOVERFLOW=y
+CONFIG_LOCKUP_DETECTOR=y
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_DEBUG_RT_MUTEXES=y
+CONFIG_RT_MUTEX_TESTER=y
+CONFIG_PROVE_RCU_DELAY=y
+CONFIG_DEBUG_BLOCK_EXT_DEVT=y
+CONFIG_LATENCYTOP=y
+CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
+CONFIG_KEYS=y
+# CONFIG_CRYPTO_HW is not set
+CONFIG_FONTS=y
diff --git a/arch/parisc/include/asm/parisc-device.h b/arch/parisc/include/asm/parisc-device.h
index 9afdad6c2ffb..eaf4dc1c7294 100644
--- a/arch/parisc/include/asm/parisc-device.h
+++ b/arch/parisc/include/asm/parisc-device.h
@@ -23,6 +23,7 @@ struct parisc_device {
         /* generic info returned from pdc_pat_cell_module() */
         unsigned long   mod_info;       /* PAT specific - Misc Module info */
         unsigned long   pmod_loc;       /* physical Module location */
+        unsigned long   mod0;
 #endif
         u64             dma_mask;       /* DMA mask for I/O */
         struct device   dev;
@@ -61,4 +62,6 @@ parisc_get_drvdata(struct parisc_device *d)
 
 extern struct bus_type parisc_bus_type;
 
+int iosapic_serial_irq(struct parisc_device *dev);
+
 #endif /*_ASM_PARISC_PARISC_DEVICE_H_*/
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index 2e65aa54bd10..c035673209f7 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -71,18 +71,27 @@ flush_cache_all_local(void)
 }
 EXPORT_SYMBOL(flush_cache_all_local);
 
+/* Virtual address of pfn.  */
+#define pfn_va(pfn)     __va(PFN_PHYS(pfn))
+
 void
 update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t *ptep)
 {
-        struct page *page = pte_page(*ptep);
+        unsigned long pfn = pte_pfn(*ptep);
+        struct page *page;
 
-        if (pfn_valid(page_to_pfn(page)) && page_mapping(page) &&
-            test_bit(PG_dcache_dirty, &page->flags)) {
+        /* We don't have pte special.  As a result, we can be called with
+           an invalid pfn and we don't need to flush the kernel dcache page.
+           This occurs with FireGL card in C8000.  */
+        if (!pfn_valid(pfn))
+                return;
 
-                flush_kernel_dcache_page(page);
+        page = pfn_to_page(pfn);
+        if (page_mapping(page) && test_bit(PG_dcache_dirty, &page->flags)) {
+                flush_kernel_dcache_page_addr(pfn_va(pfn));
                 clear_bit(PG_dcache_dirty, &page->flags);
         } else if (parisc_requires_coherency())
-                flush_kernel_dcache_page(page);
+                flush_kernel_dcache_page_addr(pfn_va(pfn));
 }
 
 void
@@ -495,44 +504,42 @@ static inline pte_t *get_ptep(pgd_t *pgd, unsigned long addr)
 
 void flush_cache_mm(struct mm_struct *mm)
 {
+        struct vm_area_struct *vma;
+        pgd_t *pgd;
+
         /* Flushing the whole cache on each cpu takes forever on
            rp3440, etc.  So, avoid it if the mm isn't too big.  */
-        if (mm_total_size(mm) < parisc_cache_flush_threshold) {
-                struct vm_area_struct *vma;
-
-                if (mm->context == mfsp(3)) {
-                        for (vma = mm->mmap; vma; vma = vma->vm_next) {
-                                flush_user_dcache_range_asm(vma->vm_start,
-                                        vma->vm_end);
-                                if (vma->vm_flags & VM_EXEC)
-                                        flush_user_icache_range_asm(
-                                          vma->vm_start, vma->vm_end);
-                        }
-                } else {
-                        pgd_t *pgd = mm->pgd;
-
-                        for (vma = mm->mmap; vma; vma = vma->vm_next) {
-                                unsigned long addr;
-
-                                for (addr = vma->vm_start; addr < vma->vm_end;
-                                     addr += PAGE_SIZE) {
-                                        pte_t *ptep = get_ptep(pgd, addr);
-                                        if (ptep != NULL) {
-                                                pte_t pte = *ptep;
-                                                __flush_cache_page(vma, addr,
-                                                  page_to_phys(pte_page(pte)));
-                                        }
-                                }
-                        }
+        if (mm_total_size(mm) >= parisc_cache_flush_threshold) {
+                flush_cache_all();
+                return;
+        }
+
+        if (mm->context == mfsp(3)) {
+                for (vma = mm->mmap; vma; vma = vma->vm_next) {
+                        flush_user_dcache_range_asm(vma->vm_start, vma->vm_end);
+                        if ((vma->vm_flags & VM_EXEC) == 0)
+                                continue;
+                        flush_user_icache_range_asm(vma->vm_start, vma->vm_end);
                 }
                 return;
         }
 
-#ifdef CONFIG_SMP
-        flush_cache_all();
-#else
-        flush_cache_all_local();
-#endif
+        pgd = mm->pgd;
+        for (vma = mm->mmap; vma; vma = vma->vm_next) {
+                unsigned long addr;
+
+                for (addr = vma->vm_start; addr < vma->vm_end;
+                     addr += PAGE_SIZE) {
+                        unsigned long pfn;
+                        pte_t *ptep = get_ptep(pgd, addr);
+                        if (!ptep)
+                                continue;
+                        pfn = pte_pfn(*ptep);
+                        if (!pfn_valid(pfn))
+                                continue;
+                        __flush_cache_page(vma, addr, PFN_PHYS(pfn));
+                }
+        }
 }
 
 void
@@ -556,33 +563,32 @@ flush_user_icache_range(unsigned long start, unsigned long end)
 void flush_cache_range(struct vm_area_struct *vma,
                 unsigned long start, unsigned long end)
 {
+        unsigned long addr;
+        pgd_t *pgd;
+
         BUG_ON(!vma->vm_mm->context);
 
-        if ((end - start) < parisc_cache_flush_threshold) {
-                if (vma->vm_mm->context == mfsp(3)) {
-                        flush_user_dcache_range_asm(start, end);
-                        if (vma->vm_flags & VM_EXEC)
-                                flush_user_icache_range_asm(start, end);
-                } else {
-                        unsigned long addr;
-                        pgd_t *pgd = vma->vm_mm->pgd;
-
-                        for (addr = start & PAGE_MASK; addr < end;
-                             addr += PAGE_SIZE) {
-                                pte_t *ptep = get_ptep(pgd, addr);
-                                if (ptep != NULL) {
-                                        pte_t pte = *ptep;
-                                        flush_cache_page(vma,
-                                           addr, pte_pfn(pte));
-                                }
-                        }
-                }
-        } else {
-#ifdef CONFIG_SMP
+        if ((end - start) >= parisc_cache_flush_threshold) {
                 flush_cache_all();
-#else
-                flush_cache_all_local();
-#endif
+                return;
+        }
+
+        if (vma->vm_mm->context == mfsp(3)) {
+                flush_user_dcache_range_asm(start, end);
+                if (vma->vm_flags & VM_EXEC)
+                        flush_user_icache_range_asm(start, end);
+                return;
+        }
+
+        pgd = vma->vm_mm->pgd;
+        for (addr = start & PAGE_MASK; addr < end; addr += PAGE_SIZE) {
+                unsigned long pfn;
+                pte_t *ptep = get_ptep(pgd, addr);
+                if (!ptep)
+                        continue;
+                pfn = pte_pfn(*ptep);
+                if (pfn_valid(pfn))
+                        __flush_cache_page(vma, addr, PFN_PHYS(pfn));
         }
 }
 
@@ -591,9 +597,10 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
 {
         BUG_ON(!vma->vm_mm->context);
 
-        flush_tlb_page(vma, vmaddr);
-        __flush_cache_page(vma, vmaddr, page_to_phys(pfn_to_page(pfn)));
-
+        if (pfn_valid(pfn)) {
+                flush_tlb_page(vma, vmaddr);
+                __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
+        }
 }
 
 #ifdef CONFIG_PARISC_TMPALIAS
diff --git a/arch/parisc/kernel/inventory.c b/arch/parisc/kernel/inventory.c
index 3295ef4a185d..f0b6722fc706 100644
--- a/arch/parisc/kernel/inventory.c
+++ b/arch/parisc/kernel/inventory.c
@@ -211,6 +211,7 @@ pat_query_module(ulong pcell_loc, ulong mod_index)
         /* REVISIT: who is the consumer of this? not sure yet... */
         dev->mod_info = pa_pdc_cell->mod_info;  /* pass to PAT_GET_ENTITY() */
         dev->pmod_loc = pa_pdc_cell->mod_location;
+        dev->mod0 = pa_pdc_cell->mod[0];
 
         register_parisc_device(dev);    /* advertise device */
 
diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
index 940188d1942c..07349b002687 100644
--- a/arch/parisc/kernel/signal.c
+++ b/arch/parisc/kernel/signal.c
@@ -56,13 +56,6 @@
 #define A(__x)  ((unsigned long)(__x))
 
 /*
- * Atomically swap in the new signal mask, and wait for a signal.
- */
-#ifdef CONFIG_64BIT
-#include "sys32.h"
-#endif
-
-/*
  * Do a signal return - restore sigcontext.
  */
 
diff --git a/arch/parisc/kernel/signal32.c b/arch/parisc/kernel/signal32.c
index 33eca1b04926..6c6a271a6140 100644
--- a/arch/parisc/kernel/signal32.c
+++ b/arch/parisc/kernel/signal32.c
@@ -34,7 +34,6 @@
 #include <asm/uaccess.h>
 
 #include "signal32.h"
-#include "sys32.h"
 
 #define DEBUG_COMPAT_SIG 0 
 #define DEBUG_COMPAT_SIG_LEVEL 2
diff --git a/arch/parisc/kernel/sys32.h b/arch/parisc/kernel/sys32.h
deleted file mode 100644
index 60dd470f39f8..000000000000
--- a/arch/parisc/kernel/sys32.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/* 
- *    Copyright (C) 2002 Richard Hirst <rhirst at parisc-linux.org>
- *    Copyright (C) 2003 James Bottomley <jejb at parisc-linux.org>
- *    Copyright (C) 2003 Randolph Chung <tausq with parisc-linux.org>
- *
- *    This program is free software; you can redistribute it and/or modify
- *    it under the terms of the GNU General Public License as published by
- *    the Free Software Foundation; either version 2 of the License, or
- *    (at your option) any later version.
- *
- *    This program is distributed in the hope that it will be useful,
- *    but WITHOUT ANY WARRANTY; without even the implied warranty of
- *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *    GNU General Public License for more details.
- *
- *    You should have received a copy of the GNU General Public License
- *    along with this program; if not, write to the Free Software
- *    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-#ifndef _PARISC64_KERNEL_SYS32_H
-#define _PARISC64_KERNEL_SYS32_H
-
-#include <linux/compat.h>
-
-/* Call a kernel syscall which will use kernel space instead of user
- * space for its copy_to/from_user.
- */
-#define KERNEL_SYSCALL(ret, syscall, args...) \
-{ \
-    mm_segment_t old_fs = get_fs(); \
-    set_fs(KERNEL_DS); \
-    ret = syscall(args); \
-    set_fs (old_fs); \
-}
-
-#endif
diff --git a/arch/parisc/kernel/sys_parisc32.c b/arch/parisc/kernel/sys_parisc32.c
index a134ff4da12e..bb9f3b64de55 100644
--- a/arch/parisc/kernel/sys_parisc32.c
+++ b/arch/parisc/kernel/sys_parisc32.c
@@ -42,8 +42,6 @@
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
 
-#include "sys32.h"
-
 #undef DEBUG
 
 #ifdef DEBUG
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index c86fcb92358e..0e8cfd09da2f 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -58,7 +58,7 @@ CONFIG_SCHED_SMT=y
 CONFIG_PPC_DENORMALISATION=y
 CONFIG_PCCARD=y
 CONFIG_ELECTRA_CF=y
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_RPA=m
 CONFIG_HOTPLUG_PCI_RPA_DLPAR=m
 CONFIG_PACKET=y
diff --git a/arch/powerpc/configs/ppc64e_defconfig b/arch/powerpc/configs/ppc64e_defconfig
index 4b20f76172e2..0085dc4642c5 100644
--- a/arch/powerpc/configs/ppc64e_defconfig
+++ b/arch/powerpc/configs/ppc64e_defconfig
@@ -32,7 +32,7 @@ CONFIG_IRQ_ALL_CPUS=y
 CONFIG_SPARSEMEM_MANUAL=y
 CONFIG_PCI_MSI=y
 CONFIG_PCCARD=y
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_XFRM_USER=m
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index bea8587c3af5..1d4b9763895d 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -53,7 +53,7 @@ CONFIG_PPC_64K_PAGES=y
 CONFIG_PPC_SUBPAGE_PROT=y
 CONFIG_SCHED_SMT=y
 CONFIG_PPC_DENORMALISATION=y
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_RPA=m
 CONFIG_HOTPLUG_PCI_RPA_DLPAR=m
 CONFIG_PACKET=y
diff --git a/arch/powerpc/include/asm/perf_event_server.h b/arch/powerpc/include/asm/perf_event_server.h
index 2dd7bfc459be..8b2492644754 100644
--- a/arch/powerpc/include/asm/perf_event_server.h
+++ b/arch/powerpc/include/asm/perf_event_server.h
@@ -12,6 +12,7 @@
 #include <linux/types.h>
 #include <asm/hw_irq.h>
 #include <linux/device.h>
+#include <uapi/asm/perf_event.h>
 
 #define MAX_HWEVENTS            8
 #define MAX_EVENT_ALTERNATIVES  8
@@ -69,11 +70,6 @@ struct power_pmu {
 #define PPMU_LIMITED_PMC_REQD   2       /* have to put this on a limited PMC */
 #define PPMU_ONLY_COUNT_RUN     4       /* only counting in run state */
 
-/*
- * We use the event config bit 63 as a flag to request EBB.
- */
-#define EVENT_CONFIG_EBB_SHIFT  63
-
 extern int register_power_pmu(struct power_pmu *);
 
 struct pt_regs;
diff --git a/arch/powerpc/include/asm/smp.h b/arch/powerpc/include/asm/smp.h
index ffbaabebcdca..48cfc858abd6 100644
--- a/arch/powerpc/include/asm/smp.h
+++ b/arch/powerpc/include/asm/smp.h
@@ -145,6 +145,10 @@ extern void __cpu_die(unsigned int cpu);
 #define smp_setup_cpu_maps()
 static inline void inhibit_secondary_onlining(void) {}
 static inline void uninhibit_secondary_onlining(void) {}
+static inline const struct cpumask *cpu_sibling_mask(int cpu)
+{
+        return cpumask_of(cpu);
+}
 
 #endif /* CONFIG_SMP */
 
diff --git a/arch/powerpc/include/uapi/asm/Kbuild b/arch/powerpc/include/uapi/asm/Kbuild
index 5182c8622b54..48be855ef37b 100644
--- a/arch/powerpc/include/uapi/asm/Kbuild
+++ b/arch/powerpc/include/uapi/asm/Kbuild
@@ -20,6 +20,7 @@ header-y += mman.h
 header-y += msgbuf.h
 header-y += nvram.h
 header-y += param.h
+header-y += perf_event.h
 header-y += poll.h
 header-y += posix_types.h
 header-y += ps3fb.h
diff --git a/arch/powerpc/include/uapi/asm/perf_event.h b/arch/powerpc/include/uapi/asm/perf_event.h
new file mode 100644
index 000000000000..80a4d40cf5bc
--- /dev/null
+++ b/arch/powerpc/include/uapi/asm/perf_event.h
@@ -0,0 +1,18 @@
+/*
+ * Copyright 2013 Michael Ellerman, IBM Corp.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2 of the
+ * License.
+ */
+
+#ifndef _UAPI_ASM_POWERPC_PERF_EVENT_H
+#define _UAPI_ASM_POWERPC_PERF_EVENT_H
+
+/*
+ * We use bit 63 of perf_event_attr.config as a flag to request EBB.
+ */
+#define PERF_EVENT_CONFIG_EBB_SHIFT     63
+
+#endif /* _UAPI_ASM_POWERPC_PERF_EVENT_H */
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 2e51cde616d2..c69440cef7af 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -362,7 +362,7 @@ int arch_show_interrupts(struct seq_file *p, int prec)
                 seq_printf(p, "%10u ", per_cpu(irq_stat, j).spurious_irqs);
         seq_printf(p, "  Spurious interrupts\n");
 
-        seq_printf(p, "%*s: ", prec, "CNT");
+        seq_printf(p, "%*s: ", prec, "PMI");
         for_each_online_cpu(j)
                 seq_printf(p, "%10u ", per_cpu(irq_stat, j).pmu_irqs);
         seq_printf(p, "  Performance monitoring interrupts\n");
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 08397217e8ac..5850798826cd 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -27,6 +27,7 @@
 #include <linux/seq_file.h>
 #include <linux/uaccess.h>
 #include <linux/slab.h>
+#include <asm/cputhreads.h>
 #include <asm/sparsemem.h>
 #include <asm/prom.h>
 #include <asm/smp.h>
@@ -1318,7 +1319,8 @@ static int update_cpu_associativity_changes_mask(void)
                         }
                 }
                 if (changed) {
-                        cpumask_set_cpu(cpu, changes);
+                        cpumask_or(changes, changes, cpu_sibling_mask(cpu));
+                        cpu = cpu_last_thread_sibling(cpu);
                 }
         }
 
@@ -1426,7 +1428,7 @@ static int update_cpu_topology(void *data)
         if (!data)
                 return -EINVAL;
 
-        cpu = get_cpu();
+        cpu = smp_processor_id();
 
         for (update = data; update; update = update->next) {
                 if (cpu != update->cpu)
@@ -1446,12 +1448,12 @@ static int update_cpu_topology(void *data)
  */
 int arch_update_cpu_topology(void)
 {
-        unsigned int cpu, changed = 0;
+        unsigned int cpu, sibling, changed = 0;
         struct topology_update_data *updates, *ud;
         unsigned int associativity[VPHN_ASSOC_BUFSIZE] = {0};
         cpumask_t updated_cpus;
         struct device *dev;
-        int weight, i = 0;
+        int weight, new_nid, i = 0;
 
         weight = cpumask_weight(&cpu_associativity_changes_mask);
         if (!weight)
@@ -1464,19 +1466,46 @@ int arch_update_cpu_topology(void)
         cpumask_clear(&updated_cpus);
 
         for_each_cpu(cpu, &cpu_associativity_changes_mask) {
-                ud = &updates[i++];
-                ud->cpu = cpu;
-                vphn_get_associativity(cpu, associativity);
-                ud->new_nid = associativity_to_nid(associativity);
-
-                if (ud->new_nid < 0 || !node_online(ud->new_nid))
-                        ud->new_nid = first_online_node;
+                /*
+                 * If siblings aren't flagged for changes, updates list
+                 * will be too short. Skip on this update and set for next
+                 * update.
+                 */
+                if (!cpumask_subset(cpu_sibling_mask(cpu),
+                                        &cpu_associativity_changes_mask)) {
+                        pr_info("Sibling bits not set for associativity "
+                                        "change, cpu%d\n", cpu);
+                        cpumask_or(&cpu_associativity_changes_mask,
+                                        &cpu_associativity_changes_mask,
+                                        cpu_sibling_mask(cpu));
+                        cpu = cpu_last_thread_sibling(cpu);
+                        continue;
+                }
 
-                ud->old_nid = numa_cpu_lookup_table[cpu];
-                cpumask_set_cpu(cpu, &updated_cpus);
+                /* Use associativity from first thread for all siblings */
+                vphn_get_associativity(cpu, associativity);
+                new_nid = associativity_to_nid(associativity);
+                if (new_nid < 0 || !node_online(new_nid))
+                        new_nid = first_online_node;
+
+                if (new_nid == numa_cpu_lookup_table[cpu]) {
+                        cpumask_andnot(&cpu_associativity_changes_mask,
+                                        &cpu_associativity_changes_mask,
+                                        cpu_sibling_mask(cpu));
+                        cpu = cpu_last_thread_sibling(cpu);
+                        continue;
+                }
 
-                if (i < weight)
-                        ud->next = &updates[i];
+                for_each_cpu(sibling, cpu_sibling_mask(cpu)) {
+                        ud = &updates[i++];
+                        ud->cpu = sibling;
+                        ud->new_nid = new_nid;
+                        ud->old_nid = numa_cpu_lookup_table[sibling];
+                        cpumask_set_cpu(sibling, &updated_cpus);
+                        if (i < weight)
+                                ud->next = &updates[i];
+                }
+                cpu = cpu_last_thread_sibling(cpu);
         }
 
         stop_machine(update_cpu_topology, &updates[0], &updated_cpus);
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 24a45f91c65f..eeae308cf982 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -484,7 +484,7 @@ static bool is_ebb_event(struct perf_event *event)
          * use bit 63 of the event code for something else if they wish.
          */
         return (ppmu->flags & PPMU_EBB) &&
-               ((event->attr.config >> EVENT_CONFIG_EBB_SHIFT) & 1);
+               ((event->attr.config >> PERF_EVENT_CONFIG_EBB_SHIFT) & 1);
 }
 
 static int ebb_event_check(struct perf_event *event)
diff --git a/arch/powerpc/perf/power8-pmu.c b/arch/powerpc/perf/power8-pmu.c
index 7466374d2787..2ee4a707f0df 100644
--- a/arch/powerpc/perf/power8-pmu.c
+++ b/arch/powerpc/perf/power8-pmu.c
@@ -118,7 +118,7 @@
          (EVENT_UNIT_MASK      << EVENT_UNIT_SHIFT)             |       \
          (EVENT_COMBINE_MASK   << EVENT_COMBINE_SHIFT)          |       \
          (EVENT_MARKED_MASK    << EVENT_MARKED_SHIFT)           |       \
-         (EVENT_EBB_MASK       << EVENT_CONFIG_EBB_SHIFT)       |       \
+         (EVENT_EBB_MASK       << PERF_EVENT_CONFIG_EBB_SHIFT)  |       \
           EVENT_PSEL_MASK)
 
 /* MMCRA IFM bits - POWER8 */
@@ -233,10 +233,10 @@ static int power8_get_constraint(u64 event, unsigned long *maskp, unsigned long
         pmc   = (event >> EVENT_PMC_SHIFT)        & EVENT_PMC_MASK;
         unit  = (event >> EVENT_UNIT_SHIFT)       & EVENT_UNIT_MASK;
         cache = (event >> EVENT_CACHE_SEL_SHIFT)  & EVENT_CACHE_SEL_MASK;
-        ebb   = (event >> EVENT_CONFIG_EBB_SHIFT) & EVENT_EBB_MASK;
+        ebb   = (event >> PERF_EVENT_CONFIG_EBB_SHIFT) & EVENT_EBB_MASK;
 
         /* Clear the EBB bit in the event, so event checks work below */
-        event &= ~(EVENT_EBB_MASK << EVENT_CONFIG_EBB_SHIFT);
+        event &= ~(EVENT_EBB_MASK << PERF_EVENT_CONFIG_EBB_SHIFT);
 
         if (pmc) {
                 if (pmc > 6)
diff --git a/arch/sh/configs/sh03_defconfig b/arch/sh/configs/sh03_defconfig
index 2051821724c6..0cf4097b71e8 100644
--- a/arch/sh/configs/sh03_defconfig
+++ b/arch/sh/configs/sh03_defconfig
@@ -22,7 +22,7 @@ CONFIG_PREEMPT=y
 CONFIG_CMDLINE_OVERWRITE=y
 CONFIG_CMDLINE="console=ttySC1,115200 mem=64M root=/dev/nfs"
 CONFIG_PCI=y
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_BINFMT_MISC=y
 CONFIG_NET=y
 CONFIG_PACKET=y
diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c
index e2703520d120..c370e1c4468b 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
+++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
@@ -111,8 +111,8 @@ static struct severity {
 #ifdef  CONFIG_MEMORY_FAILURE
         MCESEV(
                 KEEP, "Action required but unaffected thread is continuable",
-                SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR|MCACOD, MCI_UC_SAR|MCI_ADDR),
-                MCGMASK(MCG_STATUS_RIPV, MCG_STATUS_RIPV)
+                SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR, MCI_UC_SAR|MCI_ADDR),
+                MCGMASK(MCG_STATUS_RIPV|MCG_STATUS_EIPV, MCG_STATUS_RIPV)
                 ),
         MCESEV(
                 AR, "Action required: data load error in a user process",
diff --git a/arch/x86/platform/ce4100/ce4100.c b/arch/x86/platform/ce4100/ce4100.c
index 643b8b5eee86..8244f5ec2f4c 100644
--- a/arch/x86/platform/ce4100/ce4100.c
+++ b/arch/x86/platform/ce4100/ce4100.c
@@ -12,6 +12,7 @@
 #include <linux/kernel.h>
 #include <linux/irq.h>
 #include <linux/module.h>
+#include <linux/reboot.h>
 #include <linux/serial_reg.h>
 #include <linux/serial_8250.h>
 #include <linux/reboot.h>
diff --git a/drivers/accessibility/braille/braille_console.c b/drivers/accessibility/braille/braille_console.c
index d21167bfc865..dc34a5b8bcee 100644
--- a/drivers/accessibility/braille/braille_console.c
+++ b/drivers/accessibility/braille/braille_console.c
@@ -359,6 +359,9 @@ int braille_register_console(struct console *console, int index,
                 char *console_options, char *braille_options)
 {
         int ret;
+
+        if (!(console->flags & CON_BRL))
+                return 0;
         if (!console_options)
                 /* Only support VisioBraille for now */
                 console_options = "57600o8";
@@ -374,15 +377,17 @@ int braille_register_console(struct console *console, int index,
         braille_co = console;
         register_keyboard_notifier(&keyboard_notifier_block);
         register_vt_notifier(&vt_notifier_block);
-        return 0;
+        return 1;
 }
 
 int braille_unregister_console(struct console *console)
 {
         if (braille_co != console)
                 return -EINVAL;
+        if (!(console->flags & CON_BRL))
+                return 0;
         unregister_keyboard_notifier(&keyboard_notifier_block);
         unregister_vt_notifier(&vt_notifier_block);
         braille_co = NULL;
-        return 0;
+        return 1;
 }
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 082b4dd252a8..d405fbad406a 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -117,6 +117,7 @@ struct acpi_battery {
         struct acpi_device *device;
         struct notifier_block pm_nb;
         unsigned long update_time;
+        int revision;
         int rate_now;
         int capacity_now;
         int voltage_now;
@@ -359,6 +360,7 @@ static struct acpi_offsets info_offsets[] = {
 };
 
 static struct acpi_offsets extended_info_offsets[] = {
+        {offsetof(struct acpi_battery, revision), 0},
         {offsetof(struct acpi_battery, power_unit), 0},
         {offsetof(struct acpi_battery, design_capacity), 0},
         {offsetof(struct acpi_battery, full_charge_capacity), 0},
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 11f467c00d0a..a12b923bbaca 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -91,6 +91,10 @@ static struct usb_device_id ath3k_table[] = {
         { USB_DEVICE(0x0489, 0xe04e) },
         { USB_DEVICE(0x0489, 0xe056) },
         { USB_DEVICE(0x0489, 0xe04d) },
+        { USB_DEVICE(0x04c5, 0x1330) },
+        { USB_DEVICE(0x13d3, 0x3402) },
+        { USB_DEVICE(0x0cf3, 0x3121) },
+        { USB_DEVICE(0x0cf3, 0xe003) },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE02C) },
@@ -128,6 +132,10 @@ static struct usb_device_id ath3k_blist_tbl[] = {
         { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
 
         /* Atheros AR5BBU22 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
@@ -193,24 +201,44 @@ error:
 
 static int ath3k_get_state(struct usb_device *udev, unsigned char *state)
 {
-        int pipe = 0;
+        int ret, pipe = 0;
+        char *buf;
+
+        buf = kmalloc(sizeof(*buf), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
 
         pipe = usb_rcvctrlpipe(udev, 0);
-        return usb_control_msg(udev, pipe, ATH3K_GETSTATE,
-                        USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
-                        state, 0x01, USB_CTRL_SET_TIMEOUT);
+        ret = usb_control_msg(udev, pipe, ATH3K_GETSTATE,
+                              USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
+                              buf, sizeof(*buf), USB_CTRL_SET_TIMEOUT);
+
+        *state = *buf;
+        kfree(buf);
+
+        return ret;
 }
 
 static int ath3k_get_version(struct usb_device *udev,
                         struct ath3k_version *version)
 {
-        int pipe = 0;
+        int ret, pipe = 0;
+        struct ath3k_version *buf;
+        const int size = sizeof(*buf);
+
+        buf = kmalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
 
         pipe = usb_rcvctrlpipe(udev, 0);
-        return usb_control_msg(udev, pipe, ATH3K_GETVERSION,
-                        USB_TYPE_VENDOR | USB_DIR_IN, 0, 0, version,
-                        sizeof(struct ath3k_version),
-                        USB_CTRL_SET_TIMEOUT);
+        ret = usb_control_msg(udev, pipe, ATH3K_GETVERSION,
+                              USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
+                              buf, size, USB_CTRL_SET_TIMEOUT);
+
+        memcpy(version, buf, size);
+        kfree(buf);
+
+        return ret;
 }
 
 static int ath3k_load_fwfile(struct usb_device *udev,
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index de4cf4daa2f4..8e16f0af6358 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -154,6 +154,10 @@ static struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
@@ -1095,7 +1099,7 @@ static int btusb_setup_intel_patching(struct hci_dev *hdev,
         if (IS_ERR(skb)) {
                 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
                        hdev->name, cmd->opcode, PTR_ERR(skb));
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
 
         /* It ensures that the returned event matches the event data read from
@@ -1147,7 +1151,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
         if (IS_ERR(skb)) {
                 BT_ERR("%s sending initial HCI reset command failed (%ld)",
                        hdev->name, PTR_ERR(skb));
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
         kfree_skb(skb);
 
@@ -1161,7 +1165,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
         if (IS_ERR(skb)) {
                 BT_ERR("%s reading Intel fw version command failed (%ld)",
                        hdev->name, PTR_ERR(skb));
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
 
         if (skb->len != sizeof(*ver)) {
@@ -1219,7 +1223,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
                 BT_ERR("%s entering Intel manufacturer mode failed (%ld)",
                        hdev->name, PTR_ERR(skb));
                 release_firmware(fw);
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
 
         if (skb->data[0]) {
@@ -1276,7 +1280,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
         if (IS_ERR(skb)) {
                 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
                        hdev->name, PTR_ERR(skb));
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
         kfree_skb(skb);
 
@@ -1292,7 +1296,7 @@ exit_mfg_disable:
         if (IS_ERR(skb)) {
                 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
                        hdev->name, PTR_ERR(skb));
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
         kfree_skb(skb);
 
@@ -1310,7 +1314,7 @@ exit_mfg_deactivate:
         if (IS_ERR(skb)) {
                 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
                        hdev->name, PTR_ERR(skb));
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
         kfree_skb(skb);
 
diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
index bf5d2477cb77..15f2e7025b78 100644
--- a/drivers/char/agp/parisc-agp.c
+++ b/drivers/char/agp/parisc-agp.c
@@ -129,7 +129,8 @@ parisc_agp_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
         off_t j, io_pg_start;
         int io_pg_count;
 
-        if (type != 0 || mem->type != 0) {
+        if (type != mem->type ||
+                agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type)) {
                 return -EINVAL;
         }
 
@@ -175,7 +176,8 @@ parisc_agp_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
         struct _parisc_agp_info *info = &parisc_agp_info;
         int i, io_pg_start, io_pg_count;
 
-        if (type != 0 || mem->type != 0) {
+        if (type != mem->type ||
+                agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type)) {
                 return -EINVAL;
         }
 
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index a4ad7339588d..f0a5e2b0eb8a 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1177,14 +1177,11 @@ static int __cpufreq_remove_dev(struct device *dev,
                                 __func__, cpu_dev->id, cpu);
         }
 
-        if ((cpus == 1) && (cpufreq_driver->target))
-                __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
-
-        pr_debug("%s: removing link, cpu: %d\n", __func__, cpu);
-        cpufreq_cpu_put(data);
-
         /* If cpu is last user of policy, free policy */
         if (cpus == 1) {
+                if (cpufreq_driver->target)
+                        __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
+
                 lock_policy_rwsem_read(cpu);
                 kobj = &data->kobj;
                 cmp = &data->kobj_unregister;
@@ -1205,9 +1202,13 @@ static int __cpufreq_remove_dev(struct device *dev,
                 free_cpumask_var(data->related_cpus);
                 free_cpumask_var(data->cpus);
                 kfree(data);
-        } else if (cpufreq_driver->target) {
-                __cpufreq_governor(data, CPUFREQ_GOV_START);
-                __cpufreq_governor(data, CPUFREQ_GOV_LIMITS);
+        } else {
+                pr_debug("%s: removing link, cpu: %d\n", __func__, cpu);
+                cpufreq_cpu_put(data);
+                if (cpufreq_driver->target) {
+                        __cpufreq_governor(data, CPUFREQ_GOV_START);
+                        __cpufreq_governor(data, CPUFREQ_GOV_LIMITS);
+                }
         }
 
         per_cpu(cpufreq_policy_cpu, cpu) = -1;
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index fe343a06b7da..bc580b67a652 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -28,13 +28,6 @@
 #define MAX_INTERESTING 50000
 #define STDDEV_THRESH 400
 
-/* 60 * 60 > STDDEV_THRESH * INTERVALS = 400 * 8 */
-#define MAX_DEVIATION 60
-
-static DEFINE_PER_CPU(struct hrtimer, menu_hrtimer);
-static DEFINE_PER_CPU(int, hrtimer_status);
-/* menu hrtimer mode */
-enum {MENU_HRTIMER_STOP, MENU_HRTIMER_REPEAT, MENU_HRTIMER_GENERAL};
 
 /*
  * Concepts and ideas behind the menu governor
@@ -116,13 +109,6 @@ enum {MENU_HRTIMER_STOP, MENU_HRTIMER_REPEAT, MENU_HRTIMER_GENERAL};
  *
  */
 
-/*
- * The C-state residency is so long that is is worthwhile to exit
- * from the shallow C-state and re-enter into a deeper C-state.
- */
-static unsigned int perfect_cstate_ms __read_mostly = 30;
-module_param(perfect_cstate_ms, uint, 0000);
-
 struct menu_device {
         int             last_state_idx;
         int             needs_update;
@@ -205,52 +191,17 @@ static u64 div_round64(u64 dividend, u32 divisor)
         return div_u64(dividend + (divisor / 2), divisor);
 }
 
-/* Cancel the hrtimer if it is not triggered yet */
-void menu_hrtimer_cancel(void)
-{
-        int cpu = smp_processor_id();
-        struct hrtimer *hrtmr = &per_cpu(menu_hrtimer, cpu);
-
-        /* The timer is still not time out*/
-        if (per_cpu(hrtimer_status, cpu)) {
-                hrtimer_cancel(hrtmr);
-                per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_STOP;
-        }
-}
-EXPORT_SYMBOL_GPL(menu_hrtimer_cancel);
-
-/* Call back for hrtimer is triggered */
-static enum hrtimer_restart menu_hrtimer_notify(struct hrtimer *hrtimer)
-{
-        int cpu = smp_processor_id();
-        struct menu_device *data = &per_cpu(menu_devices, cpu);
-
-        /* In general case, the expected residency is much larger than
-         *  deepest C-state target residency, but prediction logic still
-         *  predicts a small predicted residency, so the prediction
-         *  history is totally broken if the timer is triggered.
-         *  So reset the correction factor.
-         */
-        if (per_cpu(hrtimer_status, cpu) == MENU_HRTIMER_GENERAL)
-                data->correction_factor[data->bucket] = RESOLUTION * DECAY;
-
-        per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_STOP;
-
-        return HRTIMER_NORESTART;
-}
-
 /*
  * Try detecting repeating patterns by keeping track of the last 8
  * intervals, and checking if the standard deviation of that set
  * of points is below a threshold. If it is... then use the
  * average of these 8 points as the estimated value.
  */
-static u32 get_typical_interval(struct menu_device *data)
+static void get_typical_interval(struct menu_device *data)
 {
         int i = 0, divisor = 0;
         uint64_t max = 0, avg = 0, stddev = 0;
         int64_t thresh = LLONG_MAX; /* Discard outliers above this value. */
-        unsigned int ret = 0;
 
 again:
 
@@ -291,16 +242,13 @@ again:
         if (((avg > stddev * 6) && (divisor * 4 >= INTERVALS * 3))
                                                         || stddev <= 20) {
                 data->predicted_us = avg;
-                ret = 1;
-                return ret;
+                return;
 
         } else if ((divisor * 4) > INTERVALS * 3) {
                 /* Exclude the max interval */
                 thresh = max - 1;
                 goto again;
         }
-
-        return ret;
 }
 
 /**
@@ -315,9 +263,6 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
         int i;
         int multiplier;
         struct timespec t;
-        int repeat = 0, low_predicted = 0;
-        int cpu = smp_processor_id();
-        struct hrtimer *hrtmr = &per_cpu(menu_hrtimer, cpu);
 
         if (data->needs_update) {
                 menu_update(drv, dev);
@@ -352,7 +297,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
         data->predicted_us = div_round64(data->expected_us * data->correction_factor[data->bucket],
                                          RESOLUTION * DECAY);
 
-        repeat = get_typical_interval(data);
+        get_typical_interval(data);
 
         /*
          * We want to default to C1 (hlt), not to busy polling
@@ -373,10 +318,8 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
 
                 if (s->disabled || su->disable)
                         continue;
-                if (s->target_residency > data->predicted_us) {
-                        low_predicted = 1;
+                if (s->target_residency > data->predicted_us)
                         continue;
-                }
                 if (s->exit_latency > latency_req)
                         continue;
                 if (s->exit_latency * multiplier > data->predicted_us)
@@ -386,44 +329,6 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
                 data->exit_us = s->exit_latency;
         }
 
-        /* not deepest C-state chosen for low predicted residency */
-        if (low_predicted) {
-                unsigned int timer_us = 0;
-                unsigned int perfect_us = 0;
-
-                /*
-                 * Set a timer to detect whether this sleep is much
-                 * longer than repeat mode predicted.  If the timer
-                 * triggers, the code will evaluate whether to put
-                 * the CPU into a deeper C-state.
-                 * The timer is cancelled on CPU wakeup.
-                 */
-                timer_us = 2 * (data->predicted_us + MAX_DEVIATION);
-
-                perfect_us = perfect_cstate_ms * 1000;
-
-                if (repeat && (4 * timer_us < data->expected_us)) {
-                        RCU_NONIDLE(hrtimer_start(hrtmr,
-                                ns_to_ktime(1000 * timer_us),
-                                HRTIMER_MODE_REL_PINNED));
-                        /* In repeat case, menu hrtimer is started */
-                        per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_REPEAT;
-                } else if (perfect_us < data->expected_us) {
-                        /*
-                         * The next timer is long. This could be because
-                         * we did not make a useful prediction.
-                         * In that case, it makes sense to re-enter
-                         * into a deeper C-state after some time.
-                         */
-                        RCU_NONIDLE(hrtimer_start(hrtmr,
-                                ns_to_ktime(1000 * timer_us),
-                                HRTIMER_MODE_REL_PINNED));
-                        /* In general case, menu hrtimer is started */
-                        per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_GENERAL;
-                }
-
-        }
-
         return data->last_state_idx;
 }
 
@@ -514,9 +419,6 @@ static int menu_enable_device(struct cpuidle_driver *drv,
                                 struct cpuidle_device *dev)
 {
         struct menu_device *data = &per_cpu(menu_devices, dev->cpu);
-        struct hrtimer *t = &per_cpu(menu_hrtimer, dev->cpu);
-        hrtimer_init(t, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
-        t->function = menu_hrtimer_notify;
 
         memset(data, 0, sizeof(struct menu_device));
 
diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c
index ce3dc3e9688c..0bbdea5059f3 100644
--- a/drivers/dma/pch_dma.c
+++ b/drivers/dma/pch_dma.c
@@ -867,6 +867,7 @@ static int pch_dma_probe(struct pci_dev *pdev,
 
         if (!(pci_resource_flags(pdev, 1) & IORESOURCE_MEM)) {
                 dev_err(&pdev->dev, "Cannot find proper base address\n");
+                err = -ENODEV;
                 goto err_disable_pdev;
         }
 
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 593827b3fdd4..fa645d825009 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2505,6 +2505,10 @@ static dma_cookie_t pl330_tx_submit(struct dma_async_tx_descriptor *tx)
         /* Assign cookies to all nodes */
         while (!list_empty(&last->node)) {
                 desc = list_entry(last->node.next, struct dma_pl330_desc, node);
+                if (pch->cyclic) {
+                        desc->txd.callback = last->txd.callback;
+                        desc->txd.callback_param = last->txd.callback_param;
+                }
 
                 dma_cookie_assign(&desc->txd);
 
@@ -2688,45 +2692,82 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic(
                 size_t period_len, enum dma_transfer_direction direction,
                 unsigned long flags, void *context)
 {
-        struct dma_pl330_desc *desc;
+        struct dma_pl330_desc *desc = NULL, *first = NULL;
         struct dma_pl330_chan *pch = to_pchan(chan);
+        struct dma_pl330_dmac *pdmac = pch->dmac;
+        unsigned int i;
         dma_addr_t dst;
         dma_addr_t src;
 
-        desc = pl330_get_desc(pch);
-        if (!desc) {
-                dev_err(pch->dmac->pif.dev, "%s:%d Unable to fetch desc\n",
-                        __func__, __LINE__);
+        if (len % period_len != 0)
                 return NULL;
-        }
 
-        switch (direction) {
-        case DMA_MEM_TO_DEV:
-                desc->rqcfg.src_inc = 1;
-                desc->rqcfg.dst_inc = 0;
-                desc->req.rqtype = MEMTODEV;
-                src = dma_addr;
-                dst = pch->fifo_addr;
-                break;
-        case DMA_DEV_TO_MEM:
-                desc->rqcfg.src_inc = 0;
-                desc->rqcfg.dst_inc = 1;
-                desc->req.rqtype = DEVTOMEM;
-                src = pch->fifo_addr;
-                dst = dma_addr;
-                break;
-        default:
+        if (!is_slave_direction(direction)) {
                 dev_err(pch->dmac->pif.dev, "%s:%d Invalid dma direction\n",
                 __func__, __LINE__);
                 return NULL;
         }
 
-        desc->rqcfg.brst_size = pch->burst_sz;
-        desc->rqcfg.brst_len = 1;
+        for (i = 0; i < len / period_len; i++) {
+                desc = pl330_get_desc(pch);
+                if (!desc) {
+                        dev_err(pch->dmac->pif.dev, "%s:%d Unable to fetch desc\n",
+                                __func__, __LINE__);
 
-        pch->cyclic = true;
+                        if (!first)
+                                return NULL;
+
+                        spin_lock_irqsave(&pdmac->pool_lock, flags);
+
+                        while (!list_empty(&first->node)) {
+                                desc = list_entry(first->node.next,
+                                                struct dma_pl330_desc, node);
+                                list_move_tail(&desc->node, &pdmac->desc_pool);
+                        }
+
+                        list_move_tail(&first->node, &pdmac->desc_pool);
 
-        fill_px(&desc->px, dst, src, period_len);
+                        spin_unlock_irqrestore(&pdmac->pool_lock, flags);
+
+                        return NULL;
+                }
+
+                switch (direction) {
+                case DMA_MEM_TO_DEV:
+                        desc->rqcfg.src_inc = 1;
+                        desc->rqcfg.dst_inc = 0;
+                        desc->req.rqtype = MEMTODEV;
+                        src = dma_addr;
+                        dst = pch->fifo_addr;
+                        break;
+                case DMA_DEV_TO_MEM:
+                        desc->rqcfg.src_inc = 0;
+                        desc->rqcfg.dst_inc = 1;
+                        desc->req.rqtype = DEVTOMEM;
+                        src = pch->fifo_addr;
+                        dst = dma_addr;
+                        break;
+                default:
+                        break;
+                }
+
+                desc->rqcfg.brst_size = pch->burst_sz;
+                desc->rqcfg.brst_len = 1;
+                fill_px(&desc->px, dst, src, period_len);
+
+                if (!first)
+                        first = desc;
+                else
+                        list_add_tail(&desc->node, &first->node);
+
+                dma_addr += period_len;
+        }
+
+        if (!desc)
+                return NULL;
+
+        pch->cyclic = true;
+        desc->txd.flags = flags;
 
         return &desc->txd;
 }
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 7ef316fdc4d9..ac1b43a04285 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -54,6 +54,7 @@
 #define FW_CDEV_KERNEL_VERSION                  5
 #define FW_CDEV_VERSION_EVENT_REQUEST2          4
 #define FW_CDEV_VERSION_ALLOCATE_REGION_END     4
+#define FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW 5
 
 struct client {
         u32 version;
@@ -1005,6 +1006,8 @@ static int ioctl_create_iso_context(struct client *client, union ioctl_arg *arg)
                         a->channel, a->speed, a->header_size, cb, client);
         if (IS_ERR(context))
                 return PTR_ERR(context);
+        if (client->version < FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW)
+                context->drop_overflow_headers = true;
 
         /* We only support one context at this time. */
         spin_lock_irq(&client->lock);
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 9e1db6490b9a..afb701ec90ca 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2749,8 +2749,11 @@ static void copy_iso_headers(struct iso_context *ctx, const u32 *dma_hdr)
 {
         u32 *ctx_hdr;
 
-        if (ctx->header_length + ctx->base.header_size > PAGE_SIZE)
+        if (ctx->header_length + ctx->base.header_size > PAGE_SIZE) {
+                if (ctx->base.drop_overflow_headers)
+                        return;
                 flush_iso_completions(ctx);
+        }
 
         ctx_hdr = ctx->header + ctx->header_length;
         ctx->last_timestamp = (u16)le32_to_cpu((__force __le32)dma_hdr[0]);
@@ -2910,8 +2913,11 @@ static int handle_it_packet(struct context *context,
 
         sync_it_packet_for_cpu(context, d);
 
-        if (ctx->header_length + 4 > PAGE_SIZE)
+        if (ctx->header_length + 4 > PAGE_SIZE) {
+                if (ctx->base.drop_overflow_headers)
+                        return 1;
                 flush_iso_completions(ctx);
+        }
 
         ctx_hdr = ctx->header + ctx->header_length;
         ctx->last_timestamp = le16_to_cpu(last->res_count);
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index eb760a218da4..232fa8fce26a 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -419,6 +419,13 @@ static void __init dmi_format_ids(char *buf, size_t len)
                             dmi_get_system_info(DMI_BIOS_DATE));
 }
 
+/*
+ * Check for DMI/SMBIOS headers in the system firmware image.  Any
+ * SMBIOS header must start 16 bytes before the DMI header, so take a
+ * 32 byte buffer and check for DMI at offset 16 and SMBIOS at offset
+ * 0.  If the DMI header is present, set dmi_ver accordingly (SMBIOS
+ * takes precedence) and return 0.  Otherwise return 1.
+ */
 static int __init dmi_present(const u8 *buf)
 {
         int smbios_ver;
@@ -506,6 +513,13 @@ void __init dmi_scan_machine(void)
                 if (p == NULL)
                         goto error;
 
+                /*
+                 * Iterate over all possible DMI header addresses q.
+                 * Maintain the 32 bytes around q in buf.  On the
+                 * first iteration, substitute zero for the
+                 * out-of-range bytes so there is no chance of falsely
+                 * detecting an SMBIOS header.
+                 */
                 memset(buf, 0, 16);
                 for (q = p; q < p + 0x10000; q += 16) {
                         memcpy_fromio(buf + 16, q, 16);
diff --git a/drivers/gpio/gpio-msm-v1.c b/drivers/gpio/gpio-msm-v1.c
index e3ceaacde45c..73b73969d361 100644
--- a/drivers/gpio/gpio-msm-v1.c
+++ b/drivers/gpio/gpio-msm-v1.c
@@ -21,6 +21,7 @@
 #include <linux/module.h>
 #include <linux/device.h>
 #include <linux/platform_device.h>
+#include <linux/err.h>
 
 #include <mach/msm_gpiomux.h>
 
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index c57244ef428b..dfeb3a3a8f20 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -1037,18 +1037,6 @@ omap_mpuio_alloc_gc(struct gpio_bank *bank, unsigned int irq_start,
                                IRQ_NOREQUEST | IRQ_NOPROBE, 0);
 }
 
-#if defined(CONFIG_OF_GPIO)
-static inline bool omap_gpio_chip_boot_dt(struct gpio_chip *chip)
-{
-        return chip->of_node != NULL;
-}
-#else
-static inline bool omap_gpio_chip_boot_dt(struct gpio_chip *chip)
-{
-        return false;
-}
-#endif
-
 static void omap_gpio_chip_init(struct gpio_bank *bank)
 {
         int j;
@@ -1080,68 +1068,24 @@ static void omap_gpio_chip_init(struct gpio_bank *bank)
 
         gpiochip_add(&bank->chip);
 
-        /*
-         * REVISIT these explicit calls to irq_create_mapping()
-         * to do the GPIO to IRQ domain mapping for each GPIO in
-         * the bank can be removed once all OMAP platforms have
-         * been migrated to Device Tree boot only.
-         * Since in DT boot irq_create_mapping() is called from
-         * irq_create_of_mapping() only for the GPIO lines that
-         * are used as interrupts.
-         */
-        if (!omap_gpio_chip_boot_dt(&bank->chip))
-                for (j = 0; j < bank->width; j++)
-                        irq_create_mapping(bank->domain, j);
+        for (j = 0; j < bank->width; j++) {
+                int irq = irq_create_mapping(bank->domain, j);
+                irq_set_lockdep_class(irq, &gpio_lock_class);
+                irq_set_chip_data(irq, bank);
+                if (bank->is_mpuio) {
+                        omap_mpuio_alloc_gc(bank, irq, bank->width);
+                } else {
+                        irq_set_chip_and_handler(irq, &gpio_irq_chip,
+                                                 handle_simple_irq);
+                        set_irq_flags(irq, IRQF_VALID);
+                }
+        }
         irq_set_chained_handler(bank->irq, gpio_irq_handler);
         irq_set_handler_data(bank->irq, bank);
 }
 
 static const struct of_device_id omap_gpio_match[];
 
-static int omap_gpio_irq_map(struct irq_domain *d, unsigned int virq,
-                             irq_hw_number_t hwirq)
-{
-        struct gpio_bank *bank = d->host_data;
-        int gpio;
-        int ret;
-
-        if (!bank)
-                return -EINVAL;
-
-        irq_set_lockdep_class(virq, &gpio_lock_class);
-        irq_set_chip_data(virq, bank);
-        if (bank->is_mpuio) {
-                omap_mpuio_alloc_gc(bank, virq, bank->width);
-        } else {
-                irq_set_chip_and_handler(virq, &gpio_irq_chip,
-                                         handle_simple_irq);
-                set_irq_flags(virq, IRQF_VALID);
-        }
-
-        /*
-         * REVISIT most GPIO IRQ chip drivers need to call
-         * gpio_request() before a GPIO line can be used as an
-         * IRQ. Ideally this should be handled by the IRQ core
-         * but until then this has to be done on a per driver
-         * basis. Remove this once this is managed by the core.
-         */
-        if (omap_gpio_chip_boot_dt(&bank->chip)) {
-                gpio = irq_to_gpio(bank, hwirq);
-                ret = gpio_request_one(gpio, GPIOF_IN, NULL);
-                if (ret) {
-                        dev_err(bank->dev, "Could not request GPIO%d\n", gpio);
-                        return ret;
-                }
-        }
-
-        return 0;
-}
-
-static struct irq_domain_ops omap_gpio_irq_ops = {
-        .xlate  = irq_domain_xlate_onetwocell,
-        .map    = omap_gpio_irq_map,
-};
-
 static int omap_gpio_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
@@ -1207,10 +1151,10 @@ static int omap_gpio_probe(struct platform_device *pdev)
         }
 
         bank->domain = irq_domain_add_legacy(node, bank->width, irq_base,
-                                             0, &omap_gpio_irq_ops, bank);
+                                             0, &irq_domain_simple_ops, NULL);
 #else
         bank->domain = irq_domain_add_linear(node, bank->width,
-                                             &omap_gpio_irq_ops, bank);
+                                             &irq_domain_simple_ops, NULL);
 #endif
         if (!bank->domain) {
                 dev_err(dev, "Couldn't register an IRQ domain\n");
diff --git a/drivers/gpu/drm/exynos/exynos_ddc.c b/drivers/gpu/drm/exynos/exynos_ddc.c
index 95c75edef01a..30ef41bcd7b8 100644
--- a/drivers/gpu/drm/exynos/exynos_ddc.c
+++ b/drivers/gpu/drm/exynos/exynos_ddc.c
@@ -15,7 +15,6 @@
 
 #include <linux/kernel.h>
 #include <linux/i2c.h>
-#include <linux/module.h>
 
 
 #include "exynos_drm_drv.h"
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
index 61b094f689a7..6e047bd53e2f 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
@@ -12,7 +12,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/mfd/syscon.h>
 #include <linux/regmap.h>
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 3e106beca5b6..1c263dac3c1c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -14,7 +14,6 @@
 #include <drm/drmP.h>
 
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
 #include <linux/of_device.h>
@@ -130,7 +129,6 @@ static const struct of_device_id fimd_driver_dt_match[] = {
           .data = &exynos5_fimd_driver_data },
         {},
 };
-MODULE_DEVICE_TABLE(of, fimd_driver_dt_match);
 #endif
 
 static inline struct fimd_driver_data *drm_fimd_get_driver_data(
@@ -1082,7 +1080,6 @@ static struct platform_device_id fimd_driver_ids[] = {
         },
         {},
 };
-MODULE_DEVICE_TABLE(platform, fimd_driver_ids);
 
 static const struct dev_pm_ops fimd_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(fimd_suspend, fimd_resume)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 42a5a5466075..eddea4941483 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -8,7 +8,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/interrupt.h>
@@ -806,9 +805,20 @@ static void g2d_dma_start(struct g2d_data *g2d,
         struct g2d_cmdlist_node *node =
                                 list_first_entry(&runqueue_node->run_cmdlist,
                                                 struct g2d_cmdlist_node, list);
+        int ret;
+
+        ret = pm_runtime_get_sync(g2d->dev);
+        if (ret < 0) {
+                dev_warn(g2d->dev, "failed pm power on.\n");
+                return;
+        }
 
-        pm_runtime_get_sync(g2d->dev);
-        clk_enable(g2d->gate_clk);
+        ret = clk_prepare_enable(g2d->gate_clk);
+        if (ret < 0) {
+                dev_warn(g2d->dev, "failed to enable clock.\n");
+                pm_runtime_put_sync(g2d->dev);
+                return;
+        }
 
         writel_relaxed(node->dma_addr, g2d->regs + G2D_DMA_SFR_BASE_ADDR);
         writel_relaxed(G2D_DMA_START, g2d->regs + G2D_DMA_COMMAND);
@@ -861,7 +871,7 @@ static void g2d_runqueue_worker(struct work_struct *work)
                                             runqueue_work);
 
         mutex_lock(&g2d->runqueue_mutex);
-        clk_disable(g2d->gate_clk);
+        clk_disable_unprepare(g2d->gate_clk);
         pm_runtime_put_sync(g2d->dev);
 
         complete(&g2d->runqueue_node->complete);
@@ -1521,7 +1531,6 @@ static const struct of_device_id exynos_g2d_match[] = {
         { .compatible = "samsung,exynos5250-g2d" },
         {},
 };
-MODULE_DEVICE_TABLE(of, exynos_g2d_match);
 #endif
 
 struct platform_driver g2d_driver = {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
index 472e3b25e7f2..90b8a1a5344c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -12,7 +12,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
 #include <linux/pm_runtime.h>
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
index aaa550d622f0..8d3bc01d6834 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
@@ -15,7 +15,6 @@
 
 #include <linux/kernel.h>
 #include <linux/wait.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_ipp.c b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
index b1ef8e7ff9c9..d2b6ab4def93 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_ipp.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
@@ -12,7 +12,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/types.h>
 #include <linux/clk.h>
@@ -342,10 +341,10 @@ int exynos_drm_ipp_get_property(struct drm_device *drm_dev, void *data,
                  */
                 ippdrv = ipp_find_obj(&ctx->ipp_idr, &ctx->ipp_lock,
                                                 prop_list->ipp_id);
-                if (!ippdrv) {
+                if (IS_ERR(ippdrv)) {
                         DRM_ERROR("not found ipp%d driver.\n",
                                         prop_list->ipp_id);
-                        return -EINVAL;
+                        return PTR_ERR(ippdrv);
                 }
 
                 prop_list = ippdrv->prop_list;
@@ -970,9 +969,9 @@ int exynos_drm_ipp_queue_buf(struct drm_device *drm_dev, void *data,
         /* find command node */
         c_node = ipp_find_obj(&ctx->prop_idr, &ctx->prop_lock,
                 qbuf->prop_id);
-        if (!c_node) {
+        if (IS_ERR(c_node)) {
                 DRM_ERROR("failed to get command node.\n");
-                return -EFAULT;
+                return PTR_ERR(c_node);
         }
 
         /* buffer control */
@@ -1106,9 +1105,9 @@ int exynos_drm_ipp_cmd_ctrl(struct drm_device *drm_dev, void *data,
 
         c_node = ipp_find_obj(&ctx->prop_idr, &ctx->prop_lock,
                 cmd_ctrl->prop_id);
-        if (!c_node) {
+        if (IS_ERR(c_node)) {
                 DRM_ERROR("invalid command node list.\n");
-                return -EINVAL;
+                return PTR_ERR(c_node);
         }
 
         if (!exynos_drm_ipp_check_valid(ippdrv->dev, cmd_ctrl->ctrl,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index 427640aa5148..49669aa24c45 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -10,7 +10,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/err.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 41cc74d83e4e..c57c56519add 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -13,7 +13,6 @@
 #include <drm/drmP.h>
 
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 
 #include <drm/exynos_drm.h>
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 62ef5971ac3c..2f5c6942c968 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -24,7 +24,6 @@
 #include <linux/spinlock.h>
 #include <linux/wait.h>
 #include <linux/i2c.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
diff --git a/drivers/gpu/drm/exynos/exynos_hdmiphy.c b/drivers/gpu/drm/exynos/exynos_hdmiphy.c
index ef04255076c7..6e320ae9afed 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmiphy.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmiphy.c
@@ -15,7 +15,6 @@
 
 #include <linux/kernel.h>
 #include <linux/i2c.h>
-#include <linux/module.h>
 
 #include "exynos_drm_drv.h"
 #include "exynos_hdmi.h"
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 42ffb71c63bc..c9a137caea41 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -23,7 +23,6 @@
 #include <linux/spinlock.h>
 #include <linux/wait.h>
 #include <linux/i2c.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 66c63808fa35..f4669802a0fb 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1594,6 +1594,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         intel_detect_pch(dev);
 
         intel_irq_init(dev);
+        intel_pm_init(dev);
         intel_gt_sanitize(dev);
         intel_gt_init(dev);
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index d2ee3343c943..1929bffc1c77 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1582,6 +1582,7 @@ void i915_hangcheck_elapsed(unsigned long data);
 void i915_handle_error(struct drm_device *dev, bool wedged);
 
 extern void intel_irq_init(struct drm_device *dev);
+extern void intel_pm_init(struct drm_device *dev);
 extern void intel_hpd_init(struct drm_device *dev);
 extern void intel_gt_init(struct drm_device *dev);
 extern void intel_gt_sanitize(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 51a2a60f5bfc..f895d1508df8 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -5536,6 +5536,12 @@ void intel_gt_init(struct drm_device *dev)
                 dev_priv->gt.force_wake_get = __gen6_gt_force_wake_get;
                 dev_priv->gt.force_wake_put = __gen6_gt_force_wake_put;
         }
+}
+
+void intel_pm_init(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
         INIT_DELAYED_WORK(&dev_priv->rps.delayed_resume_work,
                           intel_gen6_powersave_work);
 }
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index 251784aa2225..503a414cbdad 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -29,6 +29,7 @@ static void mga_crtc_load_lut(struct drm_crtc *crtc)
         struct mga_crtc *mga_crtc = to_mga_crtc(crtc);
         struct drm_device *dev = crtc->dev;
         struct mga_device *mdev = dev->dev_private;
+        struct drm_framebuffer *fb = crtc->fb;
         int i;
 
         if (!crtc->enabled)
@@ -36,6 +37,28 @@ static void mga_crtc_load_lut(struct drm_crtc *crtc)
 
         WREG8(DAC_INDEX + MGA1064_INDEX, 0);
 
+        if (fb && fb->bits_per_pixel == 16) {
+                int inc = (fb->depth == 15) ? 8 : 4;
+                u8 r, b;
+                for (i = 0; i < MGAG200_LUT_SIZE; i += inc) {
+                        if (fb->depth == 16) {
+                                if (i > (MGAG200_LUT_SIZE >> 1)) {
+                                        r = b = 0;
+                                } else {
+                                        r = mga_crtc->lut_r[i << 1];
+                                        b = mga_crtc->lut_b[i << 1];
+                                }
+                        } else {
+                                r = mga_crtc->lut_r[i];
+                                b = mga_crtc->lut_b[i];
+                        }
+                        /* VGA registers */
+                        WREG8(DAC_INDEX + MGA1064_COL_PAL, r);
+                        WREG8(DAC_INDEX + MGA1064_COL_PAL, mga_crtc->lut_g[i]);
+                        WREG8(DAC_INDEX + MGA1064_COL_PAL, b);
+                }
+                return;
+        }
         for (i = 0; i < MGAG200_LUT_SIZE; i++) {
                 /* VGA registers */
                 WREG8(DAC_INDEX + MGA1064_COL_PAL, mga_crtc->lut_r[i]);
@@ -877,7 +900,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
 
         pitch = crtc->fb->pitches[0] / (crtc->fb->bits_per_pixel / 8);
         if (crtc->fb->bits_per_pixel == 24)
-                pitch = pitch >> (4 - bppshift);
+                pitch = (pitch * 3) >> (4 - bppshift);
         else
                 pitch = pitch >> (4 - bppshift);
 
@@ -1251,6 +1274,24 @@ static void mga_crtc_destroy(struct drm_crtc *crtc)
         kfree(mga_crtc);
 }
 
+static void mga_crtc_disable(struct drm_crtc *crtc)
+{
+        int ret;
+        DRM_DEBUG_KMS("\n");
+        mga_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
+        if (crtc->fb) {
+                struct mga_framebuffer *mga_fb = to_mga_framebuffer(crtc->fb);
+                struct drm_gem_object *obj = mga_fb->obj;
+                struct mgag200_bo *bo = gem_to_mga_bo(obj);
+                ret = mgag200_bo_reserve(bo, false);
+                if (ret)
+                        return;
+                mgag200_bo_push_sysram(bo);
+                mgag200_bo_unreserve(bo);
+        }
+        crtc->fb = NULL;
+}
+
 /* These provide the minimum set of functions required to handle a CRTC */
 static const struct drm_crtc_funcs mga_crtc_funcs = {
         .cursor_set = mga_crtc_cursor_set,
@@ -1261,6 +1302,7 @@ static const struct drm_crtc_funcs mga_crtc_funcs = {
 };
 
 static const struct drm_crtc_helper_funcs mga_helper_funcs = {
+        .disable = mga_crtc_disable,
         .dpms = mga_crtc_dpms,
         .mode_fixup = mga_crtc_mode_fixup,
         .mode_set = mga_crtc_mode_set,
@@ -1581,6 +1623,8 @@ static struct drm_connector *mga_vga_init(struct drm_device *dev)
 
         drm_connector_helper_add(connector, &mga_vga_connector_helper_funcs);
 
+        drm_sysfs_connector_add(connector);
+
         mga_connector->i2c = mgag200_i2c_create(dev);
         if (!mga_connector->i2c)
                 DRM_ERROR("failed to add ddc bus\n");
diff --git a/drivers/gpu/drm/mgag200/mgag200_ttm.c b/drivers/gpu/drm/mgag200/mgag200_ttm.c
index 3acb2b044c7b..13878d5de063 100644
--- a/drivers/gpu/drm/mgag200/mgag200_ttm.c
+++ b/drivers/gpu/drm/mgag200/mgag200_ttm.c
@@ -353,6 +353,7 @@ int mgag200_bo_pin(struct mgag200_bo *bo, u32 pl_flag, u64 *gpu_addr)
                 bo->pin_count++;
                 if (gpu_addr)
                         *gpu_addr = mgag200_bo_gpu_offset(bo);
+                return 0;
         }
 
         mgag200_ttm_placement(bo, pl_flag);
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c b/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c
index 373dbcc523b2..a19e7d79b847 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c
@@ -36,6 +36,8 @@ nva3_hda_eld(struct nv50_disp_priv *priv, int or, u8 *data, u32 size)
         if (data && data[0]) {
                 for (i = 0; i < size; i++)
                         nv_wr32(priv, 0x61c440 + soff, (i << 8) | data[i]);
+                for (; i < 0x60; i++)
+                        nv_wr32(priv, 0x61c440 + soff, (i << 8));
                 nv_mask(priv, 0x61c448 + soff, 0x80000003, 0x80000003);
         } else
         if (data) {
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c b/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c
index dc57e24fc1df..717639386ced 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c
@@ -41,6 +41,8 @@ nvd0_hda_eld(struct nv50_disp_priv *priv, int or, u8 *data, u32 size)
         if (data && data[0]) {
                 for (i = 0; i < size; i++)
                         nv_wr32(priv, 0x10ec00 + soff, (i << 8) | data[i]);
+                for (; i < 0x60; i++)
+                        nv_wr32(priv, 0x10ec00 + soff, (i << 8));
                 nv_mask(priv, 0x10ec10 + soff, 0x80000003, 0x80000003);
         } else
         if (data) {
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
index ab1e918469a8..526b75242899 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
@@ -47,14 +47,8 @@ int
 nv50_sor_mthd(struct nouveau_object *object, u32 mthd, void *args, u32 size)
 {
         struct nv50_disp_priv *priv = (void *)object->engine;
-        struct nouveau_bios *bios = nouveau_bios(priv);
-        const u16 type = (mthd & NV50_DISP_SOR_MTHD_TYPE) >> 12;
         const u8  head = (mthd & NV50_DISP_SOR_MTHD_HEAD) >> 3;
-        const u8  link = (mthd & NV50_DISP_SOR_MTHD_LINK) >> 2;
         const u8    or = (mthd & NV50_DISP_SOR_MTHD_OR);
-        const u16 mask = (0x0100 << head) | (0x0040 << link) | (0x0001 << or);
-        struct dcb_output outp;
-        u8  ver, hdr;
         u32 data;
         int ret = -EINVAL;
 
@@ -62,8 +56,6 @@ nv50_sor_mthd(struct nouveau_object *object, u32 mthd, void *args, u32 size)
                 return -EINVAL;
         data = *(u32 *)args;
 
-        if (type && !dcb_outp_match(bios, type, mask, &ver, &hdr, &outp))
-                return -ENODEV;
 
         switch (mthd & ~0x3f) {
         case NV50_DISP_SOR_PWR:
diff --git a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv31.c b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv31.c
index 49ecbb859b25..c19004301309 100644
--- a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv31.c
+++ b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv31.c
@@ -265,8 +265,8 @@ nv31_mpeg_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
 int
 nv31_mpeg_init(struct nouveau_object *object)
 {
-        struct nouveau_engine *engine = nv_engine(object->engine);
-        struct nv31_mpeg_priv *priv = (void *)engine;
+        struct nouveau_engine *engine = nv_engine(object);
+        struct nv31_mpeg_priv *priv = (void *)object;
         struct nouveau_fb *pfb = nouveau_fb(object);
         int ret, i;
 
@@ -284,7 +284,10 @@ nv31_mpeg_init(struct nouveau_object *object)
         /* PMPEG init */
         nv_wr32(priv, 0x00b32c, 0x00000000);
         nv_wr32(priv, 0x00b314, 0x00000100);
-        nv_wr32(priv, 0x00b220, nv44_graph_class(priv) ? 0x00000044 : 0x00000031);
+        if (nv_device(priv)->chipset >= 0x40 && nv44_graph_class(priv))
+                nv_wr32(priv, 0x00b220, 0x00000044);
+        else
+                nv_wr32(priv, 0x00b220, 0x00000031);
         nv_wr32(priv, 0x00b300, 0x02001ec1);
         nv_mask(priv, 0x00b32c, 0x00000001, 0x00000001);
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
index f7c581ad1991..dd6196072e9c 100644
--- a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
+++ b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
@@ -61,6 +61,7 @@ nv40_mpeg_context_ctor(struct nouveau_object *parent,
         if (ret)
                 return ret;
 
+        nv_wo32(&chan->base.base, 0x78, 0x02001ec1);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/xtensa.c b/drivers/gpu/drm/nouveau/core/engine/xtensa.c
index 0639bc59d0a5..5f6ede7c4892 100644
--- a/drivers/gpu/drm/nouveau/core/engine/xtensa.c
+++ b/drivers/gpu/drm/nouveau/core/engine/xtensa.c
@@ -118,7 +118,13 @@ _nouveau_xtensa_init(struct nouveau_object *object)
                         return ret;
                 }
 
-                ret = nouveau_gpuobj_new(object, NULL, fw->size, 0x1000, 0,
+                if (fw->size > 0x40000) {
+                        nv_warn(xtensa, "firmware %s too large\n", name);
+                        release_firmware(fw);
+                        return -EINVAL;
+                }
+
+                ret = nouveau_gpuobj_new(object, NULL, 0x40000, 0x1000, 0,
                                          &xtensa->gpu_fw);
                 if (ret) {
                         release_firmware(fw);
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/vm.h b/drivers/gpu/drm/nouveau/core/include/subdev/vm.h
index f2e87b105666..fcf57fa309bf 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/vm.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/vm.h
@@ -55,7 +55,7 @@ struct nouveau_vma {
 struct nouveau_vm {
         struct nouveau_vmmgr *vmm;
         struct nouveau_mm mm;
-        int refcount;
+        struct kref refcount;
 
         struct list_head pgd_list;
         atomic_t engref[NVDEV_SUBDEV_NR];
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/priv.h b/drivers/gpu/drm/nouveau/core/subdev/fb/priv.h
index 6c974dd83e8b..db9d6ddde52c 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/priv.h
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/priv.h
@@ -81,7 +81,7 @@ void nv44_fb_tile_prog(struct nouveau_fb *, int, struct nouveau_fb_tile *);
 void nv46_fb_tile_init(struct nouveau_fb *, int i, u32 addr, u32 size,
                        u32 pitch, u32 flags, struct nouveau_fb_tile *);
 
-void nv50_ram_put(struct nouveau_fb *, struct nouveau_mem **);
+void __nv50_ram_put(struct nouveau_fb *, struct nouveau_mem *);
 extern int nv50_fb_memtype[0x80];
 
 #endif
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv50.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv50.c
index af5aa7ee8ad9..903baff77fdd 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv50.c
@@ -27,17 +27,10 @@
 #include "priv.h"
 
 void
-nv50_ram_put(struct nouveau_fb *pfb, struct nouveau_mem **pmem)
+__nv50_ram_put(struct nouveau_fb *pfb, struct nouveau_mem *mem)
 {
         struct nouveau_mm_node *this;
-        struct nouveau_mem *mem;
 
-        mem = *pmem;
-        *pmem = NULL;
-        if (unlikely(mem == NULL))
-                return;
-
-        mutex_lock(&pfb->base.mutex);
         while (!list_empty(&mem->regions)) {
                 this = list_first_entry(&mem->regions, typeof(*this), rl_entry);
 
@@ -46,6 +39,19 @@ nv50_ram_put(struct nouveau_fb *pfb, struct nouveau_mem **pmem)
         }
 
         nouveau_mm_free(&pfb->tags, &mem->tag);
+}
+
+void
+nv50_ram_put(struct nouveau_fb *pfb, struct nouveau_mem **pmem)
+{
+        struct nouveau_mem *mem = *pmem;
+
+        *pmem = NULL;
+        if (unlikely(mem == NULL))
+                return;
+
+        mutex_lock(&pfb->base.mutex);
+        __nv50_ram_put(pfb, mem);
         mutex_unlock(&pfb->base.mutex);
 
         kfree(mem);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvc0.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvc0.c
index 9c3634acbb9d..cf97c4de4a6b 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvc0.c
@@ -33,11 +33,19 @@ void
 nvc0_ram_put(struct nouveau_fb *pfb, struct nouveau_mem **pmem)
 {
         struct nouveau_ltcg *ltcg = nouveau_ltcg(pfb);
+        struct nouveau_mem *mem = *pmem;
 
-        if ((*pmem)->tag)
-                ltcg->tags_free(ltcg, &(*pmem)->tag);
+        *pmem = NULL;
+        if (unlikely(mem == NULL))
+                return;
 
-        nv50_ram_put(pfb, pmem);
+        mutex_lock(&pfb->base.mutex);
+        if (mem->tag)
+                ltcg->tags_free(ltcg, &mem->tag);
+        __nv50_ram_put(pfb, mem);
+        mutex_unlock(&pfb->base.mutex);
+
+        kfree(mem);
 }
 
 int
diff --git a/drivers/gpu/drm/nouveau/core/subdev/gpio/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/gpio/nv50.c
index bf489dcf46e2..c4c1d415e7fe 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/gpio/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/gpio/nv50.c
@@ -103,7 +103,7 @@ nv50_gpio_intr(struct nouveau_subdev *subdev)
         int i;
 
         intr0 = nv_rd32(priv, 0xe054) & nv_rd32(priv, 0xe050);
-        if (nv_device(priv)->chipset >= 0x90)
+        if (nv_device(priv)->chipset > 0x92)
                 intr1 = nv_rd32(priv, 0xe074) & nv_rd32(priv, 0xe070);
 
         hi = (intr0 & 0x0000ffff) | (intr1 << 16);
@@ -115,7 +115,7 @@ nv50_gpio_intr(struct nouveau_subdev *subdev)
         }
 
         nv_wr32(priv, 0xe054, intr0);
-        if (nv_device(priv)->chipset >= 0x90)
+        if (nv_device(priv)->chipset > 0x92)
                 nv_wr32(priv, 0xe074, intr1);
 }
 
@@ -146,7 +146,7 @@ nv50_gpio_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         int ret;
 
         ret = nouveau_gpio_create(parent, engine, oclass,
-                                  nv_device(parent)->chipset >= 0x90 ? 32 : 16,
+                                  nv_device(parent)->chipset > 0x92 ? 32 : 16,
                                   &priv);
         *pobject = nv_object(priv);
         if (ret)
@@ -182,7 +182,7 @@ nv50_gpio_init(struct nouveau_object *object)
         /* disable, and ack any pending gpio interrupts */
         nv_wr32(priv, 0xe050, 0x00000000);
         nv_wr32(priv, 0xe054, 0xffffffff);
-        if (nv_device(priv)->chipset >= 0x90) {
+        if (nv_device(priv)->chipset > 0x92) {
                 nv_wr32(priv, 0xe070, 0x00000000);
                 nv_wr32(priv, 0xe074, 0xffffffff);
         }
@@ -195,7 +195,7 @@ nv50_gpio_fini(struct nouveau_object *object, bool suspend)
 {
         struct nv50_gpio_priv *priv = (void *)object;
         nv_wr32(priv, 0xe050, 0x00000000);
-        if (nv_device(priv)->chipset >= 0x90)
+        if (nv_device(priv)->chipset > 0x92)
                 nv_wr32(priv, 0xe070, 0x00000000);
         return nouveau_gpio_fini(&priv->base, suspend);
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
index 0cb322a5e72c..f25fc5fc7dd1 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
@@ -41,7 +41,7 @@ nv50_mc_intr[] = {
         { 0x04000000, NVDEV_ENGINE_DISP },
         { 0x10000000, NVDEV_SUBDEV_BUS },
         { 0x80000000, NVDEV_ENGINE_SW },
-        { 0x0000d101, NVDEV_SUBDEV_FB },
+        { 0x0002d101, NVDEV_SUBDEV_FB },
         {},
 };
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
index 67fcb6c852ac..ef3133e7575c 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
@@ -361,7 +361,7 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
 
         INIT_LIST_HEAD(&vm->pgd_list);
         vm->vmm = vmm;
-        vm->refcount = 1;
+        kref_init(&vm->refcount);
         vm->fpde = offset >> (vmm->pgt_bits + 12);
         vm->lpde = (offset + length - 1) >> (vmm->pgt_bits + 12);
 
@@ -441,8 +441,9 @@ nouveau_vm_unlink(struct nouveau_vm *vm, struct nouveau_gpuobj *mpgd)
 }
 
 static void
-nouveau_vm_del(struct nouveau_vm *vm)
+nouveau_vm_del(struct kref *kref)
 {
+        struct nouveau_vm *vm = container_of(kref, typeof(*vm), refcount);
         struct nouveau_vm_pgd *vpgd, *tmp;
 
         list_for_each_entry_safe(vpgd, tmp, &vm->pgd_list, head) {
@@ -458,27 +459,19 @@ int
 nouveau_vm_ref(struct nouveau_vm *ref, struct nouveau_vm **ptr,
                struct nouveau_gpuobj *pgd)
 {
-        struct nouveau_vm *vm;
-        int ret;
-
-        vm = ref;
-        if (vm) {
-                ret = nouveau_vm_link(vm, pgd);
+        if (ref) {
+                int ret = nouveau_vm_link(ref, pgd);
                 if (ret)
                         return ret;
 
-                vm->refcount++;
+                kref_get(&ref->refcount);
         }
 
-        vm = *ptr;
-        *ptr = ref;
-
-        if (vm) {
-                nouveau_vm_unlink(vm, pgd);
-
-                if (--vm->refcount == 0)
-                        nouveau_vm_del(vm);
+        if (*ptr) {
+                nouveau_vm_unlink(*ptr, pgd);
+                kref_put(&(*ptr)->refcount, nouveau_vm_del);
         }
 
+        *ptr = ref;
         return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 4e7ee5f4155c..af20fba3a1a4 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -198,7 +198,12 @@ nouveau_bo_new(struct drm_device *dev, int size, int align,
         size_t acc_size;
         int ret;
         int type = ttm_bo_type_device;
-        int max_size = INT_MAX & ~((1 << drm->client.base.vm->vmm->lpg_shift) - 1);
+        int lpg_shift = 12;
+        int max_size;
+
+        if (drm->client.base.vm)
+                lpg_shift = drm->client.base.vm->vmm->lpg_shift;
+        max_size = INT_MAX & ~((1 << lpg_shift) - 1);
 
         if (size <= 0 || size > max_size) {
                 nv_warn(drm, "skipped size %x\n", (u32)size);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 4c1bc061fae2..8f6d63d7edd3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -398,7 +398,8 @@ void
 nouveau_fbcon_output_poll_changed(struct drm_device *dev)
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
-        drm_fb_helper_hotplug_event(&drm->fbcon->helper);
+        if (drm->fbcon)
+                drm_fb_helper_hotplug_event(&drm->fbcon->helper);
 }
 
 static int
diff --git a/drivers/gpu/drm/nouveau/nv17_fence.c b/drivers/gpu/drm/nouveau/nv17_fence.c
index 8e47a9bae8c3..22aa9963ea6f 100644
--- a/drivers/gpu/drm/nouveau/nv17_fence.c
+++ b/drivers/gpu/drm/nouveau/nv17_fence.c
@@ -76,7 +76,7 @@ nv17_fence_context_new(struct nouveau_channel *chan)
         struct ttm_mem_reg *mem = &priv->bo->bo.mem;
         struct nouveau_object *object;
         u32 start = mem->start * PAGE_SIZE;
-        u32 limit = mem->start + mem->size - 1;
+        u32 limit = start + mem->size - 1;
         int ret = 0;
 
         fctx = chan->fence = kzalloc(sizeof(*fctx), GFP_KERNEL);
diff --git a/drivers/gpu/drm/nouveau/nv50_fence.c b/drivers/gpu/drm/nouveau/nv50_fence.c
index f9701e567db8..0ee363840035 100644
--- a/drivers/gpu/drm/nouveau/nv50_fence.c
+++ b/drivers/gpu/drm/nouveau/nv50_fence.c
@@ -39,6 +39,8 @@ nv50_fence_context_new(struct nouveau_channel *chan)
         struct nv10_fence_chan *fctx;
         struct ttm_mem_reg *mem = &priv->bo->bo.mem;
         struct nouveau_object *object;
+        u32 start = mem->start * PAGE_SIZE;
+        u32 limit = start + mem->size - 1;
         int ret, i;
 
         fctx = chan->fence = kzalloc(sizeof(*fctx), GFP_KERNEL);
@@ -51,26 +53,28 @@ nv50_fence_context_new(struct nouveau_channel *chan)
         fctx->base.sync = nv17_fence_sync;
 
         ret = nouveau_object_new(nv_object(chan->cli), chan->handle,
-                                 NvSema, 0x0002,
+                                 NvSema, 0x003d,
                                  &(struct nv_dma_class) {
                                         .flags = NV_DMA_TARGET_VRAM |
                                                  NV_DMA_ACCESS_RDWR,
-                                        .start = mem->start * PAGE_SIZE,
-                                        .limit = mem->size - 1,
+                                        .start = start,
+                                        .limit = limit,
                                  }, sizeof(struct nv_dma_class),
                                  &object);
 
         /* dma objects for display sync channel semaphore blocks */
         for (i = 0; !ret && i < dev->mode_config.num_crtc; i++) {
                 struct nouveau_bo *bo = nv50_display_crtc_sema(dev, i);
+                u32 start = bo->bo.mem.start * PAGE_SIZE;
+                u32 limit = start + bo->bo.mem.size - 1;
 
                 ret = nouveau_object_new(nv_object(chan->cli), chan->handle,
                                          NvEvoSema0 + i, 0x003d,
                                          &(struct nv_dma_class) {
                                                 .flags = NV_DMA_TARGET_VRAM |
                                                          NV_DMA_ACCESS_RDWR,
-                                                .start = bo->bo.offset,
-                                                .limit = bo->bo.offset + 0xfff,
+                                                .start = start,
+                                                .limit = limit,
                                          }, sizeof(struct nv_dma_class),
                                          &object);
         }
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index fb441a790f3d..15da7ef344a4 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -1222,12 +1222,17 @@ int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
         int r;
 
         mutex_lock(&ctx->mutex);
+        /* reset data block */
+        ctx->data_block = 0;
         /* reset reg block */
         ctx->reg_block = 0;
         /* reset fb window */
         ctx->fb_base = 0;
         /* reset io mode */
         ctx->io_mode = ATOM_IO_MM;
+        /* reset divmul */
+        ctx->divmul[0] = 0;
+        ctx->divmul[1] = 0;
         r = atom_execute_table_locked(ctx, index, params);
         mutex_unlock(&ctx->mutex);
         return r;
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index b0d3fb341417..bb9ea3641312 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -157,9 +157,9 @@ static void evergreen_audio_set_dto(struct drm_encoder *encoder, u32 clock)
          * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
          * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
          */
+        WREG32(DCCG_AUDIO_DTO_SOURCE, DCCG_AUDIO_DTO0_SOURCE_SEL(radeon_crtc->crtc_id));
         WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
         WREG32(DCCG_AUDIO_DTO0_MODULE, clock * 100);
-        WREG32(DCCG_AUDIO_DTO_SOURCE, DCCG_AUDIO_DTO0_SOURCE_SEL(radeon_crtc->crtc_id));
 }
 
 
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 559cf24d51af..4f9b9bc20daa 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -1054,10 +1054,6 @@ static int ni_restrict_performance_levels_before_switch(struct radeon_device *rd
 int ni_dpm_force_performance_level(struct radeon_device *rdev,
                                    enum radeon_dpm_forced_level level)
 {
-        struct radeon_ps *rps = rdev->pm.dpm.current_ps;
-        struct ni_ps *ps = ni_get_ps(rps);
-        u32 levels;
-
         if (level == RADEON_DPM_FORCED_LEVEL_HIGH) {
                 if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 0) != PPSMC_Result_OK)
                         return -EINVAL;
@@ -1068,8 +1064,7 @@ int ni_dpm_force_performance_level(struct radeon_device *rdev,
                 if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
                         return -EINVAL;
 
-                levels = ps->performance_level_count - 1;
-                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
+                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 1) != PPSMC_Result_OK)
                         return -EINVAL;
         } else if (level == RADEON_DPM_FORCED_LEVEL_AUTO) {
                 if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index e3f3e8841789..4ccd61f60eb6 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2782,7 +2782,7 @@ int radeon_atom_get_clock_dividers(struct radeon_device *rdev,
                                                              ATOM_PLL_CNTL_FLAG_PLL_POST_DIV_EN) ? true : false;
                                 dividers->enable_dithen = (args.v3.ucCntlFlag &
                                                            ATOM_PLL_CNTL_FLAG_FRACTION_DISABLE) ? false : true;
-                                dividers->fb_div = le16_to_cpu(args.v3.ulFbDiv.usFbDiv);
+                                dividers->whole_fb_div = le16_to_cpu(args.v3.ulFbDiv.usFbDiv);
                                 dividers->frac_fb_div = le16_to_cpu(args.v3.ulFbDiv.usFbDivFrac);
                                 dividers->ref_div = args.v3.ucRefDiv;
                                 dividers->vco_mode = (args.v3.ucCntlFlag &
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index d325280e2f9f..6ca904673a4f 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -5215,14 +5215,12 @@ static void si_enable_mc_ls(struct radeon_device *rdev,
 
 static void si_init_cg(struct radeon_device *rdev)
 {
-        bool has_uvd = true;
-
         si_enable_mgcg(rdev, true);
-        si_enable_cgcg(rdev, true);
+        si_enable_cgcg(rdev, false);
         /* disable MC LS on Tahiti */
         if (rdev->family == CHIP_TAHITI)
                 si_enable_mc_ls(rdev, false);
-        if (has_uvd) {
+        if (rdev->has_uvd) {
                 si_enable_uvd_mgcg(rdev, true);
                 si_init_uvd_internal_cg(rdev);
         }
@@ -5230,9 +5228,7 @@ static void si_init_cg(struct radeon_device *rdev)
 
 static void si_fini_cg(struct radeon_device *rdev)
 {
-        bool has_uvd = true;
-
-        if (has_uvd)
+        if (rdev->has_uvd)
                 si_enable_uvd_mgcg(rdev, false);
         si_enable_cgcg(rdev, false);
         si_enable_mgcg(rdev, false);
@@ -5241,11 +5237,11 @@ static void si_fini_cg(struct radeon_device *rdev)
 static void si_init_pg(struct radeon_device *rdev)
 {
         bool has_pg = false;
-
+#if 0
         /* only cape verde supports PG */
         if (rdev->family == CHIP_VERDE)
                 has_pg = true;
-
+#endif
         if (has_pg) {
                 si_init_ao_cu_mask(rdev);
                 si_init_dma_pg(rdev);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 73aaa2e4c312..41825575b403 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -37,8 +37,6 @@
 
 #define SMC_RAM_END                 0x20000
 
-#define DDR3_DRAM_ROWS              0x2000
-
 #define SCLK_MIN_DEEPSLEEP_FREQ     1350
 
 static const struct si_cac_config_reg cac_weights_tahiti[] =
@@ -1767,8 +1765,9 @@ static void si_calculate_leakage_for_v_and_t_formula(const struct ni_leakage_coe
 {
         s64 kt, kv, leakage_w, i_leakage, vddc;
         s64 temperature, t_slope, t_intercept, av, bv, t_ref;
+        s64 tmp;
 
-        i_leakage = drm_int2fixp(ileakage / 100);
+        i_leakage = div64_s64(drm_int2fixp(ileakage), 100);
         vddc = div64_s64(drm_int2fixp(v), 1000);
         temperature = div64_s64(drm_int2fixp(t), 1000);
 
@@ -1778,8 +1777,9 @@ static void si_calculate_leakage_for_v_and_t_formula(const struct ni_leakage_coe
         bv = div64_s64(drm_int2fixp(coeff->bv), 100000000);
         t_ref = drm_int2fixp(coeff->t_ref);
 
-        kt = drm_fixp_div(drm_fixp_exp(drm_fixp_mul(drm_fixp_mul(t_slope, vddc) + t_intercept, temperature)),
-                          drm_fixp_exp(drm_fixp_mul(drm_fixp_mul(t_slope, vddc) + t_intercept, t_ref)));
+        tmp = drm_fixp_mul(t_slope, vddc) + t_intercept;
+        kt = drm_fixp_exp(drm_fixp_mul(tmp, temperature));
+        kt = drm_fixp_div(kt, drm_fixp_exp(drm_fixp_mul(tmp, t_ref)));
         kv = drm_fixp_mul(av, drm_fixp_exp(drm_fixp_mul(bv, vddc)));
 
         leakage_w = drm_fixp_mul(drm_fixp_mul(drm_fixp_mul(i_leakage, kt), kv), vddc);
@@ -1931,6 +1931,7 @@ static void si_initialize_powertune_defaults(struct radeon_device *rdev)
                         si_pi->cac_override = cac_override_pitcairn;
                         si_pi->powertune_data = &powertune_data_pitcairn;
                         si_pi->dte_data = dte_data_pitcairn;
+                        break;
                 }
         } else if (rdev->family == CHIP_VERDE) {
                 si_pi->lcac_config = lcac_cape_verde;
@@ -1941,6 +1942,7 @@ static void si_initialize_powertune_defaults(struct radeon_device *rdev)
                 case 0x683B:
                 case 0x683F:
                 case 0x6829:
+                case 0x6835:
                         si_pi->cac_weights = cac_weights_cape_verde_pro;
                         si_pi->dte_data = dte_data_cape_verde;
                         break;
@@ -3237,10 +3239,10 @@ int si_dpm_force_performance_level(struct radeon_device *rdev,
 {
         struct radeon_ps *rps = rdev->pm.dpm.current_ps;
         struct ni_ps *ps = ni_get_ps(rps);
-        u32 levels;
+        u32 levels = ps->performance_level_count;
 
         if (level == RADEON_DPM_FORCED_LEVEL_HIGH) {
-                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 0) != PPSMC_Result_OK)
+                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
                         return -EINVAL;
 
                 if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 1) != PPSMC_Result_OK)
@@ -3249,14 +3251,13 @@ int si_dpm_force_performance_level(struct radeon_device *rdev,
                 if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
                         return -EINVAL;
 
-                levels = ps->performance_level_count - 1;
-                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
+                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 1) != PPSMC_Result_OK)
                         return -EINVAL;
         } else if (level == RADEON_DPM_FORCED_LEVEL_AUTO) {
                 if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
                         return -EINVAL;
 
-                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 0) != PPSMC_Result_OK)
+                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
                         return -EINVAL;
         }
 
@@ -3620,8 +3621,12 @@ static void si_enable_display_gap(struct radeon_device *rdev)
 {
         u32 tmp = RREG32(CG_DISPLAY_GAP_CNTL);
 
+        tmp &= ~(DISP1_GAP_MASK | DISP2_GAP_MASK);
+        tmp |= (DISP1_GAP(R600_PM_DISPLAY_GAP_IGNORE) |
+                DISP2_GAP(R600_PM_DISPLAY_GAP_IGNORE));
+
         tmp &= ~(DISP1_GAP_MCHG_MASK | DISP2_GAP_MCHG_MASK);
-        tmp |= (DISP1_GAP_MCHG(R600_PM_DISPLAY_GAP_IGNORE) |
+        tmp |= (DISP1_GAP_MCHG(R600_PM_DISPLAY_GAP_VBLANK) |
                 DISP2_GAP_MCHG(R600_PM_DISPLAY_GAP_IGNORE));
         WREG32(CG_DISPLAY_GAP_CNTL, tmp);
 }
@@ -4036,16 +4041,15 @@ static int si_force_switch_to_arb_f0(struct radeon_device *rdev)
 static u32 si_calculate_memory_refresh_rate(struct radeon_device *rdev,
                                             u32 engine_clock)
 {
-        struct rv7xx_power_info *pi = rv770_get_pi(rdev);
         u32 dram_rows;
         u32 dram_refresh_rate;
         u32 mc_arb_rfsh_rate;
         u32 tmp = (RREG32(MC_ARB_RAMCFG) & NOOFROWS_MASK) >> NOOFROWS_SHIFT;
 
-        if (pi->mem_gddr5)
-                dram_rows = 1 << (tmp + 10);
+        if (tmp >= 4)
+                dram_rows = 16384;
         else
-                dram_rows = DDR3_DRAM_ROWS;
+                dram_rows = 1 << (tmp + 10);
 
         dram_refresh_rate = 1 << ((RREG32(MC_SEQ_MISC0) & 0x3) + 3);
         mc_arb_rfsh_rate = ((engine_clock * 10) * dram_refresh_rate / dram_rows - 32) / 64;
@@ -6013,16 +6017,11 @@ int si_dpm_set_power_state(struct radeon_device *rdev)
                 return ret;
         }
 
-#if 0
-        /* XXX */
         ret = si_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
         if (ret) {
                 DRM_ERROR("si_dpm_force_performance_level failed\n");
                 return ret;
         }
-#else
-        rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
-#endif
 
         return 0;
 }
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 5207591a598c..7a5764843bfb 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -192,6 +192,7 @@ static struct hid_ll_driver logi_dj_ll_driver;
 static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
                                         size_t count,
                                         unsigned char report_type);
+static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev);
 
 static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev,
                                                 struct dj_report *dj_report)
@@ -232,6 +233,7 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
         if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] &
             SPFUNCTION_DEVICE_LIST_EMPTY) {
                 dbg_hid("%s: device list is empty\n", __func__);
+                djrcv_dev->querying_devices = false;
                 return;
         }
 
@@ -242,6 +244,12 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
                 return;
         }
 
+        if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
+                /* The device is already known. No need to reallocate it. */
+                dbg_hid("%s: device is already known\n", __func__);
+                return;
+        }
+
         dj_hiddev = hid_allocate_device();
         if (IS_ERR(dj_hiddev)) {
                 dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
@@ -305,6 +313,7 @@ static void delayedwork_callback(struct work_struct *work)
         struct dj_report dj_report;
         unsigned long flags;
         int count;
+        int retval;
 
         dbg_hid("%s\n", __func__);
 
@@ -337,6 +346,25 @@ static void delayedwork_callback(struct work_struct *work)
                 logi_dj_recv_destroy_djhid_device(djrcv_dev, &dj_report);
                 break;
         default:
+        /* A normal report (i. e. not belonging to a pair/unpair notification)
+         * arriving here, means that the report arrived but we did not have a
+         * paired dj_device associated to the report's device_index, this
+         * means that the original "device paired" notification corresponding
+         * to this dj_device never arrived to this driver. The reason is that
+         * hid-core discards all packets coming from a device while probe() is
+         * executing. */
+        if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) {
+                /* ok, we don't know the device, just re-ask the
+                 * receiver for the list of connected devices. */
+                retval = logi_dj_recv_query_paired_devices(djrcv_dev);
+                if (!retval) {
+                        /* everything went fine, so just leave */
+                        break;
+                }
+                dev_err(&djrcv_dev->hdev->dev,
+                        "%s:logi_dj_recv_query_paired_devices "
+                        "error:%d\n", __func__, retval);
+                }
                 dbg_hid("%s: unexpected report type\n", __func__);
         }
 }
@@ -367,6 +395,12 @@ static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
         if (!djdev) {
                 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
                         " is NULL, index %d\n", dj_report->device_index);
+                kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+
+                if (schedule_work(&djrcv_dev->work) == 0) {
+                        dbg_hid("%s: did not schedule the work item, was already "
+                        "queued\n", __func__);
+                }
                 return;
         }
 
@@ -397,6 +431,12 @@ static void logi_dj_recv_forward_report(struct dj_receiver_dev *djrcv_dev,
         if (dj_device == NULL) {
                 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
                         " is NULL, index %d\n", dj_report->device_index);
+                kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+
+                if (schedule_work(&djrcv_dev->work) == 0) {
+                        dbg_hid("%s: did not schedule the work item, was already "
+                        "queued\n", __func__);
+                }
                 return;
         }
 
@@ -444,6 +484,12 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
         struct dj_report *dj_report;
         int retval;
 
+        /* no need to protect djrcv_dev->querying_devices */
+        if (djrcv_dev->querying_devices)
+                return 0;
+
+        djrcv_dev->querying_devices = true;
+
         dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
         if (!dj_report)
                 return -ENOMEM;
@@ -455,6 +501,7 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
         return retval;
 }
 
+
 static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
                                           unsigned timeout)
 {
diff --git a/drivers/hid/hid-logitech-dj.h b/drivers/hid/hid-logitech-dj.h
index fd28a5e0ca3b..4a4000340ce1 100644
--- a/drivers/hid/hid-logitech-dj.h
+++ b/drivers/hid/hid-logitech-dj.h
@@ -101,6 +101,7 @@ struct dj_receiver_dev {
         struct work_struct work;
         struct kfifo notif_fifo;
         spinlock_t lock;
+        bool querying_devices;
 };
 
 struct dj_device {
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index ecbc74923d06..87fbe2924cfa 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -369,7 +369,8 @@ static int sony_mapping(struct hid_device *hdev, struct hid_input *hi,
         if (sc->quirks & PS3REMOTE)
                 return ps3remote_mapping(hdev, hi, field, usage, bit, max);
 
-        return -1;
+        /* Let hid-core decide for the others */
+        return 0;
 }
 
 /*
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index a7451632ceb4..6f1feb2c2e97 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -518,7 +518,6 @@ int hidraw_connect(struct hid_device *hid)
                 goto out;
         }
 
-        mutex_unlock(&minors_lock);
         init_waitqueue_head(&dev->wait);
         INIT_LIST_HEAD(&dev->list);
 
@@ -528,6 +527,7 @@ int hidraw_connect(struct hid_device *hid)
         dev->exist = 1;
         hid->hidraw = dev;
 
+        mutex_unlock(&minors_lock);
 out:
         return result;
 
diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c
index 328fb0353c17..a41b5f3fc506 100644
--- a/drivers/hwmon/max6697.c
+++ b/drivers/hwmon/max6697.c
@@ -605,12 +605,12 @@ static int max6697_init_chip(struct i2c_client *client)
                 if (ret < 0)
                         return ret;
                 ret = i2c_smbus_write_byte_data(client, MAX6581_REG_IDEALITY,
-                                                pdata->ideality_mask >> 1);
+                                                pdata->ideality_value);
                 if (ret < 0)
                         return ret;
                 ret = i2c_smbus_write_byte_data(client,
                                                 MAX6581_REG_IDEALITY_SELECT,
-                                                pdata->ideality_value);
+                                                pdata->ideality_mask >> 1);
                 if (ret < 0)
                         return ret;
         }
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index f1c279fabe64..7c0f9535fb7d 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -423,7 +423,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
         struct sockaddr_ib *addr;
         union ib_gid gid, sgid, *dgid;
         u16 pkey, index;
-        u8 port, p;
+        u8 p;
         int i;
 
         cma_dev = NULL;
@@ -443,7 +443,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
                                 if (!memcmp(&gid, dgid, sizeof(gid))) {
                                         cma_dev = cur_dev;
                                         sgid = gid;
-                                        port = p;
+                                        id_priv->id.port_num = p;
                                         goto found;
                                 }
 
@@ -451,7 +451,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
                                                  dgid->global.subnet_prefix)) {
                                         cma_dev = cur_dev;
                                         sgid = gid;
-                                        port = p;
+                                        id_priv->id.port_num = p;
                                 }
                         }
                 }
@@ -462,7 +462,6 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
 
 found:
         cma_attach_to_dev(id_priv, cma_dev);
-        id_priv->id.port_num = port;
         addr = (struct sockaddr_ib *) cma_src_addr(id_priv);
         memcpy(&addr->sib_addr, &sgid, sizeof sgid);
         cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr);
@@ -880,7 +879,8 @@ static int cma_save_net_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id
 {
         struct cma_hdr *hdr;
 
-        if (listen_id->route.addr.src_addr.ss_family == AF_IB) {
+        if ((listen_id->route.addr.src_addr.ss_family == AF_IB) &&
+            (ib_event->event == IB_CM_REQ_RECEIVED)) {
                 cma_save_ib_info(id, listen_id, ib_event->param.req_rcvd.primary_path);
                 return 0;
         }
@@ -2677,29 +2677,32 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
 {
         struct ib_cm_sidr_req_param req;
         struct ib_cm_id *id;
+        void *private_data;
         int offset, ret;
 
+        memset(&req, 0, sizeof req);
         offset = cma_user_data_offset(id_priv);
         req.private_data_len = offset + conn_param->private_data_len;
         if (req.private_data_len < conn_param->private_data_len)
                 return -EINVAL;
 
         if (req.private_data_len) {
-                req.private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
-                if (!req.private_data)
+                private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
+                if (!private_data)
                         return -ENOMEM;
         } else {
-                req.private_data = NULL;
+                private_data = NULL;
         }
 
         if (conn_param->private_data && conn_param->private_data_len)
-                memcpy((void *) req.private_data + offset,
-                       conn_param->private_data, conn_param->private_data_len);
+                memcpy(private_data + offset, conn_param->private_data,
+                       conn_param->private_data_len);
 
-        if (req.private_data) {
-                ret = cma_format_hdr((void *) req.private_data, id_priv);
+        if (private_data) {
+                ret = cma_format_hdr(private_data, id_priv);
                 if (ret)
                         goto out;
+                req.private_data = private_data;
         }
 
         id = ib_create_cm_id(id_priv->id.device, cma_sidr_rep_handler,
@@ -2721,7 +2724,7 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
                 id_priv->cm_id.ib = NULL;
         }
 out:
-        kfree(req.private_data);
+        kfree(private_data);
         return ret;
 }
 
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index dc3fd1e8af07..4c837e66516b 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -2663,6 +2663,7 @@ static int ib_mad_port_start(struct ib_mad_port_private *port_priv)
         int ret, i;
         struct ib_qp_attr *attr;
         struct ib_qp *qp;
+        u16 pkey_index;
 
         attr = kmalloc(sizeof *attr, GFP_KERNEL);
         if (!attr) {
@@ -2670,6 +2671,11 @@ static int ib_mad_port_start(struct ib_mad_port_private *port_priv)
                 return -ENOMEM;
         }
 
+        ret = ib_find_pkey(port_priv->device, port_priv->port_num,
+                           IB_DEFAULT_PKEY_FULL, &pkey_index);
+        if (ret)
+                pkey_index = 0;
+
         for (i = 0; i < IB_MAD_QPS_CORE; i++) {
                 qp = port_priv->qp_info[i].qp;
                 if (!qp)
@@ -2680,7 +2686,7 @@ static int ib_mad_port_start(struct ib_mad_port_private *port_priv)
                  * one is needed for the Reset to Init transition
                  */
                 attr->qp_state = IB_QPS_INIT;
-                attr->pkey_index = 0;
+                attr->pkey_index = pkey_index;
                 attr->qkey = (qp->qp_num == 0) ? 0 : IB_QP1_QKEY;
                 ret = ib_modify_qp(qp, attr, IB_QP_STATE |
                                              IB_QP_PKEY_INDEX | IB_QP_QKEY);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index e87f2201b220..d2283837d451 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -226,6 +226,7 @@ static struct ib_cq *iwch_create_cq(struct ib_device *ibdev, int entries, int ve
                         mm->len = PAGE_ALIGN(((1UL << uresp.size_log2) + 1) *
                                              sizeof(struct t3_cqe));
                         uresp.memsize = mm->len;
+                        uresp.reserved = 0;
                         resplen = sizeof uresp;
                 }
                 if (ib_copy_to_udata(udata, &uresp, resplen)) {
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 232040447e8a..a4975e1654a6 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1657,6 +1657,8 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
                 if (mm5) {
                         uresp.ma_sync_key = ucontext->key;
                         ucontext->key += PAGE_SIZE;
+                } else {
+                        uresp.ma_sync_key =  0;
                 }
                 uresp.sq_key = ucontext->key;
                 ucontext->key += PAGE_SIZE;
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 4d599cedbb0b..f2a3f48107e7 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1511,8 +1511,14 @@ static int create_pv_sqp(struct mlx4_ib_demux_pv_ctx *ctx,
 
         memset(&attr, 0, sizeof attr);
         attr.qp_state = IB_QPS_INIT;
-        attr.pkey_index =
-                to_mdev(ctx->ib_dev)->pkeys.virt2phys_pkey[ctx->slave][ctx->port - 1][0];
+        ret = 0;
+        if (create_tun)
+                ret = find_slave_port_pkey_ix(to_mdev(ctx->ib_dev), ctx->slave,
+                                              ctx->port, IB_DEFAULT_PKEY_FULL,
+                                              &attr.pkey_index);
+        if (ret || !create_tun)
+                attr.pkey_index =
+                        to_mdev(ctx->ib_dev)->pkeys.virt2phys_pkey[ctx->slave][ctx->port - 1][0];
         attr.qkey = IB_QP1_QKEY;
         attr.port_num = ctx->port;
         ret = ib_modify_qp(tun_qp->qp, &attr, qp_attr_mask_INIT);
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 8000fff4d444..3f831de9a4d8 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -619,7 +619,8 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev,
 
         resp.tot_uuars = req.total_num_uuars;
         resp.num_ports = dev->mdev.caps.num_ports;
-        err = ib_copy_to_udata(udata, &resp, sizeof(resp));
+        err = ib_copy_to_udata(udata, &resp,
+                               sizeof(resp) - sizeof(resp.reserved));
         if (err)
                 goto out_uars;
 
@@ -1426,7 +1427,8 @@ static int init_one(struct pci_dev *pdev,
         if (err)
                 goto err_eqs;
 
-        if (ib_register_device(&dev->ib_dev, NULL))
+        err = ib_register_device(&dev->ib_dev, NULL);
+        if (err)
                 goto err_rsrc;
 
         err = create_umr_res(dev);
@@ -1434,8 +1436,9 @@ static int init_one(struct pci_dev *pdev,
                 goto err_dev;
 
         for (i = 0; i < ARRAY_SIZE(mlx5_class_attributes); i++) {
-                if (device_create_file(&dev->ib_dev.dev,
-                                       mlx5_class_attributes[i]))
+                err = device_create_file(&dev->ib_dev.dev,
+                                         mlx5_class_attributes[i]);
+                if (err)
                         goto err_umrc;
         }
 
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 16ac54c9819f..045f8cdbd303 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -199,7 +199,7 @@ static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap,
 
 static int sq_overhead(enum ib_qp_type qp_type)
 {
-        int size;
+        int size = 0;
 
         switch (qp_type) {
         case IB_QPT_XRC_INI:
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index 418004c93feb..90200245c5eb 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -3570,10 +3570,10 @@ static void nes_process_iwarp_aeqe(struct nes_device *nesdev,
         tcp_state = (aeq_info & NES_AEQE_TCP_STATE_MASK) >> NES_AEQE_TCP_STATE_SHIFT;
         iwarp_state = (aeq_info & NES_AEQE_IWARP_STATE_MASK) >> NES_AEQE_IWARP_STATE_SHIFT;
         nes_debug(NES_DBG_AEQ, "aeid = 0x%04X, qp-cq id = %d, aeqe = %p,"
-                        " Tcp state = %d, iWARP state = %d\n",
+                        " Tcp state = %s, iWARP state = %s\n",
                         async_event_id,
                         le32_to_cpu(aeqe->aeqe_words[NES_AEQE_COMP_QP_CQ_ID_IDX]), aeqe,
-                        tcp_state, iwarp_state);
+                        nes_tcp_state_str[tcp_state], nes_iwarp_state_str[iwarp_state]);
 
         aeqe_cq_id = le32_to_cpu(aeqe->aeqe_words[NES_AEQE_COMP_QP_CQ_ID_IDX]);
         if (aeq_info & NES_AEQE_QP) {
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 8f67fe2e91e6..5b53ca5a2284 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -1384,6 +1384,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
 
                         if (ibpd->uobject) {
                                 uresp.mmap_sq_db_index = nesqp->mmap_sq_db_index;
+                                uresp.mmap_rq_db_index = 0;
                                 uresp.actual_sq_size = sq_size;
                                 uresp.actual_rq_size = rq_size;
                                 uresp.qp_id = nesqp->hwqp.qp_id;
@@ -1767,7 +1768,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                 resp.cq_id = nescq->hw_cq.cq_number;
                 resp.cq_size = nescq->hw_cq.cq_size;
                 resp.mmap_db_index = 0;
-                if (ib_copy_to_udata(udata, &resp, sizeof resp)) {
+                if (ib_copy_to_udata(udata, &resp, sizeof resp - sizeof resp.reserved)) {
                         nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);
                         kfree(nescq);
                         return ERR_PTR(-EFAULT);
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
index a877a8ed7907..f4c587c68f64 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
@@ -29,7 +29,6 @@
 #include <net/netevent.h>
 
 #include <rdma/ib_addr.h>
-#include <rdma/ib_cache.h>
 
 #include "ocrdma.h"
 #include "ocrdma_verbs.h"
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index dcfbab177faa..f36630e4b6be 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -242,6 +242,7 @@ struct ib_ucontext *ocrdma_alloc_ucontext(struct ib_device *ibdev,
         memset(ctx->ah_tbl.va, 0, map_len);
         ctx->ah_tbl.len = map_len;
 
+        memset(&resp, 0, sizeof(resp));
         resp.ah_tbl_len = ctx->ah_tbl.len;
         resp.ah_tbl_page = ctx->ah_tbl.pa;
 
@@ -253,7 +254,6 @@ struct ib_ucontext *ocrdma_alloc_ucontext(struct ib_device *ibdev,
         resp.wqe_size = dev->attr.wqe_size;
         resp.rqe_size = dev->attr.rqe_size;
         resp.dpp_wqe_size = dev->attr.wqe_size;
-        resp.rsvd = 0;
 
         memcpy(resp.fw_ver, dev->attr.fw_ver, sizeof(resp.fw_ver));
         status = ib_copy_to_udata(udata, &resp, sizeof(resp));
@@ -338,6 +338,7 @@ static int ocrdma_copy_pd_uresp(struct ocrdma_pd *pd,
         struct ocrdma_alloc_pd_uresp rsp;
         struct ocrdma_ucontext *uctx = get_ocrdma_ucontext(ib_ctx);
 
+        memset(&rsp, 0, sizeof(rsp));
         rsp.id = pd->id;
         rsp.dpp_enabled = pd->dpp_enabled;
         db_page_addr = pd->dev->nic_info.unmapped_db +
@@ -692,6 +693,7 @@ static int ocrdma_copy_cq_uresp(struct ocrdma_cq *cq, struct ib_udata *udata,
         struct ocrdma_ucontext *uctx;
         struct ocrdma_create_cq_uresp uresp;
 
+        memset(&uresp, 0, sizeof(uresp));
         uresp.cq_id = cq->id;
         uresp.page_size = cq->len;
         uresp.num_pages = 1;
@@ -1460,6 +1462,7 @@ static int ocrdma_copy_srq_uresp(struct ocrdma_srq *srq, struct ib_udata *udata)
         int status;
         struct ocrdma_create_srq_uresp uresp;
 
+        memset(&uresp, 0, sizeof(uresp));
         uresp.rq_dbid = srq->rq.dbid;
         uresp.num_rq_pages = 1;
         uresp.rq_page_addr[0] = srq->rq.pa;
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 21e8b09d4bf8..016e7429adf6 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -1596,6 +1596,8 @@ static void sdma_7322_p_errors(struct qib_pportdata *ppd, u64 errs)
         struct qib_devdata *dd = ppd->dd;
 
         errs &= QIB_E_P_SDMAERRS;
+        err_decode(ppd->cpspec->sdmamsgbuf, sizeof(ppd->cpspec->sdmamsgbuf),
+                   errs, qib_7322p_error_msgs);
 
         if (errs & QIB_E_P_SDMAUNEXPDATA)
                 qib_dev_err(dd, "IB%u:%u SDmaUnexpData\n", dd->unit,
diff --git a/drivers/infiniband/hw/qib/qib_sdma.c b/drivers/infiniband/hw/qib/qib_sdma.c
index 32162d355370..9b5322d8cd5a 100644
--- a/drivers/infiniband/hw/qib/qib_sdma.c
+++ b/drivers/infiniband/hw/qib/qib_sdma.c
@@ -717,7 +717,7 @@ void dump_sdma_state(struct qib_pportdata *ppd)
         struct qib_sdma_txreq *txp, *txpnext;
         __le64 *descqp;
         u64 desc[2];
-        dma_addr_t addr;
+        u64 addr;
         u16 gen, dwlen, dwoffset;
         u16 head, tail, cnt;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 2cfa76f5d99e..196b1d13cbcb 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -932,12 +932,47 @@ int ipoib_ib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
         return 0;
 }
 
+/*
+ * Takes whatever value which is in pkey index 0 and updates priv->pkey
+ * returns 0 if the pkey value was changed.
+ */
+static inline int update_parent_pkey(struct ipoib_dev_priv *priv)
+{
+        int result;
+        u16 prev_pkey;
+
+        prev_pkey = priv->pkey;
+        result = ib_query_pkey(priv->ca, priv->port, 0, &priv->pkey);
+        if (result) {
+                ipoib_warn(priv, "ib_query_pkey port %d failed (ret = %d)\n",
+                           priv->port, result);
+                return result;
+        }
+
+        priv->pkey |= 0x8000;
+
+        if (prev_pkey != priv->pkey) {
+                ipoib_dbg(priv, "pkey changed from 0x%x to 0x%x\n",
+                          prev_pkey, priv->pkey);
+                /*
+                 * Update the pkey in the broadcast address, while making sure to set
+                 * the full membership bit, so that we join the right broadcast group.
+                 */
+                priv->dev->broadcast[8] = priv->pkey >> 8;
+                priv->dev->broadcast[9] = priv->pkey & 0xff;
+                return 0;
+        }
+
+        return 1;
+}
+
 static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
                                 enum ipoib_flush_level level)
 {
         struct ipoib_dev_priv *cpriv;
         struct net_device *dev = priv->dev;
         u16 new_index;
+        int result;
 
         mutex_lock(&priv->vlan_mutex);
 
@@ -951,6 +986,10 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
         mutex_unlock(&priv->vlan_mutex);
 
         if (!test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags)) {
+                /* for non-child devices must check/update the pkey value here */
+                if (level == IPOIB_FLUSH_HEAVY &&
+                    !test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags))
+                        update_parent_pkey(priv);
                 ipoib_dbg(priv, "Not flushing - IPOIB_FLAG_INITIALIZED not set.\n");
                 return;
         }
@@ -961,21 +1000,32 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
         }
 
         if (level == IPOIB_FLUSH_HEAVY) {
-                if (ib_find_pkey(priv->ca, priv->port, priv->pkey, &new_index)) {
-                        clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
-                        ipoib_ib_dev_down(dev, 0);
-                        ipoib_ib_dev_stop(dev, 0);
-                        if (ipoib_pkey_dev_delay_open(dev))
+                /* child devices chase their origin pkey value, while non-child
+                 * (parent) devices should always takes what present in pkey index 0
+                 */
+                if (test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags)) {
+                        if (ib_find_pkey(priv->ca, priv->port, priv->pkey, &new_index)) {
+                                clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
+                                ipoib_ib_dev_down(dev, 0);
+                                ipoib_ib_dev_stop(dev, 0);
+                                if (ipoib_pkey_dev_delay_open(dev))
+                                        return;
+                        }
+                        /* restart QP only if P_Key index is changed */
+                        if (test_and_set_bit(IPOIB_PKEY_ASSIGNED, &priv->flags) &&
+                            new_index == priv->pkey_index) {
+                                ipoib_dbg(priv, "Not flushing - P_Key index not changed.\n");
                                 return;
+                        }
+                        priv->pkey_index = new_index;
+                } else {
+                        result = update_parent_pkey(priv);
+                        /* restart QP only if P_Key value changed */
+                        if (result) {
+                                ipoib_dbg(priv, "Not flushing - P_Key value not changed.\n");
+                                return;
+                        }
                 }
-
-                /* restart QP only if P_Key index is changed */
-                if (test_and_set_bit(IPOIB_PKEY_ASSIGNED, &priv->flags) &&
-                    new_index == priv->pkey_index) {
-                        ipoib_dbg(priv, "Not flushing - P_Key index not changed.\n");
-                        return;
-                }
-                priv->pkey_index = new_index;
         }
 
         if (level == IPOIB_FLUSH_LIGHT) {
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index b6e049a3c7a8..c6f71a88c55c 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1461,7 +1461,7 @@ static ssize_t create_child(struct device *dev,
         if (sscanf(buf, "%i", &pkey) != 1)
                 return -EINVAL;
 
-        if (pkey < 0 || pkey > 0xffff)
+        if (pkey <= 0 || pkey > 0xffff || pkey == 0x8000)
                 return -EINVAL;
 
         /*
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
index 74685936c948..f81abe16cf09 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
@@ -119,6 +119,15 @@ static int ipoib_new_child_link(struct net *src_net, struct net_device *dev,
         } else
                 child_pkey  = nla_get_u16(data[IFLA_IPOIB_PKEY]);
 
+        if (child_pkey == 0 || child_pkey == 0x8000)
+                return -EINVAL;
+
+        /*
+         * Set the full membership bit, so that we join the right
+         * broadcast group, etc.
+         */
+        child_pkey |= 0x8000;
+
         err = __ipoib_vlan_add(ppriv, netdev_priv(dev), child_pkey, IPOIB_RTNL_CHILD);
 
         if (!err && data)
diff --git a/drivers/macintosh/windfarm_rm31.c b/drivers/macintosh/windfarm_rm31.c
index 0b9a79b2f48a..82fc86a90c1a 100644
--- a/drivers/macintosh/windfarm_rm31.c
+++ b/drivers/macintosh/windfarm_rm31.c
@@ -439,15 +439,15 @@ static void backside_setup_pid(void)
 
 /* Slots fan */
 static const struct wf_pid_param slots_param = {
-        .interval       = 5,
-        .history_len    = 2,
-        .gd             = 30 << 20,
-        .gp             = 5 << 20,
-        .gr             = 0,
-        .itarget        = 40 << 16,
-        .additive       = 1,
-        .min            = 300,
-        .max            = 4000,
+        .interval       = 1,
+        .history_len    = 20,
+        .gd             = 0,
+        .gp             = 0,
+        .gr             = 0x00100000,
+        .itarget        = 3200000,
+        .additive       = 0,
+        .min            = 20,
+        .max            = 100,
 };
 
 static void slots_fan_tick(void)
diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
index a746ba272f04..a956053608f9 100644
--- a/drivers/net/arcnet/arcnet.c
+++ b/drivers/net/arcnet/arcnet.c
@@ -1007,7 +1007,7 @@ static void arcnet_rx(struct net_device *dev, int bufnum)
 
         soft = &pkt.soft.rfc1201;
 
-        lp->hw.copy_from_card(dev, bufnum, 0, &pkt, sizeof(ARC_HDR_SIZE));
+        lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE);
         if (pkt.hard.offset[0]) {
                 ofs = pkt.hard.offset[0];
                 length = 256 - ofs;
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 6aa7b3266c80..ac6177d3befc 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -412,10 +412,20 @@ static void esd_usb2_read_bulk_callback(struct urb *urb)
 
                 switch (msg->msg.hdr.cmd) {
                 case CMD_CAN_RX:
+                        if (msg->msg.rx.net >= dev->net_count) {
+                                dev_err(dev->udev->dev.parent, "format error\n");
+                                break;
+                        }
+
                         esd_usb2_rx_can_msg(dev->nets[msg->msg.rx.net], msg);
                         break;
 
                 case CMD_CAN_TX:
+                        if (msg->msg.txdone.net >= dev->net_count) {
+                                dev_err(dev->udev->dev.parent, "format error\n");
+                                break;
+                        }
+
                         esd_usb2_tx_done_msg(dev->nets[msg->msg.txdone.net],
                                              msg);
                         break;
diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index cbd388eea682..8becd3d838b5 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -779,6 +779,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
                         usb_unanchor_urb(urb);
                         usb_free_coherent(priv->udev, RX_BUFFER_SIZE, buf,
                                           urb->transfer_dma);
+                        usb_free_urb(urb);
                         break;
                 }
 
diff --git a/drivers/net/ethernet/allwinner/Kconfig b/drivers/net/ethernet/allwinner/Kconfig
index 53ad213e865b..d8d95d4cd45a 100644
--- a/drivers/net/ethernet/allwinner/Kconfig
+++ b/drivers/net/ethernet/allwinner/Kconfig
@@ -3,19 +3,20 @@
 #
 
 config NET_VENDOR_ALLWINNER
-       bool "Allwinner devices"
-       default y
-       depends on ARCH_SUNXI
-       ---help---
-         If you have a network (Ethernet) card belonging to this
-         class, say Y and read the Ethernet-HOWTO, available from
-         <http://www.tldp.org/docs.html#howto>.
+        bool "Allwinner devices"
+        default y
 
-         Note that the answer to this question doesn't directly
-         affect the kernel: saying N will just cause the configurator
-         to skip all the questions about Allwinner cards. If you say Y,
-         you will be asked for your specific card in the following
-         questions.
+        depends on ARCH_SUNXI
+        ---help---
+          If you have a network (Ethernet) card belonging to this
+          class, say Y and read the Ethernet-HOWTO, available from
+          <http://www.tldp.org/docs.html#howto>.
+
+          Note that the answer to this question doesn't directly
+          affect the kernel: saying N will just cause the configurator
+          to skip all the questions about Allwinner cards. If you say Y,
+          you will be asked for your specific card in the following
+          questions.
 
 if NET_VENDOR_ALLWINNER
 
@@ -26,6 +27,7 @@ config SUN4I_EMAC
         select CRC32
         select MII
         select PHYLIB
+        select MDIO_SUN4I
         ---help---
           Support for Allwinner A10 EMAC ethernet driver.
 
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c.h b/drivers/net/ethernet/atheros/atl1c/atl1c.h
index b2bf324631dc..0f0556526ba9 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c.h
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c.h
@@ -520,6 +520,9 @@ struct atl1c_adapter {
         struct net_device   *netdev;
         struct pci_dev      *pdev;
         struct napi_struct  napi;
+        struct page         *rx_page;
+        unsigned int        rx_page_offset;
+        unsigned int        rx_frag_size;
         struct atl1c_hw        hw;
         struct atl1c_hw_stats  hw_stats;
         struct mii_if_info  mii;    /* MII interface info */
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 786a87483298..a36a760ada28 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -481,10 +481,15 @@ static int atl1c_set_mac_addr(struct net_device *netdev, void *p)
 static void atl1c_set_rxbufsize(struct atl1c_adapter *adapter,
                                 struct net_device *dev)
 {
+        unsigned int head_size;
         int mtu = dev->mtu;
 
         adapter->rx_buffer_len = mtu > AT_RX_BUF_SIZE ?
                 roundup(mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN, 8) : AT_RX_BUF_SIZE;
+
+        head_size = SKB_DATA_ALIGN(adapter->rx_buffer_len + NET_SKB_PAD) +
+                    SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+        adapter->rx_frag_size = roundup_pow_of_two(head_size);
 }
 
 static netdev_features_t atl1c_fix_features(struct net_device *netdev,
@@ -952,6 +957,10 @@ static void atl1c_free_ring_resources(struct atl1c_adapter *adapter)
                 kfree(adapter->tpd_ring[0].buffer_info);
                 adapter->tpd_ring[0].buffer_info = NULL;
         }
+        if (adapter->rx_page) {
+                put_page(adapter->rx_page);
+                adapter->rx_page = NULL;
+        }
 }
 
 /**
@@ -1639,6 +1648,35 @@ static inline void atl1c_rx_checksum(struct atl1c_adapter *adapter,
         skb_checksum_none_assert(skb);
 }
 
+static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter)
+{
+        struct sk_buff *skb;
+        struct page *page;
+
+        if (adapter->rx_frag_size > PAGE_SIZE)
+                return netdev_alloc_skb(adapter->netdev,
+                                        adapter->rx_buffer_len);
+
+        page = adapter->rx_page;
+        if (!page) {
+                adapter->rx_page = page = alloc_page(GFP_ATOMIC);
+                if (unlikely(!page))
+                        return NULL;
+                adapter->rx_page_offset = 0;
+        }
+
+        skb = build_skb(page_address(page) + adapter->rx_page_offset,
+                        adapter->rx_frag_size);
+        if (likely(skb)) {
+                adapter->rx_page_offset += adapter->rx_frag_size;
+                if (adapter->rx_page_offset >= PAGE_SIZE)
+                        adapter->rx_page = NULL;
+                else
+                        get_page(page);
+        }
+        return skb;
+}
+
 static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
 {
         struct atl1c_rfd_ring *rfd_ring = &adapter->rfd_ring;
@@ -1660,7 +1698,7 @@ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
         while (next_info->flags & ATL1C_BUFFER_FREE) {
                 rfd_desc = ATL1C_RFD_DESC(rfd_ring, rfd_next_to_use);
 
-                skb = netdev_alloc_skb(adapter->netdev, adapter->rx_buffer_len);
+                skb = atl1c_alloc_skb(adapter);
                 if (unlikely(!skb)) {
                         if (netif_msg_rx_err(adapter))
                                 dev_warn(&pdev->dev, "alloc rx buffer failed\n");
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index dedbd76c033e..d80e34b8285f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -486,7 +486,7 @@ struct bnx2x_fastpath {
 
         struct napi_struct      napi;
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         unsigned int state;
 #define BNX2X_FP_STATE_IDLE                   0
 #define BNX2X_FP_STATE_NAPI             (1 << 0)    /* NAPI owns this FP */
@@ -498,7 +498,7 @@ struct bnx2x_fastpath {
 #define BNX2X_FP_USER_PEND (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_POLL_YIELD)
         /* protect state */
         spinlock_t lock;
-#endif /* CONFIG_NET_LL_RX_POLL */
+#endif /* CONFIG_NET_RX_BUSY_POLL */
 
         union host_hc_status_block      status_blk;
         /* chip independent shortcuts into sb structure */
@@ -572,7 +572,7 @@ struct bnx2x_fastpath {
 #define bnx2x_fp_stats(bp, fp)  (&((bp)->fp_stats[(fp)->index]))
 #define bnx2x_fp_qstats(bp, fp) (&((bp)->fp_stats[(fp)->index].eth_q_stats))
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 static inline void bnx2x_fp_init_lock(struct bnx2x_fastpath *fp)
 {
         spin_lock_init(&fp->lock);
@@ -680,7 +680,7 @@ static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
 {
         return false;
 }
-#endif /* CONFIG_NET_LL_RX_POLL */
+#endif /* CONFIG_NET_RX_BUSY_POLL */
 
 /* Use 2500 as a mini-jumbo MTU for FCoE */
 #define BNX2X_FCOE_MINI_JUMBO_MTU       2500
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index ee350bde1818..f2d1ff10054b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3117,7 +3117,7 @@ int bnx2x_poll(struct napi_struct *napi, int budget)
         return work_done;
 }
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 /* must be called with local_bh_disable()d */
 int bnx2x_low_latency_recv(struct napi_struct *napi)
 {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index e5da07858a2f..e06186c305d8 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12026,7 +12026,7 @@ static const struct net_device_ops bnx2x_netdev_ops = {
         .ndo_fcoe_get_wwn       = bnx2x_fcoe_get_wwn,
 #endif
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         .ndo_busy_poll          = bnx2x_low_latency_recv,
 #endif
 };
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index d964f302ac94..ddebc7a5dda0 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -17625,7 +17625,8 @@ err_out_free_res:
         pci_release_regions(pdev);
 
 err_out_disable_pdev:
-        pci_disable_device(pdev);
+        if (pci_is_enabled(pdev))
+                pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
         return err;
 }
@@ -17773,7 +17774,8 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
 
         rtnl_lock();
 
-        if (!netif_running(netdev))
+        /* We probably don't have netdev yet */
+        if (!netdev || !netif_running(netdev))
                 goto done;
 
         tg3_phy_stop(tp);
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index 2b0a0ea4f8e7..ae236009f1a8 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -259,6 +259,7 @@ struct bufdesc_ex {
 struct fec_enet_delayed_work {
         struct delayed_work delay_work;
         bool timeout;
+        bool trig_tx;
 };
 
 /* The FEC buffer descriptors track the ring buffers.  The rx_bd_base and
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index d3ad5ea711d3..77ea0db0bbfc 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -93,6 +93,20 @@ static void set_multicast_list(struct net_device *ndev);
 #define FEC_QUIRK_HAS_CSUM              (1 << 5)
 /* Controller has hardware vlan support */
 #define FEC_QUIRK_HAS_VLAN              (1 << 6)
+/* ENET IP errata ERR006358
+ *
+ * If the ready bit in the transmit buffer descriptor (TxBD[R]) is previously
+ * detected as not set during a prior frame transmission, then the
+ * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
+ * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
+ * If the ready bit in the transmit buffer descriptor (TxBD[R]) is previously
+ * detected as not set during a prior frame transmission, then the
+ * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
+ * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
+ * frames not being transmitted until there is a 0-to-1 transition on
+ * ENET_TDAR[TDAR].
+ */
+#define FEC_QUIRK_ERR006358            (1 << 7)
 
 static struct platform_device_id fec_devtype[] = {
         {
@@ -112,7 +126,7 @@ static struct platform_device_id fec_devtype[] = {
                 .name = "imx6q-fec",
                 .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
                                 FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
-                                FEC_QUIRK_HAS_VLAN,
+                                FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR006358,
         }, {
                 .name = "mvf600-fec",
                 .driver_data = FEC_QUIRK_ENET_MAC,
@@ -275,16 +289,11 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         struct fec_enet_private *fep = netdev_priv(ndev);
         const struct platform_device_id *id_entry =
                                 platform_get_device_id(fep->pdev);
-        struct bufdesc *bdp;
+        struct bufdesc *bdp, *bdp_pre;
         void *bufaddr;
         unsigned short  status;
         unsigned int index;
 
-        if (!fep->link) {
-                /* Link is down or auto-negotiation is in progress. */
-                return NETDEV_TX_BUSY;
-        }
-
         /* Fill in a Tx ring entry */
         bdp = fep->cur_tx;
 
@@ -370,6 +379,15 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                                 ebdp->cbd_esc |= BD_ENET_TX_PINS;
                 }
         }
+
+        bdp_pre = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
+        if ((id_entry->driver_data & FEC_QUIRK_ERR006358) &&
+            !(bdp_pre->cbd_sc & BD_ENET_TX_READY)) {
+                fep->delay_work.trig_tx = true;
+                schedule_delayed_work(&(fep->delay_work.delay_work),
+                                        msecs_to_jiffies(1));
+        }
+
         /* If this was the last BD in the ring, start at the beginning again. */
         if (status & BD_ENET_TX_WRAP)
                 bdp = fep->tx_bd_base;
@@ -689,6 +707,11 @@ static void fec_enet_work(struct work_struct *work)
                 fec_restart(fep->netdev, fep->full_duplex);
                 netif_wake_queue(fep->netdev);
         }
+
+        if (fep->delay_work.trig_tx) {
+                fep->delay_work.trig_tx = false;
+                writel(0, fep->hwp + FEC_X_DES_ACTIVE);
+        }
 }
 
 static void
@@ -2279,4 +2302,5 @@ static struct platform_driver fec_driver = {
 
 module_platform_driver(fec_driver);
 
+MODULE_ALIAS("platform:"DRIVER_NAME);
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 6a0c1b66ce54..c1d72c03cb59 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -3739,9 +3739,8 @@ static void igb_set_rx_mode(struct net_device *netdev)
         rctl &= ~(E1000_RCTL_UPE | E1000_RCTL_MPE | E1000_RCTL_VFE);
 
         if (netdev->flags & IFF_PROMISC) {
-                u32 mrqc = rd32(E1000_MRQC);
                 /* retain VLAN HW filtering if in VT mode */
-                if (mrqc & E1000_MRQC_ENABLE_VMDQ)
+                if (adapter->vfs_allocated_count)
                         rctl |= E1000_RCTL_VFE;
                 rctl |= (E1000_RCTL_UPE | E1000_RCTL_MPE);
                 vmolr |= (E1000_VMOLR_ROPE | E1000_VMOLR_MPME);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
index 7be725cdfea8..a6494e5daffe 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
@@ -54,7 +54,7 @@
 
 #include <net/busy_poll.h>
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 #define LL_EXTENDED_STATS
 #endif
 /* common prefix used by pr_<> macros */
@@ -366,7 +366,7 @@ struct ixgbe_q_vector {
         struct rcu_head rcu;    /* to avoid race with update stats on free */
         char name[IFNAMSIZ + 9];
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         unsigned int state;
 #define IXGBE_QV_STATE_IDLE        0
 #define IXGBE_QV_STATE_NAPI        1    /* NAPI owns this QV */
@@ -377,12 +377,12 @@ struct ixgbe_q_vector {
 #define IXGBE_QV_YIELD (IXGBE_QV_STATE_NAPI_YIELD | IXGBE_QV_STATE_POLL_YIELD)
 #define IXGBE_QV_USER_PEND (IXGBE_QV_STATE_POLL | IXGBE_QV_STATE_POLL_YIELD)
         spinlock_t lock;
-#endif  /* CONFIG_NET_LL_RX_POLL */
+#endif  /* CONFIG_NET_RX_BUSY_POLL */
 
         /* for dynamic allocation of rings associated with this q_vector */
         struct ixgbe_ring ring[0] ____cacheline_internodealigned_in_smp;
 };
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 static inline void ixgbe_qv_init_lock(struct ixgbe_q_vector *q_vector)
 {
 
@@ -462,7 +462,7 @@ static inline bool ixgbe_qv_ll_polling(struct ixgbe_q_vector *q_vector)
         WARN_ON(!(q_vector->state & IXGBE_QV_LOCKED));
         return q_vector->state & IXGBE_QV_USER_PEND;
 }
-#else /* CONFIG_NET_LL_RX_POLL */
+#else /* CONFIG_NET_RX_BUSY_POLL */
 static inline void ixgbe_qv_init_lock(struct ixgbe_q_vector *q_vector)
 {
 }
@@ -491,7 +491,7 @@ static inline bool ixgbe_qv_ll_polling(struct ixgbe_q_vector *q_vector)
 {
         return false;
 }
-#endif /* CONFIG_NET_LL_RX_POLL */
+#endif /* CONFIG_NET_RX_BUSY_POLL */
 
 #ifdef CONFIG_IXGBE_HWMON
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
index ac780770863d..7a77f37a7cbc 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
@@ -108,9 +108,8 @@ s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *hw,
 
         /* Enable arbiter */
         reg &= ~IXGBE_DPMCS_ARBDIS;
-        /* Enable DFP and Recycle mode */
-        reg |= (IXGBE_DPMCS_TDPAC | IXGBE_DPMCS_TRM);
         reg |= IXGBE_DPMCS_TSOEF;
+
         /* Configure Max TSO packet size 34KB including payload and headers */
         reg |= (0x4 << IXGBE_DPMCS_MTSOS_SHIFT);
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index bad8f14b1941..be4b1fb3d0d2 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1998,7 +1998,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
         return total_rx_packets;
 }
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 /* must be called with local_bh_disable()d */
 static int ixgbe_low_latency_recv(struct napi_struct *napi)
 {
@@ -2030,7 +2030,7 @@ static int ixgbe_low_latency_recv(struct napi_struct *napi)
 
         return found;
 }
-#endif  /* CONFIG_NET_LL_RX_POLL */
+#endif  /* CONFIG_NET_RX_BUSY_POLL */
 
 /**
  * ixgbe_configure_msix - Configure MSI-X hardware
@@ -7227,7 +7227,7 @@ static const struct net_device_ops ixgbe_netdev_ops = {
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = ixgbe_netpoll,
 #endif
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         .ndo_busy_poll          = ixgbe_low_latency_recv,
 #endif
 #ifdef IXGBE_FCOE
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 712779fb12b7..b017818bccae 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -88,6 +88,8 @@
 #define      MVNETA_TX_IN_PRGRS                  BIT(1)
 #define      MVNETA_TX_FIFO_EMPTY                BIT(8)
 #define MVNETA_RX_MIN_FRAME_SIZE                 0x247c
+#define MVNETA_SGMII_SERDES_CFG                  0x24A0
+#define      MVNETA_SGMII_SERDES_PROTO           0x0cc7
 #define MVNETA_TYPE_PRIO                         0x24bc
 #define      MVNETA_FORCE_UNI                    BIT(21)
 #define MVNETA_TXQ_CMD_1                         0x24e4
@@ -655,6 +657,8 @@ static void mvneta_port_sgmii_config(struct mvneta_port *pp)
         val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
         val |= MVNETA_GMAC2_PSC_ENABLE;
         mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
+
+        mvreg_write(pp, MVNETA_SGMII_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO);
 }
 
 /* Start the Ethernet port RX and TX activity */
@@ -2728,28 +2732,24 @@ static int mvneta_probe(struct platform_device *pdev)
 
         pp = netdev_priv(dev);
 
-        pp->tx_done_timer.function = mvneta_tx_done_timer_callback;
-        init_timer(&pp->tx_done_timer);
-        clear_bit(MVNETA_F_TX_DONE_TIMER_BIT, &pp->flags);
-
         pp->weight = MVNETA_RX_POLL_WEIGHT;
         pp->phy_node = phy_node;
         pp->phy_interface = phy_mode;
 
-        pp->base = of_iomap(dn, 0);
-        if (pp->base == NULL) {
-                err = -ENOMEM;
-                goto err_free_irq;
-        }
-
         pp->clk = devm_clk_get(&pdev->dev, NULL);
         if (IS_ERR(pp->clk)) {
                 err = PTR_ERR(pp->clk);
-                goto err_unmap;
+                goto err_free_irq;
         }
 
         clk_prepare_enable(pp->clk);
 
+        pp->base = of_iomap(dn, 0);
+        if (pp->base == NULL) {
+                err = -ENOMEM;
+                goto err_clk;
+        }
+
         dt_mac_addr = of_get_mac_address(dn);
         if (dt_mac_addr && is_valid_ether_addr(dt_mac_addr)) {
                 mac_from = "device tree";
@@ -2766,6 +2766,9 @@ static int mvneta_probe(struct platform_device *pdev)
         }
 
         pp->tx_done_timer.data = (unsigned long)dev;
+        pp->tx_done_timer.function = mvneta_tx_done_timer_callback;
+        init_timer(&pp->tx_done_timer);
+        clear_bit(MVNETA_F_TX_DONE_TIMER_BIT, &pp->flags);
 
         pp->tx_ring_size = MVNETA_MAX_TXD;
         pp->rx_ring_size = MVNETA_MAX_RXD;
@@ -2776,7 +2779,7 @@ static int mvneta_probe(struct platform_device *pdev)
         err = mvneta_init(pp, phy_addr);
         if (err < 0) {
                 dev_err(&pdev->dev, "can't init eth hal\n");
-                goto err_clk;
+                goto err_unmap;
         }
         mvneta_port_power_up(pp, phy_mode);
 
@@ -2806,10 +2809,10 @@ static int mvneta_probe(struct platform_device *pdev)
 
 err_deinit:
         mvneta_deinit(pp);
-err_clk:
-        clk_disable_unprepare(pp->clk);
 err_unmap:
         iounmap(pp->base);
+err_clk:
+        clk_disable_unprepare(pp->clk);
 err_free_irq:
         irq_dispose_mapping(dev->irq);
 err_free_netdev:
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index 727874f575ce..a28cd801a236 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -223,7 +223,7 @@ static int mlx4_en_get_sset_count(struct net_device *dev, int sset)
         case ETH_SS_STATS:
                 return (priv->stats_bitmap ? bit_count : NUM_ALL_STATS) +
                         (priv->tx_ring_num * 2) +
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
                         (priv->rx_ring_num * 5);
 #else
                         (priv->rx_ring_num * 2);
@@ -276,7 +276,7 @@ static void mlx4_en_get_ethtool_stats(struct net_device *dev,
         for (i = 0; i < priv->rx_ring_num; i++) {
                 data[index++] = priv->rx_ring[i].packets;
                 data[index++] = priv->rx_ring[i].bytes;
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
                 data[index++] = priv->rx_ring[i].yields;
                 data[index++] = priv->rx_ring[i].misses;
                 data[index++] = priv->rx_ring[i].cleaned;
@@ -344,7 +344,7 @@ static void mlx4_en_get_strings(struct net_device *dev,
                                 "rx%d_packets", i);
                         sprintf(data + (index++) * ETH_GSTRING_LEN,
                                 "rx%d_bytes", i);
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
                         sprintf(data + (index++) * ETH_GSTRING_LEN,
                                 "rx%d_napi_yield", i);
                         sprintf(data + (index++) * ETH_GSTRING_LEN,
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 5eac871399d8..fa37b7a61213 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -68,7 +68,7 @@ int mlx4_en_setup_tc(struct net_device *dev, u8 up)
         return 0;
 }
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 /* must be called with local_bh_disable()d */
 static int mlx4_en_low_latency_recv(struct napi_struct *napi)
 {
@@ -94,7 +94,7 @@ static int mlx4_en_low_latency_recv(struct napi_struct *napi)
 
         return done;
 }
-#endif  /* CONFIG_NET_LL_RX_POLL */
+#endif  /* CONFIG_NET_RX_BUSY_POLL */
 
 #ifdef CONFIG_RFS_ACCEL
 
@@ -2140,7 +2140,7 @@ static const struct net_device_ops mlx4_netdev_ops = {
 #ifdef CONFIG_RFS_ACCEL
         .ndo_rx_flow_steer      = mlx4_en_filter_rfs,
 #endif
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         .ndo_busy_poll          = mlx4_en_low_latency_recv,
 #endif
 };
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 8873d6802c80..6fc6dabc78d5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -845,16 +845,7 @@ int mlx4_QUERY_PORT_wrapper(struct mlx4_dev *dev, int slave,
                            MLX4_CMD_NATIVE);
 
         if (!err && dev->caps.function != slave) {
-                /* if config MAC in DB use it */
-                if (priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac)
-                        def_mac = priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac;
-                else {
-                        /* set slave default_mac address */
-                        MLX4_GET(def_mac, outbox->buf, QUERY_PORT_MAC_OFFSET);
-                        def_mac += slave << 8;
-                        priv->mfunc.master.vf_admin[slave].vport[vhcr->in_modifier].mac = def_mac;
-                }
-
+                def_mac = priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac;
                 MLX4_PUT(outbox->buf, def_mac, QUERY_PORT_MAC_OFFSET);
 
                 /* get port type - currently only eth is enabled */
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index e85af922dcdc..36be3208786a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -371,7 +371,7 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
 
         dev->caps.sqp_demux = (mlx4_is_master(dev)) ? MLX4_MAX_NUM_SLAVES : 0;
 
-        if (!enable_64b_cqe_eqe) {
+        if (!enable_64b_cqe_eqe && !mlx4_is_slave(dev)) {
                 if (dev_cap->flags &
                     (MLX4_DEV_CAP_FLAG_64B_CQE | MLX4_DEV_CAP_FLAG_64B_EQE)) {
                         mlx4_warn(dev, "64B EQEs/CQEs supported by the device but not enabled\n");
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 35fb60e2320c..5e0aa569306a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -292,7 +292,7 @@ struct mlx4_en_rx_ring {
         void *rx_info;
         unsigned long bytes;
         unsigned long packets;
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         unsigned long yields;
         unsigned long misses;
         unsigned long cleaned;
@@ -318,7 +318,7 @@ struct mlx4_en_cq {
         struct mlx4_cqe *buf;
 #define MLX4_EN_OPCODE_ERROR    0x1e
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         unsigned int state;
 #define MLX4_EN_CQ_STATE_IDLE        0
 #define MLX4_EN_CQ_STATE_NAPI     1    /* NAPI owns this CQ */
@@ -329,7 +329,7 @@ struct mlx4_en_cq {
 #define CQ_YIELD (MLX4_EN_CQ_STATE_NAPI_YIELD | MLX4_EN_CQ_STATE_POLL_YIELD)
 #define CQ_USER_PEND (MLX4_EN_CQ_STATE_POLL | MLX4_EN_CQ_STATE_POLL_YIELD)
         spinlock_t poll_lock; /* protects from LLS/napi conflicts */
-#endif  /* CONFIG_NET_LL_RX_POLL */
+#endif  /* CONFIG_NET_RX_BUSY_POLL */
 };
 
 struct mlx4_en_port_profile {
@@ -580,7 +580,7 @@ struct mlx4_mac_entry {
         struct rcu_head rcu;
 };
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 static inline void mlx4_en_cq_init_lock(struct mlx4_en_cq *cq)
 {
         spin_lock_init(&cq->poll_lock);
@@ -687,7 +687,7 @@ static inline bool mlx4_en_cq_ll_polling(struct mlx4_en_cq *cq)
 {
         return false;
 }
-#endif /* CONFIG_NET_LL_RX_POLL */
+#endif /* CONFIG_NET_RX_BUSY_POLL */
 
 #define MLX4_EN_WOL_DO_MODIFY (1ULL << 63)
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 205753a04cfc..c571de85d0f9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -46,7 +46,7 @@
 #include "mlx5_core.h"
 
 enum {
-        CMD_IF_REV = 3,
+        CMD_IF_REV = 4,
 };
 
 enum {
@@ -282,6 +282,12 @@ const char *mlx5_command_str(int command)
         case MLX5_CMD_OP_TEARDOWN_HCA:
                 return "TEARDOWN_HCA";
 
+        case MLX5_CMD_OP_ENABLE_HCA:
+                return "MLX5_CMD_OP_ENABLE_HCA";
+
+        case MLX5_CMD_OP_DISABLE_HCA:
+                return "MLX5_CMD_OP_DISABLE_HCA";
+
         case MLX5_CMD_OP_QUERY_PAGES:
                 return "QUERY_PAGES";
 
@@ -1113,7 +1119,13 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, unsigned long vector)
 
         for (i = 0; i < (1 << cmd->log_sz); i++) {
                 if (test_bit(i, &vector)) {
+                        struct semaphore *sem;
+
                         ent = cmd->ent_arr[i];
+                        if (ent->page_queue)
+                                sem = &cmd->pages_sem;
+                        else
+                                sem = &cmd->sem;
                         ktime_get_ts(&ent->ts2);
                         memcpy(ent->out->first.data, ent->lay->out, sizeof(ent->lay->out));
                         dump_command(dev, ent, 0);
@@ -1136,10 +1148,7 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, unsigned long vector)
                         } else {
                                 complete(&ent->done);
                         }
-                        if (ent->page_queue)
-                                up(&cmd->pages_sem);
-                        else
-                                up(&cmd->sem);
+                        up(sem);
                 }
         }
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 12242de2b0e3..b47739b0b5f6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -249,6 +249,44 @@ static int set_hca_ctrl(struct mlx5_core_dev *dev)
         return err;
 }
 
+static int mlx5_core_enable_hca(struct mlx5_core_dev *dev)
+{
+        int err;
+        struct mlx5_enable_hca_mbox_in in;
+        struct mlx5_enable_hca_mbox_out out;
+
+        memset(&in, 0, sizeof(in));
+        memset(&out, 0, sizeof(out));
+        in.hdr.opcode = cpu_to_be16(MLX5_CMD_OP_ENABLE_HCA);
+        err = mlx5_cmd_exec(dev, &in, sizeof(in), &out, sizeof(out));
+        if (err)
+                return err;
+
+        if (out.hdr.status)
+                return mlx5_cmd_status_to_err(&out.hdr);
+
+        return 0;
+}
+
+static int mlx5_core_disable_hca(struct mlx5_core_dev *dev)
+{
+        int err;
+        struct mlx5_disable_hca_mbox_in in;
+        struct mlx5_disable_hca_mbox_out out;
+
+        memset(&in, 0, sizeof(in));
+        memset(&out, 0, sizeof(out));
+        in.hdr.opcode = cpu_to_be16(MLX5_CMD_OP_DISABLE_HCA);
+        err = mlx5_cmd_exec(dev, &in, sizeof(in), &out, sizeof(out));
+        if (err)
+                return err;
+
+        if (out.hdr.status)
+                return mlx5_cmd_status_to_err(&out.hdr);
+
+        return 0;
+}
+
 int mlx5_dev_init(struct mlx5_core_dev *dev, struct pci_dev *pdev)
 {
         struct mlx5_priv *priv = &dev->priv;
@@ -304,28 +342,41 @@ int mlx5_dev_init(struct mlx5_core_dev *dev, struct pci_dev *pdev)
         }
 
         mlx5_pagealloc_init(dev);
+
+        err = mlx5_core_enable_hca(dev);
+        if (err) {
+                dev_err(&pdev->dev, "enable hca failed\n");
+                goto err_pagealloc_cleanup;
+        }
+
+        err = mlx5_satisfy_startup_pages(dev, 1);
+        if (err) {
+                dev_err(&pdev->dev, "failed to allocate boot pages\n");
+                goto err_disable_hca;
+        }
+
         err = set_hca_ctrl(dev);
         if (err) {
                 dev_err(&pdev->dev, "set_hca_ctrl failed\n");
-                goto err_pagealloc_cleanup;
+                goto reclaim_boot_pages;
         }
 
         err = handle_hca_cap(dev);
         if (err) {
                 dev_err(&pdev->dev, "handle_hca_cap failed\n");
-                goto err_pagealloc_cleanup;
+                goto reclaim_boot_pages;
         }
 
-        err = mlx5_satisfy_startup_pages(dev);
+        err = mlx5_satisfy_startup_pages(dev, 0);
         if (err) {
-                dev_err(&pdev->dev, "failed to allocate startup pages\n");
-                goto err_pagealloc_cleanup;
+                dev_err(&pdev->dev, "failed to allocate init pages\n");
+                goto reclaim_boot_pages;
         }
 
         err = mlx5_pagealloc_start(dev);
         if (err) {
                 dev_err(&pdev->dev, "mlx5_pagealloc_start failed\n");
-                goto err_reclaim_pages;
+                goto reclaim_boot_pages;
         }
 
         err = mlx5_cmd_init_hca(dev);
@@ -396,9 +447,12 @@ err_stop_poll:
 err_pagealloc_stop:
         mlx5_pagealloc_stop(dev);
 
-err_reclaim_pages:
+reclaim_boot_pages:
         mlx5_reclaim_startup_pages(dev);
 
+err_disable_hca:
+        mlx5_core_disable_hca(dev);
+
 err_pagealloc_cleanup:
         mlx5_pagealloc_cleanup(dev);
         mlx5_cmd_cleanup(dev);
@@ -434,6 +488,7 @@ void mlx5_dev_cleanup(struct mlx5_core_dev *dev)
         mlx5_cmd_teardown_hca(dev);
         mlx5_pagealloc_stop(dev);
         mlx5_reclaim_startup_pages(dev);
+        mlx5_core_disable_hca(dev);
         mlx5_pagealloc_cleanup(dev);
         mlx5_cmd_cleanup(dev);
         iounmap(dev->iseg);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
index f0bf46339b28..4a3e137931a3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -64,7 +64,7 @@ struct mlx5_query_pages_inbox {
 
 struct mlx5_query_pages_outbox {
         struct mlx5_outbox_hdr  hdr;
-        u8                      reserved[2];
+        __be16                  num_boot_pages;
         __be16                  func_id;
         __be16                  init_pages;
         __be16                  num_pages;
@@ -146,7 +146,7 @@ static struct page *remove_page(struct mlx5_core_dev *dev, u64 addr)
 }
 
 static int mlx5_cmd_query_pages(struct mlx5_core_dev *dev, u16 *func_id,
-                                s16 *pages, s16 *init_pages)
+                                s16 *pages, s16 *init_pages, u16 *boot_pages)
 {
         struct mlx5_query_pages_inbox   in;
         struct mlx5_query_pages_outbox  out;
@@ -164,8 +164,13 @@ static int mlx5_cmd_query_pages(struct mlx5_core_dev *dev, u16 *func_id,
 
         if (pages)
                 *pages = be16_to_cpu(out.num_pages);
+
         if (init_pages)
                 *init_pages = be16_to_cpu(out.init_pages);
+
+        if (boot_pages)
+                *boot_pages = be16_to_cpu(out.num_boot_pages);
+
         *func_id = be16_to_cpu(out.func_id);
 
         return err;
@@ -357,19 +362,22 @@ void mlx5_core_req_pages_handler(struct mlx5_core_dev *dev, u16 func_id,
         queue_work(dev->priv.pg_wq, &req->work);
 }
 
-int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev)
+int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev, int boot)
 {
+        u16 uninitialized_var(boot_pages);
         s16 uninitialized_var(init_pages);
         u16 uninitialized_var(func_id);
         int err;
 
-        err = mlx5_cmd_query_pages(dev, &func_id, NULL, &init_pages);
+        err = mlx5_cmd_query_pages(dev, &func_id, NULL, &init_pages,
+                                   &boot_pages);
         if (err)
                 return err;
 
-        mlx5_core_dbg(dev, "requested %d init pages for func_id 0x%x\n", init_pages, func_id);
 
-        return give_pages(dev, func_id, init_pages, 0);
+        mlx5_core_dbg(dev, "requested %d init pages and %d boot pages for func_id 0x%x\n",
+                      init_pages, boot_pages, func_id);
+        return give_pages(dev, func_id, boot ? boot_pages : init_pages, 0);
 }
 
 static int optimal_reclaimed_pages(void)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/uar.c b/drivers/net/ethernet/mellanox/mlx5/core/uar.c
index 71d4a3937200..68f5d9c77c7b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/uar.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/uar.c
@@ -164,6 +164,7 @@ int mlx5_alloc_uuars(struct mlx5_core_dev *dev, struct mlx5_uuar_info *uuari)
                 uuari->uars[i].map = ioremap(addr, PAGE_SIZE);
                 if (!uuari->uars[i].map) {
                         mlx5_cmd_free_uar(dev, uuari->uars[i].index);
+                        err = -ENOMEM;
                         goto out_count;
                 }
                 mlx5_core_dbg(dev, "allocated uar index 0x%x, mmaped at %p\n",
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig b/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig
index cb22341a14a8..a588ffde9700 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig
@@ -4,7 +4,7 @@
 
 config PCH_GBE
         tristate "OKI SEMICONDUCTOR IOH(ML7223/ML7831) GbE"
-        depends on PCI
+        depends on PCI && (X86 || COMPILE_TEST)
         select MII
         select PTP_1588_CLOCK_PCH
         ---help---
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index b00cf5665eab..221645e9f182 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -1400,8 +1400,8 @@ void qlcnic_pci_camqm_write_2M(struct qlcnic_adapter *, u64, u64);
 #define ADDR_IN_RANGE(addr, low, high)  \
         (((addr) < (high)) && ((addr) >= (low)))
 
-#define QLCRD32(adapter, off) \
-        (adapter->ahw->hw_ops->read_reg)(adapter, off)
+#define QLCRD32(adapter, off, err) \
+        (adapter->ahw->hw_ops->read_reg)(adapter, off, err)
 
 #define QLCWR32(adapter, off, val) \
         adapter->ahw->hw_ops->write_reg(adapter, off, val)
@@ -1604,7 +1604,7 @@ struct qlcnic_nic_template {
 struct qlcnic_hardware_ops {
         void (*read_crb) (struct qlcnic_adapter *, char *, loff_t, size_t);
         void (*write_crb) (struct qlcnic_adapter *, char *, loff_t, size_t);
-        int (*read_reg) (struct qlcnic_adapter *, ulong);
+        int (*read_reg) (struct qlcnic_adapter *, ulong, int *);
         int (*write_reg) (struct qlcnic_adapter *, ulong, u32);
         void (*get_ocm_win) (struct qlcnic_hardware_context *);
         int (*get_mac_address) (struct qlcnic_adapter *, u8 *);
@@ -1662,12 +1662,6 @@ static inline void qlcnic_write_crb(struct qlcnic_adapter *adapter, char *buf,
         adapter->ahw->hw_ops->write_crb(adapter, buf, offset, size);
 }
 
-static inline int qlcnic_hw_read_wx_2M(struct qlcnic_adapter *adapter,
-                                       ulong off)
-{
-        return adapter->ahw->hw_ops->read_reg(adapter, off);
-}
-
 static inline int qlcnic_hw_write_wx_2M(struct qlcnic_adapter *adapter,
                                         ulong off, u32 data)
 {
@@ -1869,7 +1863,8 @@ static inline void qlcnic_free_mac_list(struct qlcnic_adapter *adapter)
 
 static inline void qlcnic_set_mac_filter_count(struct qlcnic_adapter *adapter)
 {
-        adapter->ahw->hw_ops->set_mac_filter_count(adapter);
+        if (adapter->ahw->hw_ops->set_mac_filter_count)
+                adapter->ahw->hw_ops->set_mac_filter_count(adapter);
 }
 
 static inline void qlcnic_dev_request_reset(struct qlcnic_adapter *adapter,
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 0913c623a67e..92da9980a0a0 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -228,17 +228,17 @@ static int __qlcnic_set_win_base(struct qlcnic_adapter *adapter, u32 addr)
         return 0;
 }
 
-int qlcnic_83xx_rd_reg_indirect(struct qlcnic_adapter *adapter, ulong addr)
+int qlcnic_83xx_rd_reg_indirect(struct qlcnic_adapter *adapter, ulong addr,
+                                int *err)
 {
-        int ret;
         struct qlcnic_hardware_context *ahw = adapter->ahw;
 
-        ret = __qlcnic_set_win_base(adapter, (u32) addr);
-        if (!ret) {
+        *err = __qlcnic_set_win_base(adapter, (u32) addr);
+        if (!*err) {
                 return QLCRDX(ahw, QLCNIC_WILDCARD);
         } else {
                 dev_err(&adapter->pdev->dev,
-                        "%s failed, addr = 0x%x\n", __func__, (int)addr);
+                        "%s failed, addr = 0x%lx\n", __func__, addr);
                 return -EIO;
         }
 }
@@ -561,7 +561,7 @@ void qlcnic_83xx_cam_unlock(struct qlcnic_adapter *adapter)
 void qlcnic_83xx_read_crb(struct qlcnic_adapter *adapter, char *buf,
                           loff_t offset, size_t size)
 {
-        int ret;
+        int ret = 0;
         u32 data;
 
         if (qlcnic_api_lock(adapter)) {
@@ -571,7 +571,7 @@ void qlcnic_83xx_read_crb(struct qlcnic_adapter *adapter, char *buf,
                 return;
         }
 
-        ret = qlcnic_83xx_rd_reg_indirect(adapter, (u32) offset);
+        data = QLCRD32(adapter, (u32) offset, &ret);
         qlcnic_api_unlock(adapter);
 
         if (ret == -EIO) {
@@ -580,7 +580,6 @@ void qlcnic_83xx_read_crb(struct qlcnic_adapter *adapter, char *buf,
                         __func__, (u32)offset);
                 return;
         }
-        data = ret;
         memcpy(buf, &data, size);
 }
 
@@ -2075,18 +2074,25 @@ void qlcnic_83xx_config_intr_coal(struct qlcnic_adapter *adapter)
 static void qlcnic_83xx_handle_link_aen(struct qlcnic_adapter *adapter,
                                         u32 data[])
 {
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
         u8 link_status, duplex;
         /* link speed */
         link_status = LSB(data[3]) & 1;
-        adapter->ahw->link_speed = MSW(data[2]);
-        adapter->ahw->link_autoneg = MSB(MSW(data[3]));
-        adapter->ahw->module_type = MSB(LSW(data[3]));
-        duplex = LSB(MSW(data[3]));
-        if (duplex)
-                adapter->ahw->link_duplex = DUPLEX_FULL;
-        else
-                adapter->ahw->link_duplex = DUPLEX_HALF;
-        adapter->ahw->has_link_events = 1;
+        if (link_status) {
+                ahw->link_speed = MSW(data[2]);
+                duplex = LSB(MSW(data[3]));
+                if (duplex)
+                        ahw->link_duplex = DUPLEX_FULL;
+                else
+                        ahw->link_duplex = DUPLEX_HALF;
+        } else {
+                ahw->link_speed = SPEED_UNKNOWN;
+                ahw->link_duplex = DUPLEX_UNKNOWN;
+        }
+
+        ahw->link_autoneg = MSB(MSW(data[3]));
+        ahw->module_type = MSB(LSW(data[3]));
+        ahw->has_link_events = 1;
         qlcnic_advert_link_change(adapter, link_status);
 }
 
@@ -2384,9 +2390,9 @@ int qlcnic_83xx_lockless_flash_read32(struct qlcnic_adapter *adapter,
                                       u32 flash_addr, u8 *p_data,
                                       int count)
 {
-        int i, ret;
-        u32 word, range, flash_offset, addr = flash_addr;
+        u32 word, range, flash_offset, addr = flash_addr, ret;
         ulong indirect_add, direct_window;
+        int i, err = 0;
 
         flash_offset = addr & (QLCNIC_FLASH_SECTOR_SIZE - 1);
         if (addr & 0x3) {
@@ -2404,10 +2410,9 @@ int qlcnic_83xx_lockless_flash_read32(struct qlcnic_adapter *adapter,
                 /* Multi sector read */
                 for (i = 0; i < count; i++) {
                         indirect_add = QLC_83XX_FLASH_DIRECT_DATA(addr);
-                        ret = qlcnic_83xx_rd_reg_indirect(adapter,
-                                                          indirect_add);
-                        if (ret == -EIO)
-                                return -EIO;
+                        ret = QLCRD32(adapter, indirect_add, &err);
+                        if (err == -EIO)
+                                return err;
 
                         word = ret;
                         *(u32 *)p_data  = word;
@@ -2428,10 +2433,9 @@ int qlcnic_83xx_lockless_flash_read32(struct qlcnic_adapter *adapter,
                 /* Single sector read */
                 for (i = 0; i < count; i++) {
                         indirect_add = QLC_83XX_FLASH_DIRECT_DATA(addr);
-                        ret = qlcnic_83xx_rd_reg_indirect(adapter,
-                                                          indirect_add);
-                        if (ret == -EIO)
-                                return -EIO;
+                        ret = QLCRD32(adapter, indirect_add, &err);
+                        if (err == -EIO)
+                                return err;
 
                         word = ret;
                         *(u32 *)p_data  = word;
@@ -2447,10 +2451,13 @@ static int qlcnic_83xx_poll_flash_status_reg(struct qlcnic_adapter *adapter)
 {
         u32 status;
         int retries = QLC_83XX_FLASH_READ_RETRY_COUNT;
+        int err = 0;
 
         do {
-                status = qlcnic_83xx_rd_reg_indirect(adapter,
-                                                     QLC_83XX_FLASH_STATUS);
+                status = QLCRD32(adapter, QLC_83XX_FLASH_STATUS, &err);
+                if (err == -EIO)
+                        return err;
+
                 if ((status & QLC_83XX_FLASH_STATUS_READY) ==
                     QLC_83XX_FLASH_STATUS_READY)
                         break;
@@ -2502,7 +2509,8 @@ int qlcnic_83xx_disable_flash_write(struct qlcnic_adapter *adapter)
 
 int qlcnic_83xx_read_flash_mfg_id(struct qlcnic_adapter *adapter)
 {
-        int ret, mfg_id;
+        int ret, err = 0;
+        u32 mfg_id;
 
         if (qlcnic_83xx_lock_flash(adapter))
                 return -EIO;
@@ -2517,9 +2525,11 @@ int qlcnic_83xx_read_flash_mfg_id(struct qlcnic_adapter *adapter)
                 return -EIO;
         }
 
-        mfg_id = qlcnic_83xx_rd_reg_indirect(adapter, QLC_83XX_FLASH_RDDATA);
-        if (mfg_id == -EIO)
-                return -EIO;
+        mfg_id = QLCRD32(adapter, QLC_83XX_FLASH_RDDATA, &err);
+        if (err == -EIO) {
+                qlcnic_83xx_unlock_flash(adapter);
+                return err;
+        }
 
         adapter->flash_mfg_id = (mfg_id & 0xFF);
         qlcnic_83xx_unlock_flash(adapter);
@@ -2636,7 +2646,7 @@ int qlcnic_83xx_flash_bulk_write(struct qlcnic_adapter *adapter, u32 addr,
                                  u32 *p_data, int count)
 {
         u32 temp;
-        int ret = -EIO;
+        int ret = -EIO, err = 0;
 
         if ((count < QLC_83XX_FLASH_WRITE_MIN) ||
             (count > QLC_83XX_FLASH_WRITE_MAX)) {
@@ -2645,8 +2655,10 @@ int qlcnic_83xx_flash_bulk_write(struct qlcnic_adapter *adapter, u32 addr,
                 return -EIO;
         }
 
-        temp = qlcnic_83xx_rd_reg_indirect(adapter,
-                                           QLC_83XX_FLASH_SPI_CONTROL);
+        temp = QLCRD32(adapter, QLC_83XX_FLASH_SPI_CONTROL, &err);
+        if (err == -EIO)
+                return err;
+
         qlcnic_83xx_wrt_reg_indirect(adapter, QLC_83XX_FLASH_SPI_CONTROL,
                                      (temp | QLC_83XX_FLASH_SPI_CTRL));
         qlcnic_83xx_wrt_reg_indirect(adapter, QLC_83XX_FLASH_ADDR,
@@ -2695,13 +2707,18 @@ int qlcnic_83xx_flash_bulk_write(struct qlcnic_adapter *adapter, u32 addr,
                 return -EIO;
         }
 
-        ret = qlcnic_83xx_rd_reg_indirect(adapter, QLC_83XX_FLASH_SPI_STATUS);
+        ret = QLCRD32(adapter, QLC_83XX_FLASH_SPI_STATUS, &err);
+        if (err == -EIO)
+                return err;
+
         if ((ret & QLC_83XX_FLASH_SPI_CTRL) == QLC_83XX_FLASH_SPI_CTRL) {
                 dev_err(&adapter->pdev->dev, "%s: failed at %d\n",
                         __func__, __LINE__);
                 /* Operation failed, clear error bit */
-                temp = qlcnic_83xx_rd_reg_indirect(adapter,
-                                                   QLC_83XX_FLASH_SPI_CONTROL);
+                temp = QLCRD32(adapter, QLC_83XX_FLASH_SPI_CONTROL, &err);
+                if (err == -EIO)
+                        return err;
+
                 qlcnic_83xx_wrt_reg_indirect(adapter,
                                              QLC_83XX_FLASH_SPI_CONTROL,
                                              (temp | QLC_83XX_FLASH_SPI_CTRL));
@@ -2823,6 +2840,7 @@ int qlcnic_83xx_ms_mem_write128(struct qlcnic_adapter *adapter, u64 addr,
 {
         int i, j, ret = 0;
         u32 temp;
+        int err = 0;
 
         /* Check alignment */
         if (addr & 0xF)
@@ -2855,8 +2873,12 @@ int qlcnic_83xx_ms_mem_write128(struct qlcnic_adapter *adapter, u64 addr,
                                              QLCNIC_TA_WRITE_START);
 
                 for (j = 0; j < MAX_CTL_CHECK; j++) {
-                        temp = qlcnic_83xx_rd_reg_indirect(adapter,
-                                                           QLCNIC_MS_CTRL);
+                        temp = QLCRD32(adapter, QLCNIC_MS_CTRL, &err);
+                        if (err == -EIO) {
+                                mutex_unlock(&adapter->ahw->mem_lock);
+                                return err;
+                        }
+
                         if ((temp & TA_CTL_BUSY) == 0)
                                 break;
                 }
@@ -2878,9 +2900,9 @@ int qlcnic_83xx_ms_mem_write128(struct qlcnic_adapter *adapter, u64 addr,
 int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr,
                              u8 *p_data, int count)
 {
-        int i, ret;
-        u32 word, addr = flash_addr;
+        u32 word, addr = flash_addr, ret;
         ulong  indirect_addr;
+        int i, err = 0;
 
         if (qlcnic_83xx_lock_flash(adapter) != 0)
                 return -EIO;
@@ -2900,10 +2922,10 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr,
                 }
 
                 indirect_addr = QLC_83XX_FLASH_DIRECT_DATA(addr);
-                ret = qlcnic_83xx_rd_reg_indirect(adapter,
-                                                  indirect_addr);
-                if (ret == -EIO)
-                        return -EIO;
+                ret = QLCRD32(adapter, indirect_addr, &err);
+                if (err == -EIO)
+                        return err;
+
                 word = ret;
                 *(u32 *)p_data  = word;
                 p_data = p_data + 4;
@@ -3014,8 +3036,8 @@ int qlcnic_83xx_get_settings(struct qlcnic_adapter *adapter,
         }
 
         if (ahw->port_type == QLCNIC_XGBE) {
-                ecmd->supported = SUPPORTED_1000baseT_Full;
-                ecmd->advertising = ADVERTISED_1000baseT_Full;
+                ecmd->supported = SUPPORTED_10000baseT_Full;
+                ecmd->advertising = ADVERTISED_10000baseT_Full;
         } else {
                 ecmd->supported = (SUPPORTED_10baseT_Half |
                                    SUPPORTED_10baseT_Full |
@@ -3369,7 +3391,8 @@ int qlcnic_83xx_set_pauseparam(struct qlcnic_adapter *adapter,
 
 static int qlcnic_83xx_read_flash_status_reg(struct qlcnic_adapter *adapter)
 {
-        int ret;
+        int ret, err = 0;
+        u32 temp;
 
         qlcnic_83xx_wrt_reg_indirect(adapter, QLC_83XX_FLASH_ADDR,
                                      QLC_83XX_FLASH_OEM_READ_SIG);
@@ -3379,8 +3402,11 @@ static int qlcnic_83xx_read_flash_status_reg(struct qlcnic_adapter *adapter)
         if (ret)
                 return -EIO;
 
-        ret = qlcnic_83xx_rd_reg_indirect(adapter, QLC_83XX_FLASH_RDDATA);
-        return ret & 0xFF;
+        temp = QLCRD32(adapter, QLC_83XX_FLASH_RDDATA, &err);
+        if (err == -EIO)
+                return err;
+
+        return temp & 0xFF;
 }
 
 int qlcnic_83xx_flash_test(struct qlcnic_adapter *adapter)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
index 2548d1403d75..272f56a2e14b 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
@@ -508,7 +508,7 @@ void qlcnic_83xx_add_sysfs(struct qlcnic_adapter *);
 void qlcnic_83xx_remove_sysfs(struct qlcnic_adapter *);
 void qlcnic_83xx_write_crb(struct qlcnic_adapter *, char *, loff_t, size_t);
 void qlcnic_83xx_read_crb(struct qlcnic_adapter *, char *, loff_t, size_t);
-int qlcnic_83xx_rd_reg_indirect(struct qlcnic_adapter *, ulong);
+int qlcnic_83xx_rd_reg_indirect(struct qlcnic_adapter *, ulong, int *);
 int qlcnic_83xx_wrt_reg_indirect(struct qlcnic_adapter *, ulong, u32);
 void qlcnic_83xx_process_rcv_diag(struct qlcnic_adapter *, int, u64 []);
 int qlcnic_83xx_nic_set_promisc(struct qlcnic_adapter *, u32);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index f41dfab1e9a3..9f4b8d5f0865 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -1303,8 +1303,11 @@ static void qlcnic_83xx_dump_pause_control_regs(struct qlcnic_adapter *adapter)
 {
         int i, j;
         u32 val = 0, val1 = 0, reg = 0;
+        int err = 0;
 
-        val = QLCRD32(adapter, QLC_83XX_SRE_SHIM_REG);
+        val = QLCRD32(adapter, QLC_83XX_SRE_SHIM_REG, &err);
+        if (err == -EIO)
+                return;
         dev_info(&adapter->pdev->dev, "SRE-Shim Ctrl:0x%x\n", val);
 
         for (j = 0; j < 2; j++) {
@@ -1318,7 +1321,9 @@ static void qlcnic_83xx_dump_pause_control_regs(struct qlcnic_adapter *adapter)
                         reg = QLC_83XX_PORT1_THRESHOLD;
                 }
                 for (i = 0; i < 8; i++) {
-                        val = QLCRD32(adapter, reg + (i * 0x4));
+                        val = QLCRD32(adapter, reg + (i * 0x4), &err);
+                        if (err == -EIO)
+                                return;
                         dev_info(&adapter->pdev->dev, "0x%x  ", val);
                 }
                 dev_info(&adapter->pdev->dev, "\n");
@@ -1335,8 +1340,10 @@ static void qlcnic_83xx_dump_pause_control_regs(struct qlcnic_adapter *adapter)
                         reg = QLC_83XX_PORT1_TC_MC_REG;
                 }
                 for (i = 0; i < 4; i++) {
-                        val = QLCRD32(adapter, reg + (i * 0x4));
-                         dev_info(&adapter->pdev->dev, "0x%x  ", val);
+                        val = QLCRD32(adapter, reg + (i * 0x4), &err);
+                        if (err == -EIO)
+                                return;
+                        dev_info(&adapter->pdev->dev, "0x%x  ", val);
                 }
                 dev_info(&adapter->pdev->dev, "\n");
         }
@@ -1352,17 +1359,25 @@ static void qlcnic_83xx_dump_pause_control_regs(struct qlcnic_adapter *adapter)
                         reg = QLC_83XX_PORT1_TC_STATS;
                 }
                 for (i = 7; i >= 0; i--) {
-                        val = QLCRD32(adapter, reg);
+                        val = QLCRD32(adapter, reg, &err);
+                        if (err == -EIO)
+                                return;
                         val &= ~(0x7 << 29);    /* Reset bits 29 to 31 */
                         QLCWR32(adapter, reg, (val | (i << 29)));
-                        val = QLCRD32(adapter, reg);
+                        val = QLCRD32(adapter, reg, &err);
+                        if (err == -EIO)
+                                return;
                         dev_info(&adapter->pdev->dev, "0x%x  ", val);
                 }
                 dev_info(&adapter->pdev->dev, "\n");
         }
 
-        val = QLCRD32(adapter, QLC_83XX_PORT2_IFB_THRESHOLD);
-        val1 = QLCRD32(adapter, QLC_83XX_PORT3_IFB_THRESHOLD);
+        val = QLCRD32(adapter, QLC_83XX_PORT2_IFB_THRESHOLD, &err);
+        if (err == -EIO)
+                return;
+        val1 = QLCRD32(adapter, QLC_83XX_PORT3_IFB_THRESHOLD, &err);
+        if (err == -EIO)
+                return;
         dev_info(&adapter->pdev->dev,
                  "IFB-Pause Thresholds: Port 2:0x%x, Port 3:0x%x\n",
                  val, val1);
@@ -1425,7 +1440,7 @@ static void qlcnic_83xx_take_eport_out_of_reset(struct qlcnic_adapter *adapter)
 static int qlcnic_83xx_check_heartbeat(struct qlcnic_adapter *p_dev)
 {
         u32 heartbeat, peg_status;
-        int retries, ret = -EIO;
+        int retries, ret = -EIO, err = 0;
 
         retries = QLCNIC_HEARTBEAT_CHECK_RETRY_COUNT;
         p_dev->heartbeat = QLC_SHARED_REG_RD32(p_dev,
@@ -1453,11 +1468,11 @@ static int qlcnic_83xx_check_heartbeat(struct qlcnic_adapter *p_dev)
                          "PEG_NET_2_PC: 0x%x, PEG_NET_3_PC: 0x%x,\n"
                          "PEG_NET_4_PC: 0x%x\n", peg_status,
                          QLC_SHARED_REG_RD32(p_dev, QLCNIC_PEG_HALT_STATUS2),
-                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_0),
-                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_1),
-                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_2),
-                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_3),
-                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_4));
+                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_0, &err),
+                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_1, &err),
+                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_2, &err),
+                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_3, &err),
+                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_4, &err));
 
                 if (QLCNIC_FWERROR_CODE(peg_status) == 0x67)
                         dev_err(&p_dev->pdev->dev,
@@ -1501,18 +1516,22 @@ int qlcnic_83xx_check_hw_status(struct qlcnic_adapter *p_dev)
 static int qlcnic_83xx_poll_reg(struct qlcnic_adapter *p_dev, u32 addr,
                                 int duration, u32 mask, u32 status)
 {
+        int timeout_error, err = 0;
         u32 value;
-        int timeout_error;
         u8 retries;
 
-        value = qlcnic_83xx_rd_reg_indirect(p_dev, addr);
+        value = QLCRD32(p_dev, addr, &err);
+        if (err == -EIO)
+                return err;
         retries = duration / 10;
 
         do {
                 if ((value & mask) != status) {
                         timeout_error = 1;
                         msleep(duration / 10);
-                        value = qlcnic_83xx_rd_reg_indirect(p_dev, addr);
+                        value = QLCRD32(p_dev, addr, &err);
+                        if (err == -EIO)
+                                return err;
                 } else {
                         timeout_error = 0;
                         break;
@@ -1606,9 +1625,12 @@ int qlcnic_83xx_get_reset_instruction_template(struct qlcnic_adapter *p_dev)
 static void qlcnic_83xx_read_write_crb_reg(struct qlcnic_adapter *p_dev,
                                            u32 raddr, u32 waddr)
 {
-        int value;
+        int err = 0;
+        u32 value;
 
-        value = qlcnic_83xx_rd_reg_indirect(p_dev, raddr);
+        value = QLCRD32(p_dev, raddr, &err);
+        if (err == -EIO)
+                return;
         qlcnic_83xx_wrt_reg_indirect(p_dev, waddr, value);
 }
 
@@ -1617,12 +1639,16 @@ static void qlcnic_83xx_rmw_crb_reg(struct qlcnic_adapter *p_dev,
                                     u32 raddr, u32 waddr,
                                     struct qlc_83xx_rmw *p_rmw_hdr)
 {
-        int value;
+        int err = 0;
+        u32 value;
 
-        if (p_rmw_hdr->index_a)
+        if (p_rmw_hdr->index_a) {
                 value = p_dev->ahw->reset.array[p_rmw_hdr->index_a];
-        else
-                value = qlcnic_83xx_rd_reg_indirect(p_dev, raddr);
+        } else {
+                value = QLCRD32(p_dev, raddr, &err);
+                if (err == -EIO)
+                        return;
+        }
 
         value &= p_rmw_hdr->mask;
         value <<= p_rmw_hdr->shl;
@@ -1675,7 +1701,7 @@ static void qlcnic_83xx_poll_list(struct qlcnic_adapter *p_dev,
         long delay;
         struct qlc_83xx_entry *entry;
         struct qlc_83xx_poll *poll;
-        int i;
+        int i, err = 0;
         unsigned long arg1, arg2;
 
         poll = (struct qlc_83xx_poll *)((char *)p_hdr +
@@ -1699,10 +1725,12 @@ static void qlcnic_83xx_poll_list(struct qlcnic_adapter *p_dev,
                                                          arg1, delay,
                                                          poll->mask,
                                                          poll->status)){
-                                        qlcnic_83xx_rd_reg_indirect(p_dev,
-                                                                    arg1);
-                                        qlcnic_83xx_rd_reg_indirect(p_dev,
-                                                                    arg2);
+                                        QLCRD32(p_dev, arg1, &err);
+                                        if (err == -EIO)
+                                                return;
+                                        QLCRD32(p_dev, arg2, &err);
+                                        if (err == -EIO)
+                                                return;
                                 }
                         }
                 }
@@ -1768,7 +1796,7 @@ static void qlcnic_83xx_poll_read_list(struct qlcnic_adapter *p_dev,
                                        struct qlc_83xx_entry_hdr *p_hdr)
 {
         long delay;
-        int index, i, j;
+        int index, i, j, err;
         struct qlc_83xx_quad_entry *entry;
         struct qlc_83xx_poll *poll;
         unsigned long addr;
@@ -1788,7 +1816,10 @@ static void qlcnic_83xx_poll_read_list(struct qlcnic_adapter *p_dev,
                                                   poll->mask, poll->status)){
                                 index = p_dev->ahw->reset.array_index;
                                 addr = entry->dr_addr;
-                                j = qlcnic_83xx_rd_reg_indirect(p_dev, addr);
+                                j = QLCRD32(p_dev, addr, &err);
+                                if (err == -EIO)
+                                        return;
+
                                 p_dev->ahw->reset.array[index++] = j;
 
                                 if (index == QLC_83XX_MAX_RESET_SEQ_ENTRIES)
@@ -2123,6 +2154,8 @@ int qlcnic_83xx_init(struct qlcnic_adapter *adapter, int pci_using_dac)
         set_bit(QLC_83XX_MBX_READY, &adapter->ahw->idc.status);
         qlcnic_83xx_clear_function_resources(adapter);
 
+        INIT_DELAYED_WORK(&adapter->idc_aen_work, qlcnic_83xx_idc_aen_work);
+
         /* register for NIC IDC AEN Events */
         qlcnic_83xx_register_nic_idc_func(adapter, 1);
 
@@ -2140,8 +2173,6 @@ int qlcnic_83xx_init(struct qlcnic_adapter *adapter, int pci_using_dac)
         if (adapter->nic_ops->init_driver(adapter))
                 return -EIO;
 
-        INIT_DELAYED_WORK(&adapter->idc_aen_work, qlcnic_83xx_idc_aen_work);
-
         /* Periodically monitor device status */
         qlcnic_83xx_idc_poll_dev_state(&adapter->fw_work.work);
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
index 0581a484ceb5..d09389b33474 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
@@ -104,7 +104,7 @@ static u32
 qlcnic_poll_rsp(struct qlcnic_adapter *adapter)
 {
         u32 rsp;
-        int timeout = 0;
+        int timeout = 0, err = 0;
 
         do {
                 /* give atleast 1ms for firmware to respond */
@@ -113,7 +113,7 @@ qlcnic_poll_rsp(struct qlcnic_adapter *adapter)
                 if (++timeout > QLCNIC_OS_CRB_RETRY_COUNT)
                         return QLCNIC_CDRP_RSP_TIMEOUT;
 
-                rsp = QLCRD32(adapter, QLCNIC_CDRP_CRB_OFFSET);
+                rsp = QLCRD32(adapter, QLCNIC_CDRP_CRB_OFFSET, &err);
         } while (!QLCNIC_CDRP_IS_RSP(rsp));
 
         return rsp;
@@ -122,7 +122,7 @@ qlcnic_poll_rsp(struct qlcnic_adapter *adapter)
 int qlcnic_82xx_issue_cmd(struct qlcnic_adapter *adapter,
                           struct qlcnic_cmd_args *cmd)
 {
-        int i;
+        int i, err = 0;
         u32 rsp;
         u32 signature;
         struct pci_dev *pdev = adapter->pdev;
@@ -148,7 +148,7 @@ int qlcnic_82xx_issue_cmd(struct qlcnic_adapter *adapter,
                 dev_err(&pdev->dev, "card response timeout.\n");
                 cmd->rsp.arg[0] = QLCNIC_RCODE_TIMEOUT;
         } else if (rsp == QLCNIC_CDRP_RSP_FAIL) {
-                cmd->rsp.arg[0] = QLCRD32(adapter, QLCNIC_CDRP_ARG(1));
+                cmd->rsp.arg[0] = QLCRD32(adapter, QLCNIC_CDRP_ARG(1), &err);
                 switch (cmd->rsp.arg[0]) {
                 case QLCNIC_RCODE_INVALID_ARGS:
                         fmt = "CDRP invalid args: [%d]\n";
@@ -175,7 +175,7 @@ int qlcnic_82xx_issue_cmd(struct qlcnic_adapter *adapter,
                 cmd->rsp.arg[0] = QLCNIC_RCODE_SUCCESS;
 
         for (i = 1; i < cmd->rsp.num; i++)
-                cmd->rsp.arg[i] = QLCRD32(adapter, QLCNIC_CDRP_ARG(i));
+                cmd->rsp.arg[i] = QLCRD32(adapter, QLCNIC_CDRP_ARG(i), &err);
 
         /* Release semaphore */
         qlcnic_api_unlock(adapter);
@@ -210,10 +210,10 @@ int qlcnic_fw_cmd_set_drv_version(struct qlcnic_adapter *adapter, u32 fw_cmd)
         if (err) {
                 dev_info(&adapter->pdev->dev,
                          "Failed to set driver version in firmware\n");
-                return -EIO;
+                err = -EIO;
         }
-
-        return 0;
+        qlcnic_free_mbx_args(&cmd);
+        return err;
 }
 
 int
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 700a46324d09..7aac23ab31d1 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -150,6 +150,7 @@ static const char qlcnic_gstrings_test[][ETH_GSTRING_LEN] = {
         "Link_Test_on_offline",
         "Interrupt_Test_offline",
         "Internal_Loopback_offline",
+        "External_Loopback_offline",
         "EEPROM_Test_offline"
 };
 
@@ -266,7 +267,7 @@ int qlcnic_82xx_get_settings(struct qlcnic_adapter *adapter,
 {
         struct qlcnic_hardware_context *ahw = adapter->ahw;
         u32 speed, reg;
-        int check_sfp_module = 0;
+        int check_sfp_module = 0, err = 0;
         u16 pcifn = ahw->pci_func;
 
         /* read which mode */
@@ -289,7 +290,7 @@ int qlcnic_82xx_get_settings(struct qlcnic_adapter *adapter,
 
         } else if (adapter->ahw->port_type == QLCNIC_XGBE) {
                 u32 val = 0;
-                val = QLCRD32(adapter, QLCNIC_PORT_MODE_ADDR);
+                val = QLCRD32(adapter, QLCNIC_PORT_MODE_ADDR, &err);
 
                 if (val == QLCNIC_PORT_MODE_802_3_AP) {
                         ecmd->supported = SUPPORTED_1000baseT_Full;
@@ -300,9 +301,13 @@ int qlcnic_82xx_get_settings(struct qlcnic_adapter *adapter,
                 }
 
                 if (netif_running(adapter->netdev) && ahw->has_link_events) {
-                        reg = QLCRD32(adapter, P3P_LINK_SPEED_REG(pcifn));
-                        speed = P3P_LINK_SPEED_VAL(pcifn, reg);
-                        ahw->link_speed = speed * P3P_LINK_SPEED_MHZ;
+                        if (ahw->linkup) {
+                                reg = QLCRD32(adapter,
+                                              P3P_LINK_SPEED_REG(pcifn), &err);
+                                speed = P3P_LINK_SPEED_VAL(pcifn, reg);
+                                ahw->link_speed = speed * P3P_LINK_SPEED_MHZ;
+                        }
+
                         ethtool_cmd_speed_set(ecmd, ahw->link_speed);
                         ecmd->autoneg = ahw->link_autoneg;
                         ecmd->duplex = ahw->link_duplex;
@@ -463,13 +468,14 @@ static int qlcnic_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
 static int qlcnic_82xx_get_registers(struct qlcnic_adapter *adapter,
                                      u32 *regs_buff)
 {
-        int i, j = 0;
+        int i, j = 0, err = 0;
 
         for (i = QLCNIC_DEV_INFO_SIZE + 1; diag_registers[j] != -1; j++, i++)
                 regs_buff[i] = QLC_SHARED_REG_RD32(adapter, diag_registers[j]);
         j = 0;
         while (ext_diag_registers[j] != -1)
-                regs_buff[i++] = QLCRD32(adapter, ext_diag_registers[j++]);
+                regs_buff[i++] = QLCRD32(adapter, ext_diag_registers[j++],
+                                         &err);
         return i;
 }
 
@@ -519,13 +525,16 @@ qlcnic_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *p)
 static u32 qlcnic_test_link(struct net_device *dev)
 {
         struct qlcnic_adapter *adapter = netdev_priv(dev);
+        int err = 0;
         u32 val;
 
         if (qlcnic_83xx_check(adapter)) {
                 val = qlcnic_83xx_test_link(adapter);
                 return (val & 1) ? 0 : 1;
         }
-        val = QLCRD32(adapter, CRB_XG_STATE_P3P);
+        val = QLCRD32(adapter, CRB_XG_STATE_P3P, &err);
+        if (err == -EIO)
+                return err;
         val = XG_LINK_STATE_P3P(adapter->ahw->pci_func, val);
         return (val == XG_LINK_UP_P3P) ? 0 : 1;
 }
@@ -658,6 +667,7 @@ qlcnic_get_pauseparam(struct net_device *netdev,
 {
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         int port = adapter->ahw->physical_port;
+        int err = 0;
         __u32 val;
 
         if (qlcnic_83xx_check(adapter)) {
@@ -668,9 +678,13 @@ qlcnic_get_pauseparam(struct net_device *netdev,
                 if ((port < 0) || (port > QLCNIC_NIU_MAX_GBE_PORTS))
                         return;
                 /* get flow control settings */
-                val = QLCRD32(adapter, QLCNIC_NIU_GB_MAC_CONFIG_0(port));
+                val = QLCRD32(adapter, QLCNIC_NIU_GB_MAC_CONFIG_0(port), &err);
+                if (err == -EIO)
+                        return;
                 pause->rx_pause = qlcnic_gb_get_rx_flowctl(val);
-                val = QLCRD32(adapter, QLCNIC_NIU_GB_PAUSE_CTL);
+                val = QLCRD32(adapter, QLCNIC_NIU_GB_PAUSE_CTL, &err);
+                if (err == -EIO)
+                        return;
                 switch (port) {
                 case 0:
                         pause->tx_pause = !(qlcnic_gb_get_gb0_mask(val));
@@ -690,7 +704,9 @@ qlcnic_get_pauseparam(struct net_device *netdev,
                 if ((port < 0) || (port > QLCNIC_NIU_MAX_XG_PORTS))
                         return;
                 pause->rx_pause = 1;
-                val = QLCRD32(adapter, QLCNIC_NIU_XG_PAUSE_CTL);
+                val = QLCRD32(adapter, QLCNIC_NIU_XG_PAUSE_CTL, &err);
+                if (err == -EIO)
+                        return;
                 if (port == 0)
                         pause->tx_pause = !(qlcnic_xg_get_xg0_mask(val));
                 else
@@ -707,6 +723,7 @@ qlcnic_set_pauseparam(struct net_device *netdev,
 {
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         int port = adapter->ahw->physical_port;
+        int err = 0;
         __u32 val;
 
         if (qlcnic_83xx_check(adapter))
@@ -717,7 +734,9 @@ qlcnic_set_pauseparam(struct net_device *netdev,
                 if ((port < 0) || (port > QLCNIC_NIU_MAX_GBE_PORTS))
                         return -EIO;
                 /* set flow control */
-                val = QLCRD32(adapter, QLCNIC_NIU_GB_MAC_CONFIG_0(port));
+                val = QLCRD32(adapter, QLCNIC_NIU_GB_MAC_CONFIG_0(port), &err);
+                if (err == -EIO)
+                        return err;
 
                 if (pause->rx_pause)
                         qlcnic_gb_rx_flowctl(val);
@@ -728,7 +747,9 @@ qlcnic_set_pauseparam(struct net_device *netdev,
                                 val);
                 QLCWR32(adapter, QLCNIC_NIU_GB_MAC_CONFIG_0(port), val);
                 /* set autoneg */
-                val = QLCRD32(adapter, QLCNIC_NIU_GB_PAUSE_CTL);
+                val = QLCRD32(adapter, QLCNIC_NIU_GB_PAUSE_CTL, &err);
+                if (err == -EIO)
+                        return err;
                 switch (port) {
                 case 0:
                         if (pause->tx_pause)
@@ -764,7 +785,9 @@ qlcnic_set_pauseparam(struct net_device *netdev,
                 if ((port < 0) || (port > QLCNIC_NIU_MAX_XG_PORTS))
                         return -EIO;
 
-                val = QLCRD32(adapter, QLCNIC_NIU_XG_PAUSE_CTL);
+                val = QLCRD32(adapter, QLCNIC_NIU_XG_PAUSE_CTL, &err);
+                if (err == -EIO)
+                        return err;
                 if (port == 0) {
                         if (pause->tx_pause)
                                 qlcnic_xg_unset_xg0_mask(val);
@@ -788,11 +811,14 @@ static int qlcnic_reg_test(struct net_device *dev)
 {
         struct qlcnic_adapter *adapter = netdev_priv(dev);
         u32 data_read;
+        int err = 0;
 
         if (qlcnic_83xx_check(adapter))
                 return qlcnic_83xx_reg_test(adapter);
 
-        data_read = QLCRD32(adapter, QLCNIC_PCIX_PH_REG(0));
+        data_read = QLCRD32(adapter, QLCNIC_PCIX_PH_REG(0), &err);
+        if (err == -EIO)
+                return err;
         if ((data_read & 0xffff) != adapter->pdev->vendor)
                 return 1;
 
@@ -1026,8 +1052,15 @@ qlcnic_diag_test(struct net_device *dev, struct ethtool_test *eth_test,
                 if (data[3])
                         eth_test->flags |= ETH_TEST_FL_FAILED;
 
-                data[4] = qlcnic_eeprom_test(dev);
-                if (data[4])
+                if (eth_test->flags & ETH_TEST_FL_EXTERNAL_LB) {
+                        data[4] = qlcnic_loopback_test(dev, QLCNIC_ELB_MODE);
+                        if (data[4])
+                                eth_test->flags |= ETH_TEST_FL_FAILED;
+                        eth_test->flags |= ETH_TEST_FL_EXTERNAL_LB_DONE;
+                }
+
+                data[5] = qlcnic_eeprom_test(dev);
+                if (data[5])
                         eth_test->flags |= ETH_TEST_FL_FAILED;
         }
 }
@@ -1257,17 +1290,20 @@ qlcnic_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
         struct qlcnic_adapter *adapter = netdev_priv(dev);
         u32 wol_cfg;
+        int err = 0;
 
         if (qlcnic_83xx_check(adapter))
                 return;
         wol->supported = 0;
         wol->wolopts = 0;
 
-        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG_NV);
+        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG_NV, &err);
+        if (err == -EIO)
+                return;
         if (wol_cfg & (1UL << adapter->portnum))
                 wol->supported |= WAKE_MAGIC;
 
-        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG);
+        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG, &err);
         if (wol_cfg & (1UL << adapter->portnum))
                 wol->wolopts |= WAKE_MAGIC;
 }
@@ -1277,17 +1313,22 @@ qlcnic_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
         struct qlcnic_adapter *adapter = netdev_priv(dev);
         u32 wol_cfg;
+        int err = 0;
 
         if (qlcnic_83xx_check(adapter))
                 return -EOPNOTSUPP;
         if (wol->wolopts & ~WAKE_MAGIC)
                 return -EINVAL;
 
-        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG_NV);
+        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG_NV, &err);
+        if (err == -EIO)
+                return err;
         if (!(wol_cfg & (1 << adapter->portnum)))
                 return -EOPNOTSUPP;
 
-        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG);
+        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG, &err);
+        if (err == -EIO)
+                return err;
         if (wol->wolopts & WAKE_MAGIC)
                 wol_cfg |= 1UL << adapter->portnum;
         else
@@ -1540,7 +1581,7 @@ qlcnic_set_dump(struct net_device *netdev, struct ethtool_dump *val)
                 return 0;
         case QLCNIC_SET_QUIESCENT:
         case QLCNIC_RESET_QUIESCENT:
-                state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
+                state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
                 if (state == QLCNIC_DEV_FAILED || (state == QLCNIC_DEV_BADBAD))
                         netdev_info(netdev, "Device in FAILED state\n");
                 return 0;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
index 5b5d2edf125d..4d5f59b2d153 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
@@ -317,16 +317,20 @@ static void qlcnic_write_window_reg(u32 addr, void __iomem *bar0, u32 data)
 int
 qlcnic_pcie_sem_lock(struct qlcnic_adapter *adapter, int sem, u32 id_reg)
 {
-        int done = 0, timeout = 0;
+        int timeout = 0;
+        int err = 0;
+        u32 done = 0;
 
         while (!done) {
-                done = QLCRD32(adapter, QLCNIC_PCIE_REG(PCIE_SEM_LOCK(sem)));
+                done = QLCRD32(adapter, QLCNIC_PCIE_REG(PCIE_SEM_LOCK(sem)),
+                               &err);
                 if (done == 1)
                         break;
                 if (++timeout >= QLCNIC_PCIE_SEM_TIMEOUT) {
                         dev_err(&adapter->pdev->dev,
                                 "Failed to acquire sem=%d lock; holdby=%d\n",
-                                sem, id_reg ? QLCRD32(adapter, id_reg) : -1);
+                                sem,
+                                id_reg ? QLCRD32(adapter, id_reg, &err) : -1);
                         return -EIO;
                 }
                 msleep(1);
@@ -341,19 +345,22 @@ qlcnic_pcie_sem_lock(struct qlcnic_adapter *adapter, int sem, u32 id_reg)
 void
 qlcnic_pcie_sem_unlock(struct qlcnic_adapter *adapter, int sem)
 {
-        QLCRD32(adapter, QLCNIC_PCIE_REG(PCIE_SEM_UNLOCK(sem)));
+        int err = 0;
+
+        QLCRD32(adapter, QLCNIC_PCIE_REG(PCIE_SEM_UNLOCK(sem)), &err);
 }
 
 int qlcnic_ind_rd(struct qlcnic_adapter *adapter, u32 addr)
 {
+        int err = 0;
         u32 data;
 
         if (qlcnic_82xx_check(adapter))
                 qlcnic_read_window_reg(addr, adapter->ahw->pci_base0, &data);
         else {
-                data = qlcnic_83xx_rd_reg_indirect(adapter, addr);
-                if (data == -EIO)
-                        return -EIO;
+                data = QLCRD32(adapter, addr, &err);
+                if (err == -EIO)
+                        return err;
         }
         return data;
 }
@@ -516,20 +523,18 @@ void __qlcnic_set_multi(struct net_device *netdev, u16 vlan)
         if (netdev->flags & IFF_PROMISC) {
                 if (!(adapter->flags & QLCNIC_PROMISC_DISABLED))
                         mode = VPORT_MISS_MODE_ACCEPT_ALL;
-        } else if (netdev->flags & IFF_ALLMULTI) {
-                if (netdev_mc_count(netdev) > ahw->max_mc_count) {
-                        mode = VPORT_MISS_MODE_ACCEPT_MULTI;
-                } else if (!netdev_mc_empty(netdev) &&
-                           !qlcnic_sriov_vf_check(adapter)) {
-                                netdev_for_each_mc_addr(ha, netdev)
-                                        qlcnic_nic_add_mac(adapter, ha->addr,
-                                                           vlan);
-                }
-                if (mode != VPORT_MISS_MODE_ACCEPT_MULTI &&
-                    qlcnic_sriov_vf_check(adapter))
-                        qlcnic_vf_add_mc_list(netdev, vlan);
+        } else if ((netdev->flags & IFF_ALLMULTI) ||
+                   (netdev_mc_count(netdev) > ahw->max_mc_count)) {
+                mode = VPORT_MISS_MODE_ACCEPT_MULTI;
+        } else if (!netdev_mc_empty(netdev) &&
+                   !qlcnic_sriov_vf_check(adapter)) {
+                netdev_for_each_mc_addr(ha, netdev)
+                        qlcnic_nic_add_mac(adapter, ha->addr, vlan);
         }
 
+        if (qlcnic_sriov_vf_check(adapter))
+                qlcnic_vf_add_mc_list(netdev, vlan);
+
         /* configure unicast MAC address, if there is not sufficient space
          * to store all the unicast addresses then enable promiscuous mode
          */
@@ -1161,7 +1166,8 @@ int qlcnic_82xx_hw_write_wx_2M(struct qlcnic_adapter *adapter, ulong off,
         return -EIO;
 }
 
-int qlcnic_82xx_hw_read_wx_2M(struct qlcnic_adapter *adapter, ulong off)
+int qlcnic_82xx_hw_read_wx_2M(struct qlcnic_adapter *adapter, ulong off,
+                              int *err)
 {
         unsigned long flags;
         int rv;
@@ -1417,7 +1423,7 @@ int qlcnic_pci_mem_read_2M(struct qlcnic_adapter *adapter, u64 off, u64 *data)
 
 int qlcnic_82xx_get_board_info(struct qlcnic_adapter *adapter)
 {
-        int offset, board_type, magic;
+        int offset, board_type, magic, err = 0;
         struct pci_dev *pdev = adapter->pdev;
 
         offset = QLCNIC_FW_MAGIC_OFFSET;
@@ -1437,7 +1443,9 @@ int qlcnic_82xx_get_board_info(struct qlcnic_adapter *adapter)
         adapter->ahw->board_type = board_type;
 
         if (board_type == QLCNIC_BRDTYPE_P3P_4_GB_MM) {
-                u32 gpio = QLCRD32(adapter, QLCNIC_ROMUSB_GLB_PAD_GPIO_I);
+                u32 gpio = QLCRD32(adapter, QLCNIC_ROMUSB_GLB_PAD_GPIO_I, &err);
+                if (err == -EIO)
+                        return err;
                 if ((gpio & 0x8000) == 0)
                         board_type = QLCNIC_BRDTYPE_P3P_10G_TP;
         }
@@ -1477,10 +1485,13 @@ int
 qlcnic_wol_supported(struct qlcnic_adapter *adapter)
 {
         u32 wol_cfg;
+        int err = 0;
 
-        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG_NV);
+        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG_NV, &err);
         if (wol_cfg & (1UL << adapter->portnum)) {
-                wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG);
+                wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG, &err);
+                if (err == -EIO)
+                        return err;
                 if (wol_cfg & (1 << adapter->portnum))
                         return 1;
         }
@@ -1541,6 +1552,7 @@ void qlcnic_82xx_get_func_no(struct qlcnic_adapter *adapter)
 void qlcnic_82xx_read_crb(struct qlcnic_adapter *adapter, char *buf,
                           loff_t offset, size_t size)
 {
+        int err = 0;
         u32 data;
         u64 qmdata;
 
@@ -1548,7 +1560,7 @@ void qlcnic_82xx_read_crb(struct qlcnic_adapter *adapter, char *buf,
                 qlcnic_pci_camqm_read_2M(adapter, offset, &qmdata);
                 memcpy(buf, &qmdata, size);
         } else {
-                data = QLCRD32(adapter, offset);
+                data = QLCRD32(adapter, offset, &err);
                 memcpy(buf, &data, size);
         }
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h
index 2c22504f57aa..4a71b28effcb 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h
@@ -154,7 +154,7 @@ struct qlcnic_hardware_context;
 struct qlcnic_adapter;
 
 int qlcnic_82xx_start_firmware(struct qlcnic_adapter *);
-int qlcnic_82xx_hw_read_wx_2M(struct qlcnic_adapter *adapter, ulong);
+int qlcnic_82xx_hw_read_wx_2M(struct qlcnic_adapter *adapter, ulong, int *);
 int qlcnic_82xx_hw_write_wx_2M(struct qlcnic_adapter *, ulong, u32);
 int qlcnic_82xx_config_hw_lro(struct qlcnic_adapter *adapter, int);
 int qlcnic_82xx_nic_set_promisc(struct qlcnic_adapter *adapter, u32);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
index d28336fc65ab..974d62607e13 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
@@ -142,7 +142,7 @@ void qlcnic_release_tx_buffers(struct qlcnic_adapter *adapter)
                                          buffrag->length, PCI_DMA_TODEVICE);
                         buffrag->dma = 0ULL;
                 }
-                for (j = 0; j < cmd_buf->frag_count; j++) {
+                for (j = 1; j < cmd_buf->frag_count; j++) {
                         buffrag++;
                         if (buffrag->dma) {
                                 pci_unmap_page(adapter->pdev, buffrag->dma,
@@ -286,10 +286,11 @@ static int qlcnic_wait_rom_done(struct qlcnic_adapter *adapter)
 {
         long timeout = 0;
         long done = 0;
+        int err = 0;
 
         cond_resched();
         while (done == 0) {
-                done = QLCRD32(adapter, QLCNIC_ROMUSB_GLB_STATUS);
+                done = QLCRD32(adapter, QLCNIC_ROMUSB_GLB_STATUS, &err);
                 done &= 2;
                 if (++timeout >= QLCNIC_MAX_ROM_WAIT_USEC) {
                         dev_err(&adapter->pdev->dev,
@@ -304,6 +305,8 @@ static int qlcnic_wait_rom_done(struct qlcnic_adapter *adapter)
 static int do_rom_fast_read(struct qlcnic_adapter *adapter,
                             u32 addr, u32 *valp)
 {
+        int err = 0;
+
         QLCWR32(adapter, QLCNIC_ROMUSB_ROM_ADDRESS, addr);
         QLCWR32(adapter, QLCNIC_ROMUSB_ROM_DUMMY_BYTE_CNT, 0);
         QLCWR32(adapter, QLCNIC_ROMUSB_ROM_ABYTE_CNT, 3);
@@ -317,7 +320,9 @@ static int do_rom_fast_read(struct qlcnic_adapter *adapter,
         udelay(10);
         QLCWR32(adapter, QLCNIC_ROMUSB_ROM_DUMMY_BYTE_CNT, 0);
 
-        *valp = QLCRD32(adapter, QLCNIC_ROMUSB_ROM_RDATA);
+        *valp = QLCRD32(adapter, QLCNIC_ROMUSB_ROM_RDATA, &err);
+        if (err == -EIO)
+                return err;
         return 0;
 }
 
@@ -369,11 +374,11 @@ int qlcnic_rom_fast_read(struct qlcnic_adapter *adapter, u32 addr, u32 *valp)
 
 int qlcnic_pinit_from_rom(struct qlcnic_adapter *adapter)
 {
-        int addr, val;
+        int addr, err = 0;
         int i, n, init_delay;
         struct crb_addr_pair *buf;
         unsigned offset;
-        u32 off;
+        u32 off, val;
         struct pci_dev *pdev = adapter->pdev;
 
         QLC_SHARED_REG_WR32(adapter, QLCNIC_CMDPEG_STATE, 0);
@@ -402,7 +407,9 @@ int qlcnic_pinit_from_rom(struct qlcnic_adapter *adapter)
         QLCWR32(adapter, QLCNIC_CRB_NIU + 0xb0000, 0x00);
 
         /* halt sre */
-        val = QLCRD32(adapter, QLCNIC_CRB_SRE + 0x1000);
+        val = QLCRD32(adapter, QLCNIC_CRB_SRE + 0x1000, &err);
+        if (err == -EIO)
+                return err;
         QLCWR32(adapter, QLCNIC_CRB_SRE + 0x1000, val & (~(0x1)));
 
         /* halt epg */
@@ -719,10 +726,12 @@ qlcnic_check_flash_fw_ver(struct qlcnic_adapter *adapter)
 static int
 qlcnic_has_mn(struct qlcnic_adapter *adapter)
 {
-        u32 capability;
-        capability = 0;
+        u32 capability = 0;
+        int err = 0;
 
-        capability = QLCRD32(adapter, QLCNIC_PEG_TUNE_CAPABILITY);
+        capability = QLCRD32(adapter, QLCNIC_PEG_TUNE_CAPABILITY, &err);
+        if (err == -EIO)
+                return err;
         if (capability & QLCNIC_PEG_TUNE_MN_PRESENT)
                 return 1;
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index d3f8797efcc3..6946d354f44f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -161,36 +161,68 @@ static inline int qlcnic_82xx_is_lb_pkt(u64 sts_data)
         return (qlcnic_get_sts_status(sts_data) == STATUS_CKSUM_LOOP) ? 1 : 0;
 }
 
+static void qlcnic_delete_rx_list_mac(struct qlcnic_adapter *adapter,
+                                      struct qlcnic_filter *fil,
+                                      void *addr, u16 vlan_id)
+{
+        int ret;
+        u8 op;
+
+        op = vlan_id ? QLCNIC_MAC_VLAN_ADD : QLCNIC_MAC_ADD;
+        ret = qlcnic_sre_macaddr_change(adapter, addr, vlan_id, op);
+        if (ret)
+                return;
+
+        op = vlan_id ? QLCNIC_MAC_VLAN_DEL : QLCNIC_MAC_DEL;
+        ret = qlcnic_sre_macaddr_change(adapter, addr, vlan_id, op);
+        if (!ret) {
+                hlist_del(&fil->fnode);
+                adapter->rx_fhash.fnum--;
+        }
+}
+
+static struct qlcnic_filter *qlcnic_find_mac_filter(struct hlist_head *head,
+                                                    void *addr, u16 vlan_id)
+{
+        struct qlcnic_filter *tmp_fil = NULL;
+        struct hlist_node *n;
+
+        hlist_for_each_entry_safe(tmp_fil, n, head, fnode) {
+                if (!memcmp(tmp_fil->faddr, addr, ETH_ALEN) &&
+                    tmp_fil->vlan_id == vlan_id)
+                        return tmp_fil;
+        }
+
+        return NULL;
+}
+
 void qlcnic_add_lb_filter(struct qlcnic_adapter *adapter, struct sk_buff *skb,
                           int loopback_pkt, u16 vlan_id)
 {
         struct ethhdr *phdr = (struct ethhdr *)(skb->data);
         struct qlcnic_filter *fil, *tmp_fil;
-        struct hlist_node *n;
         struct hlist_head *head;
         unsigned long time;
         u64 src_addr = 0;
-        u8 hindex, found = 0, op;
+        u8 hindex, op;
         int ret;
 
         memcpy(&src_addr, phdr->h_source, ETH_ALEN);
+        hindex = qlcnic_mac_hash(src_addr) &
+                 (adapter->fhash.fbucket_size - 1);
 
         if (loopback_pkt) {
                 if (adapter->rx_fhash.fnum >= adapter->rx_fhash.fmax)
                         return;
 
-                hindex = qlcnic_mac_hash(src_addr) &
-                         (adapter->fhash.fbucket_size - 1);
                 head = &(adapter->rx_fhash.fhead[hindex]);
 
-                hlist_for_each_entry_safe(tmp_fil, n, head, fnode) {
-                        if (!memcmp(tmp_fil->faddr, &src_addr, ETH_ALEN) &&
-                            tmp_fil->vlan_id == vlan_id) {
-                                time = tmp_fil->ftime;
-                                if (jiffies > (QLCNIC_READD_AGE * HZ + time))
-                                        tmp_fil->ftime = jiffies;
-                                return;
-                        }
+                tmp_fil = qlcnic_find_mac_filter(head, &src_addr, vlan_id);
+                if (tmp_fil) {
+                        time = tmp_fil->ftime;
+                        if (time_after(jiffies, QLCNIC_READD_AGE * HZ + time))
+                                tmp_fil->ftime = jiffies;
+                        return;
                 }
 
                 fil = kzalloc(sizeof(struct qlcnic_filter), GFP_ATOMIC);
@@ -205,36 +237,37 @@ void qlcnic_add_lb_filter(struct qlcnic_adapter *adapter, struct sk_buff *skb,
                 adapter->rx_fhash.fnum++;
                 spin_unlock(&adapter->rx_mac_learn_lock);
         } else {
-                hindex = qlcnic_mac_hash(src_addr) &
-                         (adapter->fhash.fbucket_size - 1);
-                head = &(adapter->rx_fhash.fhead[hindex]);
-                spin_lock(&adapter->rx_mac_learn_lock);
-                hlist_for_each_entry_safe(tmp_fil, n, head, fnode) {
-                        if (!memcmp(tmp_fil->faddr, &src_addr, ETH_ALEN) &&
-                            tmp_fil->vlan_id == vlan_id) {
-                                found = 1;
-                                break;
-                        }
-                }
+                head = &adapter->fhash.fhead[hindex];
 
-                if (!found) {
-                        spin_unlock(&adapter->rx_mac_learn_lock);
-                        return;
-                }
+                spin_lock(&adapter->mac_learn_lock);
 
-                op = vlan_id ? QLCNIC_MAC_VLAN_ADD : QLCNIC_MAC_ADD;
-                ret = qlcnic_sre_macaddr_change(adapter, (u8 *)&src_addr,
-                                                vlan_id, op);
-                if (!ret) {
+                tmp_fil = qlcnic_find_mac_filter(head, &src_addr, vlan_id);
+                if (tmp_fil) {
                         op = vlan_id ? QLCNIC_MAC_VLAN_DEL : QLCNIC_MAC_DEL;
                         ret = qlcnic_sre_macaddr_change(adapter,
                                                         (u8 *)&src_addr,
                                                         vlan_id, op);
                         if (!ret) {
-                                hlist_del(&(tmp_fil->fnode));
-                                adapter->rx_fhash.fnum--;
+                                hlist_del(&tmp_fil->fnode);
+                                adapter->fhash.fnum--;
                         }
+
+                        spin_unlock(&adapter->mac_learn_lock);
+
+                        return;
                 }
+
+                spin_unlock(&adapter->mac_learn_lock);
+
+                head = &adapter->rx_fhash.fhead[hindex];
+
+                spin_lock(&adapter->rx_mac_learn_lock);
+
+                tmp_fil = qlcnic_find_mac_filter(head, &src_addr, vlan_id);
+                if (tmp_fil)
+                        qlcnic_delete_rx_list_mac(adapter, tmp_fil, &src_addr,
+                                                  vlan_id);
+
                 spin_unlock(&adapter->rx_mac_learn_lock);
         }
 }
@@ -262,7 +295,7 @@ void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr,
 
         mac_req = (struct qlcnic_mac_req *)&(req->words[0]);
         mac_req->op = vlan_id ? QLCNIC_MAC_VLAN_ADD : QLCNIC_MAC_ADD;
-        memcpy(mac_req->mac_addr, &uaddr, ETH_ALEN);
+        memcpy(mac_req->mac_addr, uaddr, ETH_ALEN);
 
         vlan_req = (struct qlcnic_vlan_req *)&req->words[1];
         vlan_req->vlan_id = cpu_to_le16(vlan_id);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 4528f8ec333b..ee013fcc3322 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -977,8 +977,8 @@ qlcnic_check_options(struct qlcnic_adapter *adapter)
 static int
 qlcnic_initialize_nic(struct qlcnic_adapter *adapter)
 {
-        int err;
         struct qlcnic_info nic_info;
+        int err = 0;
 
         memset(&nic_info, 0, sizeof(struct qlcnic_info));
         err = qlcnic_get_nic_info(adapter, &nic_info, adapter->ahw->pci_func);
@@ -993,7 +993,9 @@ qlcnic_initialize_nic(struct qlcnic_adapter *adapter)
 
         if (adapter->ahw->capabilities & QLCNIC_FW_CAPABILITY_MORE_CAPS) {
                 u32 temp;
-                temp = QLCRD32(adapter, CRB_FW_CAPABILITIES_2);
+                temp = QLCRD32(adapter, CRB_FW_CAPABILITIES_2, &err);
+                if (err == -EIO)
+                        return err;
                 adapter->ahw->extra_capability[0] = temp;
         }
         adapter->ahw->max_mac_filters = nic_info.max_mac_filters;
@@ -1383,6 +1385,8 @@ qlcnic_request_irq(struct qlcnic_adapter *adapter)
         if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
                 if (qlcnic_82xx_check(adapter))
                         handler = qlcnic_tmp_intr;
+                else
+                        handler = qlcnic_83xx_tmp_intr;
                 if (!QLCNIC_IS_MSI_FAMILY(adapter))
                         flags |= IRQF_SHARED;
 
@@ -1531,12 +1535,12 @@ int __qlcnic_up(struct qlcnic_adapter *adapter, struct net_device *netdev)
         if (netdev->features & NETIF_F_LRO)
                 qlcnic_config_hw_lro(adapter, QLCNIC_LRO_ENABLED);
 
+        set_bit(__QLCNIC_DEV_UP, &adapter->state);
         qlcnic_napi_enable(adapter);
 
         qlcnic_linkevent_request(adapter, 1);
 
         adapter->ahw->reset_context = 0;
-        set_bit(__QLCNIC_DEV_UP, &adapter->state);
         return 0;
 }
 
@@ -2139,7 +2143,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (qlcnic_83xx_check(adapter) && !qlcnic_use_msi_x &&
             !!qlcnic_use_msi)
                 dev_warn(&pdev->dev,
-                         "83xx adapter do not support MSI interrupts\n");
+                         "Device does not support MSI interrupts\n");
 
         err = qlcnic_setup_intr(adapter, 0);
         if (err) {
@@ -3093,6 +3097,7 @@ qlcnic_check_health(struct qlcnic_adapter *adapter)
 {
         u32 state = 0, heartbeat;
         u32 peg_status;
+        int err = 0;
 
         if (qlcnic_check_temp(adapter))
                 goto detach;
@@ -3139,11 +3144,11 @@ qlcnic_check_health(struct qlcnic_adapter *adapter)
                         "PEG_NET_4_PC: 0x%x\n",
                         peg_status,
                         QLC_SHARED_REG_RD32(adapter, QLCNIC_PEG_HALT_STATUS2),
-                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_0 + 0x3c),
-                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_1 + 0x3c),
-                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_2 + 0x3c),
-                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_3 + 0x3c),
-                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_4 + 0x3c));
+                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_0 + 0x3c, &err),
+                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_1 + 0x3c, &err),
+                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_2 + 0x3c, &err),
+                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_3 + 0x3c, &err),
+                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_4 + 0x3c, &err));
         if (QLCNIC_FWERROR_CODE(peg_status) == 0x67)
                 dev_err(&adapter->pdev->dev,
                         "Firmware aborted with error code 0x00006700. "
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
index ab8a6744d402..79e54efe07b9 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
@@ -1084,7 +1084,7 @@ flash_temp:
         tmpl_hdr = ahw->fw_dump.tmpl_hdr;
         tmpl_hdr->drv_cap_mask = QLCNIC_DUMP_MASK_DEF;
 
-        if ((tmpl_hdr->version & 0xffffff) >= 0x20001)
+        if ((tmpl_hdr->version & 0xfffff) >= 0x20001)
                 ahw->fw_dump.use_pex_dma = true;
         else
                 ahw->fw_dump.use_pex_dma = false;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 62380ce89905..5d40045b3cea 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -562,7 +562,7 @@ static int qlcnic_sriov_setup_vf(struct qlcnic_adapter *adapter,
         INIT_LIST_HEAD(&adapter->vf_mc_list);
         if (!qlcnic_use_msi_x && !!qlcnic_use_msi)
                 dev_warn(&adapter->pdev->dev,
-                         "83xx adapter do not support MSI interrupts\n");
+                         "Device does not support MSI interrupts\n");
 
         err = qlcnic_setup_intr(adapter, 1);
         if (err) {
@@ -762,6 +762,7 @@ static int qlcnic_sriov_alloc_bc_mbx_args(struct qlcnic_cmd_args *mbx, u32 type)
                         memset(mbx->rsp.arg, 0, sizeof(u32) * mbx->rsp.num);
                         mbx->req.arg[0] = (type | (mbx->req.num << 16) |
                                            (3 << 29));
+                        mbx->rsp.arg[0] = (type & 0xffff) | mbx->rsp.num << 16;
                         return 0;
                 }
         }
@@ -813,6 +814,7 @@ static int qlcnic_sriov_prepare_bc_hdr(struct qlcnic_bc_trans *trans,
                 cmd->req.num = trans->req_pay_size / 4;
                 cmd->rsp.num = trans->rsp_pay_size / 4;
                 hdr = trans->rsp_hdr;
+                cmd->op_type = trans->req_hdr->op_type;
         }
 
         trans->trans_id = seq;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index ee0c1d307966..eb49cd65378c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -635,12 +635,12 @@ static int qlcnic_sriov_pf_channel_cfg_cmd(struct qlcnic_bc_trans *trans,
                                            struct qlcnic_cmd_args *cmd)
 {
         struct qlcnic_vf_info *vf = trans->vf;
-        struct qlcnic_adapter *adapter = vf->adapter;
-        int err;
+        struct qlcnic_vport *vp = vf->vp;
+        struct qlcnic_adapter *adapter;
         u16 func = vf->pci_func;
+        int err;
 
-        cmd->rsp.arg[0] = trans->req_hdr->cmd_op;
-        cmd->rsp.arg[0] |= (1 << 16);
+        adapter = vf->adapter;
 
         if (trans->req_hdr->cmd_op == QLCNIC_BC_CMD_CHANNEL_INIT) {
                 err = qlcnic_sriov_pf_config_vport(adapter, 1, func);
@@ -650,6 +650,8 @@ static int qlcnic_sriov_pf_channel_cfg_cmd(struct qlcnic_bc_trans *trans,
                                 qlcnic_sriov_pf_config_vport(adapter, 0, func);
                 }
         } else {
+                if (vp->vlan_mode == QLC_GUEST_VLAN_MODE)
+                        vp->vlan = 0;
                 err = qlcnic_sriov_pf_config_vport(adapter, 0, func);
         }
 
@@ -1183,7 +1185,7 @@ static int qlcnic_sriov_pf_get_acl_cmd(struct qlcnic_bc_trans *trans,
         u8 cmd_op, mode = vp->vlan_mode;
 
         cmd_op = trans->req_hdr->cmd_op;
-        cmd->rsp.arg[0] = (cmd_op & 0xffff) | 14 << 16 | 1 << 25;
+        cmd->rsp.arg[0] |= 1 << 25;
 
         switch (mode) {
         case QLC_GUEST_VLAN_MODE:
@@ -1561,6 +1563,7 @@ void qlcnic_sriov_pf_handle_flr(struct qlcnic_sriov *sriov,
                                 struct qlcnic_vf_info *vf)
 {
         struct net_device *dev = vf->adapter->netdev;
+        struct qlcnic_vport *vp = vf->vp;
 
         if (!test_and_clear_bit(QLC_BC_VF_STATE, &vf->state)) {
                 clear_bit(QLC_BC_VF_FLR, &vf->state);
@@ -1573,6 +1576,9 @@ void qlcnic_sriov_pf_handle_flr(struct qlcnic_sriov *sriov,
                 return;
         }
 
+        if (vp->vlan_mode == QLC_GUEST_VLAN_MODE)
+                vp->vlan = 0;
+
         qlcnic_sriov_schedule_flr(sriov, vf, qlcnic_sriov_pf_process_flr);
         netdev_info(dev, "FLR received for PCI func %d\n", vf->pci_func);
 }
@@ -1621,13 +1627,15 @@ int qlcnic_sriov_set_vf_mac(struct net_device *netdev, int vf, u8 *mac)
 {
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         struct qlcnic_sriov *sriov = adapter->ahw->sriov;
-        int i, num_vfs = sriov->num_vfs;
+        int i, num_vfs;
         struct qlcnic_vf_info *vf_info;
         u8 *curr_mac;
 
         if (!qlcnic_sriov_pf_check(adapter))
                 return -EOPNOTSUPP;
 
+        num_vfs = sriov->num_vfs;
+
         if (!is_valid_ether_addr(mac) || vf >= num_vfs)
                 return -EINVAL;
 
@@ -1741,6 +1749,7 @@ int qlcnic_sriov_set_vf_vlan(struct net_device *netdev, int vf,
 
         switch (vlan) {
         case 4095:
+                vp->vlan = 0;
                 vp->vlan_mode = QLC_GUEST_VLAN_MODE;
                 break;
         case 0:
@@ -1759,6 +1768,29 @@ int qlcnic_sriov_set_vf_vlan(struct net_device *netdev, int vf,
         return 0;
 }
 
+static inline __u32 qlcnic_sriov_get_vf_vlan(struct qlcnic_adapter *adapter,
+                                             struct qlcnic_vport *vp, int vf)
+{
+        __u32 vlan = 0;
+
+        switch (vp->vlan_mode) {
+        case QLC_PVID_MODE:
+                vlan = vp->vlan;
+                break;
+        case QLC_GUEST_VLAN_MODE:
+                vlan = MAX_VLAN_ID;
+                break;
+        case QLC_NO_VLAN_MODE:
+                vlan = 0;
+                break;
+        default:
+                netdev_info(adapter->netdev, "Invalid VLAN mode = %d for VF %d\n",
+                            vp->vlan_mode, vf);
+        }
+
+        return vlan;
+}
+
 int qlcnic_sriov_get_vf_config(struct net_device *netdev,
                                int vf, struct ifla_vf_info *ivi)
 {
@@ -1774,7 +1806,7 @@ int qlcnic_sriov_get_vf_config(struct net_device *netdev,
 
         vp = sriov->vf_info[vf].vp;
         memcpy(&ivi->mac, vp->mac, ETH_ALEN);
-        ivi->vlan = vp->vlan;
+        ivi->vlan = qlcnic_sriov_get_vf_vlan(adapter, vp, vf);
         ivi->qos = vp->qos;
         ivi->spoofchk = vp->spoofchk;
         if (vp->max_tx_bw == MAX_BW)
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index e6acb9fa5767..6f35f8404d68 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -478,7 +478,7 @@ rx_status_loop:
 
         while (1) {
                 u32 status, len;
-                dma_addr_t mapping;
+                dma_addr_t mapping, new_mapping;
                 struct sk_buff *skb, *new_skb;
                 struct cp_desc *desc;
                 const unsigned buflen = cp->rx_buf_sz;
@@ -520,6 +520,13 @@ rx_status_loop:
                         goto rx_next;
                 }
 
+                new_mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
+                                         PCI_DMA_FROMDEVICE);
+                if (dma_mapping_error(&cp->pdev->dev, new_mapping)) {
+                        dev->stats.rx_dropped++;
+                        goto rx_next;
+                }
+
                 dma_unmap_single(&cp->pdev->dev, mapping,
                                  buflen, PCI_DMA_FROMDEVICE);
 
@@ -531,12 +538,11 @@ rx_status_loop:
 
                 skb_put(skb, len);
 
-                mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
-                                         PCI_DMA_FROMDEVICE);
                 cp->rx_skb[rx_tail] = new_skb;
 
                 cp_rx_skb(cp, skb, desc);
                 rx++;
+                mapping = new_mapping;
 
 rx_next:
                 cp->rx_ring[rx_tail].opts2 = 0;
@@ -716,6 +722,22 @@ static inline u32 cp_tx_vlan_tag(struct sk_buff *skb)
                 TxVlanTag | swab16(vlan_tx_tag_get(skb)) : 0x00;
 }
 
+static void unwind_tx_frag_mapping(struct cp_private *cp, struct sk_buff *skb,
+                                   int first, int entry_last)
+{
+        int frag, index;
+        struct cp_desc *txd;
+        skb_frag_t *this_frag;
+        for (frag = 0; frag+first < entry_last; frag++) {
+                index = first+frag;
+                cp->tx_skb[index] = NULL;
+                txd = &cp->tx_ring[index];
+                this_frag = &skb_shinfo(skb)->frags[frag];
+                dma_unmap_single(&cp->pdev->dev, le64_to_cpu(txd->addr),
+                                 skb_frag_size(this_frag), PCI_DMA_TODEVICE);
+        }
+}
+
 static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
                                         struct net_device *dev)
 {
@@ -749,6 +771,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
 
                 len = skb->len;
                 mapping = dma_map_single(&cp->pdev->dev, skb->data, len, PCI_DMA_TODEVICE);
+                if (dma_mapping_error(&cp->pdev->dev, mapping))
+                        goto out_dma_error;
+
                 txd->opts2 = opts2;
                 txd->addr = cpu_to_le64(mapping);
                 wmb();
@@ -786,6 +811,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
                 first_len = skb_headlen(skb);
                 first_mapping = dma_map_single(&cp->pdev->dev, skb->data,
                                                first_len, PCI_DMA_TODEVICE);
+                if (dma_mapping_error(&cp->pdev->dev, first_mapping))
+                        goto out_dma_error;
+
                 cp->tx_skb[entry] = skb;
                 entry = NEXT_TX(entry);
 
@@ -799,6 +827,11 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
                         mapping = dma_map_single(&cp->pdev->dev,
                                                  skb_frag_address(this_frag),
                                                  len, PCI_DMA_TODEVICE);
+                        if (dma_mapping_error(&cp->pdev->dev, mapping)) {
+                                unwind_tx_frag_mapping(cp, skb, first_entry, entry);
+                                goto out_dma_error;
+                        }
+
                         eor = (entry == (CP_TX_RING_SIZE - 1)) ? RingEnd : 0;
 
                         ctrl = eor | len | DescOwn;
@@ -859,11 +892,16 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
         if (TX_BUFFS_AVAIL(cp) <= (MAX_SKB_FRAGS + 1))
                 netif_stop_queue(dev);
 
+out_unlock:
         spin_unlock_irqrestore(&cp->lock, intr_flags);
 
         cpw8(TxPoll, NormalTxPoll);
 
         return NETDEV_TX_OK;
+out_dma_error:
+        kfree_skb(skb);
+        cp->dev->stats.tx_dropped++;
+        goto out_unlock;
 }
 
 /* Set or clear the multicast filter for this adaptor.
@@ -1054,6 +1092,10 @@ static int cp_refill_rx(struct cp_private *cp)
 
                 mapping = dma_map_single(&cp->pdev->dev, skb->data,
                                          cp->rx_buf_sz, PCI_DMA_FROMDEVICE);
+                if (dma_mapping_error(&cp->pdev->dev, mapping)) {
+                        kfree_skb(skb);
+                        goto err_out;
+                }
                 cp->rx_skb[i] = skb;
 
                 cp->rx_ring[i].opts2 = 0;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 4106a743ca74..b5eb4195fc99 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3689,7 +3689,7 @@ static void rtl_phy_work(struct rtl8169_private *tp)
         if (tp->link_ok(ioaddr))
                 return;
 
-        netif_warn(tp, link, tp->dev, "PHY reset until link up\n");
+        netif_dbg(tp, link, tp->dev, "PHY reset until link up\n");
 
         tp->phy_reset_enable(tp);
 
@@ -6468,6 +6468,8 @@ static int rtl8169_close(struct net_device *dev)
         rtl8169_down(dev);
         rtl_unlock_work(tp);
 
+        cancel_work_sync(&tp->wk.work);
+
         free_irq(pdev->irq, dev);
 
         dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
@@ -6793,8 +6795,6 @@ static void rtl_remove_one(struct pci_dev *pdev)
                 rtl8168_driver_stop(tp);
         }
 
-        cancel_work_sync(&tp->wk.work);
-
         netif_napi_del(&tp->napi);
 
         unregister_netdev(dev);
diff --git a/drivers/net/ethernet/sfc/filter.c b/drivers/net/ethernet/sfc/filter.c
index b74a60ab9ac7..2a469b27a506 100644
--- a/drivers/net/ethernet/sfc/filter.c
+++ b/drivers/net/ethernet/sfc/filter.c
@@ -1209,7 +1209,9 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
         EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + 4 * ip->ihl + 4);
         ports = (const __be16 *)(skb->data + nhoff + 4 * ip->ihl);
 
-        efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT, 0, rxq_index);
+        efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT,
+                           efx->rx_scatter ? EFX_FILTER_FLAG_RX_SCATTER : 0,
+                           rxq_index);
         rc = efx_filter_set_ipv4_full(&spec, ip->protocol,
                                       ip->daddr, ports[1], ip->saddr, ports[0]);
         if (rc)
diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c
index eb4aea3fe793..f5d7ad75e479 100644
--- a/drivers/net/ethernet/sis/sis900.c
+++ b/drivers/net/ethernet/sis/sis900.c
@@ -1318,7 +1318,7 @@ static void sis900_timer(unsigned long data)
                 if (duplex){
                         sis900_set_mode(sis_priv, speed, duplex);
                         sis630_set_eq(net_dev, sis_priv->chipset_rev);
-                        netif_start_queue(net_dev);
+                        netif_carrier_on(net_dev);
                 }
 
                 sis_priv->timer.expires = jiffies + HZ;
@@ -1336,10 +1336,8 @@ static void sis900_timer(unsigned long data)
                 status = sis900_default_phy(net_dev);
                 mii_phy = sis_priv->mii;
 
-                if (status & MII_STAT_LINK){
+                if (status & MII_STAT_LINK)
                         sis900_check_mode(net_dev, mii_phy);
-                        netif_carrier_on(net_dev);
-                }
         } else {
         /* Link ON -> OFF */
                 if (!(status & MII_STAT_LINK)){
@@ -1612,12 +1610,6 @@ sis900_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
         unsigned int  index_cur_tx, index_dirty_tx;
         unsigned int  count_dirty_tx;
 
-        /* Don't transmit data before the complete of auto-negotiation */
-        if(!sis_priv->autong_complete){
-                netif_stop_queue(net_dev);
-                return NETDEV_TX_BUSY;
-        }
-
         spin_lock_irqsave(&sis_priv->lock, flags);
 
         /* Calculate the next Tx descriptor entry. */
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 05a1674e204f..22a7a4336211 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1867,7 +1867,7 @@ static int cpsw_probe(struct platform_device *pdev)
 
         while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
                 for (i = res->start; i <= res->end; i++) {
-                        if (request_irq(i, cpsw_interrupt, IRQF_DISABLED,
+                        if (request_irq(i, cpsw_interrupt, 0,
                                         dev_name(&pdev->dev), priv)) {
                                 dev_err(priv->dev, "error attaching irq\n");
                                 goto clean_ale_ret;
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 07b176bcf929..1a222bce4bd7 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1568,8 +1568,7 @@ static int emac_dev_open(struct net_device *ndev)
         while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
                 for (i = res->start; i <= res->end; i++) {
                         if (devm_request_irq(&priv->pdev->dev, i, emac_irq,
-                                             IRQF_DISABLED,
-                                             ndev->name, ndev))
+                                             0, ndev->name, ndev))
                                 goto rollback;
                 }
                 k++;
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 18373b6ae37d..d0f9c2fd1d4f 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -337,8 +337,11 @@ static int macvlan_open(struct net_device *dev)
         int err;
 
         if (vlan->port->passthru) {
-                if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC))
-                        dev_set_promiscuity(lowerdev, 1);
+                if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC)) {
+                        err = dev_set_promiscuity(lowerdev, 1);
+                        if (err < 0)
+                                goto out;
+                }
                 goto hash_add;
         }
 
@@ -863,6 +866,18 @@ static int macvlan_changelink(struct net_device *dev,
                 struct nlattr *tb[], struct nlattr *data[])
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
+        enum macvlan_mode mode;
+        bool set_mode = false;
+
+        /* Validate mode, but don't set yet: setting flags may fail. */
+        if (data && data[IFLA_MACVLAN_MODE]) {
+                set_mode = true;
+                mode = nla_get_u32(data[IFLA_MACVLAN_MODE]);
+                /* Passthrough mode can't be set or cleared dynamically */
+                if ((mode == MACVLAN_MODE_PASSTHRU) !=
+                    (vlan->mode == MACVLAN_MODE_PASSTHRU))
+                        return -EINVAL;
+        }
 
         if (data && data[IFLA_MACVLAN_FLAGS]) {
                 __u16 flags = nla_get_u16(data[IFLA_MACVLAN_FLAGS]);
@@ -879,8 +894,8 @@ static int macvlan_changelink(struct net_device *dev,
                 }
                 vlan->flags = flags;
         }
-        if (data && data[IFLA_MACVLAN_MODE])
-                vlan->mode = nla_get_u32(data[IFLA_MACVLAN_MODE]);
+        if (set_mode)
+                vlan->mode = mode;
         return 0;
 }
 
diff --git a/drivers/net/phy/mdio-sun4i.c b/drivers/net/phy/mdio-sun4i.c
index 61d3f4ebf52e..7f25e49ae37f 100644
--- a/drivers/net/phy/mdio-sun4i.c
+++ b/drivers/net/phy/mdio-sun4i.c
@@ -40,7 +40,7 @@ struct sun4i_mdio_data {
 static int sun4i_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
 {
         struct sun4i_mdio_data *data = bus->priv;
-        unsigned long start_jiffies;
+        unsigned long timeout_jiffies;
         int value;
 
         /* issue the phy address and reg */
@@ -49,10 +49,9 @@ static int sun4i_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
         writel(0x1, data->membase + EMAC_MAC_MCMD_REG);
 
         /* Wait read complete */
-        start_jiffies = jiffies;
+        timeout_jiffies = jiffies + MDIO_TIMEOUT;
         while (readl(data->membase + EMAC_MAC_MIND_REG) & 0x1) {
-                if (time_after(start_jiffies,
-                               start_jiffies + MDIO_TIMEOUT))
+                if (time_is_before_jiffies(timeout_jiffies))
                         return -ETIMEDOUT;
                 msleep(1);
         }
@@ -69,7 +68,7 @@ static int sun4i_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
                             u16 value)
 {
         struct sun4i_mdio_data *data = bus->priv;
-        unsigned long start_jiffies;
+        unsigned long timeout_jiffies;
 
         /* issue the phy address and reg */
         writel((mii_id << 8) | regnum, data->membase + EMAC_MAC_MADR_REG);
@@ -77,10 +76,9 @@ static int sun4i_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
         writel(0x1, data->membase + EMAC_MAC_MCMD_REG);
 
         /* Wait read complete */
-        start_jiffies = jiffies;
+        timeout_jiffies = jiffies + MDIO_TIMEOUT;
         while (readl(data->membase + EMAC_MAC_MIND_REG) & 0x1) {
-                if (time_after(start_jiffies,
-                               start_jiffies + MDIO_TIMEOUT))
+                if (time_is_before_jiffies(timeout_jiffies))
                         return -ETIMEDOUT;
                 msleep(1);
         }
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 1e3c302d94fe..2bc87e3a8141 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1029,10 +1029,10 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->mii.supports_gmii = 1;
 
         dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                              NETIF_F_RXCSUM;
 
         dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                                 NETIF_F_RXCSUM;
 
         /* Enable checksum offload */
         *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
@@ -1173,7 +1173,6 @@ ax88179_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
         if (((skb->len + 8) % frame_size) == 0)
                 tx_hdr2 |= 0x80008000;  /* Enable padding */
 
-        skb_linearize(skb);
         headroom = skb_headroom(skb);
         tailroom = skb_tailroom(skb);
 
@@ -1317,10 +1316,10 @@ static int ax88179_reset(struct usbnet *dev)
                           1, 1, tmp);
 
         dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                              NETIF_F_RXCSUM;
 
         dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                                 NETIF_F_RXCSUM;
 
         /* Enable checksum offload */
         *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index ee13f9eb740c..11c51f275366 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -344,17 +344,41 @@ static const int multicast_filter_limit = 32;
 static
 int get_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)
 {
-        return usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0),
+        int ret;
+        void *tmp;
+
+        tmp = kmalloc(size, GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
+
+        ret = usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0),
                                RTL8152_REQ_GET_REGS, RTL8152_REQT_READ,
-                               value, index, data, size, 500);
+                               value, index, tmp, size, 500);
+
+        memcpy(data, tmp, size);
+        kfree(tmp);
+
+        return ret;
 }
 
 static
 int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)
 {
-        return usb_control_msg(tp->udev, usb_sndctrlpipe(tp->udev, 0),
+        int ret;
+        void *tmp;
+
+        tmp = kmalloc(size, GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
+
+        memcpy(tmp, data, size);
+
+        ret = usb_control_msg(tp->udev, usb_sndctrlpipe(tp->udev, 0),
                                RTL8152_REQ_SET_REGS, RTL8152_REQT_WRITE,
-                               value, index, data, size, 500);
+                               value, index, tmp, size, 500);
+
+        kfree(tmp);
+        return ret;
 }
 
 static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size,
@@ -490,37 +514,31 @@ int usb_ocp_write(struct r8152 *tp, u16 index, u16 byteen, u16 size, void *data)
 
 static u32 ocp_read_dword(struct r8152 *tp, u16 type, u16 index)
 {
-        u32 data;
+        __le32 data;
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_read(tp, index, sizeof(data), &data);
-        else
-                usb_ocp_read(tp, index, sizeof(data), &data);
+        generic_ocp_read(tp, index, sizeof(data), &data, type);
 
         return __le32_to_cpu(data);
 }
 
 static void ocp_write_dword(struct r8152 *tp, u16 type, u16 index, u32 data)
 {
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_write(tp, index, BYTE_EN_DWORD, sizeof(data), &data);
-        else
-                usb_ocp_write(tp, index, BYTE_EN_DWORD, sizeof(data), &data);
+        __le32 tmp = __cpu_to_le32(data);
+
+        generic_ocp_write(tp, index, BYTE_EN_DWORD, sizeof(tmp), &tmp, type);
 }
 
 static u16 ocp_read_word(struct r8152 *tp, u16 type, u16 index)
 {
         u32 data;
+        __le32 tmp;
         u8 shift = index & 2;
 
         index &= ~3;
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_read(tp, index, sizeof(data), &data);
-        else
-                usb_ocp_read(tp, index, sizeof(data), &data);
+        generic_ocp_read(tp, index, sizeof(tmp), &tmp, type);
 
-        data = __le32_to_cpu(data);
+        data = __le32_to_cpu(tmp);
         data >>= (shift * 8);
         data &= 0xffff;
 
@@ -529,7 +547,8 @@ static u16 ocp_read_word(struct r8152 *tp, u16 type, u16 index)
 
 static void ocp_write_word(struct r8152 *tp, u16 type, u16 index, u32 data)
 {
-        u32 tmp, mask = 0xffff;
+        u32 mask = 0xffff;
+        __le32 tmp;
         u16 byen = BYTE_EN_WORD;
         u8 shift = index & 2;
 
@@ -542,34 +561,25 @@ static void ocp_write_word(struct r8152 *tp, u16 type, u16 index, u32 data)
                 index &= ~3;
         }
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_read(tp, index, sizeof(tmp), &tmp);
-        else
-                usb_ocp_read(tp, index, sizeof(tmp), &tmp);
+        generic_ocp_read(tp, index, sizeof(tmp), &tmp, type);
 
-        tmp = __le32_to_cpu(tmp) & ~mask;
-        tmp |= data;
-        tmp = __cpu_to_le32(tmp);
+        data |= __le32_to_cpu(tmp) & ~mask;
+        tmp = __cpu_to_le32(data);
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_write(tp, index, byen, sizeof(tmp), &tmp);
-        else
-                usb_ocp_write(tp, index, byen, sizeof(tmp), &tmp);
+        generic_ocp_write(tp, index, byen, sizeof(tmp), &tmp, type);
 }
 
 static u8 ocp_read_byte(struct r8152 *tp, u16 type, u16 index)
 {
         u32 data;
+        __le32 tmp;
         u8 shift = index & 3;
 
         index &= ~3;
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_read(tp, index, sizeof(data), &data);
-        else
-                usb_ocp_read(tp, index, sizeof(data), &data);
+        generic_ocp_read(tp, index, sizeof(tmp), &tmp, type);
 
-        data = __le32_to_cpu(data);
+        data = __le32_to_cpu(tmp);
         data >>= (shift * 8);
         data &= 0xff;
 
@@ -578,7 +588,8 @@ static u8 ocp_read_byte(struct r8152 *tp, u16 type, u16 index)
 
 static void ocp_write_byte(struct r8152 *tp, u16 type, u16 index, u32 data)
 {
-        u32 tmp, mask = 0xff;
+        u32 mask = 0xff;
+        __le32 tmp;
         u16 byen = BYTE_EN_BYTE;
         u8 shift = index & 3;
 
@@ -591,19 +602,12 @@ static void ocp_write_byte(struct r8152 *tp, u16 type, u16 index, u32 data)
                 index &= ~3;
         }
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_read(tp, index, sizeof(tmp), &tmp);
-        else
-                usb_ocp_read(tp, index, sizeof(tmp), &tmp);
+        generic_ocp_read(tp, index, sizeof(tmp), &tmp, type);
 
-        tmp = __le32_to_cpu(tmp) & ~mask;
-        tmp |= data;
-        tmp = __cpu_to_le32(tmp);
+        data |= __le32_to_cpu(tmp) & ~mask;
+        tmp = __cpu_to_le32(data);
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_write(tp, index, byen, sizeof(tmp), &tmp);
-        else
-                usb_ocp_write(tp, index, byen, sizeof(tmp), &tmp);
+        generic_ocp_write(tp, index, byen, sizeof(tmp), &tmp, type);
 }
 
 static void r8152_mdio_write(struct r8152 *tp, u32 reg_addr, u32 value)
@@ -685,21 +689,14 @@ static void ocp_reg_write(struct r8152 *tp, u16 addr, u16 data)
 static inline void set_ethernet_addr(struct r8152 *tp)
 {
         struct net_device *dev = tp->netdev;
-        u8 *node_id;
-
-        node_id = kmalloc(sizeof(u8) * 8, GFP_KERNEL);
-        if (!node_id) {
-                netif_err(tp, probe, dev, "out of memory");
-                return;
-        }
+        u8 node_id[8] = {0};
 
-        if (pla_ocp_read(tp, PLA_IDR, sizeof(u8) * 8, node_id) < 0)
+        if (pla_ocp_read(tp, PLA_IDR, sizeof(node_id), node_id) < 0)
                 netif_notice(tp, probe, dev, "inet addr fail\n");
         else {
                 memcpy(dev->dev_addr, node_id, dev->addr_len);
                 memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
         }
-        kfree(node_id);
 }
 
 static int rtl8152_set_mac_address(struct net_device *netdev, void *p)
@@ -882,15 +879,10 @@ static void rtl8152_set_rx_mode(struct net_device *netdev)
 static void _rtl8152_set_rx_mode(struct net_device *netdev)
 {
         struct r8152 *tp = netdev_priv(netdev);
-        u32 tmp, *mc_filter;    /* Multicast hash filter */
+        u32 mc_filter[2];       /* Multicast hash filter */
+        __le32 tmp[2];
         u32 ocp_data;
 
-        mc_filter = kmalloc(sizeof(u32) * 2, GFP_KERNEL);
-        if (!mc_filter) {
-                netif_err(tp, link, netdev, "out of memory");
-                return;
-        }
-
         clear_bit(RTL8152_SET_RX_MODE, &tp->flags);
         netif_stop_queue(netdev);
         ocp_data = ocp_read_dword(tp, MCU_TYPE_PLA, PLA_RCR);
@@ -918,14 +910,12 @@ static void _rtl8152_set_rx_mode(struct net_device *netdev)
                 }
         }
 
-        tmp = mc_filter[0];
-        mc_filter[0] = __cpu_to_le32(swab32(mc_filter[1]));
-        mc_filter[1] = __cpu_to_le32(swab32(tmp));
+        tmp[0] = __cpu_to_le32(swab32(mc_filter[1]));
+        tmp[1] = __cpu_to_le32(swab32(mc_filter[0]));
 
-        pla_ocp_write(tp, PLA_MAR, BYTE_EN_DWORD, sizeof(u32) * 2, mc_filter);
+        pla_ocp_write(tp, PLA_MAR, BYTE_EN_DWORD, sizeof(tmp), tmp);
         ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RCR, ocp_data);
         netif_wake_queue(netdev);
-        kfree(mc_filter);
 }
 
 static netdev_tx_t rtl8152_start_xmit(struct sk_buff *skb,
diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c
index 852392269718..2df2f4fb42a7 100644
--- a/drivers/net/usb/r815x.c
+++ b/drivers/net/usb/r815x.c
@@ -24,34 +24,43 @@
 
 static int pla_read_word(struct usb_device *udev, u16 index)
 {
-        int data, ret;
+        int ret;
         u8 shift = index & 2;
-        __le32 ocp_data;
+        __le32 *tmp;
+
+        tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
 
         index &= ~3;
 
         ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
                               RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-                              index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data),
-                              500);
+                              index, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500);
         if (ret < 0)
-                return ret;
+                goto out2;
 
-        data = __le32_to_cpu(ocp_data);
-        data >>= (shift * 8);
-        data &= 0xffff;
+        ret = __le32_to_cpu(*tmp);
+        ret >>= (shift * 8);
+        ret &= 0xffff;
 
-        return data;
+out2:
+        kfree(tmp);
+        return ret;
 }
 
 static int pla_write_word(struct usb_device *udev, u16 index, u32 data)
 {
-        __le32 ocp_data;
+        __le32 *tmp;
         u32 mask = 0xffff;
         u16 byen = BYTE_EN_WORD;
         u8 shift = index & 2;
         int ret;
 
+        tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
+
         data &= mask;
 
         if (shift) {
@@ -63,19 +72,20 @@ static int pla_write_word(struct usb_device *udev, u16 index, u32 data)
 
         ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
                               RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-                              index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data),
-                              500);
+                              index, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500);
         if (ret < 0)
-                return ret;
+                goto out3;
 
-        data |= __le32_to_cpu(ocp_data) & ~mask;
-        ocp_data = __cpu_to_le32(data);
+        data |= __le32_to_cpu(*tmp) & ~mask;
+        *tmp = __cpu_to_le32(data);
 
         ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
                               RTL815x_REQ_SET_REGS, RTL815x_REQT_WRITE,
-                              index, MCU_TYPE_PLA | byen, &ocp_data,
-                              sizeof(ocp_data), 500);
+                              index, MCU_TYPE_PLA | byen, tmp, sizeof(*tmp),
+                              500);
 
+out3:
+        kfree(tmp);
         return ret;
 }
 
@@ -116,11 +126,18 @@ out1:
 static int r815x_mdio_read(struct net_device *netdev, int phy_id, int reg)
 {
         struct usbnet *dev = netdev_priv(netdev);
+        int ret;
 
         if (phy_id != R815x_PHY_ID)
                 return -EINVAL;
 
-        return ocp_reg_read(dev, BASE_MII + reg * 2);
+        if (usb_autopm_get_interface(dev->intf) < 0)
+                return -ENODEV;
+
+        ret = ocp_reg_read(dev, BASE_MII + reg * 2);
+
+        usb_autopm_put_interface(dev->intf);
+        return ret;
 }
 
 static
@@ -131,7 +148,12 @@ void r815x_mdio_write(struct net_device *netdev, int phy_id, int reg, int val)
         if (phy_id != R815x_PHY_ID)
                 return;
 
+        if (usb_autopm_get_interface(dev->intf) < 0)
+                return;
+
         ocp_reg_write(dev, BASE_MII + reg * 2, val);
+
+        usb_autopm_put_interface(dev->intf);
 }
 
 static int r8153_bind(struct usbnet *dev, struct usb_interface *intf)
@@ -150,7 +172,7 @@ static int r8153_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->mii.phy_id = R815x_PHY_ID;
         dev->mii.supports_gmii = 1;
 
-        return 0;
+        return status;
 }
 
 static int r8152_bind(struct usbnet *dev, struct usb_interface *intf)
@@ -169,7 +191,7 @@ static int r8152_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->mii.phy_id = R815x_PHY_ID;
         dev->mii.supports_gmii = 0;
 
-        return 0;
+        return status;
 }
 
 static const struct driver_info r8152_info = {
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 75409748c774..66ebbacf066f 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -45,7 +45,6 @@
 #define EEPROM_MAC_OFFSET               (0x01)
 #define DEFAULT_TX_CSUM_ENABLE          (true)
 #define DEFAULT_RX_CSUM_ENABLE          (true)
-#define DEFAULT_TSO_ENABLE              (true)
 #define SMSC75XX_INTERNAL_PHY_ID        (1)
 #define SMSC75XX_TX_OVERHEAD            (8)
 #define MAX_RX_FIFO_SIZE                (20 * 1024)
@@ -1410,17 +1409,14 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
 
         INIT_WORK(&pdata->set_multicast, smsc75xx_deferred_multicast_write);
 
-        if (DEFAULT_TX_CSUM_ENABLE) {
+        if (DEFAULT_TX_CSUM_ENABLE)
                 dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
-                if (DEFAULT_TSO_ENABLE)
-                        dev->net->features |= NETIF_F_SG |
-                                NETIF_F_TSO | NETIF_F_TSO6;
-        }
+
         if (DEFAULT_RX_CSUM_ENABLE)
                 dev->net->features |= NETIF_F_RXCSUM;
 
         dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_RXCSUM;
+                                NETIF_F_RXCSUM;
 
         ret = smsc75xx_wait_ready(dev, 0);
         if (ret < 0) {
@@ -2200,8 +2196,6 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
 {
         u32 tx_cmd_a, tx_cmd_b;
 
-        skb_linearize(skb);
-
         if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
                 struct sk_buff *skb2 =
                         skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index da866523cf20..eee1f19ef1e9 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -269,6 +269,7 @@ static void veth_setup(struct net_device *dev)
         dev->ethtool_ops = &veth_ethtool_ops;
         dev->features |= NETIF_F_LLTX;
         dev->features |= VETH_FEATURES;
+        dev->vlan_features = dev->features;
         dev->destructor = veth_dev_free;
 
         dev->hw_features = VETH_FEATURES;
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index a5ba8dd7e6be..f4c6db419ddb 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -136,7 +136,8 @@ struct vxlan_dev {
         u32               flags;        /* VXLAN_F_* below */
 
         struct work_struct sock_work;
-        struct work_struct igmp_work;
+        struct work_struct igmp_join;
+        struct work_struct igmp_leave;
 
         unsigned long     age_interval;
         struct timer_list age_timer;
@@ -736,7 +737,6 @@ static bool vxlan_snoop(struct net_device *dev,
         return false;
 }
 
-
 /* See if multicast group is already in use by other ID */
 static bool vxlan_group_used(struct vxlan_net *vn, __be32 remote_ip)
 {
@@ -770,12 +770,13 @@ static void vxlan_sock_release(struct vxlan_net *vn, struct vxlan_sock *vs)
         queue_work(vxlan_wq, &vs->del_work);
 }
 
-/* Callback to update multicast group membership.
- * Scheduled when vxlan goes up/down.
+/* Callback to update multicast group membership when first VNI on
+ * multicast asddress is brought up
+ * Done as workqueue because ip_mc_join_group acquires RTNL.
  */
-static void vxlan_igmp_work(struct work_struct *work)
+static void vxlan_igmp_join(struct work_struct *work)
 {
-        struct vxlan_dev *vxlan = container_of(work, struct vxlan_dev, igmp_work);
+        struct vxlan_dev *vxlan = container_of(work, struct vxlan_dev, igmp_join);
         struct vxlan_net *vn = net_generic(dev_net(vxlan->dev), vxlan_net_id);
         struct vxlan_sock *vs = vxlan->vn_sock;
         struct sock *sk = vs->sock->sk;
@@ -785,10 +786,27 @@ static void vxlan_igmp_work(struct work_struct *work)
         };
 
         lock_sock(sk);
-        if (vxlan_group_used(vn, vxlan->default_dst.remote_ip))
-                ip_mc_join_group(sk, &mreq);
-        else
-                ip_mc_leave_group(sk, &mreq);
+        ip_mc_join_group(sk, &mreq);
+        release_sock(sk);
+
+        vxlan_sock_release(vn, vs);
+        dev_put(vxlan->dev);
+}
+
+/* Inverse of vxlan_igmp_join when last VNI is brought down */
+static void vxlan_igmp_leave(struct work_struct *work)
+{
+        struct vxlan_dev *vxlan = container_of(work, struct vxlan_dev, igmp_leave);
+        struct vxlan_net *vn = net_generic(dev_net(vxlan->dev), vxlan_net_id);
+        struct vxlan_sock *vs = vxlan->vn_sock;
+        struct sock *sk = vs->sock->sk;
+        struct ip_mreqn mreq = {
+                .imr_multiaddr.s_addr   = vxlan->default_dst.remote_ip,
+                .imr_ifindex            = vxlan->default_dst.remote_ifindex,
+        };
+
+        lock_sock(sk);
+        ip_mc_leave_group(sk, &mreq);
         release_sock(sk);
 
         vxlan_sock_release(vn, vs);
@@ -1359,6 +1377,7 @@ static void vxlan_uninit(struct net_device *dev)
 /* Start ageing timer and join group when device is brought up */
 static int vxlan_open(struct net_device *dev)
 {
+        struct vxlan_net *vn = net_generic(dev_net(dev), vxlan_net_id);
         struct vxlan_dev *vxlan = netdev_priv(dev);
         struct vxlan_sock *vs = vxlan->vn_sock;
 
@@ -1366,10 +1385,11 @@ static int vxlan_open(struct net_device *dev)
         if (!vs)
                 return -ENOTCONN;
 
-        if (IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip))) {
+        if (IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip)) &&
+            ! vxlan_group_used(vn, vxlan->default_dst.remote_ip)) {
                 vxlan_sock_hold(vs);
                 dev_hold(dev);
-                queue_work(vxlan_wq, &vxlan->igmp_work);
+                queue_work(vxlan_wq, &vxlan->igmp_join);
         }
 
         if (vxlan->age_interval)
@@ -1400,13 +1420,15 @@ static void vxlan_flush(struct vxlan_dev *vxlan)
 /* Cleanup timer and forwarding table on shutdown */
 static int vxlan_stop(struct net_device *dev)
 {
+        struct vxlan_net *vn = net_generic(dev_net(dev), vxlan_net_id);
         struct vxlan_dev *vxlan = netdev_priv(dev);
         struct vxlan_sock *vs = vxlan->vn_sock;
 
-        if (vs && IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip))) {
+        if (vs && IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip)) &&
+            ! vxlan_group_used(vn, vxlan->default_dst.remote_ip)) {
                 vxlan_sock_hold(vs);
                 dev_hold(dev);
-                queue_work(vxlan_wq, &vxlan->igmp_work);
+                queue_work(vxlan_wq, &vxlan->igmp_leave);
         }
 
         del_timer_sync(&vxlan->age_timer);
@@ -1471,7 +1493,8 @@ static void vxlan_setup(struct net_device *dev)
 
         INIT_LIST_HEAD(&vxlan->next);
         spin_lock_init(&vxlan->hash_lock);
-        INIT_WORK(&vxlan->igmp_work, vxlan_igmp_work);
+        INIT_WORK(&vxlan->igmp_join, vxlan_igmp_join);
+        INIT_WORK(&vxlan->igmp_leave, vxlan_igmp_leave);
         INIT_WORK(&vxlan->sock_work, vxlan_sock_work);
 
         init_timer_deferrable(&vxlan->age_timer);
@@ -1878,10 +1901,12 @@ static __net_exit void vxlan_exit_net(struct net *net)
 {
         struct vxlan_net *vn = net_generic(net, vxlan_net_id);
         struct vxlan_dev *vxlan;
+        LIST_HEAD(list);
 
         rtnl_lock();
         list_for_each_entry(vxlan, &vn->vxlan_list, next)
-                dev_close(vxlan->dev);
+                unregister_netdevice_queue(vxlan->dev, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/Kconfig b/drivers/net/wireless/ath/ath10k/Kconfig
index cde58fe96254..82e8088ca9b4 100644
--- a/drivers/net/wireless/ath/ath10k/Kconfig
+++ b/drivers/net/wireless/ath/ath10k/Kconfig
@@ -1,6 +1,6 @@
 config ATH10K
         tristate "Atheros 802.11ac wireless cards support"
-        depends on MAC80211
+        depends on MAC80211 && HAS_DMA
         select ATH_COMMON
         ---help---
           This module adds support for wireless adapters based on
diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
index 81b686c6a376..40825d43322e 100644
--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
@@ -325,7 +325,7 @@ ath5k_prepare_multicast(struct ieee80211_hw *hw,
         struct netdev_hw_addr *ha;
 
         mfilt[0] = 0;
-        mfilt[1] = 1;
+        mfilt[1] = 0;
 
         netdev_hw_addr_list_for_each(ha, mc_list) {
                 /* calculate XOR of eight 6-bit values */
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index d1acfe98918a..1576d58291d4 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -610,7 +610,15 @@ static void ar5008_hw_override_ini(struct ath_hw *ah,
         REG_SET_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
 
         if (AR_SREV_9280_20_OR_LATER(ah)) {
-                val = REG_READ(ah, AR_PCU_MISC_MODE2);
+                /*
+                 * For AR9280 and above, there is a new feature that allows
+                 * Multicast search based on both MAC Address and Key ID.
+                 * By default, this feature is enabled. But since the driver
+                 * is not using this feature, we switch it off; otherwise
+                 * multicast search based on MAC addr only will fail.
+                 */
+                val = REG_READ(ah, AR_PCU_MISC_MODE2) &
+                        (~AR_ADHOC_MCAST_KEYID_ENABLE);
 
                 if (!AR_SREV_9271(ah))
                         val &= ~AR_PCU_MISC_MODE2_HWWAR1;
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 9e582e14da74..5205a3625e84 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1082,7 +1082,7 @@ static void ath9k_hif_usb_firmware_fail(struct hif_device_usb *hif_dev)
         struct device *dev = &hif_dev->udev->dev;
         struct device *parent = dev->parent;
 
-        complete(&hif_dev->fw_done);
+        complete_all(&hif_dev->fw_done);
 
         if (parent)
                 device_lock(parent);
@@ -1131,7 +1131,7 @@ static void ath9k_hif_usb_firmware_cb(const struct firmware *fw, void *context)
 
         release_firmware(fw);
         hif_dev->flags |= HIF_USB_READY;
-        complete(&hif_dev->fw_done);
+        complete_all(&hif_dev->fw_done);
 
         return;
 
@@ -1295,7 +1295,9 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
 
         usb_set_intfdata(interface, NULL);
 
-        if (!unplugged && (hif_dev->flags & HIF_USB_START))
+        /* If firmware was loaded we should drop it
+         * go back to first stage bootloader. */
+        if (!unplugged && (hif_dev->flags & HIF_USB_READY))
                 ath9k_hif_usb_reboot(udev);
 
         kfree(hif_dev);
@@ -1316,7 +1318,10 @@ static int ath9k_hif_usb_suspend(struct usb_interface *interface,
         if (!(hif_dev->flags & HIF_USB_START))
                 ath9k_htc_suspend(hif_dev->htc_handle);
 
-        ath9k_hif_usb_dealloc_urbs(hif_dev);
+        wait_for_completion(&hif_dev->fw_done);
+
+        if (hif_dev->flags & HIF_USB_READY)
+                ath9k_hif_usb_dealloc_urbs(hif_dev);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 71a183ffc77f..c3676bf1d6c4 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -861,6 +861,7 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv,
         if (error != 0)
                 goto err_rx;
 
+        ath9k_hw_disable(priv->ah);
 #ifdef CONFIG_MAC80211_LEDS
         /* must be initialized before ieee80211_register_hw */
         priv->led_cdev.default_trigger = ieee80211_create_tpt_led_trigger(priv->hw,
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index c59ae43b9b35..927992732620 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -146,6 +146,28 @@ static void ath_set_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
                                ARRAY_SIZE(bf->rates));
 }
 
+static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
+                             struct sk_buff *skb)
+{
+        int q;
+
+        q = skb_get_queue_mapping(skb);
+        if (txq == sc->tx.uapsdq)
+                txq = sc->tx.txq_map[q];
+
+        if (txq != sc->tx.txq_map[q])
+                return;
+
+        if (WARN_ON(--txq->pending_frames < 0))
+                txq->pending_frames = 0;
+
+        if (txq->stopped &&
+            txq->pending_frames < sc->tx.txq_max_pending[q]) {
+                ieee80211_wake_queue(sc->hw, q);
+                txq->stopped = false;
+        }
+}
+
 static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
 {
         struct ath_txq *txq = tid->ac->txq;
@@ -167,6 +189,7 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
                 if (!bf) {
                         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
                         if (!bf) {
+                                ath_txq_skb_done(sc, txq, skb);
                                 ieee80211_free_txskb(sc->hw, skb);
                                 continue;
                         }
@@ -811,6 +834,7 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
 
                 if (!bf) {
                         __skb_unlink(skb, &tid->buf_q);
+                        ath_txq_skb_done(sc, txq, skb);
                         ieee80211_free_txskb(sc->hw, skb);
                         continue;
                 }
@@ -1824,6 +1848,7 @@ static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_txq *txq,
 
         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
         if (!bf) {
+                ath_txq_skb_done(sc, txq, skb);
                 ieee80211_free_txskb(sc->hw, skb);
                 return;
         }
@@ -2090,6 +2115,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
 
         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
         if (!bf) {
+                ath_txq_skb_done(sc, txq, skb);
                 if (txctl->paprd)
                         dev_kfree_skb_any(skb);
                 else
@@ -2189,7 +2215,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
-        int q, padpos, padsize;
+        int padpos, padsize;
         unsigned long flags;
 
         ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
@@ -2225,21 +2251,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
 
         __skb_queue_tail(&txq->complete_q, skb);
-
-        q = skb_get_queue_mapping(skb);
-        if (txq == sc->tx.uapsdq)
-                txq = sc->tx.txq_map[q];
-
-        if (txq == sc->tx.txq_map[q]) {
-                if (WARN_ON(--txq->pending_frames < 0))
-                        txq->pending_frames = 0;
-
-                if (txq->stopped &&
-                    txq->pending_frames < sc->tx.txq_max_pending[q]) {
-                        ieee80211_wake_queue(sc->hw, q);
-                        txq->stopped = false;
-                }
-        }
+        ath_txq_skb_done(sc, txq, skb);
 }
 
 static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index e8308ec30970..ab636767fbde 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -145,7 +145,7 @@ static void wil_print_ring(struct seq_file *s, const char *prefix,
                                    le16_to_cpu(hdr.type), hdr.flags);
                         if (len <= MAX_MBOXITEM_SIZE) {
                                 int n = 0;
-                                unsigned char printbuf[16 * 3 + 2];
+                                char printbuf[16 * 3 + 2];
                                 unsigned char databuf[MAX_MBOXITEM_SIZE];
                                 void __iomem *src = wmi_buffer(wil, d.addr) +
                                         sizeof(struct wil6210_mbox_hdr);
@@ -416,7 +416,7 @@ static int wil_txdesc_debugfs_show(struct seq_file *s, void *data)
                 seq_printf(s, "  SKB = %p\n", skb);
 
                 if (skb) {
-                        unsigned char printbuf[16 * 3 + 2];
+                        char printbuf[16 * 3 + 2];
                         int i = 0;
                         int len = le16_to_cpu(d->dma.length);
                         void *p = skb->data;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 8e8975562ec3..80099016d21f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -242,7 +242,7 @@ void brcmf_txflowblock_if(struct brcmf_if *ifp,
 {
         unsigned long flags;
 
-        if (!ifp)
+        if (!ifp || !ifp->ndev)
                 return;
 
         brcmf_dbg(TRACE, "enter: idx=%d stop=0x%X reason=%d state=%d\n",
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index f0d9f7f6c83d..29b1f24c2d0f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -1744,13 +1744,14 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
         ulong flags;
         int fifo = BRCMF_FWS_FIFO_BCMC;
         bool multicast = is_multicast_ether_addr(eh->h_dest);
+        bool pae = eh->h_proto == htons(ETH_P_PAE);
 
         /* determine the priority */
         if (!skb->priority)
                 skb->priority = cfg80211_classify8021d(skb);
 
         drvr->tx_multicast += !!multicast;
-        if (ntohs(eh->h_proto) == ETH_P_PAE)
+        if (pae)
                 atomic_inc(&ifp->pend_8021x_cnt);
 
         if (!brcmf_fws_fc_active(fws)) {
@@ -1781,6 +1782,11 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
                 brcmf_fws_schedule_deq(fws);
         } else {
                 brcmf_err("drop skb: no hanger slot\n");
+                if (pae) {
+                        atomic_dec(&ifp->pend_8021x_cnt);
+                        if (waitqueue_active(&ifp->pend_8021x_wait))
+                                wake_up(&ifp->pend_8021x_wait);
+                }
                 brcmu_pkt_buf_free_skb(skb);
         }
         brcmf_fws_unlock(drvr, flags);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 277b37ae7126..7fa71f73cfe8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -1093,8 +1093,11 @@ static void brcmf_link_down(struct brcmf_cfg80211_vif *vif)
                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
                 err = brcmf_fil_cmd_data_set(vif->ifp,
                                              BRCMF_C_DISASSOC, NULL, 0);
-                if (err)
+                if (err) {
                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
+                        cfg80211_disconnected(vif->wdev.netdev, 0,
+                                              NULL, 0, GFP_KERNEL);
+                }
                 clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state);
         }
         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
diff --git a/drivers/net/wireless/cw1200/txrx.c b/drivers/net/wireless/cw1200/txrx.c
index 5862c373d714..e824d4d4a18d 100644
--- a/drivers/net/wireless/cw1200/txrx.c
+++ b/drivers/net/wireless/cw1200/txrx.c
@@ -1165,7 +1165,7 @@ void cw1200_rx_cb(struct cw1200_common *priv,
                 if (cw1200_handle_action_rx(priv, skb))
                         return;
         } else if (ieee80211_is_beacon(frame->frame_control) &&
-                   !arg->status &&
+                   !arg->status && priv->vif &&
                    !memcmp(ieee80211_get_SA(frame), priv->vif->bss_conf.bssid,
                            ETH_ALEN)) {
                 const u8 *tim_ie;
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 3952ddf2ddb2..1531a4fc0960 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -758,7 +758,7 @@ int iwl_alive_start(struct iwl_priv *priv)
                                          BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
                 if (ret)
                         return ret;
-        } else {
+        } else if (priv->lib->bt_params) {
                 /*
                  * default is 2-wire BT coexexistence support
                  */
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index ff8cc75c189d..a70c7b9d9bad 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -97,6 +97,8 @@
 
 #define APMG_PCIDEV_STT_VAL_L1_ACT_DIS          (0x00000800)
 
+#define APMG_RTC_INT_STT_RFKILL         (0x10000000)
+
 /* Device system time */
 #define DEVICE_SYSTEM_TIME_REG 0xA0206C
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 7e5e5c2f9f87..83da884cf303 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -134,7 +134,7 @@ struct wowlan_key_data {
         struct iwl_wowlan_rsc_tsc_params_cmd *rsc_tsc;
         struct iwl_wowlan_tkip_params_cmd *tkip;
         bool error, use_rsc_tsc, use_tkip;
-        int gtk_key_idx;
+        int wep_key_idx;
 };
 
 static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
@@ -188,8 +188,8 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                         wkc.wep_key.key_offset = 0;
                 } else {
                         /* others start at 1 */
-                        data->gtk_key_idx++;
-                        wkc.wep_key.key_offset = data->gtk_key_idx;
+                        data->wep_key_idx++;
+                        wkc.wep_key.key_offset = data->wep_key_idx;
                 }
 
                 ret = iwl_mvm_send_cmd_pdu(mvm, WEP_KEY, CMD_SYNC,
@@ -316,8 +316,13 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                 mvm->ptk_ivlen = key->iv_len;
                 mvm->ptk_icvlen = key->icv_len;
         } else {
-                data->gtk_key_idx++;
-                key->hw_key_idx = data->gtk_key_idx;
+                /*
+                 * firmware only supports TSC/RSC for a single key,
+                 * so if there are multiple keep overwriting them
+                 * with new ones -- this relies on mac80211 doing
+                 * list_add_tail().
+                 */
+                key->hw_key_idx = 1;
                 mvm->gtk_ivlen = key->iv_len;
                 mvm->gtk_icvlen = key->icv_len;
         }
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index e56ed2a84888..c24a744910ac 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -988,7 +988,11 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         char buf[100];
 
-        if (!dbgfs_dir)
+        /*
+         * Check if debugfs directory already exist before creating it.
+         * This may happen when, for example, resetting hw or suspend-resume
+         */
+        if (!dbgfs_dir || mvmvif->dbgfs_dir)
                 return;
 
         mvmvif->dbgfs_dir = debugfs_create_dir("iwlmvm", dbgfs_dir);
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index b60d14151721..365095a0c3b3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -69,7 +69,6 @@
 /* Scan Commands, Responses, Notifications */
 
 /* Masks for iwl_scan_channel.type flags */
-#define SCAN_CHANNEL_TYPE_PASSIVE       0
 #define SCAN_CHANNEL_TYPE_ACTIVE        BIT(0)
 #define SCAN_CHANNEL_NARROW_BAND        BIT(22)
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index e08683b20531..f19baf0dea6b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -257,7 +257,11 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         if (ret)
                 return ret;
 
-        return ieee80211_register_hw(mvm->hw);
+        ret = ieee80211_register_hw(mvm->hw);
+        if (ret)
+                iwl_mvm_leds_exit(mvm);
+
+        return ret;
 }
 
 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
@@ -385,6 +389,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
         ieee80211_wake_queues(mvm->hw);
 
         mvm->vif_count = 0;
+        mvm->rx_ba_sessions = 0;
 }
 
 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
@@ -507,6 +512,27 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
                 goto out_unlock;
 
         /*
+         * TODO: remove this temporary code.
+         * Currently MVM FW supports power management only on single MAC.
+         * If new interface added, disable PM on existing interface.
+         * P2P device is a special case, since it is handled by FW similary to
+         * scan. If P2P deviced is added, PM remains enabled on existing
+         * interface.
+         * Note: the method below does not count the new interface being added
+         * at this moment.
+         */
+        if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
+                mvm->vif_count++;
+        if (mvm->vif_count > 1) {
+                IWL_DEBUG_MAC80211(mvm,
+                                   "Disable power on existing interfaces\n");
+                ieee80211_iterate_active_interfaces_atomic(
+                                            mvm->hw,
+                                            IEEE80211_IFACE_ITER_NORMAL,
+                                            iwl_mvm_pm_disable_iterator, mvm);
+        }
+
+        /*
          * The AP binding flow can be done only after the beacon
          * template is configured (which happens only in the mac80211
          * start_ap() flow), and adding the broadcast station can happen
@@ -529,27 +555,6 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
                 goto out_unlock;
         }
 
-        /*
-         * TODO: remove this temporary code.
-         * Currently MVM FW supports power management only on single MAC.
-         * If new interface added, disable PM on existing interface.
-         * P2P device is a special case, since it is handled by FW similary to
-         * scan. If P2P deviced is added, PM remains enabled on existing
-         * interface.
-         * Note: the method below does not count the new interface being added
-         * at this moment.
-         */
-        if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
-                mvm->vif_count++;
-        if (mvm->vif_count > 1) {
-                IWL_DEBUG_MAC80211(mvm,
-                                   "Disable power on existing interfaces\n");
-                ieee80211_iterate_active_interfaces_atomic(
-                                            mvm->hw,
-                                            IEEE80211_IFACE_ITER_NORMAL,
-                                            iwl_mvm_pm_disable_iterator, mvm);
-        }
-
         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
         if (ret)
                 goto out_release;
@@ -1006,6 +1011,21 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
         mutex_lock(&mvm->mutex);
         if (old_state == IEEE80211_STA_NOTEXIST &&
             new_state == IEEE80211_STA_NONE) {
+                /*
+                 * Firmware bug - it'll crash if the beacon interval is less
+                 * than 16. We can't avoid connecting at all, so refuse the
+                 * station state change, this will cause mac80211 to abandon
+                 * attempts to connect to this AP, and eventually wpa_s will
+                 * blacklist the AP...
+                 */
+                if (vif->type == NL80211_IFTYPE_STATION &&
+                    vif->bss_conf.beacon_int < 16) {
+                        IWL_ERR(mvm,
+                                "AP %pM beacon interval is %d, refusing due to firmware bug!\n",
+                                sta->addr, vif->bss_conf.beacon_int);
+                        ret = -EINVAL;
+                        goto out_unlock;
+                }
                 ret = iwl_mvm_add_sta(mvm, vif, sta);
         } else if (old_state == IEEE80211_STA_NONE &&
                    new_state == IEEE80211_STA_AUTH) {
@@ -1038,6 +1058,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
         } else {
                 ret = -EIO;
         }
+ out_unlock:
         mutex_unlock(&mvm->mutex);
 
         return ret;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index d40d7db185d6..420e82d379d9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -419,6 +419,7 @@ struct iwl_mvm {
         struct work_struct sta_drained_wk;
         unsigned long sta_drained[BITS_TO_LONGS(IWL_MVM_STATION_COUNT)];
         atomic_t pending_frames[IWL_MVM_STATION_COUNT];
+        u8 rx_ba_sessions;
 
         /* configured by mac80211 */
         u32 rts_threshold;
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 2157b0f8ced5..acdff6b67e04 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -137,8 +137,8 @@ static void iwl_mvm_scan_fill_ssids(struct iwl_scan_cmd *cmd,
 {
         int fw_idx, req_idx;
 
-        fw_idx = 0;
-        for (req_idx = req->n_ssids - 1; req_idx > 0; req_idx--) {
+        for (req_idx = req->n_ssids - 1, fw_idx = 0; req_idx > 0;
+             req_idx--, fw_idx++) {
                 cmd->direct_scan[fw_idx].id = WLAN_EID_SSID;
                 cmd->direct_scan[fw_idx].len = req->ssids[req_idx].ssid_len;
                 memcpy(cmd->direct_scan[fw_idx].ssid,
@@ -153,7 +153,9 @@ static void iwl_mvm_scan_fill_ssids(struct iwl_scan_cmd *cmd,
  * just to notify that this scan is active and not passive.
  * In order to notify the FW of the number of SSIDs we wish to scan (including
  * the zero-length one), we need to set the corresponding bits in chan->type,
- * one for each SSID, and set the active bit (first).
+ * one for each SSID, and set the active bit (first). The first SSID is already
+ * included in the probe template, so we need to set only req->n_ssids - 1 bits
+ * in addition to the first bit.
  */
 static u16 iwl_mvm_get_active_dwell(enum ieee80211_band band, int n_ssids)
 {
@@ -176,19 +178,12 @@ static void iwl_mvm_scan_fill_channels(struct iwl_scan_cmd *cmd,
         struct iwl_scan_channel *chan = (struct iwl_scan_channel *)
                 (cmd->data + le16_to_cpu(cmd->tx_cmd.len));
         int i;
-        __le32 chan_type_value;
-
-        if (req->n_ssids > 0)
-                chan_type_value = cpu_to_le32(BIT(req->n_ssids + 1) - 1);
-        else
-                chan_type_value = SCAN_CHANNEL_TYPE_PASSIVE;
 
         for (i = 0; i < cmd->channel_count; i++) {
                 chan->channel = cpu_to_le16(req->channels[i]->hw_value);
+                chan->type = cpu_to_le32(BIT(req->n_ssids) - 1);
                 if (req->channels[i]->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                        chan->type = SCAN_CHANNEL_TYPE_PASSIVE;
-                else
-                        chan->type = chan_type_value;
+                        chan->type &= cpu_to_le32(~SCAN_CHANNEL_TYPE_ACTIVE);
                 chan->active_dwell = cpu_to_le16(active_dwell);
                 chan->passive_dwell = cpu_to_le16(passive_dwell);
                 chan->iteration_count = cpu_to_le16(1);
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 62fe5209093b..563f559b902d 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -608,6 +608,8 @@ int iwl_mvm_rm_bcast_sta(struct iwl_mvm *mvm, struct iwl_mvm_int_sta *bsta)
         return ret;
 }
 
+#define IWL_MAX_RX_BA_SESSIONS 16
+
 int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                        int tid, u16 ssn, bool start)
 {
@@ -618,11 +620,20 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
         lockdep_assert_held(&mvm->mutex);
 
+        if (start && mvm->rx_ba_sessions >= IWL_MAX_RX_BA_SESSIONS) {
+                IWL_WARN(mvm, "Not enough RX BA SESSIONS\n");
+                return -ENOSPC;
+        }
+
         cmd.mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color);
         cmd.sta_id = mvm_sta->sta_id;
         cmd.add_modify = STA_MODE_MODIFY;
-        cmd.add_immediate_ba_tid = (u8) tid;
-        cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
+        if (start) {
+                cmd.add_immediate_ba_tid = (u8) tid;
+                cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
+        } else {
+                cmd.remove_immediate_ba_tid = (u8) tid;
+        }
         cmd.modify_mask = start ? STA_MODIFY_ADD_BA_TID :
                                   STA_MODIFY_REMOVE_BA_TID;
 
@@ -648,6 +659,14 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 break;
         }
 
+        if (!ret) {
+                if (start)
+                        mvm->rx_ba_sessions++;
+                else if (mvm->rx_ba_sessions > 0)
+                        /* check that restart flow didn't zero the counter */
+                        mvm->rx_ba_sessions--;
+        }
+
         return ret;
 }
 
@@ -896,6 +915,7 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
         struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
         u16 txq_id;
+        enum iwl_mvm_agg_state old_state;
 
         /*
          * First set the agg state to OFF to avoid calling
@@ -905,13 +925,17 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         txq_id = tid_data->txq_id;
         IWL_DEBUG_TX_QUEUES(mvm, "Flush AGG: sta %d tid %d q %d state %d\n",
                             mvmsta->sta_id, tid, txq_id, tid_data->state);
+        old_state = tid_data->state;
         tid_data->state = IWL_AGG_OFF;
         spin_unlock_bh(&mvmsta->lock);
 
-        if (iwl_mvm_flush_tx_path(mvm, BIT(txq_id), true))
-                IWL_ERR(mvm, "Couldn't flush the AGG queue\n");
+        if (old_state >= IWL_AGG_ON) {
+                if (iwl_mvm_flush_tx_path(mvm, BIT(txq_id), true))
+                        IWL_ERR(mvm, "Couldn't flush the AGG queue\n");
+
+                iwl_trans_txq_disable(mvm->trans, tid_data->txq_id);
+        }
 
-        iwl_trans_txq_disable(mvm->trans, tid_data->txq_id);
         mvm->queue_to_mac80211[tid_data->txq_id] =
                                 IWL_INVALID_MAC80211_QUEUE;
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 81f3ea5b09a4..ff13458efc27 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -130,6 +130,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x423C, 0x1306, iwl5150_abg_cfg)}, /* Half Mini Card */
         {IWL_PCI_DEVICE(0x423C, 0x1221, iwl5150_agn_cfg)}, /* Mini Card */
         {IWL_PCI_DEVICE(0x423C, 0x1321, iwl5150_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x423C, 0x1326, iwl5150_abg_cfg)}, /* Half Mini Card */
 
         {IWL_PCI_DEVICE(0x423D, 0x1211, iwl5150_agn_cfg)}, /* Mini Card */
         {IWL_PCI_DEVICE(0x423D, 0x1311, iwl5150_agn_cfg)}, /* Half Mini Card */
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index fd848cd1583e..f600e68a410a 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -888,6 +888,14 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
 
                 iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
                 if (hw_rfkill) {
+                        /*
+                         * Clear the interrupt in APMG if the NIC is going down.
+                         * Note that when the NIC exits RFkill (else branch), we
+                         * can't access prph and the NIC will be reset in
+                         * start_hw anyway.
+                         */
+                        iwl_write_prph(trans, APMG_RTC_INT_STT_REG,
+                                       APMG_RTC_INT_STT_RFKILL);
                         set_bit(STATUS_RFKILL, &trans_pcie->status);
                         if (test_and_clear_bit(STATUS_HCMD_ACTIVE,
                                                &trans_pcie->status))
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 826c15602c46..96cfcdd39079 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -670,6 +670,11 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
                 return err;
         }
 
+        /* Reset the entire device */
+        iwl_set_bit(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
+
+        usleep_range(10, 15);
+
         iwl_pcie_apm_init(trans);
 
         /* From now on, the op_mode will be kept updated about RF kill state */
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index ef5fa890a286..89459db4c53b 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1716,9 +1716,9 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
         int ret;
 
-        if (priv->bss_mode != NL80211_IFTYPE_STATION) {
+        if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA) {
                 wiphy_err(wiphy,
-                          "%s: reject infra assoc request in non-STA mode\n",
+                          "%s: reject infra assoc request in non-STA role\n",
                           dev->name);
                 return -EINVAL;
         }
diff --git a/drivers/net/wireless/mwifiex/cfp.c b/drivers/net/wireless/mwifiex/cfp.c
index 988552dece75..5178c4630d89 100644
--- a/drivers/net/wireless/mwifiex/cfp.c
+++ b/drivers/net/wireless/mwifiex/cfp.c
@@ -415,7 +415,8 @@ u32 mwifiex_get_supported_rates(struct mwifiex_private *priv, u8 *rates)
         u32 k = 0;
         struct mwifiex_adapter *adapter = priv->adapter;
 
-        if (priv->bss_mode == NL80211_IFTYPE_STATION) {
+        if (priv->bss_mode == NL80211_IFTYPE_STATION ||
+            priv->bss_mode == NL80211_IFTYPE_P2P_CLIENT) {
                 switch (adapter->config_bands) {
                 case BAND_B:
                         dev_dbg(adapter->dev, "info: infra band=%d "
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index caaf4bd56b30..2cf8b964e966 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -693,7 +693,7 @@ int mwifiex_dnld_fw(struct mwifiex_adapter *adapter,
                 if (!ret) {
                         dev_notice(adapter->dev,
                                    "WLAN FW already running! Skip FW dnld\n");
-                        goto done;
+                        return 0;
                 }
 
                 poll_num = MAX_FIRMWARE_POLL_TRIES;
@@ -719,14 +719,8 @@ int mwifiex_dnld_fw(struct mwifiex_adapter *adapter,
 poll_fw:
         /* Check if the firmware is downloaded successfully or not */
         ret = adapter->if_ops.check_fw_status(adapter, poll_num);
-        if (ret) {
+        if (ret)
                 dev_err(adapter->dev, "FW failed to be active in time\n");
-                return -1;
-        }
-done:
-        /* re-enable host interrupt for mwifiex after fw dnld is successful */
-        if (adapter->if_ops.enable_int)
-                adapter->if_ops.enable_int(adapter);
 
         return ret;
 }
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 1c8a771e8e81..12e778159ec5 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -1291,8 +1291,10 @@ int mwifiex_associate(struct mwifiex_private *priv,
 {
         u8 current_bssid[ETH_ALEN];
 
-        /* Return error if the adapter or table entry is not marked as infra */
-        if ((priv->bss_mode != NL80211_IFTYPE_STATION) ||
+        /* Return error if the adapter is not STA role or table entry
+         * is not marked as infra.
+         */
+        if ((GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA) ||
             (bss_desc->bss_mode != NL80211_IFTYPE_STATION))
                 return -1;
 
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index e15ab72fb03d..1753431de361 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -427,6 +427,10 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
                                 "Cal data request_firmware() failed\n");
         }
 
+        /* enable host interrupt after fw dnld is successful */
+        if (adapter->if_ops.enable_int)
+                adapter->if_ops.enable_int(adapter);
+
         adapter->init_wait_q_woken = false;
         ret = mwifiex_init_fw(adapter);
         if (ret == -1) {
@@ -478,6 +482,8 @@ err_add_intf:
         mwifiex_del_virtual_intf(adapter->wiphy, priv->wdev);
         rtnl_unlock();
 err_init_fw:
+        if (adapter->if_ops.disable_int)
+                adapter->if_ops.disable_int(adapter);
         pr_debug("info: %s: unregister device\n", __func__);
         adapter->if_ops.unregister_dev(adapter);
 done:
@@ -855,7 +861,7 @@ mwifiex_add_card(void *card, struct semaphore *sem,
         INIT_WORK(&adapter->main_work, mwifiex_main_work_queue);
 
         /* Register the device. Fill up the private data structure with relevant
-           information from the card and request for the required IRQ. */
+           information from the card. */
         if (adapter->if_ops.register_dev(adapter)) {
                 pr_err("%s: failed to register mwifiex device\n", __func__);
                 goto err_registerdev;
@@ -919,6 +925,11 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
         if (!adapter)
                 goto exit_remove;
 
+        /* We can no longer handle interrupts once we start doing the teardown
+         * below. */
+        if (adapter->if_ops.disable_int)
+                adapter->if_ops.disable_int(adapter);
+
         adapter->surprise_removed = true;
 
         /* Stop data */
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 3da73d36acdf..253e0bd38e25 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -601,6 +601,7 @@ struct mwifiex_if_ops {
         int (*register_dev) (struct mwifiex_adapter *);
         void (*unregister_dev) (struct mwifiex_adapter *);
         int (*enable_int) (struct mwifiex_adapter *);
+        void (*disable_int) (struct mwifiex_adapter *);
         int (*process_int_status) (struct mwifiex_adapter *);
         int (*host_to_card) (struct mwifiex_adapter *, u8, struct sk_buff *,
                              struct mwifiex_tx_param *);
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 5ee5ed02eccd..09185c963248 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -51,6 +51,7 @@ static struct mwifiex_if_ops sdio_ops;
 static struct semaphore add_remove_card_sem;
 
 static int mwifiex_sdio_resume(struct device *dev);
+static void mwifiex_sdio_interrupt(struct sdio_func *func);
 
 /*
  * SDIO probe.
@@ -296,6 +297,15 @@ static struct sdio_driver mwifiex_sdio = {
         }
 };
 
+/* Write data into SDIO card register. Caller claims SDIO device. */
+static int
+mwifiex_write_reg_locked(struct sdio_func *func, u32 reg, u8 data)
+{
+        int ret = -1;
+        sdio_writeb(func, data, reg, &ret);
+        return ret;
+}
+
 /*
  * This function writes data into SDIO card register.
  */
@@ -303,10 +313,10 @@ static int
 mwifiex_write_reg(struct mwifiex_adapter *adapter, u32 reg, u8 data)
 {
         struct sdio_mmc_card *card = adapter->card;
-        int ret = -1;
+        int ret;
 
         sdio_claim_host(card->func);
-        sdio_writeb(card->func, data, reg, &ret);
+        ret = mwifiex_write_reg_locked(card->func, reg, data);
         sdio_release_host(card->func);
 
         return ret;
@@ -685,23 +695,15 @@ mwifiex_sdio_read_fw_status(struct mwifiex_adapter *adapter, u16 *dat)
  * The host interrupt mask is read, the disable bit is reset and
  * written back to the card host interrupt mask register.
  */
-static int mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
+static void mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
 {
-        u8 host_int_mask, host_int_disable = HOST_INT_DISABLE;
-
-        /* Read back the host_int_mask register */
-        if (mwifiex_read_reg(adapter, HOST_INT_MASK_REG, &host_int_mask))
-                return -1;
-
-        /* Update with the mask and write back to the register */
-        host_int_mask &= ~host_int_disable;
-
-        if (mwifiex_write_reg(adapter, HOST_INT_MASK_REG, host_int_mask)) {
-                dev_err(adapter->dev, "disable host interrupt failed\n");
-                return -1;
-        }
+        struct sdio_mmc_card *card = adapter->card;
+        struct sdio_func *func = card->func;
 
-        return 0;
+        sdio_claim_host(func);
+        mwifiex_write_reg_locked(func, HOST_INT_MASK_REG, 0);
+        sdio_release_irq(func);
+        sdio_release_host(func);
 }
 
 /*
@@ -713,14 +715,29 @@ static int mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
 static int mwifiex_sdio_enable_host_int(struct mwifiex_adapter *adapter)
 {
         struct sdio_mmc_card *card = adapter->card;
+        struct sdio_func *func = card->func;
+        int ret;
+
+        sdio_claim_host(func);
+
+        /* Request the SDIO IRQ */
+        ret = sdio_claim_irq(func, mwifiex_sdio_interrupt);
+        if (ret) {
+                dev_err(adapter->dev, "claim irq failed: ret=%d\n", ret);
+                goto out;
+        }
 
         /* Simply write the mask to the register */
-        if (mwifiex_write_reg(adapter, HOST_INT_MASK_REG,
-                              card->reg->host_int_enable)) {
+        ret = mwifiex_write_reg_locked(func, HOST_INT_MASK_REG,
+                                       card->reg->host_int_enable);
+        if (ret) {
                 dev_err(adapter->dev, "enable host interrupt failed\n");
-                return -1;
+                sdio_release_irq(func);
         }
-        return 0;
+
+out:
+        sdio_release_host(func);
+        return ret;
 }
 
 /*
@@ -997,9 +1014,6 @@ mwifiex_sdio_interrupt(struct sdio_func *func)
         }
         adapter = card->adapter;
 
-        if (adapter->surprise_removed)
-                return;
-
         if (!adapter->pps_uapsd_mode && adapter->ps_state == PS_STATE_SLEEP)
                 adapter->ps_state = PS_STATE_AWAKE;
 
@@ -1625,8 +1639,8 @@ static int mwifiex_sdio_host_to_card(struct mwifiex_adapter *adapter,
         /* Allocate buffer and copy payload */
         blk_size = MWIFIEX_SDIO_BLOCK_SIZE;
         buf_block_len = (pkt_len + blk_size - 1) / blk_size;
-        *(u16 *) &payload[0] = (u16) pkt_len;
-        *(u16 *) &payload[2] = type;
+        *(__le16 *)&payload[0] = cpu_to_le16((u16)pkt_len);
+        *(__le16 *)&payload[2] = cpu_to_le16(type);
 
         /*
          * This is SDIO specific header
@@ -1728,9 +1742,7 @@ mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
         struct sdio_mmc_card *card = adapter->card;
 
         if (adapter->card) {
-                /* Release the SDIO IRQ */
                 sdio_claim_host(card->func);
-                sdio_release_irq(card->func);
                 sdio_disable_func(card->func);
                 sdio_release_host(card->func);
                 sdio_set_drvdata(card->func, NULL);
@@ -1744,7 +1756,7 @@ mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
  */
 static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
 {
-        int ret = 0;
+        int ret;
         struct sdio_mmc_card *card = adapter->card;
         struct sdio_func *func = card->func;
 
@@ -1753,22 +1765,14 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
 
         sdio_claim_host(func);
 
-        /* Request the SDIO IRQ */
-        ret = sdio_claim_irq(func, mwifiex_sdio_interrupt);
-        if (ret) {
-                pr_err("claim irq failed: ret=%d\n", ret);
-                goto disable_func;
-        }
-
         /* Set block size */
         ret = sdio_set_block_size(card->func, MWIFIEX_SDIO_BLOCK_SIZE);
+        sdio_release_host(func);
         if (ret) {
                 pr_err("cannot set SDIO block size\n");
-                ret = -1;
-                goto release_irq;
+                return ret;
         }
 
-        sdio_release_host(func);
         sdio_set_drvdata(func, card);
 
         adapter->dev = &func->dev;
@@ -1776,15 +1780,6 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
         strcpy(adapter->fw_name, card->firmware);
 
         return 0;
-
-release_irq:
-        sdio_release_irq(func);
-disable_func:
-        sdio_disable_func(func);
-        sdio_release_host(func);
-        adapter->card = NULL;
-
-        return -1;
 }
 
 /*
@@ -1813,9 +1808,6 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
          */
         mwifiex_read_reg(adapter, HOST_INTSTATUS_REG, &sdio_ireg);
 
-        /* Disable host interrupt mask register for SDIO */
-        mwifiex_sdio_disable_host_int(adapter);
-
         /* Get SDIO ioport */
         mwifiex_init_sdio_ioport(adapter);
 
@@ -1957,6 +1949,7 @@ static struct mwifiex_if_ops sdio_ops = {
         .register_dev = mwifiex_register_dev,
         .unregister_dev = mwifiex_unregister_dev,
         .enable_int = mwifiex_sdio_enable_host_int,
+        .disable_int = mwifiex_sdio_disable_host_int,
         .process_int_status = mwifiex_process_int_status,
         .host_to_card = mwifiex_sdio_host_to_card,
         .wakeup = mwifiex_pm_wakeup_card,
diff --git a/drivers/net/wireless/mwifiex/sdio.h b/drivers/net/wireless/mwifiex/sdio.h
index 6d51dfdd8251..532ae0ac4dfb 100644
--- a/drivers/net/wireless/mwifiex/sdio.h
+++ b/drivers/net/wireless/mwifiex/sdio.h
@@ -92,9 +92,6 @@
 /* Host Control Registers : Download host interrupt mask */
 #define DN_LD_HOST_INT_MASK             (0x2U)
 
-/* Disable Host interrupt mask */
-#define HOST_INT_DISABLE                0xff
-
 /* Host Control Registers : Host interrupt status */
 #define HOST_INTSTATUS_REG              0x03
 /* Host Control Registers : Upload host interrupt status */
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 206c3e038072..8af97abf7108 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -257,10 +257,10 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                         goto done;
         }
 
-        if (priv->bss_mode == NL80211_IFTYPE_STATION) {
+        if (priv->bss_mode == NL80211_IFTYPE_STATION ||
+            priv->bss_mode == NL80211_IFTYPE_P2P_CLIENT) {
                 u8 config_bands;
 
-                /* Infra mode */
                 ret = mwifiex_deauthenticate(priv, NULL);
                 if (ret)
                         goto done;
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 9b915d3a44be..3e60a31582f8 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -1,6 +1,6 @@
 menuconfig RT2X00
         tristate "Ralink driver support"
-        depends on MAC80211
+        depends on MAC80211 && HAS_DMA
         ---help---
           This will enable the support for the Ralink drivers,
           developed in the rt2x00 project <http://rt2x00.serialmonkey.com>.
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 6c0a91ff963c..aa95c6cf3545 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -936,13 +936,8 @@ void rt2x00queue_index_inc(struct queue_entry *entry, enum queue_index index)
         spin_unlock_irqrestore(&queue->index_lock, irqflags);
 }
 
-void rt2x00queue_pause_queue(struct data_queue *queue)
+void rt2x00queue_pause_queue_nocheck(struct data_queue *queue)
 {
-        if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
-            !test_bit(QUEUE_STARTED, &queue->flags) ||
-            test_and_set_bit(QUEUE_PAUSED, &queue->flags))
-                return;
-
         switch (queue->qid) {
         case QID_AC_VO:
         case QID_AC_VI:
@@ -958,6 +953,15 @@ void rt2x00queue_pause_queue(struct data_queue *queue)
                 break;
         }
 }
+void rt2x00queue_pause_queue(struct data_queue *queue)
+{
+        if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
+            !test_bit(QUEUE_STARTED, &queue->flags) ||
+            test_and_set_bit(QUEUE_PAUSED, &queue->flags))
+                return;
+
+        rt2x00queue_pause_queue_nocheck(queue);
+}
 EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue);
 
 void rt2x00queue_unpause_queue(struct data_queue *queue)
@@ -1019,7 +1023,7 @@ void rt2x00queue_stop_queue(struct data_queue *queue)
                 return;
         }
 
-        rt2x00queue_pause_queue(queue);
+        rt2x00queue_pause_queue_nocheck(queue);
 
         queue->rt2x00dev->ops->lib->stop_queue(queue);
 
diff --git a/drivers/net/wireless/rtlwifi/Kconfig b/drivers/net/wireless/rtlwifi/Kconfig
index 7253de3d8c66..c2ffce7a907c 100644
--- a/drivers/net/wireless/rtlwifi/Kconfig
+++ b/drivers/net/wireless/rtlwifi/Kconfig
@@ -1,27 +1,20 @@
-config RTLWIFI
-        tristate "Realtek wireless card support"
-        depends on MAC80211
-        select FW_LOADER
-        ---help---
-          This is common code for RTL8192CE/RTL8192CU/RTL8192SE/RTL8723AE
-          drivers.  This module does nothing by itself - the various front-end
-          drivers need to be enabled to support any desired devices.
-
-          If you choose to build as a module, it'll be called rtlwifi.
-
-config RTLWIFI_DEBUG
-        bool "Debugging output for rtlwifi driver family"
-        depends on RTLWIFI
+menuconfig RTL_CARDS
+        tristate "Realtek rtlwifi family of devices"
+        depends on MAC80211 && (PCI || USB)
         default y
         ---help---
-        To use the module option that sets the dynamic-debugging level for,
-        the front-end driver, this parameter must be "Y". For memory-limited
-        systems, choose "N". If in doubt, choose "Y".
+          This option will enable support for the Realtek mac80211-based
+          wireless drivers. Drivers rtl8192ce, rtl8192cu, rtl8192se, rtl8192de,
+          rtl8723eu, and rtl8188eu share some common code.
+
+if RTL_CARDS
 
 config RTL8192CE
         tristate "Realtek RTL8192CE/RTL8188CE Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
         select RTL8192C_COMMON
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8192CE/RTL8188CE 802.11n PCIe
         wireless network adapters.
@@ -30,7 +23,9 @@ config RTL8192CE
 
 config RTL8192SE
         tristate "Realtek RTL8192SE/RTL8191SE PCIe Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8192SE/RTL8191SE 802.11n PCIe
         wireless network adapters.
@@ -39,7 +34,9 @@ config RTL8192SE
 
 config RTL8192DE
         tristate "Realtek RTL8192DE/RTL8188DE PCIe Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8192DE/RTL8188DE 802.11n PCIe
         wireless network adapters.
@@ -48,7 +45,9 @@ config RTL8192DE
 
 config RTL8723AE
         tristate "Realtek RTL8723AE PCIe Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8723AE 802.11n PCIe
         wireless network adapters.
@@ -57,7 +56,9 @@ config RTL8723AE
 
 config RTL8188EE
         tristate "Realtek RTL8188EE Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8188EE 802.11n PCIe
         wireless network adapters.
@@ -66,7 +67,9 @@ config RTL8188EE
 
 config RTL8192CU
         tristate "Realtek RTL8192CU/RTL8188CU USB Wireless Network Adapter"
-        depends on RTLWIFI && USB
+        depends on USB
+        select RTLWIFI
+        select RTLWIFI_USB
         select RTL8192C_COMMON
         ---help---
         This is the driver for Realtek RTL8192CU/RTL8188CU 802.11n USB
@@ -74,7 +77,28 @@ config RTL8192CU
 
         If you choose to build it as a module, it will be called rtl8192cu
 
+config RTLWIFI
+        tristate
+        select FW_LOADER
+
+config RTLWIFI_PCI
+        tristate
+
+config RTLWIFI_USB
+        tristate
+
+config RTLWIFI_DEBUG
+        bool "Debugging output for rtlwifi driver family"
+        depends on RTLWIFI
+        default y
+        ---help---
+        To use the module option that sets the dynamic-debugging level for,
+        the front-end driver, this parameter must be "Y". For memory-limited
+        systems, choose "N". If in doubt, choose "Y".
+
 config RTL8192C_COMMON
         tristate
         depends on RTL8192CE || RTL8192CU
-        default m
+        default y
+
+endif
diff --git a/drivers/net/wireless/rtlwifi/Makefile b/drivers/net/wireless/rtlwifi/Makefile
index ff02b874f8d8..d56f023a4b90 100644
--- a/drivers/net/wireless/rtlwifi/Makefile
+++ b/drivers/net/wireless/rtlwifi/Makefile
@@ -12,13 +12,11 @@ rtlwifi-objs	:=		\
 
 rtl8192c_common-objs +=         \
 
-ifneq ($(CONFIG_PCI),)
-rtlwifi-objs    += pci.o
-endif
+obj-$(CONFIG_RTLWIFI_PCI)       += rtl_pci.o
+rtl_pci-objs    :=              pci.o
 
-ifneq ($(CONFIG_USB),)
-rtlwifi-objs    += usb.o
-endif
+obj-$(CONFIG_RTLWIFI_USB)       += rtl_usb.o
+rtl_usb-objs    :=              usb.o
 
 obj-$(CONFIG_RTL8192C_COMMON)   += rtl8192c/
 obj-$(CONFIG_RTL8192CE)         += rtl8192ce/
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 9d558ac77b0c..7651f5acc14b 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -172,6 +172,7 @@ u8 rtl_tid_to_ac(u8 tid)
 {
         return tid_to_ac[tid];
 }
+EXPORT_SYMBOL_GPL(rtl_tid_to_ac);
 
 static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
                                   struct ieee80211_sta_ht_cap *ht_cap)
@@ -406,6 +407,7 @@ void rtl_deinit_deferred_work(struct ieee80211_hw *hw)
         cancel_delayed_work(&rtlpriv->works.ps_rfon_wq);
         cancel_delayed_work(&rtlpriv->works.fwevt_wq);
 }
+EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);
 
 void rtl_init_rfkill(struct ieee80211_hw *hw)
 {
@@ -439,6 +441,7 @@ void rtl_deinit_rfkill(struct ieee80211_hw *hw)
 {
         wiphy_rfkill_stop_polling(hw->wiphy);
 }
+EXPORT_SYMBOL_GPL(rtl_deinit_rfkill);
 
 int rtl_init_core(struct ieee80211_hw *hw)
 {
@@ -489,10 +492,12 @@ int rtl_init_core(struct ieee80211_hw *hw)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(rtl_init_core);
 
 void rtl_deinit_core(struct ieee80211_hw *hw)
 {
 }
+EXPORT_SYMBOL_GPL(rtl_deinit_core);
 
 void rtl_init_rx_config(struct ieee80211_hw *hw)
 {
@@ -501,6 +506,7 @@ void rtl_init_rx_config(struct ieee80211_hw *hw)
 
         rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_RCR, (u8 *) (&mac->rx_conf));
 }
+EXPORT_SYMBOL_GPL(rtl_init_rx_config);
 
 /*********************************************************
  *
@@ -879,6 +885,7 @@ bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         return true;
 }
+EXPORT_SYMBOL_GPL(rtl_tx_mgmt_proc);
 
 void rtl_get_tcb_desc(struct ieee80211_hw *hw,
                       struct ieee80211_tx_info *info,
@@ -1052,6 +1059,7 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
 
         return true;
 }
+EXPORT_SYMBOL_GPL(rtl_action_proc);
 
 /*should call before software enc*/
 u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
@@ -1125,6 +1133,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
 
         return false;
 }
+EXPORT_SYMBOL_GPL(rtl_is_special_data);
 
 /*********************************************************
  *
@@ -1300,6 +1309,7 @@ void rtl_beacon_statistic(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         rtlpriv->link_info.bcn_rx_inperiod++;
 }
+EXPORT_SYMBOL_GPL(rtl_beacon_statistic);
 
 void rtl_watchdog_wq_callback(void *data)
 {
@@ -1793,6 +1803,7 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len)
 
         mac->vendor = vendor;
 }
+EXPORT_SYMBOL_GPL(rtl_recognize_peer);
 
 /*********************************************************
  *
@@ -1849,6 +1860,7 @@ struct attribute_group rtl_attribute_group = {
         .name = "rtlsysfs",
         .attrs = rtl_sysfs_entries,
 };
+EXPORT_SYMBOL_GPL(rtl_attribute_group);
 
 MODULE_AUTHOR("lizhaoming       <chaoming_li@realsil.com.cn>");
 MODULE_AUTHOR("Realtek WlanFAE  <wlanfae@realtek.com>");
@@ -1856,7 +1868,8 @@ MODULE_AUTHOR("Larry Finger	<Larry.FInger@lwfinger.net>");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core");
 
-struct rtl_global_var global_var = {};
+struct rtl_global_var rtl_global_var = {};
+EXPORT_SYMBOL_GPL(rtl_global_var);
 
 static int __init rtl_core_module_init(void)
 {
@@ -1864,8 +1877,8 @@ static int __init rtl_core_module_init(void)
                 pr_err("Unable to register rtl_rc, use default RC !!\n");
 
         /* init some global vars */
-        INIT_LIST_HEAD(&global_var.glb_priv_list);
-        spin_lock_init(&global_var.glb_list_lock);
+        INIT_LIST_HEAD(&rtl_global_var.glb_priv_list);
+        spin_lock_init(&rtl_global_var.glb_list_lock);
 
         return 0;
 }
diff --git a/drivers/net/wireless/rtlwifi/base.h b/drivers/net/wireless/rtlwifi/base.h
index 8576bc34b032..0e5fe0902daf 100644
--- a/drivers/net/wireless/rtlwifi/base.h
+++ b/drivers/net/wireless/rtlwifi/base.h
@@ -147,7 +147,7 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len);
 u8 rtl_tid_to_ac(u8 tid);
 extern struct attribute_group rtl_attribute_group;
 void rtl_easy_concurrent_retrytimer_callback(unsigned long data);
-extern struct rtl_global_var global_var;
+extern struct rtl_global_var rtl_global_var;
 int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
                          bool isht, u8 desc_rate, bool first_ampdu);
 bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb);
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index ee84844be008..733b7ce7f0e2 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -1330,3 +1330,4 @@ const struct ieee80211_ops rtl_ops = {
         .rfkill_poll = rtl_op_rfkill_poll,
         .flush = rtl_op_flush,
 };
+EXPORT_SYMBOL_GPL(rtl_ops);
diff --git a/drivers/net/wireless/rtlwifi/debug.c b/drivers/net/wireless/rtlwifi/debug.c
index 7d52d3d7769f..76e2086e137e 100644
--- a/drivers/net/wireless/rtlwifi/debug.c
+++ b/drivers/net/wireless/rtlwifi/debug.c
@@ -51,3 +51,4 @@ void rtl_dbgp_flag_init(struct ieee80211_hw *hw)
 
         /*Init Debug flag enable condition */
 }
+EXPORT_SYMBOL_GPL(rtl_dbgp_flag_init);
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index 9e3894178e77..838a1ed3f194 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -229,6 +229,7 @@ void read_efuse_byte(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf)
 
         *pbuf = (u8) (value32 & 0xff);
 }
+EXPORT_SYMBOL_GPL(read_efuse_byte);
 
 void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
 {
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index c97e9d327331..703f839af6ca 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -35,6 +35,13 @@
 #include "efuse.h"
 #include <linux/export.h>
 #include <linux/kmemleak.h>
+#include <linux/module.h>
+
+MODULE_AUTHOR("lizhaoming       <chaoming_li@realsil.com.cn>");
+MODULE_AUTHOR("Realtek WlanFAE  <wlanfae@realtek.com>");
+MODULE_AUTHOR("Larry Finger     <Larry.FInger@lwfinger.net>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("PCI basic driver for rtlwifi");
 
 static const u16 pcibridge_vendors[PCI_BRIDGE_VENDOR_MAX] = {
         PCI_VENDOR_ID_INTEL,
@@ -1008,19 +1015,6 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
         return;
 }
 
-static void rtl_lps_change_work_callback(struct work_struct *work)
-{
-        struct rtl_works *rtlworks =
-            container_of(work, struct rtl_works, lps_change_work);
-        struct ieee80211_hw *hw = rtlworks->hw;
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-
-        if (rtlpriv->enter_ps)
-                rtl_lps_enter(hw);
-        else
-                rtl_lps_leave(hw);
-}
-
 static void _rtl_pci_init_trx_var(struct ieee80211_hw *hw)
 {
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
@@ -1899,7 +1893,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
         rtlpriv->rtlhal.interface = INTF_PCI;
         rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data);
         rtlpriv->intf_ops = &rtl_pci_ops;
-        rtlpriv->glb_var = &global_var;
+        rtlpriv->glb_var = &rtl_global_var;
 
         /*
          *init dbgp flags before all
diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
index 884bceae38a9..298b615964e8 100644
--- a/drivers/net/wireless/rtlwifi/ps.c
+++ b/drivers/net/wireless/rtlwifi/ps.c
@@ -269,6 +269,7 @@ void rtl_ips_nic_on(struct ieee80211_hw *hw)
 
         spin_unlock_irqrestore(&rtlpriv->locks.ips_lock, flags);
 }
+EXPORT_SYMBOL_GPL(rtl_ips_nic_on);
 
 /*for FW LPS*/
 
@@ -518,6 +519,7 @@ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
                          "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
         }
 }
+EXPORT_SYMBOL_GPL(rtl_swlps_beacon);
 
 void rtl_swlps_rf_awake(struct ieee80211_hw *hw)
 {
@@ -611,6 +613,19 @@ void rtl_swlps_rf_sleep(struct ieee80211_hw *hw)
                         MSECS(sleep_intv * mac->vif->bss_conf.beacon_int - 40));
 }
 
+void rtl_lps_change_work_callback(struct work_struct *work)
+{
+        struct rtl_works *rtlworks =
+            container_of(work, struct rtl_works, lps_change_work);
+        struct ieee80211_hw *hw = rtlworks->hw;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        if (rtlpriv->enter_ps)
+                rtl_lps_enter(hw);
+        else
+                rtl_lps_leave(hw);
+}
+EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);
 
 void rtl_swlps_wq_callback(void *data)
 {
@@ -922,3 +937,4 @@ void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len)
         else
                 rtl_p2p_noa_ie(hw, data, len - FCS_LEN);
 }
+EXPORT_SYMBOL_GPL(rtl_p2p_info);
diff --git a/drivers/net/wireless/rtlwifi/ps.h b/drivers/net/wireless/rtlwifi/ps.h
index 4d682b753f50..88bd76ea88f7 100644
--- a/drivers/net/wireless/rtlwifi/ps.h
+++ b/drivers/net/wireless/rtlwifi/ps.h
@@ -49,5 +49,6 @@ void rtl_swlps_rf_awake(struct ieee80211_hw *hw);
 void rtl_swlps_rf_sleep(struct ieee80211_hw *hw);
 void rtl_p2p_ps_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
 void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len);
+void rtl_lps_change_work_callback(struct work_struct *work);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index a3532e077871..e56778cac9bf 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -32,6 +32,13 @@
 #include "ps.h"
 #include "rtl8192c/fw_common.h"
 #include <linux/export.h>
+#include <linux/module.h>
+
+MODULE_AUTHOR("lizhaoming       <chaoming_li@realsil.com.cn>");
+MODULE_AUTHOR("Realtek WlanFAE  <wlanfae@realtek.com>");
+MODULE_AUTHOR("Larry Finger     <Larry.FInger@lwfinger.net>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("USB basic driver for rtlwifi");
 
 #define REALTEK_USB_VENQT_READ                  0xC0
 #define REALTEK_USB_VENQT_WRITE                 0x40
@@ -1070,6 +1077,8 @@ int rtl_usb_probe(struct usb_interface *intf,
         spin_lock_init(&rtlpriv->locks.usb_lock);
         INIT_WORK(&rtlpriv->works.fill_h2c_cmd,
                   rtl_fill_h2c_cmd_work_callback);
+        INIT_WORK(&rtlpriv->works.lps_change_work,
+                  rtl_lps_change_work_callback);
 
         rtlpriv->usb_data_index = 0;
         init_completion(&rtlpriv->firmware_loading_complete);
diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
index e79e006eb9ab..9ee04b4b68bf 100644
--- a/drivers/parisc/iosapic.c
+++ b/drivers/parisc/iosapic.c
@@ -811,18 +811,28 @@ int iosapic_fixup_irq(void *isi_obj, struct pci_dev *pcidev)
         return pcidev->irq;
 }
 
-static struct iosapic_info *first_isi = NULL;
+static struct iosapic_info *iosapic_list;
 
 #ifdef CONFIG_64BIT
-int iosapic_serial_irq(int num)
+int iosapic_serial_irq(struct parisc_device *dev)
 {
-        struct iosapic_info *isi = first_isi;
-        struct irt_entry *irte = NULL;  /* only used if PAT PDC */
+        struct iosapic_info *isi;
+        struct irt_entry *irte;
         struct vector_info *vi;
-        int isi_line;   /* line used by device */
+        int cnt;
+        int intin;
+
+        intin = (dev->mod_info >> 24) & 15;
 
         /* lookup IRT entry for isi/slot/pin set */
-        irte = &irt_cell[num];
+        for (cnt = 0; cnt < irt_num_entry; cnt++) {
+                irte = &irt_cell[cnt];
+                if (COMPARE_IRTE_ADDR(irte, dev->mod0) &&
+                    irte->dest_iosapic_intin == intin)
+                        break;
+        }
+        if (cnt >= irt_num_entry)
+                return 0; /* no irq found, force polling */
 
         DBG_IRT("iosapic_serial_irq(): irte %p %x %x %x %x %x %x %x %x\n",
                 irte,
@@ -834,11 +844,17 @@ int iosapic_serial_irq(int num)
                 irte->src_seg_id,
                 irte->dest_iosapic_intin,
                 (u32) irte->dest_iosapic_addr);
-        isi_line = irte->dest_iosapic_intin;
+
+        /* search for iosapic */
+        for (isi = iosapic_list; isi; isi = isi->isi_next)
+                if (isi->isi_hpa == dev->mod0)
+                        break;
+        if (!isi)
+                return 0; /* no iosapic found, force polling */
 
         /* get vector info for this input line */
-        vi = isi->isi_vector + isi_line;
-        DBG_IRT("iosapic_serial_irq:  line %d vi 0x%p\n", isi_line, vi);
+        vi = isi->isi_vector + intin;
+        DBG_IRT("iosapic_serial_irq:  line %d vi 0x%p\n", iosapic_intin, vi);
 
         /* If this IRQ line has already been setup, skip it */
         if (vi->irte)
@@ -941,8 +957,8 @@ void *iosapic_register(unsigned long hpa)
                 vip->irqline = (unsigned char) cnt;
                 vip->iosapic = isi;
         }
-        if (!first_isi)
-                first_isi = isi;
+        isi->isi_next = iosapic_list;
+        iosapic_list = isi;
         return isi;
 }
 
diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index 13a633b1612e..7bf3926aecc0 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -86,10 +86,6 @@ struct mvebu_sw_pci_bridge {
         u16 secondary_status;
         u16 membase;
         u16 memlimit;
-        u16 prefmembase;
-        u16 prefmemlimit;
-        u32 prefbaseupper;
-        u32 preflimitupper;
         u16 iobaseupper;
         u16 iolimitupper;
         u8 cappointer;
@@ -419,15 +415,7 @@ static int mvebu_sw_pci_bridge_read(struct mvebu_pcie_port *port,
                 break;
 
         case PCI_PREF_MEMORY_BASE:
-                *value = (bridge->prefmemlimit << 16 | bridge->prefmembase);
-                break;
-
-        case PCI_PREF_BASE_UPPER32:
-                *value = bridge->prefbaseupper;
-                break;
-
-        case PCI_PREF_LIMIT_UPPER32:
-                *value = bridge->preflimitupper;
+                *value = 0;
                 break;
 
         case PCI_IO_BASE_UPPER16:
@@ -501,19 +489,6 @@ static int mvebu_sw_pci_bridge_write(struct mvebu_pcie_port *port,
                 mvebu_pcie_handle_membase_change(port);
                 break;
 
-        case PCI_PREF_MEMORY_BASE:
-                bridge->prefmembase = value & 0xffff;
-                bridge->prefmemlimit = value >> 16;
-                break;
-
-        case PCI_PREF_BASE_UPPER32:
-                bridge->prefbaseupper = value;
-                break;
-
-        case PCI_PREF_LIMIT_UPPER32:
-                bridge->preflimitupper = value;
-                break;
-
         case PCI_IO_BASE_UPPER16:
                 bridge->iobaseupper = value & 0xffff;
                 bridge->iolimitupper = value >> 16;
diff --git a/drivers/pci/hotplug/Kconfig b/drivers/pci/hotplug/Kconfig
index bb7ebb22db01..d85009de713d 100644
--- a/drivers/pci/hotplug/Kconfig
+++ b/drivers/pci/hotplug/Kconfig
@@ -3,16 +3,13 @@
 #
 
 menuconfig HOTPLUG_PCI
-        tristate "Support for PCI Hotplug"
+        bool "Support for PCI Hotplug"
         depends on PCI && SYSFS
         ---help---
           Say Y here if you have a motherboard with a PCI Hotplug controller.
           This allows you to add and remove PCI cards while the machine is
           powered up and running.
 
-          To compile this driver as a module, choose M here: the
-          module will be called pci_hotplug.
-
           When in doubt, say N.
 
 if HOTPLUG_PCI
diff --git a/drivers/pci/hotplug/pciehp_pci.c b/drivers/pci/hotplug/pciehp_pci.c
index aac7a40e4a4a..0e0d0f7f63fd 100644
--- a/drivers/pci/hotplug/pciehp_pci.c
+++ b/drivers/pci/hotplug/pciehp_pci.c
@@ -92,7 +92,14 @@ int pciehp_unconfigure_device(struct slot *p_slot)
         if (ret)
                 presence = 0;
 
-        list_for_each_entry_safe(dev, temp, &parent->devices, bus_list) {
+        /*
+         * Stopping an SR-IOV PF device removes all the associated VFs,
+         * which will update the bus->devices list and confuse the
+         * iterator.  Therefore, iterate in reverse so we remove the VFs
+         * first, then the PF.  We do the same in pci_stop_bus_device().
+         */
+        list_for_each_entry_safe_reverse(dev, temp, &parent->devices,
+                                         bus_list) {
                 pci_dev_get(dev);
                 if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE && presence) {
                         pci_read_config_byte(dev, PCI_BRIDGE_CONTROL, &bctl);
diff --git a/drivers/pci/pcie/Kconfig b/drivers/pci/pcie/Kconfig
index 569f82fc9e22..3b94cfcfa03b 100644
--- a/drivers/pci/pcie/Kconfig
+++ b/drivers/pci/pcie/Kconfig
@@ -14,15 +14,12 @@ config PCIEPORTBUS
 # Include service Kconfig here
 #
 config HOTPLUG_PCI_PCIE
-        tristate "PCI Express Hotplug driver"
+        bool "PCI Express Hotplug driver"
         depends on HOTPLUG_PCI && PCIEPORTBUS
         help
           Say Y here if you have a motherboard that supports PCI Express Native
           Hotplug
 
-          To compile this driver as a module, choose M here: the
-          module will be called pciehp.
-
           When in doubt, say N.
 
 source "drivers/pci/pcie/aer/Kconfig"
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index d254e2379533..64a7de22d9af 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -300,6 +300,47 @@ static void assign_requested_resources_sorted(struct list_head *head,
         }
 }
 
+static unsigned long pci_fail_res_type_mask(struct list_head *fail_head)
+{
+        struct pci_dev_resource *fail_res;
+        unsigned long mask = 0;
+
+        /* check failed type */
+        list_for_each_entry(fail_res, fail_head, list)
+                mask |= fail_res->flags;
+
+        /*
+         * one pref failed resource will set IORESOURCE_MEM,
+         * as we can allocate pref in non-pref range.
+         * Will release all assigned non-pref sibling resources
+         * according to that bit.
+         */
+        return mask & (IORESOURCE_IO | IORESOURCE_MEM | IORESOURCE_PREFETCH);
+}
+
+static bool pci_need_to_release(unsigned long mask, struct resource *res)
+{
+        if (res->flags & IORESOURCE_IO)
+                return !!(mask & IORESOURCE_IO);
+
+        /* check pref at first */
+        if (res->flags & IORESOURCE_PREFETCH) {
+                if (mask & IORESOURCE_PREFETCH)
+                        return true;
+                /* count pref if its parent is non-pref */
+                else if ((mask & IORESOURCE_MEM) &&
+                         !(res->parent->flags & IORESOURCE_PREFETCH))
+                        return true;
+                else
+                        return false;
+        }
+
+        if (res->flags & IORESOURCE_MEM)
+                return !!(mask & IORESOURCE_MEM);
+
+        return false;   /* should not get here */
+}
+
 static void __assign_resources_sorted(struct list_head *head,
                                  struct list_head *realloc_head,
                                  struct list_head *fail_head)
@@ -312,11 +353,24 @@ static void __assign_resources_sorted(struct list_head *head,
          *  if could do that, could get out early.
          *  if could not do that, we still try to assign requested at first,
          *    then try to reassign add_size for some resources.
+         *
+         * Separate three resource type checking if we need to release
+         * assigned resource after requested + add_size try.
+         *      1. if there is io port assign fail, will release assigned
+         *         io port.
+         *      2. if there is pref mmio assign fail, release assigned
+         *         pref mmio.
+         *         if assigned pref mmio's parent is non-pref mmio and there
+         *         is non-pref mmio assign fail, will release that assigned
+         *         pref mmio.
+         *      3. if there is non-pref mmio assign fail or pref mmio
+         *         assigned fail, will release assigned non-pref mmio.
          */
         LIST_HEAD(save_head);
         LIST_HEAD(local_fail_head);
         struct pci_dev_resource *save_res;
-        struct pci_dev_resource *dev_res;
+        struct pci_dev_resource *dev_res, *tmp_res;
+        unsigned long fail_type;
 
         /* Check if optional add_size is there */
         if (!realloc_head || list_empty(realloc_head))
@@ -348,6 +402,19 @@ static void __assign_resources_sorted(struct list_head *head,
                 return;
         }
 
+        /* check failed type */
+        fail_type = pci_fail_res_type_mask(&local_fail_head);
+        /* remove not need to be released assigned res from head list etc */
+        list_for_each_entry_safe(dev_res, tmp_res, head, list)
+                if (dev_res->res->parent &&
+                    !pci_need_to_release(fail_type, dev_res->res)) {
+                        /* remove it from realloc_head list */
+                        remove_from_list(realloc_head, dev_res->res);
+                        remove_from_list(&save_head, dev_res->res);
+                        list_del(&dev_res->list);
+                        kfree(dev_res);
+                }
+
         free_list(&local_fail_head);
         /* Release assigned resource */
         list_for_each_entry(dev_res, head, list)
diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c
index f4f30af2df68..2e8a20cac588 100644
--- a/drivers/rapidio/rio.c
+++ b/drivers/rapidio/rio.c
@@ -1715,11 +1715,13 @@ int rio_unregister_scan(int mport_id, struct rio_scan *scan_ops)
                     (mport_id == RIO_MPORT_ANY && port->nscan == scan_ops))
                         port->nscan = NULL;
 
-        list_for_each_entry(scan, &rio_scans, node)
+        list_for_each_entry(scan, &rio_scans, node) {
                 if (scan->mport_id == mport_id) {
                         list_del(&scan->node);
                         kfree(scan);
+                        break;
                 }
+        }
 
         mutex_unlock(&rio_mport_list_lock);
 
diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
index 02faf3c4e0d5..c2e80d7ca5e2 100644
--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -524,6 +524,8 @@ static int twl_rtc_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto out1;
 
+        device_init_wakeup(&pdev->dev, 1);
+
         rtc = rtc_device_register(pdev->name,
                                   &pdev->dev, &twl_rtc_ops, THIS_MODULE);
         if (IS_ERR(rtc)) {
@@ -542,7 +544,6 @@ static int twl_rtc_probe(struct platform_device *pdev)
         }
 
         platform_set_drvdata(pdev, rtc);
-        device_init_wakeup(&pdev->dev, 1);
         return 0;
 
 out2:
diff --git a/drivers/tty/serial/8250/8250_gsc.c b/drivers/tty/serial/8250/8250_gsc.c
index bb91b4713ebd..2e3ea1a70d7b 100644
--- a/drivers/tty/serial/8250/8250_gsc.c
+++ b/drivers/tty/serial/8250/8250_gsc.c
@@ -31,9 +31,8 @@ static int __init serial_init_chip(struct parisc_device *dev)
         int err;
 
 #ifdef CONFIG_64BIT
-        extern int iosapic_serial_irq(int cellnum);
         if (!dev->irq && (dev->id.sversion == 0xad))
-                dev->irq = iosapic_serial_irq(dev->mod_index-1);
+                dev->irq = iosapic_serial_irq(dev);
 #endif
 
         if (!dev->irq) {
diff --git a/drivers/tty/serial/arc_uart.c b/drivers/tty/serial/arc_uart.c
index cbf1d155b7b2..22f280aa4f2c 100644
--- a/drivers/tty/serial/arc_uart.c
+++ b/drivers/tty/serial/arc_uart.c
@@ -773,6 +773,6 @@ module_init(arc_serial_init);
 module_exit(arc_serial_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("plat-arcfpga/uart");
+MODULE_ALIAS("platform:" DRIVER_NAME);
 MODULE_AUTHOR("Vineet Gupta");
 MODULE_DESCRIPTION("ARC(Synopsys) On-Chip(fpga) serial driver");
diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
index 4f5f161896a1..f85b8e6d0346 100644
--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
@@ -678,11 +678,18 @@ static void mxs_auart_settermios(struct uart_port *u,
 
 static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
 {
-        u32 istatus, istat;
+        u32 istat;
         struct mxs_auart_port *s = context;
         u32 stat = readl(s->port.membase + AUART_STAT);
 
-        istatus = istat = readl(s->port.membase + AUART_INTR);
+        istat = readl(s->port.membase + AUART_INTR);
+
+        /* ack irq */
+        writel(istat & (AUART_INTR_RTIS
+                | AUART_INTR_TXIS
+                | AUART_INTR_RXIS
+                | AUART_INTR_CTSMIS),
+                        s->port.membase + AUART_INTR_CLR);
 
         if (istat & AUART_INTR_CTSMIS) {
                 uart_handle_cts_change(&s->port, stat & AUART_STAT_CTS);
@@ -702,12 +709,6 @@ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
                 istat &= ~AUART_INTR_TXIS;
         }
 
-        writel(istatus & (AUART_INTR_RTIS
-                | AUART_INTR_TXIS
-                | AUART_INTR_RXIS
-                | AUART_INTR_CTSMIS),
-                        s->port.membase + AUART_INTR_CLR);
-
         return IRQ_HANDLED;
 }
 
@@ -850,7 +851,7 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
         struct mxs_auart_port *s;
         struct uart_port *port;
         unsigned int old_ctrl0, old_ctrl2;
-        unsigned int to = 1000;
+        unsigned int to = 20000;
 
         if (co->index >= MXS_AUART_PORTS || co->index < 0)
                 return;
@@ -871,18 +872,23 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
 
         uart_console_write(port, str, count, mxs_auart_console_putchar);
 
-        /*
-         * Finally, wait for transmitter to become empty
-         * and restore the TCR
-         */
+        /* Finally, wait for transmitter to become empty ... */
         while (readl(port->membase + AUART_STAT) & AUART_STAT_BUSY) {
+                udelay(1);
                 if (!to--)
                         break;
-                udelay(1);
         }
 
-        writel(old_ctrl0, port->membase + AUART_CTRL0);
-        writel(old_ctrl2, port->membase + AUART_CTRL2);
+        /*
+         * ... and restore the TCR if we waited long enough for the transmitter
+         * to be idle. This might keep the transmitter enabled although it is
+         * unused, but that is better than to disable it while it is still
+         * transmitting.
+         */
+        if (!(readl(port->membase + AUART_STAT) & AUART_STAT_BUSY)) {
+                writel(old_ctrl0, port->membase + AUART_CTRL0);
+                writel(old_ctrl2, port->membase + AUART_CTRL2);
+        }
 
         clk_disable(s->clk);
 }
diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 121aeb9393e1..f597e88a705d 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -256,10 +256,9 @@ void tty_port_tty_hangup(struct tty_port *port, bool check_clocal)
 {
         struct tty_struct *tty = tty_port_tty_get(port);
 
-        if (tty && (!check_clocal || !C_CLOCAL(tty))) {
+        if (tty && (!check_clocal || !C_CLOCAL(tty)))
                 tty_hangup(tty);
-                tty_kref_put(tty);
-        }
+        tty_kref_put(tty);
 }
 EXPORT_SYMBOL_GPL(tty_port_tty_hangup);
 
diff --git a/drivers/usb/chipidea/Kconfig b/drivers/usb/chipidea/Kconfig
index eb2aa2e5a842..d1bd8ef1f9c1 100644
--- a/drivers/usb/chipidea/Kconfig
+++ b/drivers/usb/chipidea/Kconfig
@@ -12,7 +12,7 @@ if USB_CHIPIDEA
 
 config USB_CHIPIDEA_UDC
         bool "ChipIdea device controller"
-        depends on USB_GADGET=y || USB_CHIPIDEA=m
+        depends on USB_GADGET=y || (USB_CHIPIDEA=m && USB_GADGET=m)
         help
           Say Y here to enable device controller functionality of the
           ChipIdea driver.
@@ -20,7 +20,7 @@ config USB_CHIPIDEA_UDC
 config USB_CHIPIDEA_HOST
         bool "ChipIdea host controller"
         depends on USB=y
-        depends on USB_EHCI_HCD=y || USB_CHIPIDEA=m
+        depends on USB_EHCI_HCD=y || (USB_CHIPIDEA=m && USB_EHCI_HCD=m)
         select USB_EHCI_ROOT_HUB_TT
         help
           Say Y here to enable host controller functionality of the
diff --git a/drivers/usb/chipidea/bits.h b/drivers/usb/chipidea/bits.h
index aefa0261220c..1b23e354f9fb 100644
--- a/drivers/usb/chipidea/bits.h
+++ b/drivers/usb/chipidea/bits.h
@@ -50,7 +50,7 @@
 #define PORTSC_PTC            (0x0FUL << 16)
 /* PTS and PTW for non lpm version only */
 #define PORTSC_PTS(d)                                           \
-        ((((d) & 0x3) << 30) | (((d) & 0x4) ? BIT(25) : 0))
+        (u32)((((d) & 0x3) << 30) | (((d) & 0x4) ? BIT(25) : 0))
 #define PORTSC_PTW            BIT(28)
 #define PORTSC_STS            BIT(29)
 
@@ -59,7 +59,7 @@
 #define DEVLC_PSPD_HS         (0x02UL << 25)
 #define DEVLC_PTW             BIT(27)
 #define DEVLC_STS             BIT(28)
-#define DEVLC_PTS(d)          (((d) & 0x7) << 29)
+#define DEVLC_PTS(d)          (u32)(((d) & 0x7) << 29)
 
 /* Encoding for DEVLC_PTS and PORTSC_PTS */
 #define PTS_UTMI              0
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index f48712ffe261..c1c113ef950c 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -449,14 +449,20 @@ fail:
 
 static int __exit eth_unbind(struct usb_composite_dev *cdev)
 {
-        if (has_rndis())
+        if (has_rndis()) {
+                usb_put_function(f_rndis);
                 usb_put_function_instance(fi_rndis);
-        if (use_eem)
+        }
+        if (use_eem) {
+                usb_put_function(f_eem);
                 usb_put_function_instance(fi_eem);
-        else if (can_support_ecm(cdev->gadget))
+        } else if (can_support_ecm(cdev->gadget)) {
+                usb_put_function(f_ecm);
                 usb_put_function_instance(fi_ecm);
-        else
+        } else {
+                usb_put_function(f_geth);
                 usb_put_function_instance(fi_geth);
+        }
         return 0;
 }
 
diff --git a/drivers/usb/gadget/f_phonet.c b/drivers/usb/gadget/f_phonet.c
index 1bf26e9f38cd..eb3aa817a662 100644
--- a/drivers/usb/gadget/f_phonet.c
+++ b/drivers/usb/gadget/f_phonet.c
@@ -488,7 +488,6 @@ static int pn_bind(struct usb_configuration *c, struct usb_function *f)
         struct usb_ep *ep;
         int status, i;
 
-#ifndef USBF_PHONET_INCLUDED
         struct f_phonet_opts *phonet_opts;
 
         phonet_opts = container_of(f->fi, struct f_phonet_opts, func_inst);
@@ -507,7 +506,6 @@ static int pn_bind(struct usb_configuration *c, struct usb_function *f)
                         return status;
                 phonet_opts->bound = true;
         }
-#endif
 
         /* Reserve interface IDs */
         status = usb_interface_id(c, f);
diff --git a/drivers/usb/gadget/multi.c b/drivers/usb/gadget/multi.c
index 032b96a51ce4..2a1ebefd8f9e 100644
--- a/drivers/usb/gadget/multi.c
+++ b/drivers/usb/gadget/multi.c
@@ -160,10 +160,8 @@ static __init int rndis_do_config(struct usb_configuration *c)
                 return ret;
 
         f_acm_rndis = usb_get_function(fi_acm);
-        if (IS_ERR(f_acm_rndis)) {
-                ret = PTR_ERR(f_acm_rndis);
-                goto err_func_acm;
-        }
+        if (IS_ERR(f_acm_rndis))
+                return PTR_ERR(f_acm_rndis);
 
         ret = usb_add_function(c, f_acm_rndis);
         if (ret)
@@ -178,7 +176,6 @@ err_fsg:
         usb_remove_function(c, f_acm_rndis);
 err_conf:
         usb_put_function(f_acm_rndis);
-err_func_acm:
         return ret;
 }
 
@@ -226,7 +223,7 @@ static __init int cdc_do_config(struct usb_configuration *c)
         /* implicit port_num is zero */
         f_acm_multi = usb_get_function(fi_acm);
         if (IS_ERR(f_acm_multi))
-                goto err_func_acm;
+                return PTR_ERR(f_acm_multi);
 
         ret = usb_add_function(c, f_acm_multi);
         if (ret)
@@ -241,7 +238,6 @@ err_fsg:
         usb_remove_function(c, f_acm_multi);
 err_conf:
         usb_put_function(f_acm_multi);
-err_func_acm:
         return ret;
 }
 
diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
index c28ac9872030..13e25f80fc20 100644
--- a/drivers/usb/gadget/udc-core.c
+++ b/drivers/usb/gadget/udc-core.c
@@ -109,7 +109,7 @@ void usb_gadget_set_state(struct usb_gadget *gadget,
                 enum usb_device_state state)
 {
         gadget->state = state;
-        sysfs_notify(&gadget->dev.kobj, NULL, "status");
+        sysfs_notify(&gadget->dev.kobj, NULL, "state");
 }
 EXPORT_SYMBOL_GPL(usb_gadget_set_state);
 
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 6708a3b78ad8..f44e8b5e00c9 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -481,7 +481,7 @@ static u64 omap2430_dmamask = DMA_BIT_MASK(32);
 
 static int omap2430_probe(struct platform_device *pdev)
 {
-        struct resource                 musb_resources[2];
+        struct resource                 musb_resources[3];
         struct musb_hdrc_platform_data  *pdata = pdev->dev.platform_data;
         struct omap_musb_board_data     *data;
         struct platform_device          *musb;
@@ -581,6 +581,11 @@ static int omap2430_probe(struct platform_device *pdev)
         musb_resources[1].end = pdev->resource[1].end;
         musb_resources[1].flags = pdev->resource[1].flags;
 
+        musb_resources[2].name = pdev->resource[2].name;
+        musb_resources[2].start = pdev->resource[2].start;
+        musb_resources[2].end = pdev->resource[2].end;
+        musb_resources[2].flags = pdev->resource[2].flags;
+
         ret = platform_device_add_resources(musb, musb_resources,
                         ARRAY_SIZE(musb_resources));
         if (ret) {
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index 2c06a8969a9f..6f8a9ca96ae7 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -1156,7 +1156,7 @@ static u64 tusb_dmamask = DMA_BIT_MASK(32);
 
 static int tusb_probe(struct platform_device *pdev)
 {
-        struct resource musb_resources[2];
+        struct resource musb_resources[3];
         struct musb_hdrc_platform_data  *pdata = pdev->dev.platform_data;
         struct platform_device          *musb;
         struct tusb6010_glue            *glue;
@@ -1199,6 +1199,11 @@ static int tusb_probe(struct platform_device *pdev)
         musb_resources[1].end = pdev->resource[1].end;
         musb_resources[1].flags = pdev->resource[1].flags;
 
+        musb_resources[2].name = pdev->resource[2].name;
+        musb_resources[2].start = pdev->resource[2].start;
+        musb_resources[2].end = pdev->resource[2].end;
+        musb_resources[2].flags = pdev->resource[2].flags;
+
         ret = platform_device_add_resources(musb, musb_resources,
                         ARRAY_SIZE(musb_resources));
         if (ret) {
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index 8c3a42ea910c..7eef9b33fde6 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -719,6 +719,13 @@ config USB_SERIAL_FLASHLOADER
           To compile this driver as a module, choose M here: the
           module will be called flashloader.
 
+config USB_SERIAL_SUUNTO
+        tristate "USB Suunto ANT+ driver"
+        help
+          Say Y here if you want to use the Suunto ANT+ USB device.
+
+          To compile this driver as a module, choose M here: the
+          module will be called suunto.
 
 config USB_SERIAL_DEBUG
         tristate "USB Debugging Device"
diff --git a/drivers/usb/serial/Makefile b/drivers/usb/serial/Makefile
index f7130114488f..a14a870d993f 100644
--- a/drivers/usb/serial/Makefile
+++ b/drivers/usb/serial/Makefile
@@ -54,6 +54,7 @@ obj-$(CONFIG_USB_SERIAL_SIEMENS_MPI)		+= siemens_mpi.o
 obj-$(CONFIG_USB_SERIAL_SIERRAWIRELESS)         += sierra.o
 obj-$(CONFIG_USB_SERIAL_SPCP8X5)                += spcp8x5.o
 obj-$(CONFIG_USB_SERIAL_SSU100)                 += ssu100.o
+obj-$(CONFIG_USB_SERIAL_SUUNTO)                 += suunto.o
 obj-$(CONFIG_USB_SERIAL_SYMBOL)                 += symbolserial.o
 obj-$(CONFIG_USB_SERIAL_WWAN)                   += usb_wwan.o
 obj-$(CONFIG_USB_SERIAL_TI)                     += ti_usb_3410_5052.o
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index bebf3ef7927e..dbf2f2818823 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -733,9 +733,34 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
         { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
-        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
-        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) },
-        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_RTS01_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29A_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29F_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S01_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29C_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_81B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_82B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5D_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K4Y_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5G_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S05_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_60_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_61_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_64_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_65_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92D_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_W5R_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_A5R_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_PW1_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
         { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 6dd79253205d..1b8af461b522 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -815,11 +815,35 @@
 /*
  * RT Systems programming cables for various ham radios
  */
-#define RTSYSTEMS_VID                   0x2100  /* Vendor ID */
-#define RTSYSTEMS_SERIAL_VX7_PID        0x9e52  /* Serial converter for VX-7 Radios using FT232RL */
-#define RTSYSTEMS_CT29B_PID             0x9e54  /* CT29B Radio Cable */
-#define RTSYSTEMS_RTS01_PID             0x9e57  /* USB-RTS01 Radio Cable */
-
+#define RTSYSTEMS_VID           0x2100  /* Vendor ID */
+#define RTSYSTEMS_USB_S03_PID   0x9001  /* RTS-03 USB to Serial Adapter */
+#define RTSYSTEMS_USB_59_PID    0x9e50  /* USB-59 USB to 8 pin plug */
+#define RTSYSTEMS_USB_57A_PID   0x9e51  /* USB-57A USB to 4pin 3.5mm plug */
+#define RTSYSTEMS_USB_57B_PID   0x9e52  /* USB-57B USB to extended 4pin 3.5mm plug */
+#define RTSYSTEMS_USB_29A_PID   0x9e53  /* USB-29A USB to 3.5mm stereo plug */
+#define RTSYSTEMS_USB_29B_PID   0x9e54  /* USB-29B USB to 6 pin mini din */
+#define RTSYSTEMS_USB_29F_PID   0x9e55  /* USB-29F USB to 6 pin modular plug */
+#define RTSYSTEMS_USB_62B_PID   0x9e56  /* USB-62B USB to 8 pin mini din plug*/
+#define RTSYSTEMS_USB_S01_PID   0x9e57  /* USB-RTS01 USB to 3.5 mm stereo plug*/
+#define RTSYSTEMS_USB_63_PID    0x9e58  /* USB-63 USB to 9 pin female*/
+#define RTSYSTEMS_USB_29C_PID   0x9e59  /* USB-29C USB to 4 pin modular plug*/
+#define RTSYSTEMS_USB_81B_PID   0x9e5A  /* USB-81 USB to 8 pin mini din plug*/
+#define RTSYSTEMS_USB_82B_PID   0x9e5B  /* USB-82 USB to 2.5 mm stereo plug*/
+#define RTSYSTEMS_USB_K5D_PID   0x9e5C  /* USB-K5D USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_K4Y_PID   0x9e5D  /* USB-K4Y USB to 2.5/3.5 mm plugs*/
+#define RTSYSTEMS_USB_K5G_PID   0x9e5E  /* USB-K5G USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_S05_PID   0x9e5F  /* USB-RTS05 USB to 2.5 mm stereo plug*/
+#define RTSYSTEMS_USB_60_PID    0x9e60  /* USB-60 USB to 6 pin din*/
+#define RTSYSTEMS_USB_61_PID    0x9e61  /* USB-61 USB to 6 pin mini din*/
+#define RTSYSTEMS_USB_62_PID    0x9e62  /* USB-62 USB to 8 pin mini din*/
+#define RTSYSTEMS_USB_63B_PID   0x9e63  /* USB-63 USB to 9 pin female*/
+#define RTSYSTEMS_USB_64_PID    0x9e64  /* USB-64 USB to 9 pin male*/
+#define RTSYSTEMS_USB_65_PID    0x9e65  /* USB-65 USB to 9 pin female null modem*/
+#define RTSYSTEMS_USB_92_PID    0x9e66  /* USB-92 USB to 12 pin plug*/
+#define RTSYSTEMS_USB_92D_PID   0x9e67  /* USB-92D USB to 12 pin plug data*/
+#define RTSYSTEMS_USB_W5R_PID   0x9e68  /* USB-W5R USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_A5R_PID   0x9e69  /* USB-A5R USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_PW1_PID   0x9e6A  /* USB-PW1 USB to 8 pin modular plug*/
 
 /*
  * Physik Instrumente
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index e31d52aa78c9..dfa678906632 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -183,7 +183,10 @@
 #define LED_ON_MS       500
 #define LED_OFF_MS      500
 
-static int device_type;
+enum mos7840_flag {
+        MOS7840_FLAG_CTRL_BUSY,
+        MOS7840_FLAG_LED_BUSY,
+};
 
 static const struct usb_device_id id_table[] = {
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
@@ -237,9 +240,12 @@ struct moschip_port {
 
         /* For device(s) with LED indicator */
         bool has_led;
-        bool led_flag;
         struct timer_list led_timer1;   /* Timer for LED on */
         struct timer_list led_timer2;   /* Timer for LED off */
+        struct urb *led_urb;
+        struct usb_ctrlrequest *led_dr;
+
+        unsigned long flags;
 };
 
 /*
@@ -459,10 +465,10 @@ static void mos7840_control_callback(struct urb *urb)
         case -ESHUTDOWN:
                 /* this urb is terminated, clean up */
                 dev_dbg(dev, "%s - urb shutting down with status: %d\n", __func__, status);
-                return;
+                goto out;
         default:
                 dev_dbg(dev, "%s - nonzero urb status received: %d\n", __func__, status);
-                return;
+                goto out;
         }
 
         dev_dbg(dev, "%s urb buffer size is %d\n", __func__, urb->actual_length);
@@ -475,6 +481,8 @@ static void mos7840_control_callback(struct urb *urb)
                 mos7840_handle_new_msr(mos7840_port, regval);
         else if (mos7840_port->MsrLsr == 1)
                 mos7840_handle_new_lsr(mos7840_port, regval);
+out:
+        clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mos7840_port->flags);
 }
 
 static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
@@ -485,6 +493,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
         unsigned char *buffer = mcs->ctrl_buf;
         int ret;
 
+        if (test_and_set_bit_lock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags))
+                return -EBUSY;
+
         dr->bRequestType = MCS_RD_RTYPE;
         dr->bRequest = MCS_RDREQ;
         dr->wValue = cpu_to_le16(Wval); /* 0 */
@@ -496,6 +507,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
                              mos7840_control_callback, mcs);
         mcs->control_urb->transfer_buffer_length = 2;
         ret = usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
+        if (ret)
+                clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags);
+
         return ret;
 }
 
@@ -522,7 +536,7 @@ static void mos7840_set_led_async(struct moschip_port *mcs, __u16 wval,
                                 __u16 reg)
 {
         struct usb_device *dev = mcs->port->serial->dev;
-        struct usb_ctrlrequest *dr = mcs->dr;
+        struct usb_ctrlrequest *dr = mcs->led_dr;
 
         dr->bRequestType = MCS_WR_RTYPE;
         dr->bRequest = MCS_WRREQ;
@@ -530,10 +544,10 @@ static void mos7840_set_led_async(struct moschip_port *mcs, __u16 wval,
         dr->wIndex = cpu_to_le16(reg);
         dr->wLength = cpu_to_le16(0);
 
-        usb_fill_control_urb(mcs->control_urb, dev, usb_sndctrlpipe(dev, 0),
+        usb_fill_control_urb(mcs->led_urb, dev, usb_sndctrlpipe(dev, 0),
                 (unsigned char *)dr, NULL, 0, mos7840_set_led_callback, NULL);
 
-        usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
+        usb_submit_urb(mcs->led_urb, GFP_ATOMIC);
 }
 
 static void mos7840_set_led_sync(struct usb_serial_port *port, __u16 reg,
@@ -559,7 +573,19 @@ static void mos7840_led_flag_off(unsigned long arg)
 {
         struct moschip_port *mcs = (struct moschip_port *) arg;
 
-        mcs->led_flag = false;
+        clear_bit_unlock(MOS7840_FLAG_LED_BUSY, &mcs->flags);
+}
+
+static void mos7840_led_activity(struct usb_serial_port *port)
+{
+        struct moschip_port *mos7840_port = usb_get_serial_port_data(port);
+
+        if (test_and_set_bit_lock(MOS7840_FLAG_LED_BUSY, &mos7840_port->flags))
+                return;
+
+        mos7840_set_led_async(mos7840_port, 0x0301, MODEM_CONTROL_REGISTER);
+        mod_timer(&mos7840_port->led_timer1,
+                                jiffies + msecs_to_jiffies(LED_ON_MS));
 }
 
 /*****************************************************************************
@@ -757,14 +783,8 @@ static void mos7840_bulk_in_callback(struct urb *urb)
                 return;
         }
 
-        /* Turn on LED */
-        if (mos7840_port->has_led && !mos7840_port->led_flag) {
-                mos7840_port->led_flag = true;
-                mos7840_set_led_async(mos7840_port, 0x0301,
-                                        MODEM_CONTROL_REGISTER);
-                mod_timer(&mos7840_port->led_timer1,
-                                jiffies + msecs_to_jiffies(LED_ON_MS));
-        }
+        if (mos7840_port->has_led)
+                mos7840_led_activity(port);
 
         mos7840_port->read_urb_busy = true;
         retval = usb_submit_urb(mos7840_port->read_urb, GFP_ATOMIC);
@@ -815,18 +835,6 @@ static void mos7840_bulk_out_data_callback(struct urb *urb)
 /************************************************************************/
 /*       D R I V E R  T T Y  I N T E R F A C E  F U N C T I O N S       */
 /************************************************************************/
-#ifdef MCSSerialProbe
-static int mos7840_serial_probe(struct usb_serial *serial,
-                                const struct usb_device_id *id)
-{
-
-        /*need to implement the mode_reg reading and updating\
-           structures usb_serial_ device_type\
-           (i.e num_ports, num_bulkin,bulkout etc) */
-        /* Also we can update the changes  attach */
-        return 1;
-}
-#endif
 
 /*****************************************************************************
  * mos7840_open
@@ -1406,13 +1414,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
         data1 = urb->transfer_buffer;
         dev_dbg(&port->dev, "bulkout endpoint is %d\n", port->bulk_out_endpointAddress);
 
-        /* Turn on LED */
-        if (mos7840_port->has_led && !mos7840_port->led_flag) {
-                mos7840_port->led_flag = true;
-                mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0301);
-                mod_timer(&mos7840_port->led_timer1,
-                                jiffies + msecs_to_jiffies(LED_ON_MS));
-        }
+        if (mos7840_port->has_led)
+                mos7840_led_activity(port);
 
         /* send it down the pipe */
         status = usb_submit_urb(urb, GFP_ATOMIC);
@@ -2139,38 +2142,48 @@ static int mos7810_check(struct usb_serial *serial)
         return 0;
 }
 
-static int mos7840_calc_num_ports(struct usb_serial *serial)
+static int mos7840_probe(struct usb_serial *serial,
+                                const struct usb_device_id *id)
 {
-        __u16 data = 0x00;
+        u16 product = serial->dev->descriptor.idProduct;
         u8 *buf;
-        int mos7840_num_ports;
+        int device_type;
+
+        if (product == MOSCHIP_DEVICE_ID_7810 ||
+                product == MOSCHIP_DEVICE_ID_7820) {
+                device_type = product;
+                goto out;
+        }
 
         buf = kzalloc(VENDOR_READ_LENGTH, GFP_KERNEL);
-        if (buf) {
-                usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+        if (!buf)
+                return -ENOMEM;
+
+        usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
                         MCS_RDREQ, MCS_RD_RTYPE, 0, GPIO_REGISTER, buf,
                         VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT);
-                data = *buf;
-                kfree(buf);
-        }
 
-        if (serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7810 ||
-                serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7820) {
-                device_type = serial->dev->descriptor.idProduct;
-        } else {
-                /* For a MCS7840 device GPIO0 must be set to 1 */
-                if ((data & 0x01) == 1)
-                        device_type = MOSCHIP_DEVICE_ID_7840;
-                else if (mos7810_check(serial))
-                        device_type = MOSCHIP_DEVICE_ID_7810;
-                else
-                        device_type = MOSCHIP_DEVICE_ID_7820;
-        }
+        /* For a MCS7840 device GPIO0 must be set to 1 */
+        if (buf[0] & 0x01)
+                device_type = MOSCHIP_DEVICE_ID_7840;
+        else if (mos7810_check(serial))
+                device_type = MOSCHIP_DEVICE_ID_7810;
+        else
+                device_type = MOSCHIP_DEVICE_ID_7820;
+
+        kfree(buf);
+out:
+        usb_set_serial_data(serial, (void *)(unsigned long)device_type);
+
+        return 0;
+}
+
+static int mos7840_calc_num_ports(struct usb_serial *serial)
+{
+        int device_type = (unsigned long)usb_get_serial_data(serial);
+        int mos7840_num_ports;
 
         mos7840_num_ports = (device_type >> 4) & 0x000F;
-        serial->num_bulk_in = mos7840_num_ports;
-        serial->num_bulk_out = mos7840_num_ports;
-        serial->num_ports = mos7840_num_ports;
 
         return mos7840_num_ports;
 }
@@ -2178,6 +2191,7 @@ static int mos7840_calc_num_ports(struct usb_serial *serial)
 static int mos7840_port_probe(struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
+        int device_type = (unsigned long)usb_get_serial_data(serial);
         struct moschip_port *mos7840_port;
         int status;
         int pnum;
@@ -2353,6 +2367,14 @@ static int mos7840_port_probe(struct usb_serial_port *port)
         if (device_type == MOSCHIP_DEVICE_ID_7810) {
                 mos7840_port->has_led = true;
 
+                mos7840_port->led_urb = usb_alloc_urb(0, GFP_KERNEL);
+                mos7840_port->led_dr = kmalloc(sizeof(*mos7840_port->led_dr),
+                                                                GFP_KERNEL);
+                if (!mos7840_port->led_urb || !mos7840_port->led_dr) {
+                        status = -ENOMEM;
+                        goto error;
+                }
+
                 init_timer(&mos7840_port->led_timer1);
                 mos7840_port->led_timer1.function = mos7840_led_off;
                 mos7840_port->led_timer1.expires =
@@ -2365,8 +2387,6 @@ static int mos7840_port_probe(struct usb_serial_port *port)
                         jiffies + msecs_to_jiffies(LED_OFF_MS);
                 mos7840_port->led_timer2.data = (unsigned long)mos7840_port;
 
-                mos7840_port->led_flag = false;
-
                 /* Turn off LED */
                 mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0300);
         }
@@ -2388,6 +2408,8 @@ out:
         }
         return 0;
 error:
+        kfree(mos7840_port->led_dr);
+        usb_free_urb(mos7840_port->led_urb);
         kfree(mos7840_port->dr);
         kfree(mos7840_port->ctrl_buf);
         usb_free_urb(mos7840_port->control_urb);
@@ -2408,6 +2430,10 @@ static int mos7840_port_remove(struct usb_serial_port *port)
 
                 del_timer_sync(&mos7840_port->led_timer1);
                 del_timer_sync(&mos7840_port->led_timer2);
+
+                usb_kill_urb(mos7840_port->led_urb);
+                usb_free_urb(mos7840_port->led_urb);
+                kfree(mos7840_port->led_dr);
         }
         usb_kill_urb(mos7840_port->control_urb);
         usb_free_urb(mos7840_port->control_urb);
@@ -2434,9 +2460,7 @@ static struct usb_serial_driver moschip7840_4port_device = {
         .throttle = mos7840_throttle,
         .unthrottle = mos7840_unthrottle,
         .calc_num_ports = mos7840_calc_num_ports,
-#ifdef MCSSerialProbe
-        .probe = mos7840_serial_probe,
-#endif
+        .probe = mos7840_probe,
         .ioctl = mos7840_ioctl,
         .set_termios = mos7840_set_termios,
         .break_ctl = mos7840_break,
diff --git a/drivers/usb/serial/suunto.c b/drivers/usb/serial/suunto.c
new file mode 100644
index 000000000000..2248e7a7d5ad
--- /dev/null
+++ b/drivers/usb/serial/suunto.c
@@ -0,0 +1,41 @@
+/*
+ * Suunto ANT+ USB Driver
+ *
+ * Copyright (C) 2013 Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+ * Copyright (C) 2013 Linux Foundation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation only.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/tty.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/usb/serial.h>
+#include <linux/uaccess.h>
+
+static const struct usb_device_id id_table[] = {
+        { USB_DEVICE(0x0fcf, 0x1008) },
+        { },
+};
+MODULE_DEVICE_TABLE(usb, id_table);
+
+static struct usb_serial_driver suunto_device = {
+        .driver = {
+                .owner =        THIS_MODULE,
+                .name =         KBUILD_MODNAME,
+        },
+        .id_table =             id_table,
+        .num_ports =            1,
+};
+
+static struct usb_serial_driver * const serial_drivers[] = {
+        &suunto_device,
+        NULL,
+};
+
+module_usb_serial_driver(serial_drivers, id_table);
+MODULE_LICENSE("GPL");
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index c5179e269df6..cef6002acbd4 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -137,8 +137,27 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev)
          */
         pci_write_config_word(pdev, PCI_COMMAND, PCI_COMMAND_INTX_DISABLE);
 
-        if (vdev->reset_works)
-                __pci_reset_function(pdev);
+        /*
+         * Careful, device_lock may already be held.  This is the case if
+         * a driver unbind is blocked.  Try to get the locks ourselves to
+         * prevent a deadlock.
+         */
+        if (vdev->reset_works) {
+                bool reset_done = false;
+
+                if (pci_cfg_access_trylock(pdev)) {
+                        if (device_trylock(&pdev->dev)) {
+                                __pci_reset_function_locked(pdev);
+                                reset_done = true;
+                                device_unlock(&pdev->dev);
+                        }
+                        pci_cfg_access_unlock(pdev);
+                }
+
+                if (!reset_done)
+                        pr_warn("%s: Unable to acquire locks for reset of %s\n",
+                                __func__, dev_name(&pdev->dev));
+        }
 
         pci_restore_state(pdev);
 }
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index c488da5db7c7..842f4507883e 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -494,27 +494,6 @@ static int vfio_group_nb_add_dev(struct vfio_group *group, struct device *dev)
         return 0;
 }
 
-static int vfio_group_nb_del_dev(struct vfio_group *group, struct device *dev)
-{
-        struct vfio_device *device;
-
-        /*
-         * Expect to fall out here.  If a device was in use, it would
-         * have been bound to a vfio sub-driver, which would have blocked
-         * in .remove at vfio_del_group_dev.  Sanity check that we no
-         * longer track the device, so it's safe to remove.
-         */
-        device = vfio_group_get_device(group, dev);
-        if (likely(!device))
-                return 0;
-
-        WARN("Device %s removed from live group %d!\n", dev_name(dev),
-             iommu_group_id(group->iommu_group));
-
-        vfio_device_put(device);
-        return 0;
-}
-
 static int vfio_group_nb_verify(struct vfio_group *group, struct device *dev)
 {
         /* We don't care what happens when the group isn't in use */
@@ -531,13 +510,11 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb,
         struct device *dev = data;
 
         /*
-         * Need to go through a group_lock lookup to get a reference or
-         * we risk racing a group being removed.  Leave a WARN_ON for
-         * debuging, but if the group no longer exists, a spurious notify
-         * is harmless.
+         * Need to go through a group_lock lookup to get a reference or we
+         * risk racing a group being removed.  Ignore spurious notifies.
          */
         group = vfio_group_try_get(group);
-        if (WARN_ON(!group))
+        if (!group)
                 return NOTIFY_OK;
 
         switch (action) {
@@ -545,7 +522,13 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb,
                 vfio_group_nb_add_dev(group, dev);
                 break;
         case IOMMU_GROUP_NOTIFY_DEL_DEVICE:
-                vfio_group_nb_del_dev(group, dev);
+                /*
+                 * Nothing to do here.  If the device is in use, then the
+                 * vfio sub-driver should block the remove callback until
+                 * it is unused.  If the device is unused or attached to a
+                 * stub driver, then it should be released and we don't
+                 * care that it will be going away.
+                 */
                 break;
         case IOMMU_GROUP_NOTIFY_BIND_DRIVER:
                 pr_debug("%s: Device %s, group %d binding to driver\n",
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index a89c15de9f45..9b0f12c5c284 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -435,8 +435,8 @@ static int correct_chipset(struct atyfb_par *par)
         const char *name;
         int i;
 
-        for (i = ARRAY_SIZE(aty_chips); i > 0; i--)
-                if (par->pci_id == aty_chips[i - 1].pci_id)
+        for (i = (int)ARRAY_SIZE(aty_chips) - 1; i >= 0; i--)
+                if (par->pci_id == aty_chips[i].pci_id)
                         break;
 
         if (i < 0)
diff --git a/drivers/video/nuc900fb.c b/drivers/video/nuc900fb.c
index 8c527e5b293c..796e5112ceee 100644
--- a/drivers/video/nuc900fb.c
+++ b/drivers/video/nuc900fb.c
@@ -587,8 +587,7 @@ static int nuc900fb_probe(struct platform_device *pdev)
         fbinfo->flags                   = FBINFO_FLAG_DEFAULT;
         fbinfo->pseudo_palette          = &fbi->pseudo_pal;
 
-        ret = request_irq(irq, nuc900fb_irqhandler, 0,
-                          pdev->name, fbinfo);
+        ret = request_irq(irq, nuc900fb_irqhandler, 0, pdev->name, fbi);
         if (ret) {
                 dev_err(&pdev->dev, "cannot register irq handler %d -err %d\n",
                         irq, ret);
diff --git a/drivers/video/sgivwfb.c b/drivers/video/sgivwfb.c
index b2a8912f6435..a9ac3ce2d0e9 100644
--- a/drivers/video/sgivwfb.c
+++ b/drivers/video/sgivwfb.c
@@ -713,7 +713,7 @@ static int sgivwfb_mmap(struct fb_info *info,
         r = vm_iomap_memory(vma, sgivwfb_mem_phys, sgivwfb_mem_size);
 
         printk(KERN_DEBUG "sgivwfb: mmap framebuffer P(%lx)->V(%lx)\n",
-               offset, vma->vm_start);
+                sgivwfb_mem_phys + (vma->vm_pgoff << PAGE_SHIFT), vma->vm_start);
 
         return r;
 }
diff --git a/drivers/video/sh7760fb.c b/drivers/video/sh7760fb.c
index a8c6c43a4658..1265b25f9f99 100644
--- a/drivers/video/sh7760fb.c
+++ b/drivers/video/sh7760fb.c
@@ -567,7 +567,7 @@ static int sh7760fb_remove(struct platform_device *dev)
         fb_dealloc_cmap(&info->cmap);
         sh7760fb_free_mem(info);
         if (par->irq >= 0)
-                free_irq(par->irq, par);
+                free_irq(par->irq, &par->vsync);
         iounmap(par->base);
         release_mem_region(par->ioarea->start, resource_size(par->ioarea));
         framebuffer_release(info);
diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c
index 830ded45fd47..2827333703d9 100644
--- a/drivers/video/vga16fb.c
+++ b/drivers/video/vga16fb.c
@@ -1265,7 +1265,6 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image
 
 static void vga16fb_destroy(struct fb_info *info)
 {
-        struct platform_device *dev = container_of(info->device, struct platform_device, dev);
         iounmap(info->screen_base);
         fb_dealloc_cmap(&info->cmap);
         /* XXX unshare VGA regions */
diff --git a/drivers/video/xilinxfb.c b/drivers/video/xilinxfb.c
index f3d4a69e1e4e..6629b29a8202 100644
--- a/drivers/video/xilinxfb.c
+++ b/drivers/video/xilinxfb.c
@@ -341,8 +341,8 @@ static int xilinxfb_assign(struct platform_device *pdev,
 
         if (drvdata->flags & BUS_ACCESS_FLAG) {
                 /* Put a banner in the log (for DEBUG) */
-                dev_dbg(dev, "regs: phys=%x, virt=%p\n", drvdata->regs_phys,
-                                        drvdata->regs);
+                dev_dbg(dev, "regs: phys=%pa, virt=%p\n",
+                        &drvdata->regs_phys, drvdata->regs);
         }
         /* Put a banner in the log (for DEBUG) */
         dev_dbg(dev, "fb: phys=%llx, virt=%p, size=%x\n",
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index 9e02d60a364b..23eae5cb69c2 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -145,7 +145,7 @@ config SWIOTLB_XEN
 
 config XEN_TMEM
         tristate
-        depends on !ARM
+        depends on !ARM && !ARM64
         default m if (CLEANCACHE || FRONTSWAP)
         help
           Shim to interface in-kernel Transcendent Memory hooks
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index eabd0ee1c2bc..14fe79d8634a 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -1,9 +1,8 @@
-ifneq ($(CONFIG_ARM),y)
-obj-y   += manage.o
+ifeq ($(filter y, $(CONFIG_ARM) $(CONFIG_ARM64)),)
 obj-$(CONFIG_HOTPLUG_CPU)               += cpu_hotplug.o
 endif
 obj-$(CONFIG_X86)                       += fallback.o
-obj-y   += grant-table.o features.o events.o balloon.o
+obj-y   += grant-table.o features.o events.o balloon.o manage.o
 obj-y   += xenbus/
 
 nostackp := $(call cc-option, -fno-stack-protector)
diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
index 8feecf01d55c..b6165e047f48 100644
--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -379,18 +379,12 @@ static long evtchn_ioctl(struct file *file,
                 if (unbind.port >= NR_EVENT_CHANNELS)
                         break;
 
-                spin_lock_irq(&port_user_lock);
-
                 rc = -ENOTCONN;
-                if (get_port_user(unbind.port) != u) {
-                        spin_unlock_irq(&port_user_lock);
+                if (get_port_user(unbind.port) != u)
                         break;
-                }
 
                 disable_irq(irq_from_evtchn(unbind.port));
 
-                spin_unlock_irq(&port_user_lock);
-
                 evtchn_unbind_from_user(u, unbind.port);
 
                 rc = 0;
@@ -490,26 +484,15 @@ static int evtchn_release(struct inode *inode, struct file *filp)
         int i;
         struct per_user_data *u = filp->private_data;
 
-        spin_lock_irq(&port_user_lock);
-
-        free_page((unsigned long)u->ring);
-
         for (i = 0; i < NR_EVENT_CHANNELS; i++) {
                 if (get_port_user(i) != u)
                         continue;
 
                 disable_irq(irq_from_evtchn(i));
-        }
-
-        spin_unlock_irq(&port_user_lock);
-
-        for (i = 0; i < NR_EVENT_CHANNELS; i++) {
-                if (get_port_user(i) != u)
-                        continue;
-
                 evtchn_unbind_from_user(get_port_user(i), i);
         }
 
+        free_page((unsigned long)u->ring);
         kfree(u->name);
         kfree(u);
 
diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
index 6ed8a9df4472..34b20bfa4e8c 100644
--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
+++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
@@ -115,7 +115,6 @@ static int xenbus_frontend_dev_resume(struct device *dev)
                         return -EFAULT;
                 }
 
-                INIT_WORK(&xdev->work, xenbus_frontend_delayed_resume);
                 queue_work(xenbus_frontend_wq, &xdev->work);
 
                 return 0;
@@ -124,6 +123,16 @@ static int xenbus_frontend_dev_resume(struct device *dev)
         return xenbus_dev_resume(dev);
 }
 
+static int xenbus_frontend_dev_probe(struct device *dev)
+{
+        if (xen_store_domain_type == XS_LOCAL) {
+                struct xenbus_device *xdev = to_xenbus_device(dev);
+                INIT_WORK(&xdev->work, xenbus_frontend_delayed_resume);
+        }
+
+        return xenbus_dev_probe(dev);
+}
+
 static const struct dev_pm_ops xenbus_pm_ops = {
         .suspend        = xenbus_dev_suspend,
         .resume         = xenbus_frontend_dev_resume,
@@ -142,7 +151,7 @@ static struct xen_bus_type xenbus_frontend = {
                 .name           = "xen",
                 .match          = xenbus_match,
                 .uevent         = xenbus_uevent_frontend,
-                .probe          = xenbus_dev_probe,
+                .probe          = xenbus_frontend_dev_probe,
                 .remove         = xenbus_dev_remove,
                 .shutdown       = xenbus_dev_shutdown,
                 .dev_attrs      = xenbus_dev_attrs,
@@ -474,7 +483,11 @@ static int __init xenbus_probe_frontend_init(void)
 
         register_xenstore_notifier(&xenstore_notifier);
 
-        xenbus_frontend_wq = create_workqueue("xenbus_frontend");
+        if (xen_store_domain_type == XS_LOCAL) {
+                xenbus_frontend_wq = create_workqueue("xenbus_frontend");
+                if (!xenbus_frontend_wq)
+                        pr_warn("create xenbus frontend workqueue failed, S3 resume is likely to fail\n");
+        }
 
         return 0;
 }
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 998b17eda09d..9f6b96a09615 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -2965,6 +2965,11 @@ int ocfs2_duplicate_clusters_by_page(handle_t *handle,
                         to = map_end & (PAGE_CACHE_SIZE - 1);
 
                 page = find_or_create_page(mapping, page_index, GFP_NOFS);
+                if (!page) {
+                        ret = -ENOMEM;
+                        mlog_errno(ret);
+                        break;
+                }
 
                 /*
                  * In case PAGE_CACHE_SIZE <= CLUSTER_SIZE, This page
diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h
index f5e1168c7647..d639049a613d 100644
--- a/include/drm/drm_fixed.h
+++ b/include/drm/drm_fixed.h
@@ -84,12 +84,12 @@ static inline int drm_fixp2int(int64_t a)
         return ((s64)a) >> DRM_FIXED_POINT;
 }
 
-static inline s64 drm_fixp_msbset(int64_t a)
+static inline unsigned drm_fixp_msbset(int64_t a)
 {
         unsigned shift, sign = (a >> 63) & 1;
 
         for (shift = 62; shift > 0; --shift)
-                if ((a >> shift) != sign)
+                if (((a >> shift) & 1) != sign)
                         return shift;
 
         return 0;
@@ -100,9 +100,9 @@ static inline s64 drm_fixp_mul(s64 a, s64 b)
         unsigned shift = drm_fixp_msbset(a) + drm_fixp_msbset(b);
         s64 result;
 
-        if (shift > 63) {
-                shift = shift - 63;
-                a >>= shift >> 1;
+        if (shift > 61) {
+                shift = shift - 61;
+                a >>= (shift >> 1) + (shift & 1);
                 b >>= shift >> 1;
         } else
                 shift = 0;
@@ -120,7 +120,7 @@ static inline s64 drm_fixp_mul(s64 a, s64 b)
 
 static inline s64 drm_fixp_div(s64 a, s64 b)
 {
-        unsigned shift = 63 - drm_fixp_msbset(a);
+        unsigned shift = 62 - drm_fixp_msbset(a);
         s64 result;
 
         a <<= shift;
@@ -154,7 +154,7 @@ static inline s64 drm_fixp_exp(s64 x)
         }
 
         if (x < 0)
-                sum = drm_fixp_div(1, sum);
+                sum = drm_fixp_div(DRM_FIXED_ONE, sum);
 
         return sum;
 }
diff --git a/include/linux/firewire.h b/include/linux/firewire.h
index 3b0e820375ab..5d7782e42b8f 100644
--- a/include/linux/firewire.h
+++ b/include/linux/firewire.h
@@ -436,6 +436,7 @@ struct fw_iso_context {
         int type;
         int channel;
         int speed;
+        bool drop_overflow_headers;
         size_t header_size;
         union {
                 fw_iso_callback_t sc;
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
index 8de8d8f22384..737685e9e852 100644
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -690,6 +690,26 @@ struct mlx5_query_cq_mbox_out {
         __be64                  pas[0];
 };
 
+struct mlx5_enable_hca_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_enable_hca_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_disable_hca_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_disable_hca_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+};
+
 struct mlx5_eq_context {
         u8                      status;
         u8                      ec_oi;
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index f22e4419839b..2aa258b0ced1 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -101,6 +101,8 @@ enum {
         MLX5_CMD_OP_QUERY_ADAPTER               = 0x101,
         MLX5_CMD_OP_INIT_HCA                    = 0x102,
         MLX5_CMD_OP_TEARDOWN_HCA                = 0x103,
+        MLX5_CMD_OP_ENABLE_HCA                  = 0x104,
+        MLX5_CMD_OP_DISABLE_HCA                 = 0x105,
         MLX5_CMD_OP_QUERY_PAGES                 = 0x107,
         MLX5_CMD_OP_MANAGE_PAGES                = 0x108,
         MLX5_CMD_OP_SET_HCA_CAP                 = 0x109,
@@ -690,7 +692,7 @@ int mlx5_pagealloc_start(struct mlx5_core_dev *dev);
 void mlx5_pagealloc_stop(struct mlx5_core_dev *dev);
 void mlx5_core_req_pages_handler(struct mlx5_core_dev *dev, u16 func_id,
                                  s16 npages);
-int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev);
+int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev, int boot);
 int mlx5_reclaim_startup_pages(struct mlx5_core_dev *dev);
 void mlx5_register_debugfs(void);
 void mlx5_unregister_debugfs(void);
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index b62d4af6c667..45e921401b06 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -361,7 +361,8 @@ struct ssb_device_id {
         __u16   vendor;
         __u16   coreid;
         __u8    revision;
-};
+        __u8    __pad;
+} __attribute__((packed, aligned(2)));
 #define SSB_DEVICE(_vendor, _coreid, _revision)  \
         { .vendor = _vendor, .coreid = _coreid, .revision = _revision, }
 #define SSB_DEVTABLE_END  \
@@ -377,7 +378,7 @@ struct bcma_device_id {
         __u16   id;
         __u8    rev;
         __u8    class;
-};
+} __attribute__((packed,aligned(2)));
 #define BCMA_CORE(_manuf, _id, _rev, _class)  \
         { .manuf = _manuf, .id = _id, .rev = _rev, .class = _class, }
 #define BCMA_CORETABLE_END  \
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 0741a1e919a5..9a4156845e93 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -973,7 +973,7 @@ struct net_device_ops {
                                                      gfp_t gfp);
         void                    (*ndo_netpoll_cleanup)(struct net_device *dev);
 #endif
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         int                     (*ndo_busy_poll)(struct napi_struct *dev);
 #endif
         int                     (*ndo_set_vf_mac)(struct net_device *dev,
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 50d04b92ceda..d722490da030 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1628,6 +1628,7 @@ extern void thread_group_cputime_adjusted(struct task_struct *p, cputime_t *ut,
 #define PF_MEMPOLICY    0x10000000      /* Non-default NUMA mempolicy */
 #define PF_MUTEX_TESTER 0x20000000      /* Thread belongs to the rt mutex tester */
 #define PF_FREEZER_SKIP 0x40000000      /* Freezer should not count it as freezable */
+#define PF_SUSPEND_TASK 0x80000000      /* this thread called freeze_processes and should not be frozen */
 
 /*
  * Only the _current_ task can read/write to tsk->flags, but other
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 5afefa01a13c..3b71a4e83642 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -501,7 +501,7 @@ struct sk_buff {
         /* 7/9 bit hole (depending on ndisc_nodetype presence) */
         kmemcheck_bitfield_end(flags2);
 
-#if defined CONFIG_NET_DMA || defined CONFIG_NET_LL_RX_POLL
+#if defined CONFIG_NET_DMA || defined CONFIG_NET_RX_BUSY_POLL
         union {
                 unsigned int    napi_id;
                 dma_cookie_t    dma_cookie;
diff --git a/include/linux/tick.h b/include/linux/tick.h
index 9180f4b85e6d..62bd8b72873c 100644
--- a/include/linux/tick.h
+++ b/include/linux/tick.h
@@ -174,10 +174,4 @@ static inline void tick_nohz_task_switch(struct task_struct *tsk) { }
 #endif
 
 
-# ifdef CONFIG_CPU_IDLE_GOV_MENU
-extern void menu_hrtimer_cancel(void);
-# else
-static inline void menu_hrtimer_cancel(void) {}
-# endif /* CONFIG_CPU_IDLE_GOV_MENU */
-
 #endif
diff --git a/include/linux/vmpressure.h b/include/linux/vmpressure.h
index 76be077340ea..7dc17e2456de 100644
--- a/include/linux/vmpressure.h
+++ b/include/linux/vmpressure.h
@@ -12,7 +12,7 @@ struct vmpressure {
         unsigned long scanned;
         unsigned long reclaimed;
         /* The lock is used to keep the scanned/reclaimed above in sync. */
-        struct mutex sr_lock;
+        struct spinlock sr_lock;
 
         /* The list of vmpressure_event structs. */
         struct list_head events;
@@ -30,6 +30,7 @@ extern void vmpressure(gfp_t gfp, struct mem_cgroup *memcg,
 extern void vmpressure_prio(gfp_t gfp, struct mem_cgroup *memcg, int prio);
 
 extern void vmpressure_init(struct vmpressure *vmpr);
+extern void vmpressure_cleanup(struct vmpressure *vmpr);
 extern struct vmpressure *memcg_to_vmpressure(struct mem_cgroup *memcg);
 extern struct cgroup_subsys_state *vmpressure_to_css(struct vmpressure *vmpr);
 extern struct vmpressure *css_to_vmpressure(struct cgroup_subsys_state *css);
diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
index a14339c2985f..f18b91966d3d 100644
--- a/include/net/busy_poll.h
+++ b/include/net/busy_poll.h
@@ -27,7 +27,7 @@
 #include <linux/netdevice.h>
 #include <net/ip.h>
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 
 struct napi_struct;
 extern unsigned int sysctl_net_busy_read __read_mostly;
@@ -146,7 +146,7 @@ static inline void sk_mark_napi_id(struct sock *sk, struct sk_buff *skb)
         sk->sk_napi_id = skb->napi_id;
 }
 
-#else /* CONFIG_NET_LL_RX_POLL */
+#else /* CONFIG_NET_RX_BUSY_POLL */
 static inline unsigned long net_busy_loop_on(void)
 {
         return 0;
@@ -181,5 +181,10 @@ static inline bool busy_loop_timeout(unsigned long end_time)
         return true;
 }
 
-#endif /* CONFIG_NET_LL_RX_POLL */
+static inline bool sk_busy_loop(struct sock *sk, int nonblock)
+{
+        return false;
+}
+
+#endif /* CONFIG_NET_RX_BUSY_POLL */
 #endif /* _LINUX_NET_BUSY_POLL_H */
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 2a601e7da1bf..48ec25a7fcb6 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -300,7 +300,7 @@ extern void			inet6_rt_notify(int event, struct rt6_info *rt,
                                                 struct nl_info *info);
 
 extern void                     fib6_run_gc(unsigned long expires,
-                                            struct net *net);
+                                            struct net *net, bool force);
 
 extern void                     fib6_gc_cleanup(void);
 
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index 949d77528f2f..6fea32340ae8 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -119,7 +119,7 @@ extern struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
  * if RFC 3831 IPv6-over-Fibre Channel is ever implemented it may
  * also need a pad of 2.
  */
-static int ndisc_addr_option_pad(unsigned short type)
+static inline int ndisc_addr_option_pad(unsigned short type)
 {
         switch (type) {
         case ARPHRD_INFINIBAND: return 2;
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index 0af851c3b038..b64b7bce4b94 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -59,7 +59,7 @@ struct nfc_hci_ops {
                               struct nfc_target *target);
         int (*event_received)(struct nfc_hci_dev *hdev, u8 gate, u8 event,
                               struct sk_buff *skb);
-        int (*fw_upload)(struct nfc_hci_dev *hdev, const char *firmware_name);
+        int (*fw_download)(struct nfc_hci_dev *hdev, const char *firmware_name);
         int (*discover_se)(struct nfc_hci_dev *dev);
         int (*enable_se)(struct nfc_hci_dev *dev, u32 se_idx);
         int (*disable_se)(struct nfc_hci_dev *dev, u32 se_idx);
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 0e353f1658bb..5f286b726bb6 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -68,7 +68,7 @@ struct nfc_ops {
                              void *cb_context);
         int (*tm_send)(struct nfc_dev *dev, struct sk_buff *skb);
         int (*check_presence)(struct nfc_dev *dev, struct nfc_target *target);
-        int (*fw_upload)(struct nfc_dev *dev, const char *firmware_name);
+        int (*fw_download)(struct nfc_dev *dev, const char *firmware_name);
 
         /* Secure Element API */
         int (*discover_se)(struct nfc_dev *dev);
@@ -127,7 +127,7 @@ struct nfc_dev {
         int targets_generation;
         struct device dev;
         bool dev_up;
-        bool fw_upload_in_progress;
+        bool fw_download_in_progress;
         u8 rf_mode;
         bool polling;
         struct nfc_target *active_target;
diff --git a/include/net/sock.h b/include/net/sock.h
index 95a5a2c6925a..31d5cfbb51ec 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -327,7 +327,7 @@ struct sock {
 #ifdef CONFIG_RPS
         __u32                   sk_rxhash;
 #endif
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         unsigned int            sk_napi_id;
         unsigned int            sk_ll_usec;
 #endif
diff --git a/include/uapi/linux/firewire-cdev.h b/include/uapi/linux/firewire-cdev.h
index d50036953497..1db453e4b550 100644
--- a/include/uapi/linux/firewire-cdev.h
+++ b/include/uapi/linux/firewire-cdev.h
@@ -215,8 +215,8 @@ struct fw_cdev_event_request2 {
  * with the %FW_CDEV_ISO_INTERRUPT bit set, when explicitly requested with
  * %FW_CDEV_IOC_FLUSH_ISO, or when there have been so many completed packets
  * without the interrupt bit set that the kernel's internal buffer for @header
- * is about to overflow.  (In the last case, kernels with ABI version < 5 drop
- * header data up to the next interrupt packet.)
+ * is about to overflow.  (In the last case, ABI versions < 5 drop header data
+ * up to the next interrupt packet.)
  *
  * Isochronous transmit events (context type %FW_CDEV_ISO_CONTEXT_TRANSMIT):
  *
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index caed0f324d5f..8137dd8d2adf 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -69,8 +69,8 @@
  *      starting a poll from a device which has a secure element enabled means
  *      we want to do SE based card emulation.
  * @NFC_CMD_DISABLE_SE: Disable the physical link to a specific secure element.
- * @NFC_CMD_FW_UPLOAD: Request to Load/flash firmware, or event to inform that
- *      some firmware was loaded
+ * @NFC_CMD_FW_DOWNLOAD: Request to Load/flash firmware, or event to inform
+ *      that some firmware was loaded
  */
 enum nfc_commands {
         NFC_CMD_UNSPEC,
@@ -94,7 +94,7 @@ enum nfc_commands {
         NFC_CMD_DISABLE_SE,
         NFC_CMD_LLC_SDREQ,
         NFC_EVENT_LLC_SDRES,
-        NFC_CMD_FW_UPLOAD,
+        NFC_CMD_FW_DOWNLOAD,
         NFC_EVENT_SE_ADDED,
         NFC_EVENT_SE_REMOVED,
 /* private: internal use only */
diff --git a/kernel/Makefile b/kernel/Makefile
index 470839d1a30e..35ef1185e359 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the linux kernel.
 #
 
-obj-y     = fork.o exec_domain.o panic.o printk.o \
+obj-y     = fork.o exec_domain.o panic.o \
             cpu.o exit.o itimer.o time.o softirq.o resource.o \
             sysctl.o sysctl_binary.o capability.o ptrace.o timer.o user.o \
             signal.o sys.o kmod.o workqueue.o pid.o task_work.o \
@@ -24,6 +24,7 @@ endif
 
 obj-y += sched/
 obj-y += power/
+obj-y += printk/
 obj-y += cpu/
 
 obj-$(CONFIG_CHECKPOINT_RESTORE) += kcmp.o
diff --git a/kernel/freezer.c b/kernel/freezer.c
index 8b2afc1c9df0..b462fa197517 100644
--- a/kernel/freezer.c
+++ b/kernel/freezer.c
@@ -33,7 +33,7 @@ static DEFINE_SPINLOCK(freezer_lock);
  */
 bool freezing_slow_path(struct task_struct *p)
 {
-        if (p->flags & PF_NOFREEZE)
+        if (p->flags & (PF_NOFREEZE | PF_SUSPEND_TASK))
                 return false;
 
         if (pm_nosig_freezing || cgroup_freezing(p))
diff --git a/kernel/power/process.c b/kernel/power/process.c
index fc0df8486449..06ec8869dbf1 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -109,6 +109,8 @@ static int try_to_freeze_tasks(bool user_only)
 
 /**
  * freeze_processes - Signal user space processes to enter the refrigerator.
+ * The current thread will not be frozen.  The same process that calls
+ * freeze_processes must later call thaw_processes.
  *
  * On success, returns 0.  On failure, -errno and system is fully thawed.
  */
@@ -120,6 +122,9 @@ int freeze_processes(void)
         if (error)
                 return error;
 
+        /* Make sure this task doesn't get frozen */
+        current->flags |= PF_SUSPEND_TASK;
+
         if (!pm_freezing)
                 atomic_inc(&system_freezing_cnt);
 
@@ -168,6 +173,7 @@ int freeze_kernel_threads(void)
 void thaw_processes(void)
 {
         struct task_struct *g, *p;
+        struct task_struct *curr = current;
 
         if (pm_freezing)
                 atomic_dec(&system_freezing_cnt);
@@ -182,10 +188,15 @@ void thaw_processes(void)
 
         read_lock(&tasklist_lock);
         do_each_thread(g, p) {
+                /* No other threads should have PF_SUSPEND_TASK set */
+                WARN_ON((p != curr) && (p->flags & PF_SUSPEND_TASK));
                 __thaw_task(p);
         } while_each_thread(g, p);
         read_unlock(&tasklist_lock);
 
+        WARN_ON(!(curr->flags & PF_SUSPEND_TASK));
+        curr->flags &= ~PF_SUSPEND_TASK;
+
         usermodehelper_enable();
 
         schedule();
diff --git a/kernel/printk/Makefile b/kernel/printk/Makefile
new file mode 100644
index 000000000000..85405bdcf2b3
--- /dev/null
+++ b/kernel/printk/Makefile
@@ -0,0 +1,2 @@
+obj-y   = printk.o
+obj-$(CONFIG_A11Y_BRAILLE_CONSOLE)      += braille.o
diff --git a/kernel/printk/braille.c b/kernel/printk/braille.c
new file mode 100644
index 000000000000..b51087fb9ace
--- /dev/null
+++ b/kernel/printk/braille.c
@@ -0,0 +1,48 @@
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/kernel.h>
+#include <linux/console.h>
+#include <linux/string.h>
+
+#include "console_cmdline.h"
+#include "braille.h"
+
+char *_braille_console_setup(char **str, char **brl_options)
+{
+        if (!memcmp(*str, "brl,", 4)) {
+                *brl_options = "";
+                *str += 4;
+        } else if (!memcmp(str, "brl=", 4)) {
+                *brl_options = *str + 4;
+                *str = strchr(*brl_options, ',');
+                if (!*str)
+                        pr_err("need port name after brl=\n");
+                else
+                        *((*str)++) = 0;
+        }
+
+        return *str;
+}
+
+int
+_braille_register_console(struct console *console, struct console_cmdline *c)
+{
+        int rtn = 0;
+
+        if (c->brl_options) {
+                console->flags |= CON_BRL;
+                rtn = braille_register_console(console, c->index, c->options,
+                                               c->brl_options);
+        }
+
+        return rtn;
+}
+
+int
+_braille_unregister_console(struct console *console)
+{
+        if (console->flags & CON_BRL)
+                return braille_unregister_console(console);
+
+        return 0;
+}
diff --git a/kernel/printk/braille.h b/kernel/printk/braille.h
new file mode 100644
index 000000000000..769d771145c8
--- /dev/null
+++ b/kernel/printk/braille.h
@@ -0,0 +1,48 @@
+#ifndef _PRINTK_BRAILLE_H
+#define _PRINTK_BRAILLE_H
+
+#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+
+static inline void
+braille_set_options(struct console_cmdline *c, char *brl_options)
+{
+        c->brl_options = brl_options;
+}
+
+char *
+_braille_console_setup(char **str, char **brl_options);
+
+int
+_braille_register_console(struct console *console, struct console_cmdline *c);
+
+int
+_braille_unregister_console(struct console *console);
+
+#else
+
+static inline void
+braille_set_options(struct console_cmdline *c, char *brl_options)
+{
+}
+
+static inline char *
+_braille_console_setup(char **str, char **brl_options)
+{
+        return NULL;
+}
+
+static inline int
+_braille_register_console(struct console *console, struct console_cmdline *c)
+{
+        return 0;
+}
+
+static inline int
+_braille_unregister_console(struct console *console)
+{
+        return 0;
+}
+
+#endif
+
+#endif
diff --git a/kernel/printk/console_cmdline.h b/kernel/printk/console_cmdline.h
new file mode 100644
index 000000000000..cbd69d842341
--- /dev/null
+++ b/kernel/printk/console_cmdline.h
@@ -0,0 +1,14 @@
+#ifndef _CONSOLE_CMDLINE_H
+#define _CONSOLE_CMDLINE_H
+
+struct console_cmdline
+{
+        char    name[8];                        /* Name of the driver       */
+        int     index;                          /* Minor dev. to use        */
+        char    *options;                       /* Options for the driver   */
+#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+        char    *brl_options;                   /* Options for braille driver */
+#endif
+};
+
+#endif
diff --git a/kernel/printk.c b/kernel/printk/printk.c
index 69b0890ed7e5..5b5a7080e2a5 100644
--- a/kernel/printk.c
+++ b/kernel/printk/printk.c
@@ -51,6 +51,9 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/printk.h>
 
+#include "console_cmdline.h"
+#include "braille.h"
+
 /* printk's without a loglevel use this.. */
 #define DEFAULT_MESSAGE_LOGLEVEL CONFIG_DEFAULT_MESSAGE_LOGLEVEL
 
@@ -105,19 +108,11 @@ static struct console *exclusive_console;
 /*
  *      Array of consoles built from command line options (console=)
  */
-struct console_cmdline
-{
-        char    name[8];                        /* Name of the driver       */
-        int     index;                          /* Minor dev. to use        */
-        char    *options;                       /* Options for the driver   */
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-        char    *brl_options;                   /* Options for braille driver */
-#endif
-};
 
 #define MAX_CMDLINECONSOLES 8
 
 static struct console_cmdline console_cmdline[MAX_CMDLINECONSOLES];
+
 static int selected_console = -1;
 static int preferred_console = -1;
 int console_set_on_cmdline;
@@ -178,7 +173,7 @@ static int console_may_schedule;
  *         67                           "g"
  *   0032     00 00 00                  padding to next message header
  *
- * The 'struct log' buffer header must never be directly exported to
+ * The 'struct printk_log' buffer header must never be directly exported to
  * userspace, it is a kernel-private implementation detail that might
  * need to be changed in the future, when the requirements change.
  *
@@ -200,7 +195,7 @@ enum log_flags {
         LOG_CONT        = 8,    /* text is a fragment of a continuation line */
 };
 
-struct log {
+struct printk_log {
         u64 ts_nsec;            /* timestamp in nanoseconds */
         u16 len;                /* length of entire record */
         u16 text_len;           /* length of text buffer */
@@ -248,7 +243,7 @@ static u32 clear_idx;
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
 #define LOG_ALIGN 4
 #else
-#define LOG_ALIGN __alignof__(struct log)
+#define LOG_ALIGN __alignof__(struct printk_log)
 #endif
 #define __LOG_BUF_LEN (1 << CONFIG_LOG_BUF_SHIFT)
 static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN);
@@ -259,35 +254,35 @@ static u32 log_buf_len = __LOG_BUF_LEN;
 static volatile unsigned int logbuf_cpu = UINT_MAX;
 
 /* human readable text of the record */
-static char *log_text(const struct log *msg)
+static char *log_text(const struct printk_log *msg)
 {
-        return (char *)msg + sizeof(struct log);
+        return (char *)msg + sizeof(struct printk_log);
 }
 
 /* optional key/value pair dictionary attached to the record */
-static char *log_dict(const struct log *msg)
+static char *log_dict(const struct printk_log *msg)
 {
-        return (char *)msg + sizeof(struct log) + msg->text_len;
+        return (char *)msg + sizeof(struct printk_log) + msg->text_len;
 }
 
 /* get record by index; idx must point to valid msg */
-static struct log *log_from_idx(u32 idx)
+static struct printk_log *log_from_idx(u32 idx)
 {
-        struct log *msg = (struct log *)(log_buf + idx);
+        struct printk_log *msg = (struct printk_log *)(log_buf + idx);
 
         /*
          * A length == 0 record is the end of buffer marker. Wrap around and
          * read the message at the start of the buffer.
          */
         if (!msg->len)
-                return (struct log *)log_buf;
+                return (struct printk_log *)log_buf;
         return msg;
 }
 
 /* get next record; idx must point to valid msg */
 static u32 log_next(u32 idx)
 {
-        struct log *msg = (struct log *)(log_buf + idx);
+        struct printk_log *msg = (struct printk_log *)(log_buf + idx);
 
         /* length == 0 indicates the end of the buffer; wrap */
         /*
@@ -296,7 +291,7 @@ static u32 log_next(u32 idx)
          * return the one after that.
          */
         if (!msg->len) {
-                msg = (struct log *)log_buf;
+                msg = (struct printk_log *)log_buf;
                 return msg->len;
         }
         return idx + msg->len;
@@ -308,11 +303,11 @@ static void log_store(int facility, int level,
                       const char *dict, u16 dict_len,
                       const char *text, u16 text_len)
 {
-        struct log *msg;
+        struct printk_log *msg;
         u32 size, pad_len;
 
         /* number of '\0' padding bytes to next message */
-        size = sizeof(struct log) + text_len + dict_len;
+        size = sizeof(struct printk_log) + text_len + dict_len;
         pad_len = (-size) & (LOG_ALIGN - 1);
         size += pad_len;
 
@@ -324,7 +319,7 @@ static void log_store(int facility, int level,
                 else
                         free = log_first_idx - log_next_idx;
 
-                if (free > size + sizeof(struct log))
+                if (free > size + sizeof(struct printk_log))
                         break;
 
                 /* drop old messages until we have enough contiuous space */
@@ -332,18 +327,18 @@ static void log_store(int facility, int level,
                 log_first_seq++;
         }
 
-        if (log_next_idx + size + sizeof(struct log) >= log_buf_len) {
+        if (log_next_idx + size + sizeof(struct printk_log) >= log_buf_len) {
                 /*
                  * This message + an additional empty header does not fit
                  * at the end of the buffer. Add an empty header with len == 0
                  * to signify a wrap around.
                  */
-                memset(log_buf + log_next_idx, 0, sizeof(struct log));
+                memset(log_buf + log_next_idx, 0, sizeof(struct printk_log));
                 log_next_idx = 0;
         }
 
         /* fill message */
-        msg = (struct log *)(log_buf + log_next_idx);
+        msg = (struct printk_log *)(log_buf + log_next_idx);
         memcpy(log_text(msg), text, text_len);
         msg->text_len = text_len;
         memcpy(log_dict(msg), dict, dict_len);
@@ -356,7 +351,7 @@ static void log_store(int facility, int level,
         else
                 msg->ts_nsec = local_clock();
         memset(log_dict(msg) + dict_len, 0, pad_len);
-        msg->len = sizeof(struct log) + text_len + dict_len + pad_len;
+        msg->len = sizeof(struct printk_log) + text_len + dict_len + pad_len;
 
         /* insert message */
         log_next_idx += msg->len;
@@ -479,7 +474,7 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
                             size_t count, loff_t *ppos)
 {
         struct devkmsg_user *user = file->private_data;
-        struct log *msg;
+        struct printk_log *msg;
         u64 ts_usec;
         size_t i;
         char cont = '-';
@@ -724,14 +719,14 @@ void log_buf_kexec_setup(void)
         VMCOREINFO_SYMBOL(log_first_idx);
         VMCOREINFO_SYMBOL(log_next_idx);
         /*
-         * Export struct log size and field offsets. User space tools can
+         * Export struct printk_log size and field offsets. User space tools can
          * parse it and detect any changes to structure down the line.
          */
-        VMCOREINFO_STRUCT_SIZE(log);
-        VMCOREINFO_OFFSET(log, ts_nsec);
-        VMCOREINFO_OFFSET(log, len);
-        VMCOREINFO_OFFSET(log, text_len);
-        VMCOREINFO_OFFSET(log, dict_len);
+        VMCOREINFO_STRUCT_SIZE(printk_log);
+        VMCOREINFO_OFFSET(printk_log, ts_nsec);
+        VMCOREINFO_OFFSET(printk_log, len);
+        VMCOREINFO_OFFSET(printk_log, text_len);
+        VMCOREINFO_OFFSET(printk_log, dict_len);
 }
 #endif
 
@@ -884,7 +879,7 @@ static size_t print_time(u64 ts, char *buf)
                        (unsigned long)ts, rem_nsec / 1000);
 }
 
-static size_t print_prefix(const struct log *msg, bool syslog, char *buf)
+static size_t print_prefix(const struct printk_log *msg, bool syslog, char *buf)
 {
         size_t len = 0;
         unsigned int prefix = (msg->facility << 3) | msg->level;
@@ -907,7 +902,7 @@ static size_t print_prefix(const struct log *msg, bool syslog, char *buf)
         return len;
 }
 
-static size_t msg_print_text(const struct log *msg, enum log_flags prev,
+static size_t msg_print_text(const struct printk_log *msg, enum log_flags prev,
                              bool syslog, char *buf, size_t size)
 {
         const char *text = log_text(msg);
@@ -969,7 +964,7 @@ static size_t msg_print_text(const struct log *msg, enum log_flags prev,
 static int syslog_print(char __user *buf, int size)
 {
         char *text;
-        struct log *msg;
+        struct printk_log *msg;
         int len = 0;
 
         text = kmalloc(LOG_LINE_MAX + PREFIX_MAX, GFP_KERNEL);
@@ -1060,7 +1055,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 idx = clear_idx;
                 prev = 0;
                 while (seq < log_next_seq) {
-                        struct log *msg = log_from_idx(idx);
+                        struct printk_log *msg = log_from_idx(idx);
 
                         len += msg_print_text(msg, prev, true, NULL, 0);
                         prev = msg->flags;
@@ -1073,7 +1068,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 idx = clear_idx;
                 prev = 0;
                 while (len > size && seq < log_next_seq) {
-                        struct log *msg = log_from_idx(idx);
+                        struct printk_log *msg = log_from_idx(idx);
 
                         len -= msg_print_text(msg, prev, true, NULL, 0);
                         prev = msg->flags;
@@ -1087,7 +1082,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 len = 0;
                 prev = 0;
                 while (len >= 0 && seq < next_seq) {
-                        struct log *msg = log_from_idx(idx);
+                        struct printk_log *msg = log_from_idx(idx);
                         int textlen;
 
                         textlen = msg_print_text(msg, prev, true, text,
@@ -1233,7 +1228,7 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
 
                         error = 0;
                         while (seq < log_next_seq) {
-                                struct log *msg = log_from_idx(idx);
+                                struct printk_log *msg = log_from_idx(idx);
 
                                 error += msg_print_text(msg, prev, true, NULL, 0);
                                 idx = log_next(idx);
@@ -1719,10 +1714,10 @@ static struct cont {
         u8 level;
         bool flushed:1;
 } cont;
-static struct log *log_from_idx(u32 idx) { return NULL; }
+static struct printk_log *log_from_idx(u32 idx) { return NULL; }
 static u32 log_next(u32 idx) { return 0; }
 static void call_console_drivers(int level, const char *text, size_t len) {}
-static size_t msg_print_text(const struct log *msg, enum log_flags prev,
+static size_t msg_print_text(const struct printk_log *msg, enum log_flags prev,
                              bool syslog, char *buf, size_t size) { return 0; }
 static size_t cont_print_text(char *text, size_t size) { return 0; }
 
@@ -1761,23 +1756,23 @@ static int __add_preferred_console(char *name, int idx, char *options,
          *      See if this tty is not yet registered, and
          *      if we have a slot free.
          */
-        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; i++)
-                if (strcmp(console_cmdline[i].name, name) == 0 &&
-                          console_cmdline[i].index == idx) {
-                                if (!brl_options)
-                                        selected_console = i;
-                                return 0;
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
+                if (strcmp(c->name, name) == 0 && c->index == idx) {
+                        if (!brl_options)
+                                selected_console = i;
+                        return 0;
                 }
+        }
         if (i == MAX_CMDLINECONSOLES)
                 return -E2BIG;
         if (!brl_options)
                 selected_console = i;
-        c = &console_cmdline[i];
         strlcpy(c->name, name, sizeof(c->name));
         c->options = options;
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-        c->brl_options = brl_options;
-#endif
+        braille_set_options(c, brl_options);
+
         c->index = idx;
         return 0;
 }
@@ -1790,20 +1785,8 @@ static int __init console_setup(char *str)
         char *s, *options, *brl_options = NULL;
         int idx;
 
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-        if (!memcmp(str, "brl,", 4)) {
-                brl_options = "";
-                str += 4;
-        } else if (!memcmp(str, "brl=", 4)) {
-                brl_options = str + 4;
-                str = strchr(brl_options, ',');
-                if (!str) {
-                        printk(KERN_ERR "need port name after brl=\n");
-                        return 1;
-                }
-                *(str++) = 0;
-        }
-#endif
+        if (_braille_console_setup(&str, &brl_options))
+                return 1;
 
         /*
          * Decode str into name, index, options.
@@ -1858,15 +1841,15 @@ int update_console_cmdline(char *name, int idx, char *name_new, int idx_new, cha
         struct console_cmdline *c;
         int i;
 
-        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; i++)
-                if (strcmp(console_cmdline[i].name, name) == 0 &&
-                          console_cmdline[i].index == idx) {
-                                c = &console_cmdline[i];
-                                strlcpy(c->name, name_new, sizeof(c->name));
-                                c->name[sizeof(c->name) - 1] = 0;
-                                c->options = options;
-                                c->index = idx_new;
-                                return i;
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++)
+                if (strcmp(c->name, name) == 0 && c->index == idx) {
+                        strlcpy(c->name, name_new, sizeof(c->name));
+                        c->name[sizeof(c->name) - 1] = 0;
+                        c->options = options;
+                        c->index = idx_new;
+                        return i;
                 }
         /* not found */
         return -1;
@@ -2046,7 +2029,7 @@ void console_unlock(void)
         console_cont_flush(text, sizeof(text));
 again:
         for (;;) {
-                struct log *msg;
+                struct printk_log *msg;
                 size_t len;
                 int level;
 
@@ -2241,6 +2224,7 @@ void register_console(struct console *newcon)
         int i;
         unsigned long flags;
         struct console *bcon = NULL;
+        struct console_cmdline *c;
 
         /*
          * before we register a new CON_BOOT console, make sure we don't
@@ -2288,30 +2272,25 @@ void register_console(struct console *newcon)
          *      See if this console matches one we selected on
          *      the command line.
          */
-        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0];
-                        i++) {
-                if (strcmp(console_cmdline[i].name, newcon->name) != 0)
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
+                if (strcmp(c->name, newcon->name) != 0)
                         continue;
                 if (newcon->index >= 0 &&
-                    newcon->index != console_cmdline[i].index)
+                    newcon->index != c->index)
                         continue;
                 if (newcon->index < 0)
-                        newcon->index = console_cmdline[i].index;
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-                if (console_cmdline[i].brl_options) {
-                        newcon->flags |= CON_BRL;
-                        braille_register_console(newcon,
-                                        console_cmdline[i].index,
-                                        console_cmdline[i].options,
-                                        console_cmdline[i].brl_options);
+                        newcon->index = c->index;
+
+                if (_braille_register_console(newcon, c))
                         return;
-                }
-#endif
+
                 if (newcon->setup &&
                     newcon->setup(newcon, console_cmdline[i].options) != 0)
                         break;
                 newcon->flags |= CON_ENABLED;
-                newcon->index = console_cmdline[i].index;
+                newcon->index = c->index;
                 if (i == selected_console) {
                         newcon->flags |= CON_CONSDEV;
                         preferred_console = selected_console;
@@ -2394,13 +2373,13 @@ EXPORT_SYMBOL(register_console);
 int unregister_console(struct console *console)
 {
         struct console *a, *b;
-        int res = 1;
+        int res;
 
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-        if (console->flags & CON_BRL)
-                return braille_unregister_console(console);
-#endif
+        res = _braille_unregister_console(console);
+        if (res)
+                return res;
 
+        res = 1;
         console_lock();
         if (console_drivers == console) {
                 console_drivers=console->next;
@@ -2666,7 +2645,7 @@ void kmsg_dump(enum kmsg_dump_reason reason)
 bool kmsg_dump_get_line_nolock(struct kmsg_dumper *dumper, bool syslog,
                                char *line, size_t size, size_t *len)
 {
-        struct log *msg;
+        struct printk_log *msg;
         size_t l = 0;
         bool ret = false;
 
@@ -2778,7 +2757,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
         idx = dumper->cur_idx;
         prev = 0;
         while (seq < dumper->next_seq) {
-                struct log *msg = log_from_idx(idx);
+                struct printk_log *msg = log_from_idx(idx);
 
                 l += msg_print_text(msg, prev, true, NULL, 0);
                 idx = log_next(idx);
@@ -2791,7 +2770,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
         idx = dumper->cur_idx;
         prev = 0;
         while (l > size && seq < dumper->next_seq) {
-                struct log *msg = log_from_idx(idx);
+                struct printk_log *msg = log_from_idx(idx);
 
                 l -= msg_print_text(msg, prev, true, NULL, 0);
                 idx = log_next(idx);
@@ -2806,7 +2785,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
         l = 0;
         prev = 0;
         while (seq < dumper->next_seq) {
-                struct log *msg = log_from_idx(idx);
+                struct printk_log *msg = log_from_idx(idx);
 
                 l += msg_print_text(msg, prev, syslog, buf + l, size - l);
                 idx = log_next(idx);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index bb456f44b7b1..9565645e3202 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -851,7 +851,7 @@ void task_numa_fault(int node, int pages, bool migrated)
 {
         struct task_struct *p = current;
 
-        if (!sched_feat_numa(NUMA))
+        if (!numabalancing_enabled)
                 return;
 
         /* FIXME: Allocate task-specific structure for placement policy here */
@@ -5786,7 +5786,7 @@ static void task_tick_fair(struct rq *rq, struct task_struct *curr, int queued)
                 entity_tick(cfs_rq, se, queued);
         }
 
-        if (sched_feat_numa(NUMA))
+        if (numabalancing_enabled)
                 task_tick_numa(rq, curr);
 
         update_rq_runnable_avg(rq, 1);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index ac09d98490aa..07f6fc468e17 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2346,7 +2346,11 @@ static int do_proc_dointvec_ms_jiffies_conv(bool *negp, unsigned long *lvalp,
                                             int write, void *data)
 {
         if (write) {
-                *valp = msecs_to_jiffies(*negp ? -*lvalp : *lvalp);
+                unsigned long jif = msecs_to_jiffies(*negp ? -*lvalp : *lvalp);
+
+                if (jif > INT_MAX)
+                        return 1;
+                *valp = (int)jif;
         } else {
                 int val = *valp;
                 unsigned long lval;
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index e80183f4a6c4..e77edc97e036 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -827,13 +827,10 @@ void tick_nohz_irq_exit(void)
 {
         struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
 
-        if (ts->inidle) {
-                /* Cancel the timer because CPU already waken up from the C-states*/
-                menu_hrtimer_cancel();
+        if (ts->inidle)
                 __tick_nohz_idle_enter(ts);
-        } else {
+        else
                 tick_nohz_full_stop_tick(ts);
-        }
 }
 
 /**
@@ -931,8 +928,6 @@ void tick_nohz_idle_exit(void)
 
         ts->inidle = 0;
 
-        /* Cancel the timer because CPU already waken up from the C-states*/
-        menu_hrtimer_cancel();
         if (ts->idle_active || ts->tick_stopped)
                 now = ktime_get();
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 243e710c6039..a92012a71702 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1620,7 +1620,9 @@ static void __split_huge_page_refcount(struct page *page,
                                      ((1L << PG_referenced) |
                                       (1L << PG_swapbacked) |
                                       (1L << PG_mlocked) |
-                                      (1L << PG_uptodate)));
+                                      (1L << PG_uptodate) |
+                                      (1L << PG_active) |
+                                      (1L << PG_unevictable)));
                 page_tail->flags |= (1L << PG_dirty);
 
                 /* clear PageTail before overwriting first_page */
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 00a7a664b9c1..c290a1cf3862 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -6335,6 +6335,7 @@ static void mem_cgroup_css_offline(struct cgroup *cont)
         mem_cgroup_invalidate_reclaim_iterators(memcg);
         mem_cgroup_reparent_charges(memcg);
         mem_cgroup_destroy_all_caches(memcg);
+        vmpressure_cleanup(&memcg->vmpressure);
 }
 
 static void mem_cgroup_css_free(struct cgroup *cont)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 74310017296e..4baf12e534d1 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -732,7 +732,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
                 if (prev) {
                         vma = prev;
                         next = vma->vm_next;
-                        continue;
+                        if (mpol_equal(vma_policy(vma), new_pol))
+                                continue;
+                        /* vma_merge() joined vma && vma->next, case 8 */
+                        goto replace;
                 }
                 if (vma->vm_start != vmstart) {
                         err = split_vma(vma->vm_mm, vma, vmstart, 1);
@@ -744,6 +747,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
                         if (err)
                                 goto out;
                 }
+ replace:
                 err = vma_replace_policy(vma, new_pol);
                 if (err)
                         goto out;
diff --git a/mm/mmap.c b/mm/mmap.c
index fbad7b091090..1edbaa3136c3 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -865,7 +865,7 @@ again:			remove_next = 1 + (end > next->vm_end);
                 if (next->anon_vma)
                         anon_vma_merge(vma, next);
                 mm->map_count--;
-                vma_set_policy(vma, vma_policy(next));
+                mpol_put(vma_policy(next));
                 kmem_cache_free(vm_area_cachep, next);
                 /*
                  * In mprotect's case 6 (see comments on vma_merge),
diff --git a/mm/shmem.c b/mm/shmem.c
index a87990cf9f94..8335dbd3fc35 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1798,7 +1798,8 @@ static loff_t shmem_file_llseek(struct file *file, loff_t offset, int whence)
                 }
         }
 
-        offset = vfs_setpos(file, offset, MAX_LFS_FILESIZE);
+        if (offset >= 0)
+                offset = vfs_setpos(file, offset, MAX_LFS_FILESIZE);
         mutex_unlock(&inode->i_mutex);
         return offset;
 }
diff --git a/mm/swap.c b/mm/swap.c
index 4a1d0d2c52fa..62b78a6e224f 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -512,12 +512,7 @@ EXPORT_SYMBOL(__lru_cache_add);
  */
 void lru_cache_add(struct page *page)
 {
-        if (PageActive(page)) {
-                VM_BUG_ON(PageUnevictable(page));
-        } else if (PageUnevictable(page)) {
-                VM_BUG_ON(PageActive(page));
-        }
-
+        VM_BUG_ON(PageActive(page) && PageUnevictable(page));
         VM_BUG_ON(PageLRU(page));
         __lru_cache_add(page);
 }
@@ -539,6 +534,7 @@ void add_page_to_unevictable_list(struct page *page)
 
         spin_lock_irq(&zone->lru_lock);
         lruvec = mem_cgroup_page_lruvec(page, zone);
+        ClearPageActive(page);
         SetPageUnevictable(page);
         SetPageLRU(page);
         add_page_to_lru_list(page, lruvec, LRU_UNEVICTABLE);
@@ -774,8 +770,6 @@ EXPORT_SYMBOL(__pagevec_release);
 void lru_add_page_tail(struct page *page, struct page *page_tail,
                        struct lruvec *lruvec, struct list_head *list)
 {
-        int uninitialized_var(active);
-        enum lru_list lru;
         const int file = 0;
 
         VM_BUG_ON(!PageHead(page));
@@ -787,20 +781,6 @@ void lru_add_page_tail(struct page *page, struct page *page_tail,
         if (!list)
                 SetPageLRU(page_tail);
 
-        if (page_evictable(page_tail)) {
-                if (PageActive(page)) {
-                        SetPageActive(page_tail);
-                        active = 1;
-                        lru = LRU_ACTIVE_ANON;
-                } else {
-                        active = 0;
-                        lru = LRU_INACTIVE_ANON;
-                }
-        } else {
-                SetPageUnevictable(page_tail);
-                lru = LRU_UNEVICTABLE;
-        }
-
         if (likely(PageLRU(page)))
                 list_add_tail(&page_tail->lru, &page->lru);
         else if (list) {
@@ -816,13 +796,13 @@ void lru_add_page_tail(struct page *page, struct page *page_tail,
                  * Use the standard add function to put page_tail on the list,
                  * but then correct its position so they all end up in order.
                  */
-                add_page_to_lru_list(page_tail, lruvec, lru);
+                add_page_to_lru_list(page_tail, lruvec, page_lru(page_tail));
                 list_head = page_tail->lru.prev;
                 list_move_tail(&page_tail->lru, list_head);
         }
 
         if (!PageUnevictable(page))
-                update_page_reclaim_stat(lruvec, file, active);
+                update_page_reclaim_stat(lruvec, file, PageActive(page_tail));
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
@@ -833,7 +813,6 @@ static void __pagevec_lru_add_fn(struct page *page, struct lruvec *lruvec,
         int active = PageActive(page);
         enum lru_list lru = page_lru(page);
 
-        VM_BUG_ON(PageUnevictable(page));
         VM_BUG_ON(PageLRU(page));
 
         SetPageLRU(page);
diff --git a/mm/vmpressure.c b/mm/vmpressure.c
index 736a6011c2c8..0c1e37d829fa 100644
--- a/mm/vmpressure.c
+++ b/mm/vmpressure.c
@@ -180,12 +180,12 @@ static void vmpressure_work_fn(struct work_struct *work)
         if (!vmpr->scanned)
                 return;
 
-        mutex_lock(&vmpr->sr_lock);
+        spin_lock(&vmpr->sr_lock);
         scanned = vmpr->scanned;
         reclaimed = vmpr->reclaimed;
         vmpr->scanned = 0;
         vmpr->reclaimed = 0;
-        mutex_unlock(&vmpr->sr_lock);
+        spin_unlock(&vmpr->sr_lock);
 
         do {
                 if (vmpressure_event(vmpr, scanned, reclaimed))
@@ -240,13 +240,13 @@ void vmpressure(gfp_t gfp, struct mem_cgroup *memcg,
         if (!scanned)
                 return;
 
-        mutex_lock(&vmpr->sr_lock);
+        spin_lock(&vmpr->sr_lock);
         vmpr->scanned += scanned;
         vmpr->reclaimed += reclaimed;
         scanned = vmpr->scanned;
-        mutex_unlock(&vmpr->sr_lock);
+        spin_unlock(&vmpr->sr_lock);
 
-        if (scanned < vmpressure_win || work_pending(&vmpr->work))
+        if (scanned < vmpressure_win)
                 return;
         schedule_work(&vmpr->work);
 }
@@ -367,8 +367,24 @@ void vmpressure_unregister_event(struct cgroup *cg, struct cftype *cft,
  */
 void vmpressure_init(struct vmpressure *vmpr)
 {
-        mutex_init(&vmpr->sr_lock);
+        spin_lock_init(&vmpr->sr_lock);
         mutex_init(&vmpr->events_lock);
         INIT_LIST_HEAD(&vmpr->events);
         INIT_WORK(&vmpr->work, vmpressure_work_fn);
 }
+
+/**
+ * vmpressure_cleanup() - shuts down vmpressure control structure
+ * @vmpr:       Structure to be cleaned up
+ *
+ * This function should be called before the structure in which it is
+ * embedded is cleaned up.
+ */
+void vmpressure_cleanup(struct vmpressure *vmpr)
+{
+        /*
+         * Make sure there is no pending work before eventfd infrastructure
+         * goes away.
+         */
+        flush_work(&vmpr->work);
+}
diff --git a/mm/zbud.c b/mm/zbud.c
index 9bb4710e3589..ad1e781284fd 100644
--- a/mm/zbud.c
+++ b/mm/zbud.c
@@ -257,7 +257,7 @@ int zbud_alloc(struct zbud_pool *pool, int size, gfp_t gfp,
 
         if (size <= 0 || gfp & __GFP_HIGHMEM)
                 return -EINVAL;
-        if (size > PAGE_SIZE - ZHDR_SIZE_ALIGNED)
+        if (size > PAGE_SIZE - ZHDR_SIZE_ALIGNED - CHUNK_SIZE)
                 return -ENOSPC;
         chunks = size_to_chunks(size);
         spin_lock(&pool->lock);
diff --git a/net/Kconfig b/net/Kconfig
index 37702491abe9..2b406608a1a4 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -244,7 +244,7 @@ config NETPRIO_CGROUP
           Cgroup subsystem for use in assigning processes to network priorities on
           a per-interface basis
 
-config NET_LL_RX_POLL
+config NET_RX_BUSY_POLL
         boolean
         default y
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index e3a349977595..cc27297da5a9 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -513,7 +513,10 @@ static void hci_init2_req(struct hci_request *req, unsigned long opt)
 
         hci_setup_event_mask(req);
 
-        if (hdev->hci_ver > BLUETOOTH_VER_1_1)
+        /* AVM Berlin (31), aka "BlueFRITZ!", doesn't support the read
+         * local supported commands HCI command.
+         */
+        if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1)
                 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 
         if (lmp_ssp_capable(hdev)) {
@@ -2165,10 +2168,6 @@ int hci_register_dev(struct hci_dev *hdev)
 
         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
 
-        write_lock(&hci_dev_list_lock);
-        list_add(&hdev->list, &hci_dev_list);
-        write_unlock(&hci_dev_list_lock);
-
         hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
                                           WQ_MEM_RECLAIM, 1, hdev->name);
         if (!hdev->workqueue) {
@@ -2203,6 +2202,10 @@ int hci_register_dev(struct hci_dev *hdev)
         if (hdev->dev_type != HCI_AMP)
                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
 
+        write_lock(&hci_dev_list_lock);
+        list_add(&hdev->list, &hci_dev_list);
+        write_unlock(&hci_dev_list_lock);
+
         hci_notify(hdev, HCI_DEV_REG);
         hci_dev_hold(hdev);
 
@@ -2215,9 +2218,6 @@ err_wqueue:
         destroy_workqueue(hdev->req_workqueue);
 err:
         ida_simple_remove(&hci_index_ida, hdev->id);
-        write_lock(&hci_dev_list_lock);
-        list_del(&hdev->list);
-        write_unlock(&hci_dev_list_lock);
 
         return error;
 }
@@ -3399,8 +3399,16 @@ void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
          */
         if (hdev->sent_cmd) {
                 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
-                if (req_complete)
+
+                if (req_complete) {
+                        /* We must set the complete callback to NULL to
+                         * avoid calling the callback more than once if
+                         * this function gets called again.
+                         */
+                        bt_cb(hdev->sent_cmd)->req.complete = NULL;
+
                         goto call_complete;
+                }
         }
 
         /* Remove all pending commands belonging to this request */
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 2ef66781fedb..69363bd37f64 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -70,7 +70,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
 
                 mdst = br_mdb_get(br, skb, vid);
-                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb))
+                if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
+                    br_multicast_querier_exists(br))
                         br_multicast_deliver(mdst, skb);
                 else
                         br_flood_deliver(br, skb, false);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 1b8b8b824cd7..8c561c0aa636 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -101,7 +101,8 @@ int br_handle_frame_finish(struct sk_buff *skb)
                 unicast = false;
         } else if (is_multicast_ether_addr(dest)) {
                 mdst = br_mdb_get(br, skb, vid);
-                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) {
+                if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
+                    br_multicast_querier_exists(br)) {
                         if ((mdst && mdst->mglist) ||
                             br_multicast_is_router(br))
                                 skb2 = skb;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 69af490cce44..61c5e819380e 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -619,6 +619,9 @@ rehash:
         mp->br = br;
         mp->addr = *group;
 
+        setup_timer(&mp->timer, br_multicast_group_expired,
+                    (unsigned long)mp);
+
         hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
         mdb->size++;
 
@@ -1011,6 +1014,16 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
 }
 #endif
 
+static void br_multicast_update_querier_timer(struct net_bridge *br,
+                                              unsigned long max_delay)
+{
+        if (!timer_pending(&br->multicast_querier_timer))
+                br->multicast_querier_delay_time = jiffies + max_delay;
+
+        mod_timer(&br->multicast_querier_timer,
+                  jiffies + br->multicast_querier_interval);
+}
+
 /*
  * Add port to router_list
  *  list is maintained ordered by pointer value
@@ -1061,11 +1074,11 @@ timer:
 
 static void br_multicast_query_received(struct net_bridge *br,
                                         struct net_bridge_port *port,
-                                        int saddr)
+                                        int saddr,
+                                        unsigned long max_delay)
 {
         if (saddr)
-                mod_timer(&br->multicast_querier_timer,
-                          jiffies + br->multicast_querier_interval);
+                br_multicast_update_querier_timer(br, max_delay);
         else if (timer_pending(&br->multicast_querier_timer))
                 return;
 
@@ -1093,8 +1106,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
             (port && port->state == BR_STATE_DISABLED))
                 goto out;
 
-        br_multicast_query_received(br, port, !!iph->saddr);
-
         group = ih->group;
 
         if (skb->len == sizeof(*ih)) {
@@ -1118,6 +1129,8 @@ static int br_ip4_multicast_query(struct net_bridge *br,
                             IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
         }
 
+        br_multicast_query_received(br, port, !!iph->saddr, max_delay);
+
         if (!group)
                 goto out;
 
@@ -1126,7 +1139,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
         if (!mp)
                 goto out;
 
-        setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
         mod_timer(&mp->timer, now + br->multicast_membership_interval);
         mp->timer_armed = true;
 
@@ -1174,8 +1186,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
             (port && port->state == BR_STATE_DISABLED))
                 goto out;
 
-        br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr));
-
         if (skb->len == sizeof(*mld)) {
                 if (!pskb_may_pull(skb, sizeof(*mld))) {
                         err = -EINVAL;
@@ -1196,6 +1206,9 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(ntohs(mld2q->mld2q_mrc)) : 1;
         }
 
+        br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr),
+                                    max_delay);
+
         if (!group)
                 goto out;
 
@@ -1204,7 +1217,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         if (!mp)
                 goto out;
 
-        setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
         mod_timer(&mp->timer, now + br->multicast_membership_interval);
         mp->timer_armed = true;
 
@@ -1642,6 +1654,8 @@ void br_multicast_init(struct net_bridge *br)
         br->multicast_querier_interval = 255 * HZ;
         br->multicast_membership_interval = 260 * HZ;
 
+        br->multicast_querier_delay_time = 0;
+
         spin_lock_init(&br->multicast_lock);
         setup_timer(&br->multicast_router_timer,
                     br_multicast_local_router_expired, 0);
@@ -1830,6 +1844,8 @@ unlock:
 
 int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
 {
+        unsigned long max_delay;
+
         val = !!val;
 
         spin_lock_bh(&br->multicast_lock);
@@ -1837,8 +1853,14 @@ int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
                 goto unlock;
 
         br->multicast_querier = val;
-        if (val)
-                br_multicast_start_querier(br);
+        if (!val)
+                goto unlock;
+
+        max_delay = br->multicast_query_response_interval;
+        if (!timer_pending(&br->multicast_querier_timer))
+                br->multicast_querier_delay_time = jiffies + max_delay;
+
+        br_multicast_start_querier(br);
 
 unlock:
         spin_unlock_bh(&br->multicast_lock);
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 3be89b3ce17b..2f7da41851bf 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -267,6 +267,7 @@ struct net_bridge
         unsigned long                   multicast_query_interval;
         unsigned long                   multicast_query_response_interval;
         unsigned long                   multicast_startup_query_interval;
+        unsigned long                   multicast_querier_delay_time;
 
         spinlock_t                      multicast_lock;
         struct net_bridge_mdb_htable __rcu *mdb;
@@ -501,6 +502,13 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
                (br->multicast_router == 1 &&
                 timer_pending(&br->multicast_router_timer));
 }
+
+static inline bool br_multicast_querier_exists(struct net_bridge *br)
+{
+        return time_is_before_jiffies(br->multicast_querier_delay_time) &&
+               (br->multicast_querier ||
+                timer_pending(&br->multicast_querier_timer));
+}
 #else
 static inline int br_multicast_rcv(struct net_bridge *br,
                                    struct net_bridge_port *port,
@@ -557,6 +565,10 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
 {
         return 0;
 }
+static inline bool br_multicast_querier_exists(struct net_bridge *br)
+{
+        return false;
+}
 static inline void br_mdb_init(void)
 {
 }
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index b7de821f98df..9232c68941ab 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2767,6 +2767,7 @@ EXPORT_SYMBOL(neigh_app_ns);
 
 #ifdef CONFIG_SYSCTL
 static int zero;
+static int int_max = INT_MAX;
 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
 
 static int proc_unres_qlen(struct ctl_table *ctl, int write,
@@ -2819,19 +2820,25 @@ static struct neigh_sysctl_table {
                         .procname       = "mcast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_UCAST_PROBE] = {
                         .procname       = "ucast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_APP_PROBE] = {
                         .procname       = "app_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_RETRANS_TIME] = {
                         .procname       = "retrans_time",
@@ -2874,7 +2881,9 @@ static struct neigh_sysctl_table {
                         .procname       = "proxy_qlen",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_ANYCAST_DELAY] = {
                         .procname       = "anycast_delay",
@@ -2916,19 +2925,25 @@ static struct neigh_sysctl_table {
                         .procname       = "gc_thresh1",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_GC_THRESH2] = {
                         .procname       = "gc_thresh2",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_GC_THRESH3] = {
                         .procname       = "gc_thresh3",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 {},
         },
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 20e02d2605ec..2c3d0f53d198 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -309,7 +309,8 @@ EXPORT_SYMBOL(__alloc_skb);
  * @frag_size: size of fragment, or 0 if head was kmalloced
  *
  * Allocate a new &sk_buff. Caller provides space holding head and
- * skb_shared_info. @data must have been allocated by kmalloc()
+ * skb_shared_info. @data must have been allocated by kmalloc() only if
+ * @frag_size is 0, otherwise data should come from the page allocator.
  * The return is the new skb buffer.
  * On a failure the return is %NULL, and @data is not freed.
  * Notes :
@@ -739,7 +740,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 
         skb_copy_secmark(new, old);
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         new->napi_id    = old->napi_id;
 #endif
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 548d716c5f62..2c097c5a35dd 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -900,7 +900,7 @@ set_rcvbuf:
                 sock_valbool_flag(sk, SOCK_SELECT_ERR_QUEUE, valbool);
                 break;
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         case SO_BUSY_POLL:
                 /* allow unprivileged users to decrease the value */
                 if ((val > sk->sk_ll_usec) && !capable(CAP_NET_ADMIN))
@@ -1170,7 +1170,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 v.val = sock_flag(sk, SOCK_SELECT_ERR_QUEUE);
                 break;
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         case SO_BUSY_POLL:
                 v.val = sk->sk_ll_usec;
                 break;
@@ -2292,7 +2292,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
 
         sk->sk_stamp = ktime_set(-1L, 0);
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         sk->sk_napi_id          =       0;
         sk->sk_ll_usec          =       sysctl_net_busy_read;
 #endif
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 660968616637..31107abd2783 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -21,7 +21,9 @@
 #include <net/net_ratelimit.h>
 #include <net/busy_poll.h>
 
+static int zero = 0;
 static int one = 1;
+static int ushort_max = USHRT_MAX;
 
 #ifdef CONFIG_RPS
 static int rps_sock_flow_sysctl(struct ctl_table *table, int write,
@@ -298,7 +300,7 @@ static struct ctl_table net_core_table[] = {
                 .proc_handler   = flow_limit_table_len_sysctl
         },
 #endif /* CONFIG_NET_FLOW_LIMIT */
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         {
                 .procname       = "busy_poll",
                 .data           = &sysctl_net_busy_poll,
@@ -339,7 +341,9 @@ static struct ctl_table netns_core_table[] = {
                 .data           = &init_net.core.sysctl_somaxconn,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .extra1         = &zero,
+                .extra2         = &ushort_max,
+                .proc_handler   = proc_dointvec_minmax
         },
         { }
 };
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 8d48c392adcc..34ca6d5a3a4b 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -772,7 +772,7 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
                 ci = nla_data(tb[IFA_CACHEINFO]);
                 if (!ci->ifa_valid || ci->ifa_prefered > ci->ifa_valid) {
                         err = -EINVAL;
-                        goto errout;
+                        goto errout_free;
                 }
                 *pvalid_lft = ci->ifa_valid;
                 *pprefered_lft = ci->ifa_prefered;
@@ -780,6 +780,8 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
 
         return ifa;
 
+errout_free:
+        inet_free_ifa(ifa);
 errout:
         return ERR_PTR(err);
 }
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 49616fed9340..108a1e9c9eac 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2133,7 +2133,7 @@ static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat)
                 max--;
 
         pointers = 0;
-        for (i = 1; i <= max; i++)
+        for (i = 1; i < max; i++)
                 if (stat->nodesizes[i] != 0) {
                         seq_printf(seq, "  %u: %u",  i, stat->nodesizes[i]);
                         pointers += (1<<i) * stat->nodesizes[i];
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index b2c123c44d69..610e324348d1 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -36,6 +36,8 @@ static int tcp_adv_win_scale_min = -31;
 static int tcp_adv_win_scale_max = 31;
 static int ip_ttl_min = 1;
 static int ip_ttl_max = 255;
+static int tcp_syn_retries_min = 1;
+static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
 static int ip_ping_group_range_min[] = { 0, 0 };
 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
 
@@ -332,7 +334,9 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_syn_retries,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &tcp_syn_retries_min,
+                .extra2         = &tcp_syn_retries_max
         },
         {
                 .procname       = "tcp_synack_retries",
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index cfdcf7b2daf6..da4241c8c7da 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -813,8 +813,9 @@ static u32 inet6_addr_hash(const struct in6_addr *addr)
 /* On success it returns ifp with increased reference count */
 
 static struct inet6_ifaddr *
-ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
-              int scope, u32 flags)
+ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
+              const struct in6_addr *peer_addr, int pfxlen,
+              int scope, u32 flags, u32 valid_lft, u32 prefered_lft)
 {
         struct inet6_ifaddr *ifa = NULL;
         struct rt6_info *rt;
@@ -863,6 +864,8 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         }
 
         ifa->addr = *addr;
+        if (peer_addr)
+                ifa->peer_addr = *peer_addr;
 
         spin_lock_init(&ifa->lock);
         spin_lock_init(&ifa->state_lock);
@@ -872,6 +875,8 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         ifa->scope = scope;
         ifa->prefix_len = pfxlen;
         ifa->flags = flags | IFA_F_TENTATIVE;
+        ifa->valid_lft = valid_lft;
+        ifa->prefered_lft = prefered_lft;
         ifa->cstamp = ifa->tstamp = jiffies;
         ifa->tokenized = false;
 
@@ -1123,8 +1128,9 @@ retry:
 
         ift = !max_addresses ||
               ipv6_count_addresses(idev) < max_addresses ?
-                ipv6_add_addr(idev, &addr, tmp_plen, ipv6_addr_scope(&addr),
-                              addr_flags) : NULL;
+                ipv6_add_addr(idev, &addr, NULL, tmp_plen,
+                              ipv6_addr_scope(&addr), addr_flags,
+                              tmp_valid_lft, tmp_prefered_lft) : NULL;
         if (IS_ERR_OR_NULL(ift)) {
                 in6_ifa_put(ifp);
                 in6_dev_put(idev);
@@ -1136,8 +1142,6 @@ retry:
 
         spin_lock_bh(&ift->lock);
         ift->ifpub = ifp;
-        ift->valid_lft = tmp_valid_lft;
-        ift->prefered_lft = tmp_prefered_lft;
         ift->cstamp = now;
         ift->tstamp = tmp_tstamp;
         spin_unlock_bh(&ift->lock);
@@ -2179,16 +2183,19 @@ ok:
                          */
                         if (!max_addresses ||
                             ipv6_count_addresses(in6_dev) < max_addresses)
-                                ifp = ipv6_add_addr(in6_dev, &addr, pinfo->prefix_len,
+                                ifp = ipv6_add_addr(in6_dev, &addr, NULL,
+                                                    pinfo->prefix_len,
                                                     addr_type&IPV6_ADDR_SCOPE_MASK,
-                                                    addr_flags);
+                                                    addr_flags, valid_lft,
+                                                    prefered_lft);
 
                         if (IS_ERR_OR_NULL(ifp)) {
                                 in6_dev_put(in6_dev);
                                 return;
                         }
 
-                        update_lft = create = 1;
+                        update_lft = 0;
+                        create = 1;
                         ifp->cstamp = jiffies;
                         ifp->tokenized = tokenized;
                         addrconf_dad_start(ifp);
@@ -2209,7 +2216,7 @@ ok:
                                 stored_lft = ifp->valid_lft - (now - ifp->tstamp) / HZ;
                         else
                                 stored_lft = 0;
-                        if (!update_lft && stored_lft) {
+                        if (!update_lft && !create && stored_lft) {
                                 if (valid_lft > MIN_VALID_LIFETIME ||
                                     valid_lft > stored_lft)
                                         update_lft = 1;
@@ -2455,17 +2462,10 @@ static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *p
                 prefered_lft = timeout;
         }
 
-        ifp = ipv6_add_addr(idev, pfx, plen, scope, ifa_flags);
+        ifp = ipv6_add_addr(idev, pfx, peer_pfx, plen, scope, ifa_flags,
+                            valid_lft, prefered_lft);
 
         if (!IS_ERR(ifp)) {
-                spin_lock_bh(&ifp->lock);
-                ifp->valid_lft = valid_lft;
-                ifp->prefered_lft = prefered_lft;
-                ifp->tstamp = jiffies;
-                if (peer_pfx)
-                        ifp->peer_addr = *peer_pfx;
-                spin_unlock_bh(&ifp->lock);
-
                 addrconf_prefix_route(&ifp->addr, ifp->prefix_len, dev,
                                       expires, flags);
                 /*
@@ -2557,7 +2557,8 @@ static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
 {
         struct inet6_ifaddr *ifp;
 
-        ifp = ipv6_add_addr(idev, addr, plen, scope, IFA_F_PERMANENT);
+        ifp = ipv6_add_addr(idev, addr, NULL, plen,
+                            scope, IFA_F_PERMANENT, 0, 0);
         if (!IS_ERR(ifp)) {
                 spin_lock_bh(&ifp->lock);
                 ifp->flags &= ~IFA_F_TENTATIVE;
@@ -2683,7 +2684,7 @@ static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr
 #endif
 
 
-        ifp = ipv6_add_addr(idev, addr, 64, IFA_LINK, addr_flags);
+        ifp = ipv6_add_addr(idev, addr, NULL, 64, IFA_LINK, addr_flags, 0, 0);
         if (!IS_ERR(ifp)) {
                 addrconf_prefix_route(&ifp->addr, ifp->prefix_len, idev->dev, 0, 0);
                 addrconf_dad_start(ifp);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 5fc9c7a68d8d..bff3d821c7eb 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1632,27 +1632,28 @@ static int fib6_age(struct rt6_info *rt, void *arg)
 
 static DEFINE_SPINLOCK(fib6_gc_lock);
 
-void fib6_run_gc(unsigned long expires, struct net *net)
+void fib6_run_gc(unsigned long expires, struct net *net, bool force)
 {
-        if (expires != ~0UL) {
+        unsigned long now;
+
+        if (force) {
                 spin_lock_bh(&fib6_gc_lock);
-                gc_args.timeout = expires ? (int)expires :
-                        net->ipv6.sysctl.ip6_rt_gc_interval;
-        } else {
-                if (!spin_trylock_bh(&fib6_gc_lock)) {
-                        mod_timer(&net->ipv6.ip6_fib_timer, jiffies + HZ);
-                        return;
-                }
-                gc_args.timeout = net->ipv6.sysctl.ip6_rt_gc_interval;
+        } else if (!spin_trylock_bh(&fib6_gc_lock)) {
+                mod_timer(&net->ipv6.ip6_fib_timer, jiffies + HZ);
+                return;
         }
+        gc_args.timeout = expires ? (int)expires :
+                          net->ipv6.sysctl.ip6_rt_gc_interval;
 
         gc_args.more = icmp6_dst_gc();
 
         fib6_clean_all(net, fib6_age, 0, NULL);
+        now = jiffies;
+        net->ipv6.ip6_rt_last_gc = now;
 
         if (gc_args.more)
                 mod_timer(&net->ipv6.ip6_fib_timer,
-                          round_jiffies(jiffies
+                          round_jiffies(now
                                         + net->ipv6.sysctl.ip6_rt_gc_interval));
         else
                 del_timer(&net->ipv6.ip6_fib_timer);
@@ -1661,7 +1662,7 @@ void fib6_run_gc(unsigned long expires, struct net *net)
 
 static void fib6_gc_timer_cb(unsigned long arg)
 {
-        fib6_run_gc(0, (struct net *)arg);
+        fib6_run_gc(0, (struct net *)arg, true);
 }
 
 static int __net_init fib6_net_init(struct net *net)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 583e8d435f9a..03986d31fa41 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -259,10 +259,12 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
 {
         struct mr6_table *mrt, *next;
 
+        rtnl_lock();
         list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
                 list_del(&mrt->list);
                 ip6mr_free_table(mrt);
         }
+        rtnl_unlock();
         fib_rules_unregister(net->ipv6.mr6_rules_ops);
 }
 #else
@@ -289,7 +291,10 @@ static int __net_init ip6mr_rules_init(struct net *net)
 
 static void __net_exit ip6mr_rules_exit(struct net *net)
 {
+        rtnl_lock();
         ip6mr_free_table(net->ipv6.mrt6);
+        net->ipv6.mrt6 = NULL;
+        rtnl_unlock();
 }
 #endif
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 24c03396e008..79aa9652ed86 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1576,7 +1576,7 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
         switch (event) {
         case NETDEV_CHANGEADDR:
                 neigh_changeaddr(&nd_tbl, dev);
-                fib6_run_gc(~0UL, net);
+                fib6_run_gc(0, net, false);
                 idev = in6_dev_get(dev);
                 if (!idev)
                         break;
@@ -1586,7 +1586,7 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
                 break;
         case NETDEV_DOWN:
                 neigh_ifdown(&nd_tbl, dev);
-                fib6_run_gc(~0UL, net);
+                fib6_run_gc(0, net, false);
                 break;
         case NETDEV_NOTIFY_PEERS:
                 ndisc_send_unsol_na(dev);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a8c891aa2464..b70f8979003b 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1311,7 +1311,6 @@ static void icmp6_clean_all(int (*func)(struct rt6_info *rt, void *arg),
 
 static int ip6_dst_gc(struct dst_ops *ops)
 {
-        unsigned long now = jiffies;
         struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
         int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
         int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size;
@@ -1321,13 +1320,12 @@ static int ip6_dst_gc(struct dst_ops *ops)
         int entries;
 
         entries = dst_entries_get_fast(ops);
-        if (time_after(rt_last_gc + rt_min_interval, now) &&
+        if (time_after(rt_last_gc + rt_min_interval, jiffies) &&
             entries <= rt_max_size)
                 goto out;
 
         net->ipv6.ip6_rt_gc_expire++;
-        fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net);
-        net->ipv6.ip6_rt_last_gc = now;
+        fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, entries > rt_max_size);
         entries = dst_entries_get_slow(ops);
         if (entries < ops->gc_thresh)
                 net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
@@ -2827,7 +2825,7 @@ int ipv6_sysctl_rtcache_flush(struct ctl_table *ctl, int write,
         net = (struct net *)ctl->extra1;
         delay = net->ipv6.sysctl.flush_delay;
         proc_dointvec(ctl, write, buffer, lenp, ppos);
-        fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
+        fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0);
         return 0;
 }
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9da862070dd8..ab8bd2cabfa0 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2081,6 +2081,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy *
                         pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
         }
         pol->sadb_x_policy_dir = dir+1;
+        pol->sadb_x_policy_reserved = 0;
         pol->sadb_x_policy_id = xp->index;
         pol->sadb_x_policy_priority = xp->priority;
 
@@ -3137,7 +3138,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
         pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
         pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
         pol->sadb_x_policy_dir = XFRM_POLICY_OUT + 1;
+        pol->sadb_x_policy_reserved = 0;
         pol->sadb_x_policy_id = xp->index;
+        pol->sadb_x_policy_priority = xp->priority;
 
         /* Set sadb_comb's. */
         if (x->id.proto == IPPROTO_AH)
@@ -3525,6 +3528,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
         pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
         pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
         pol->sadb_x_policy_dir = dir + 1;
+        pol->sadb_x_policy_reserved = 0;
         pol->sadb_x_policy_id = 0;
         pol->sadb_x_policy_priority = 0;
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 8184d121ff09..43dd7525bfcb 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -666,6 +666,8 @@ static void ieee80211_get_et_stats(struct wiphy *wiphy,
                         if (sta->sdata->dev != dev)
                                 continue;
 
+                        sinfo.filled = 0;
+                        sta_set_sinfo(sta, &sinfo);
                         i = 0;
                         ADD_STA_STATS(sta);
                 }
diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c
index 3b7bfc01ee36..22290a929b94 100644
--- a/net/mac80211/mesh_ps.c
+++ b/net/mac80211/mesh_ps.c
@@ -229,6 +229,10 @@ void ieee80211_mps_sta_status_update(struct sta_info *sta)
         enum nl80211_mesh_power_mode pm;
         bool do_buffer;
 
+        /* For non-assoc STA, prevent buffering or frame transmission */
+        if (sta->sta_state < IEEE80211_STA_ASSOC)
+                return;
+
         /*
          * use peer-specific power mode if peering is established and the
          * peer's power mode is known
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 7fc5d0d8149a..340126204343 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -99,10 +99,13 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         }
         mutex_unlock(&local->sta_mtx);
 
-        /* remove all interfaces */
+        /* remove all interfaces that were created in the driver */
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata))
+                if (!ieee80211_sdata_running(sdata) ||
+                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+                    sdata->vif.type == NL80211_IFTYPE_MONITOR)
                         continue;
+
                 drv_remove_interface(local, sdata);
         }
 
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index ac7ef5414bde..e6512e2ffd20 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
         struct minstrel_rate *msr, *mr;
         unsigned int ndx;
         bool mrr_capable;
-        bool prev_sample = mi->prev_sample;
+        bool prev_sample;
         int delta;
         int sampling_ratio;
 
@@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
                         (mi->sample_count + mi->sample_deferred / 2);
 
         /* delta < 0: no sampling required */
+        prev_sample = mi->prev_sample;
         mi->prev_sample = false;
         if (delta < 0 || (!mrr_capable && prev_sample))
                 return;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 5b2d3012b983..f5aed963b22e 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -804,10 +804,18 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
 
         sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
         info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+        rate->count = 1;
+
+        if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
+                int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
+                rate->idx = mp->cck_rates[idx];
+                rate->flags = 0;
+                return;
+        }
+
         rate->idx = sample_idx % MCS_GROUP_RATES +
                     (sample_group->streams - 1) * MCS_GROUP_RATES;
         rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
-        rate->count = 1;
 }
 
 static void
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 23dbcfc69b3b..2c5a79bd3777 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -936,8 +936,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
 
-        /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
-        if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
+        /*
+         * Drop duplicate 802.11 retransmissions
+         * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
+         */
+        if (rx->skb->len >= 24 && rx->sta &&
+            !ieee80211_is_ctl(hdr->frame_control) &&
+            !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
+            !is_multicast_ether_addr(hdr->addr1)) {
                 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
                              rx->sta->last_seq_ctrl[rx->seqno_idx] ==
                              hdr->seq_ctrl)) {
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index c63b618cd619..4fd1ca94fd4a 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -293,6 +293,11 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
                        sizeof(exp->tuple.dst.u3) - len);
 
         exp->tuple.dst.u.all = *dst;
+
+#ifdef CONFIG_NF_NAT_NEEDED
+        memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
+        memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
+#endif
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_init);
 
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index f8b71911037a..20b15916f403 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -172,7 +172,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
 
                 /* Ignore non-transparent sockets,
                    if XT_SOCKET_TRANSPARENT is used */
-                if (info && info->flags & XT_SOCKET_TRANSPARENT)
+                if (info->flags & XT_SOCKET_TRANSPARENT)
                         transparent = ((sk->sk_state != TCP_TIME_WAIT &&
                                         inet_sk(sk)->transparent) ||
                                        (sk->sk_state == TCP_TIME_WAIT &&
@@ -196,7 +196,11 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
 static bool
 socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par)
 {
-        return socket_match(skb, par, NULL);
+        static struct xt_socket_mtinfo1 xt_info_v0 = {
+                .flags = 0,
+        };
+
+        return socket_match(skb, par, &xt_info_v0);
 }
 
 static bool
@@ -314,7 +318,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
 
                 /* Ignore non-transparent sockets,
                    if XT_SOCKET_TRANSPARENT is used */
-                if (info && info->flags & XT_SOCKET_TRANSPARENT)
+                if (info->flags & XT_SOCKET_TRANSPARENT)
                         transparent = ((sk->sk_state != TCP_TIME_WAIT &&
                                         inet_sk(sk)->transparent) ||
                                        (sk->sk_state == TCP_TIME_WAIT &&
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index c15042f987bd..a1100640495d 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -691,8 +691,8 @@ static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
 {
         struct netlbl_domhsh_walk_arg *cb_arg = arg;
 
-        if (entry->type == NETLBL_NLTYPE_CIPSOV4 &&
-            entry->type_def.cipsov4->doi == cb_arg->doi)
+        if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 &&
+            entry->def.cipso->doi == cb_arg->doi)
                 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
 
         return 0;
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index 6bb1d42f0fac..85d842e6e431 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -84,15 +84,15 @@ static void netlbl_domhsh_free_entry(struct rcu_head *entry)
 #endif /* IPv6 */
 
         ptr = container_of(entry, struct netlbl_dom_map, rcu);
-        if (ptr->type == NETLBL_NLTYPE_ADDRSELECT) {
+        if (ptr->def.type == NETLBL_NLTYPE_ADDRSELECT) {
                 netlbl_af4list_foreach_safe(iter4, tmp4,
-                                            &ptr->type_def.addrsel->list4) {
+                                            &ptr->def.addrsel->list4) {
                         netlbl_af4list_remove_entry(iter4);
                         kfree(netlbl_domhsh_addr4_entry(iter4));
                 }
 #if IS_ENABLED(CONFIG_IPV6)
                 netlbl_af6list_foreach_safe(iter6, tmp6,
-                                            &ptr->type_def.addrsel->list6) {
+                                            &ptr->def.addrsel->list6) {
                         netlbl_af6list_remove_entry(iter6);
                         kfree(netlbl_domhsh_addr6_entry(iter6));
                 }
@@ -213,21 +213,21 @@ static void netlbl_domhsh_audit_add(struct netlbl_dom_map *entry,
                 if (addr4 != NULL) {
                         struct netlbl_domaddr4_map *map4;
                         map4 = netlbl_domhsh_addr4_entry(addr4);
-                        type = map4->type;
-                        cipsov4 = map4->type_def.cipsov4;
+                        type = map4->def.type;
+                        cipsov4 = map4->def.cipso;
                         netlbl_af4list_audit_addr(audit_buf, 0, NULL,
                                                   addr4->addr, addr4->mask);
 #if IS_ENABLED(CONFIG_IPV6)
                 } else if (addr6 != NULL) {
                         struct netlbl_domaddr6_map *map6;
                         map6 = netlbl_domhsh_addr6_entry(addr6);
-                        type = map6->type;
+                        type = map6->def.type;
                         netlbl_af6list_audit_addr(audit_buf, 0, NULL,
                                                   &addr6->addr, &addr6->mask);
 #endif /* IPv6 */
                 } else {
-                        type = entry->type;
-                        cipsov4 = entry->type_def.cipsov4;
+                        type = entry->def.type;
+                        cipsov4 = entry->def.cipso;
                 }
                 switch (type) {
                 case NETLBL_NLTYPE_UNLABELED:
@@ -265,26 +265,25 @@ static int netlbl_domhsh_validate(const struct netlbl_dom_map *entry)
         if (entry == NULL)
                 return -EINVAL;
 
-        switch (entry->type) {
+        switch (entry->def.type) {
         case NETLBL_NLTYPE_UNLABELED:
-                if (entry->type_def.cipsov4 != NULL ||
-                    entry->type_def.addrsel != NULL)
+                if (entry->def.cipso != NULL || entry->def.addrsel != NULL)
                         return -EINVAL;
                 break;
         case NETLBL_NLTYPE_CIPSOV4:
-                if (entry->type_def.cipsov4 == NULL)
+                if (entry->def.cipso == NULL)
                         return -EINVAL;
                 break;
         case NETLBL_NLTYPE_ADDRSELECT:
-                netlbl_af4list_foreach(iter4, &entry->type_def.addrsel->list4) {
+                netlbl_af4list_foreach(iter4, &entry->def.addrsel->list4) {
                         map4 = netlbl_domhsh_addr4_entry(iter4);
-                        switch (map4->type) {
+                        switch (map4->def.type) {
                         case NETLBL_NLTYPE_UNLABELED:
-                                if (map4->type_def.cipsov4 != NULL)
+                                if (map4->def.cipso != NULL)
                                         return -EINVAL;
                                 break;
                         case NETLBL_NLTYPE_CIPSOV4:
-                                if (map4->type_def.cipsov4 == NULL)
+                                if (map4->def.cipso == NULL)
                                         return -EINVAL;
                                 break;
                         default:
@@ -292,9 +291,9 @@ static int netlbl_domhsh_validate(const struct netlbl_dom_map *entry)
                         }
                 }
 #if IS_ENABLED(CONFIG_IPV6)
-                netlbl_af6list_foreach(iter6, &entry->type_def.addrsel->list6) {
+                netlbl_af6list_foreach(iter6, &entry->def.addrsel->list6) {
                         map6 = netlbl_domhsh_addr6_entry(iter6);
-                        switch (map6->type) {
+                        switch (map6->def.type) {
                         case NETLBL_NLTYPE_UNLABELED:
                                 break;
                         default:
@@ -402,32 +401,31 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                         rcu_assign_pointer(netlbl_domhsh_def, entry);
                 }
 
-                if (entry->type == NETLBL_NLTYPE_ADDRSELECT) {
+                if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
                         netlbl_af4list_foreach_rcu(iter4,
-                                               &entry->type_def.addrsel->list4)
+                                                   &entry->def.addrsel->list4)
                                 netlbl_domhsh_audit_add(entry, iter4, NULL,
                                                         ret_val, audit_info);
 #if IS_ENABLED(CONFIG_IPV6)
                         netlbl_af6list_foreach_rcu(iter6,
-                                               &entry->type_def.addrsel->list6)
+                                                   &entry->def.addrsel->list6)
                                 netlbl_domhsh_audit_add(entry, NULL, iter6,
                                                         ret_val, audit_info);
 #endif /* IPv6 */
                 } else
                         netlbl_domhsh_audit_add(entry, NULL, NULL,
                                                 ret_val, audit_info);
-        } else if (entry_old->type == NETLBL_NLTYPE_ADDRSELECT &&
-                   entry->type == NETLBL_NLTYPE_ADDRSELECT) {
+        } else if (entry_old->def.type == NETLBL_NLTYPE_ADDRSELECT &&
+                   entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
                 struct list_head *old_list4;
                 struct list_head *old_list6;
 
-                old_list4 = &entry_old->type_def.addrsel->list4;
-                old_list6 = &entry_old->type_def.addrsel->list6;
+                old_list4 = &entry_old->def.addrsel->list4;
+                old_list6 = &entry_old->def.addrsel->list6;
 
                 /* we only allow the addition of address selectors if all of
                  * the selectors do not exist in the existing domain map */
-                netlbl_af4list_foreach_rcu(iter4,
-                                           &entry->type_def.addrsel->list4)
+                netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4)
                         if (netlbl_af4list_search_exact(iter4->addr,
                                                         iter4->mask,
                                                         old_list4)) {
@@ -435,8 +433,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                                 goto add_return;
                         }
 #if IS_ENABLED(CONFIG_IPV6)
-                netlbl_af6list_foreach_rcu(iter6,
-                                           &entry->type_def.addrsel->list6)
+                netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6)
                         if (netlbl_af6list_search_exact(&iter6->addr,
                                                         &iter6->mask,
                                                         old_list6)) {
@@ -446,7 +443,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
 #endif /* IPv6 */
 
                 netlbl_af4list_foreach_safe(iter4, tmp4,
-                                            &entry->type_def.addrsel->list4) {
+                                            &entry->def.addrsel->list4) {
                         netlbl_af4list_remove_entry(iter4);
                         iter4->valid = 1;
                         ret_val = netlbl_af4list_add(iter4, old_list4);
@@ -457,7 +454,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                 }
 #if IS_ENABLED(CONFIG_IPV6)
                 netlbl_af6list_foreach_safe(iter6, tmp6,
-                                            &entry->type_def.addrsel->list6) {
+                                            &entry->def.addrsel->list6) {
                         netlbl_af6list_remove_entry(iter6);
                         iter6->valid = 1;
                         ret_val = netlbl_af6list_add(iter6, old_list6);
@@ -538,18 +535,18 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
                 struct netlbl_af4list *iter4;
                 struct netlbl_domaddr4_map *map4;
 
-                switch (entry->type) {
+                switch (entry->def.type) {
                 case NETLBL_NLTYPE_ADDRSELECT:
                         netlbl_af4list_foreach_rcu(iter4,
-                                             &entry->type_def.addrsel->list4) {
+                                             &entry->def.addrsel->list4) {
                                 map4 = netlbl_domhsh_addr4_entry(iter4);
-                                cipso_v4_doi_putdef(map4->type_def.cipsov4);
+                                cipso_v4_doi_putdef(map4->def.cipso);
                         }
                         /* no need to check the IPv6 list since we currently
                          * support only unlabeled protocols for IPv6 */
                         break;
                 case NETLBL_NLTYPE_CIPSOV4:
-                        cipso_v4_doi_putdef(entry->type_def.cipsov4);
+                        cipso_v4_doi_putdef(entry->def.cipso);
                         break;
                 }
                 call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
@@ -590,20 +587,21 @@ int netlbl_domhsh_remove_af4(const char *domain,
                 entry_map = netlbl_domhsh_search(domain);
         else
                 entry_map = netlbl_domhsh_search_def(domain);
-        if (entry_map == NULL || entry_map->type != NETLBL_NLTYPE_ADDRSELECT)
+        if (entry_map == NULL ||
+            entry_map->def.type != NETLBL_NLTYPE_ADDRSELECT)
                 goto remove_af4_failure;
 
         spin_lock(&netlbl_domhsh_lock);
         entry_addr = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
-                                           &entry_map->type_def.addrsel->list4);
+                                           &entry_map->def.addrsel->list4);
         spin_unlock(&netlbl_domhsh_lock);
 
         if (entry_addr == NULL)
                 goto remove_af4_failure;
-        netlbl_af4list_foreach_rcu(iter4, &entry_map->type_def.addrsel->list4)
+        netlbl_af4list_foreach_rcu(iter4, &entry_map->def.addrsel->list4)
                 goto remove_af4_single_addr;
 #if IS_ENABLED(CONFIG_IPV6)
-        netlbl_af6list_foreach_rcu(iter6, &entry_map->type_def.addrsel->list6)
+        netlbl_af6list_foreach_rcu(iter6, &entry_map->def.addrsel->list6)
                 goto remove_af4_single_addr;
 #endif /* IPv6 */
         /* the domain mapping is empty so remove it from the mapping table */
@@ -616,7 +614,7 @@ remove_af4_single_addr:
          * shouldn't be a problem */
         synchronize_rcu();
         entry = netlbl_domhsh_addr4_entry(entry_addr);
-        cipso_v4_doi_putdef(entry->type_def.cipsov4);
+        cipso_v4_doi_putdef(entry->def.cipso);
         kfree(entry);
         return 0;
 
@@ -693,8 +691,8 @@ struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain)
  * responsible for ensuring that rcu_read_[un]lock() is called.
  *
  */
-struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
-                                                       __be32 addr)
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af4(const char *domain,
+                                                     __be32 addr)
 {
         struct netlbl_dom_map *dom_iter;
         struct netlbl_af4list *addr_iter;
@@ -702,15 +700,13 @@ struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
         dom_iter = netlbl_domhsh_search_def(domain);
         if (dom_iter == NULL)
                 return NULL;
-        if (dom_iter->type != NETLBL_NLTYPE_ADDRSELECT)
-                return NULL;
 
-        addr_iter = netlbl_af4list_search(addr,
-                                          &dom_iter->type_def.addrsel->list4);
+        if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT)
+                return &dom_iter->def;
+        addr_iter = netlbl_af4list_search(addr, &dom_iter->def.addrsel->list4);
         if (addr_iter == NULL)
                 return NULL;
-
-        return netlbl_domhsh_addr4_entry(addr_iter);
+        return &(netlbl_domhsh_addr4_entry(addr_iter)->def);
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
@@ -725,7 +721,7 @@ struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
  * responsible for ensuring that rcu_read_[un]lock() is called.
  *
  */
-struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6(const char *domain,
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af6(const char *domain,
                                                    const struct in6_addr *addr)
 {
         struct netlbl_dom_map *dom_iter;
@@ -734,15 +730,13 @@ struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6(const char *domain,
         dom_iter = netlbl_domhsh_search_def(domain);
         if (dom_iter == NULL)
                 return NULL;
-        if (dom_iter->type != NETLBL_NLTYPE_ADDRSELECT)
-                return NULL;
 
-        addr_iter = netlbl_af6list_search(addr,
-                                          &dom_iter->type_def.addrsel->list6);
+        if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT)
+                return &dom_iter->def;
+        addr_iter = netlbl_af6list_search(addr, &dom_iter->def.addrsel->list6);
         if (addr_iter == NULL)
                 return NULL;
-
-        return netlbl_domhsh_addr6_entry(addr_iter);
+        return &(netlbl_domhsh_addr6_entry(addr_iter)->def);
 }
 #endif /* IPv6 */
 
diff --git a/net/netlabel/netlabel_domainhash.h b/net/netlabel/netlabel_domainhash.h
index 90872c4ca30f..b9be0eed8980 100644
--- a/net/netlabel/netlabel_domainhash.h
+++ b/net/netlabel/netlabel_domainhash.h
@@ -43,37 +43,35 @@
 #define NETLBL_DOMHSH_BITSIZE       7
 
 /* Domain mapping definition structures */
+struct netlbl_domaddr_map {
+        struct list_head list4;
+        struct list_head list6;
+};
+struct netlbl_dommap_def {
+        u32 type;
+        union {
+                struct netlbl_domaddr_map *addrsel;
+                struct cipso_v4_doi *cipso;
+        };
+};
 #define netlbl_domhsh_addr4_entry(iter) \
         container_of(iter, struct netlbl_domaddr4_map, list)
 struct netlbl_domaddr4_map {
-        u32 type;
-        union {
-                struct cipso_v4_doi *cipsov4;
-        } type_def;
+        struct netlbl_dommap_def def;
 
         struct netlbl_af4list list;
 };
 #define netlbl_domhsh_addr6_entry(iter) \
         container_of(iter, struct netlbl_domaddr6_map, list)
 struct netlbl_domaddr6_map {
-        u32 type;
-
-        /* NOTE: no 'type_def' union needed at present since we don't currently
-         *       support any IPv6 labeling protocols */
+        struct netlbl_dommap_def def;
 
         struct netlbl_af6list list;
 };
-struct netlbl_domaddr_map {
-        struct list_head list4;
-        struct list_head list6;
-};
+
 struct netlbl_dom_map {
         char *domain;
-        u32 type;
-        union {
-                struct cipso_v4_doi *cipsov4;
-                struct netlbl_domaddr_map *addrsel;
-        } type_def;
+        struct netlbl_dommap_def def;
 
         u32 valid;
         struct list_head list;
@@ -97,16 +95,16 @@ int netlbl_domhsh_remove_af4(const char *domain,
 int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info);
 int netlbl_domhsh_remove_default(struct netlbl_audit *audit_info);
 struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain);
-struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
-                                                       __be32 addr);
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af4(const char *domain,
+                                                     __be32 addr);
+#if IS_ENABLED(CONFIG_IPV6)
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af6(const char *domain,
+                                                   const struct in6_addr *addr);
+#endif /* IPv6 */
+
 int netlbl_domhsh_walk(u32 *skip_bkt,
                      u32 *skip_chain,
                      int (*callback) (struct netlbl_dom_map *entry, void *arg),
                      void *cb_arg);
 
-#if IS_ENABLED(CONFIG_IPV6)
-struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6(const char *domain,
-                                                  const struct in6_addr *addr);
-#endif /* IPv6 */
-
 #endif
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 7c94aedd0912..96a458e12f60 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -122,7 +122,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
         }
 
         if (addr == NULL && mask == NULL)
-                entry->type = NETLBL_NLTYPE_UNLABELED;
+                entry->def.type = NETLBL_NLTYPE_UNLABELED;
         else if (addr != NULL && mask != NULL) {
                 addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                 if (addrmap == NULL)
@@ -137,7 +137,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         map4 = kzalloc(sizeof(*map4), GFP_ATOMIC);
                         if (map4 == NULL)
                                 goto cfg_unlbl_map_add_failure;
-                        map4->type = NETLBL_NLTYPE_UNLABELED;
+                        map4->def.type = NETLBL_NLTYPE_UNLABELED;
                         map4->list.addr = addr4->s_addr & mask4->s_addr;
                         map4->list.mask = mask4->s_addr;
                         map4->list.valid = 1;
@@ -154,7 +154,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
                         if (map6 == NULL)
                                 goto cfg_unlbl_map_add_failure;
-                        map6->type = NETLBL_NLTYPE_UNLABELED;
+                        map6->def.type = NETLBL_NLTYPE_UNLABELED;
                         map6->list.addr = *addr6;
                         map6->list.addr.s6_addr32[0] &= mask6->s6_addr32[0];
                         map6->list.addr.s6_addr32[1] &= mask6->s6_addr32[1];
@@ -174,8 +174,8 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         break;
                 }
 
-                entry->type_def.addrsel = addrmap;
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.addrsel = addrmap;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
         } else {
                 ret_val = -EINVAL;
                 goto cfg_unlbl_map_add_failure;
@@ -355,8 +355,8 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
         }
 
         if (addr == NULL && mask == NULL) {
-                entry->type_def.cipsov4 = doi_def;
-                entry->type = NETLBL_NLTYPE_CIPSOV4;
+                entry->def.cipso = doi_def;
+                entry->def.type = NETLBL_NLTYPE_CIPSOV4;
         } else if (addr != NULL && mask != NULL) {
                 addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                 if (addrmap == NULL)
@@ -367,8 +367,8 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
                 addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
                 if (addrinfo == NULL)
                         goto out_addrinfo;
-                addrinfo->type_def.cipsov4 = doi_def;
-                addrinfo->type = NETLBL_NLTYPE_CIPSOV4;
+                addrinfo->def.cipso = doi_def;
+                addrinfo->def.type = NETLBL_NLTYPE_CIPSOV4;
                 addrinfo->list.addr = addr->s_addr & mask->s_addr;
                 addrinfo->list.mask = mask->s_addr;
                 addrinfo->list.valid = 1;
@@ -376,8 +376,8 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
                 if (ret_val != 0)
                         goto cfg_cipsov4_map_add_failure;
 
-                entry->type_def.addrsel = addrmap;
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.addrsel = addrmap;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
         } else {
                 ret_val = -EINVAL;
                 goto out_addrmap;
@@ -657,14 +657,14 @@ int netlbl_sock_setattr(struct sock *sk,
         }
         switch (family) {
         case AF_INET:
-                switch (dom_entry->type) {
+                switch (dom_entry->def.type) {
                 case NETLBL_NLTYPE_ADDRSELECT:
                         ret_val = -EDESTADDRREQ;
                         break;
                 case NETLBL_NLTYPE_CIPSOV4:
                         ret_val = cipso_v4_sock_setattr(sk,
-                                                    dom_entry->type_def.cipsov4,
-                                                    secattr);
+                                                        dom_entry->def.cipso,
+                                                        secattr);
                         break;
                 case NETLBL_NLTYPE_UNLABELED:
                         ret_val = 0;
@@ -754,23 +754,22 @@ int netlbl_conn_setattr(struct sock *sk,
 {
         int ret_val;
         struct sockaddr_in *addr4;
-        struct netlbl_domaddr4_map *af4_entry;
+        struct netlbl_dommap_def *entry;
 
         rcu_read_lock();
         switch (addr->sa_family) {
         case AF_INET:
                 addr4 = (struct sockaddr_in *)addr;
-                af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
-                                                       addr4->sin_addr.s_addr);
-                if (af4_entry == NULL) {
+                entry = netlbl_domhsh_getentry_af4(secattr->domain,
+                                                   addr4->sin_addr.s_addr);
+                if (entry == NULL) {
                         ret_val = -ENOENT;
                         goto conn_setattr_return;
                 }
-                switch (af4_entry->type) {
+                switch (entry->type) {
                 case NETLBL_NLTYPE_CIPSOV4:
                         ret_val = cipso_v4_sock_setattr(sk,
-                                                   af4_entry->type_def.cipsov4,
-                                                   secattr);
+                                                        entry->cipso, secattr);
                         break;
                 case NETLBL_NLTYPE_UNLABELED:
                         /* just delete the protocols we support for right now
@@ -812,36 +811,21 @@ int netlbl_req_setattr(struct request_sock *req,
                        const struct netlbl_lsm_secattr *secattr)
 {
         int ret_val;
-        struct netlbl_dom_map *dom_entry;
-        struct netlbl_domaddr4_map *af4_entry;
-        u32 proto_type;
-        struct cipso_v4_doi *proto_cv4;
+        struct netlbl_dommap_def *entry;
 
         rcu_read_lock();
-        dom_entry = netlbl_domhsh_getentry(secattr->domain);
-        if (dom_entry == NULL) {
-                ret_val = -ENOENT;
-                goto req_setattr_return;
-        }
         switch (req->rsk_ops->family) {
         case AF_INET:
-                if (dom_entry->type == NETLBL_NLTYPE_ADDRSELECT) {
-                        struct inet_request_sock *req_inet = inet_rsk(req);
-                        af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
-                                                            req_inet->rmt_addr);
-                        if (af4_entry == NULL) {
-                                ret_val = -ENOENT;
-                                goto req_setattr_return;
-                        }
-                        proto_type = af4_entry->type;
-                        proto_cv4 = af4_entry->type_def.cipsov4;
-                } else {
-                        proto_type = dom_entry->type;
-                        proto_cv4 = dom_entry->type_def.cipsov4;
+                entry = netlbl_domhsh_getentry_af4(secattr->domain,
+                                                   inet_rsk(req)->rmt_addr);
+                if (entry == NULL) {
+                        ret_val = -ENOENT;
+                        goto req_setattr_return;
                 }
-                switch (proto_type) {
+                switch (entry->type) {
                 case NETLBL_NLTYPE_CIPSOV4:
-                        ret_val = cipso_v4_req_setattr(req, proto_cv4, secattr);
+                        ret_val = cipso_v4_req_setattr(req,
+                                                       entry->cipso, secattr);
                         break;
                 case NETLBL_NLTYPE_UNLABELED:
                         /* just delete the protocols we support for right now
@@ -899,23 +883,21 @@ int netlbl_skbuff_setattr(struct sk_buff *skb,
 {
         int ret_val;
         struct iphdr *hdr4;
-        struct netlbl_domaddr4_map *af4_entry;
+        struct netlbl_dommap_def *entry;
 
         rcu_read_lock();
         switch (family) {
         case AF_INET:
                 hdr4 = ip_hdr(skb);
-                af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
-                                                       hdr4->daddr);
-                if (af4_entry == NULL) {
+                entry = netlbl_domhsh_getentry_af4(secattr->domain,hdr4->daddr);
+                if (entry == NULL) {
                         ret_val = -ENOENT;
                         goto skbuff_setattr_return;
                 }
-                switch (af4_entry->type) {
+                switch (entry->type) {
                 case NETLBL_NLTYPE_CIPSOV4:
-                        ret_val = cipso_v4_skbuff_setattr(skb,
-                                                   af4_entry->type_def.cipsov4,
-                                                   secattr);
+                        ret_val = cipso_v4_skbuff_setattr(skb, entry->cipso,
+                                                          secattr);
                         break;
                 case NETLBL_NLTYPE_UNLABELED:
                         /* just delete the protocols we support for right now
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index c5384ffc6146..dd1c37d7acbc 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -104,7 +104,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                 ret_val = -ENOMEM;
                 goto add_failure;
         }
-        entry->type = nla_get_u32(info->attrs[NLBL_MGMT_A_PROTOCOL]);
+        entry->def.type = nla_get_u32(info->attrs[NLBL_MGMT_A_PROTOCOL]);
         if (info->attrs[NLBL_MGMT_A_DOMAIN]) {
                 size_t tmp_size = nla_len(info->attrs[NLBL_MGMT_A_DOMAIN]);
                 entry->domain = kmalloc(tmp_size, GFP_KERNEL);
@@ -116,12 +116,12 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                             info->attrs[NLBL_MGMT_A_DOMAIN], tmp_size);
         }
 
-        /* NOTE: internally we allow/use a entry->type value of
+        /* NOTE: internally we allow/use a entry->def.type value of
          *       NETLBL_NLTYPE_ADDRSELECT but we don't currently allow users
          *       to pass that as a protocol value because we need to know the
          *       "real" protocol */
 
-        switch (entry->type) {
+        switch (entry->def.type) {
         case NETLBL_NLTYPE_UNLABELED:
                 break;
         case NETLBL_NLTYPE_CIPSOV4:
@@ -132,7 +132,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                 cipsov4 = cipso_v4_doi_getdef(tmp_val);
                 if (cipsov4 == NULL)
                         goto add_failure;
-                entry->type_def.cipsov4 = cipsov4;
+                entry->def.cipso = cipsov4;
                 break;
         default:
                 goto add_failure;
@@ -172,9 +172,9 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                 map->list.addr = addr->s_addr & mask->s_addr;
                 map->list.mask = mask->s_addr;
                 map->list.valid = 1;
-                map->type = entry->type;
+                map->def.type = entry->def.type;
                 if (cipsov4)
-                        map->type_def.cipsov4 = cipsov4;
+                        map->def.cipso = cipsov4;
 
                 ret_val = netlbl_af4list_add(&map->list, &addrmap->list4);
                 if (ret_val != 0) {
@@ -182,8 +182,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                         goto add_failure;
                 }
 
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
-                entry->type_def.addrsel = addrmap;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.addrsel = addrmap;
 #if IS_ENABLED(CONFIG_IPV6)
         } else if (info->attrs[NLBL_MGMT_A_IPV6ADDR]) {
                 struct in6_addr *addr;
@@ -223,7 +223,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                 map->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
                 map->list.mask = *mask;
                 map->list.valid = 1;
-                map->type = entry->type;
+                map->def.type = entry->def.type;
 
                 ret_val = netlbl_af6list_add(&map->list, &addrmap->list6);
                 if (ret_val != 0) {
@@ -231,8 +231,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                         goto add_failure;
                 }
 
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
-                entry->type_def.addrsel = addrmap;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.addrsel = addrmap;
 #endif /* IPv6 */
         }
 
@@ -281,14 +281,13 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                         return ret_val;
         }
 
-        switch (entry->type) {
+        switch (entry->def.type) {
         case NETLBL_NLTYPE_ADDRSELECT:
                 nla_a = nla_nest_start(skb, NLBL_MGMT_A_SELECTORLIST);
                 if (nla_a == NULL)
                         return -ENOMEM;
 
-                netlbl_af4list_foreach_rcu(iter4,
-                                           &entry->type_def.addrsel->list4) {
+                netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) {
                         struct netlbl_domaddr4_map *map4;
                         struct in_addr addr_struct;
 
@@ -310,13 +309,13 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                                 return ret_val;
                         map4 = netlbl_domhsh_addr4_entry(iter4);
                         ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL,
-                                              map4->type);
+                                              map4->def.type);
                         if (ret_val != 0)
                                 return ret_val;
-                        switch (map4->type) {
+                        switch (map4->def.type) {
                         case NETLBL_NLTYPE_CIPSOV4:
                                 ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI,
-                                                  map4->type_def.cipsov4->doi);
+                                                      map4->def.cipso->doi);
                                 if (ret_val != 0)
                                         return ret_val;
                                 break;
@@ -325,8 +324,7 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                         nla_nest_end(skb, nla_b);
                 }
 #if IS_ENABLED(CONFIG_IPV6)
-                netlbl_af6list_foreach_rcu(iter6,
-                                           &entry->type_def.addrsel->list6) {
+                netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) {
                         struct netlbl_domaddr6_map *map6;
 
                         nla_b = nla_nest_start(skb, NLBL_MGMT_A_ADDRSELECTOR);
@@ -345,7 +343,7 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                                 return ret_val;
                         map6 = netlbl_domhsh_addr6_entry(iter6);
                         ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL,
-                                              map6->type);
+                                              map6->def.type);
                         if (ret_val != 0)
                                 return ret_val;
 
@@ -356,14 +354,14 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                 nla_nest_end(skb, nla_a);
                 break;
         case NETLBL_NLTYPE_UNLABELED:
-                ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, entry->type);
+                ret_val = nla_put_u32(skb,NLBL_MGMT_A_PROTOCOL,entry->def.type);
                 break;
         case NETLBL_NLTYPE_CIPSOV4:
-                ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, entry->type);
+                ret_val = nla_put_u32(skb,NLBL_MGMT_A_PROTOCOL,entry->def.type);
                 if (ret_val != 0)
                         return ret_val;
                 ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI,
-                                      entry->type_def.cipsov4->doi);
+                                      entry->def.cipso->doi);
                 break;
         }
 
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index af3531926ee0..8f0897407a2c 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1541,7 +1541,7 @@ int __init netlbl_unlabel_defconf(void)
         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
         if (entry == NULL)
                 return -ENOMEM;
-        entry->type = NETLBL_NLTYPE_UNLABELED;
+        entry->def.type = NETLBL_NLTYPE_UNLABELED;
         ret_val = netlbl_domhsh_add_default(entry, &audit_info);
         if (ret_val != 0)
                 return ret_val;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 2fd6dbea327a..512718adb0d5 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -571,7 +571,7 @@ static int genl_family_rcv_msg(struct genl_family *family,
             !capable(CAP_NET_ADMIN))
                 return -EPERM;
 
-        if (nlh->nlmsg_flags & NLM_F_DUMP) {
+        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
                 struct netlink_dump_control c = {
                         .dump = ops->dumpit,
                         .done = ops->done,
@@ -877,8 +877,10 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
 #ifdef CONFIG_MODULES
                 if (res == NULL) {
                         genl_unlock();
+                        up_read(&cb_lock);
                         request_module("net-pf-%d-proto-%d-family-%s",
                                        PF_NETLINK, NETLINK_GENERIC, name);
+                        down_read(&cb_lock);
                         genl_lock();
                         res = genl_family_find_byname(name);
                 }
diff --git a/net/nfc/core.c b/net/nfc/core.c
index dc96a83aa6ab..1d074dd1650f 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -44,7 +44,7 @@ DEFINE_MUTEX(nfc_devlist_mutex);
 /* NFC device ID bitmap */
 static DEFINE_IDA(nfc_index_ida);
 
-int nfc_fw_upload(struct nfc_dev *dev, const char *firmware_name)
+int nfc_fw_download(struct nfc_dev *dev, const char *firmware_name)
 {
         int rc = 0;
 
@@ -62,28 +62,28 @@ int nfc_fw_upload(struct nfc_dev *dev, const char *firmware_name)
                 goto error;
         }
 
-        if (!dev->ops->fw_upload) {
+        if (!dev->ops->fw_download) {
                 rc = -EOPNOTSUPP;
                 goto error;
         }
 
-        dev->fw_upload_in_progress = true;
-        rc = dev->ops->fw_upload(dev, firmware_name);
+        dev->fw_download_in_progress = true;
+        rc = dev->ops->fw_download(dev, firmware_name);
         if (rc)
-                dev->fw_upload_in_progress = false;
+                dev->fw_download_in_progress = false;
 
 error:
         device_unlock(&dev->dev);
         return rc;
 }
 
-int nfc_fw_upload_done(struct nfc_dev *dev, const char *firmware_name)
+int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name)
 {
-        dev->fw_upload_in_progress = false;
+        dev->fw_download_in_progress = false;
 
-        return nfc_genl_fw_upload_done(dev, firmware_name);
+        return nfc_genl_fw_download_done(dev, firmware_name);
 }
-EXPORT_SYMBOL(nfc_fw_upload_done);
+EXPORT_SYMBOL(nfc_fw_download_done);
 
 /**
  * nfc_dev_up - turn on the NFC device
@@ -110,7 +110,7 @@ int nfc_dev_up(struct nfc_dev *dev)
                 goto error;
         }
 
-        if (dev->fw_upload_in_progress) {
+        if (dev->fw_download_in_progress) {
                 rc = -EBUSY;
                 goto error;
         }
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index 7b1c186736eb..fe66908401f5 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -809,14 +809,14 @@ static void nfc_hci_recv_from_llc(struct nfc_hci_dev *hdev, struct sk_buff *skb)
         }
 }
 
-static int hci_fw_upload(struct nfc_dev *nfc_dev, const char *firmware_name)
+static int hci_fw_download(struct nfc_dev *nfc_dev, const char *firmware_name)
 {
         struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
 
-        if (!hdev->ops->fw_upload)
+        if (!hdev->ops->fw_download)
                 return -ENOTSUPP;
 
-        return hdev->ops->fw_upload(hdev, firmware_name);
+        return hdev->ops->fw_download(hdev, firmware_name);
 }
 
 static struct nfc_ops hci_nfc_ops = {
@@ -831,7 +831,7 @@ static struct nfc_ops hci_nfc_ops = {
         .im_transceive = hci_transceive,
         .tm_send = hci_tm_send,
         .check_presence = hci_check_presence,
-        .fw_upload = hci_fw_upload,
+        .fw_download = hci_fw_download,
         .discover_se = hci_discover_se,
         .enable_se = hci_enable_se,
         .disable_se = hci_disable_se,
diff --git a/net/nfc/nci/Kconfig b/net/nfc/nci/Kconfig
index 2a2416080b4f..a4f1e42e3481 100644
--- a/net/nfc/nci/Kconfig
+++ b/net/nfc/nci/Kconfig
@@ -11,6 +11,7 @@ config NFC_NCI
 
 config NFC_NCI_SPI
         depends on NFC_NCI && SPI
+        select CRC_CCITT
         bool "NCI over SPI protocol support"
         default n
         help
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index b05ad909778f..f16fd59d4160 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1089,7 +1089,7 @@ exit:
         return rc;
 }
 
-static int nfc_genl_fw_upload(struct sk_buff *skb, struct genl_info *info)
+static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info)
 {
         struct nfc_dev *dev;
         int rc;
@@ -1108,13 +1108,13 @@ static int nfc_genl_fw_upload(struct sk_buff *skb, struct genl_info *info)
         nla_strlcpy(firmware_name, info->attrs[NFC_ATTR_FIRMWARE_NAME],
                     sizeof(firmware_name));
 
-        rc = nfc_fw_upload(dev, firmware_name);
+        rc = nfc_fw_download(dev, firmware_name);
 
         nfc_put_device(dev);
         return rc;
 }
 
-int nfc_genl_fw_upload_done(struct nfc_dev *dev, const char *firmware_name)
+int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name)
 {
         struct sk_buff *msg;
         void *hdr;
@@ -1124,7 +1124,7 @@ int nfc_genl_fw_upload_done(struct nfc_dev *dev, const char *firmware_name)
                 return -ENOMEM;
 
         hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
-                          NFC_CMD_FW_UPLOAD);
+                          NFC_CMD_FW_DOWNLOAD);
         if (!hdr)
                 goto free_msg;
 
@@ -1251,8 +1251,8 @@ static struct genl_ops nfc_genl_ops[] = {
                 .policy = nfc_genl_policy,
         },
         {
-                .cmd = NFC_CMD_FW_UPLOAD,
-                .doit = nfc_genl_fw_upload,
+                .cmd = NFC_CMD_FW_DOWNLOAD,
+                .doit = nfc_genl_fw_download,
                 .policy = nfc_genl_policy,
         },
         {
diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
index ee85a1fc1b24..820a7850c36a 100644
--- a/net/nfc/nfc.h
+++ b/net/nfc/nfc.h
@@ -123,10 +123,10 @@ static inline void nfc_device_iter_exit(struct class_dev_iter *iter)
         class_dev_iter_exit(iter);
 }
 
-int nfc_fw_upload(struct nfc_dev *dev, const char *firmware_name);
-int nfc_genl_fw_upload_done(struct nfc_dev *dev, const char *firmware_name);
+int nfc_fw_download(struct nfc_dev *dev, const char *firmware_name);
+int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name);
 
-int nfc_fw_upload_done(struct nfc_dev *dev, const char *firmware_name);
+int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name);
 
 int nfc_dev_up(struct nfc_dev *dev);
 
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index ca8e0a57d945..1f9c31411f19 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -605,6 +605,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
                 struct sockaddr_atmpvc pvc;
                 int state;
 
+                memset(&pvc, 0, sizeof(pvc));
                 pvc.sap_family = AF_ATMPVC;
                 pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
                 pvc.sap_addr.vpi = flow->vcc->vpi;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 71a568862557..7a42c81a19eb 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1465,6 +1465,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
         unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_wrropt opt;
 
+        memset(&opt, 0, sizeof(opt));
         opt.flags = 0;
         opt.allot = cl->allot;
         opt.priority = cl->priority + 1;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index c2124ea29f45..45e751527dfc 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -100,7 +100,7 @@ struct htb_class {
         struct psched_ratecfg   ceil;
         s64                     buffer, cbuffer;/* token bucket depth/rate */
         s64                     mbuffer;        /* max wait time */
-        int                     prio;           /* these two are used only by leaves... */
+        u32                     prio;           /* these two are used only by leaves... */
         int                     quantum;        /* but stored for parent-to-leaf return */
 
         struct tcf_proto        *filter_list;   /* class attached filters */
diff --git a/net/socket.c b/net/socket.c
index 829b460acb87..b2d7c629eeb9 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -106,7 +106,7 @@
 #include <linux/atalk.h>
 #include <net/busy_poll.h>
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 unsigned int sysctl_net_busy_read __read_mostly;
 unsigned int sysctl_net_busy_poll __read_mostly;
 #endif
diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
index d304f41260f2..af7ffd447fee 100644
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -120,7 +120,7 @@ static int gssp_rpc_create(struct net *net, struct rpc_clnt **_clnt)
         if (IS_ERR(clnt)) {
                 dprintk("RPC:       failed to create AF_LOCAL gssproxy "
                                 "client (errno %ld).\n", PTR_ERR(clnt));
-                result = -PTR_ERR(clnt);
+                result = PTR_ERR(clnt);
                 *_clnt = NULL;
                 goto out;
         }
@@ -328,7 +328,6 @@ void gssp_free_upcall_data(struct gssp_upcall_data *data)
         kfree(data->in_handle.data);
         kfree(data->out_handle.data);
         kfree(data->out_token.data);
-        kfree(data->mech_oid.data);
         free_svc_cred(&data->creds);
 }
 
diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
index 357f613df7ff..3c85d1c8a028 100644
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -430,7 +430,7 @@ static int dummy_enc_nameattr_array(struct xdr_stream *xdr,
 static int dummy_dec_nameattr_array(struct xdr_stream *xdr,
                                     struct gssx_name_attr_array *naa)
 {
-        struct gssx_name_attr dummy;
+        struct gssx_name_attr dummy = { .attr = {.len = 0} };
         u32 count, i;
         __be32 *p;
 
@@ -493,12 +493,13 @@ static int gssx_enc_name(struct xdr_stream *xdr,
         return err;
 }
 
+
 static int gssx_dec_name(struct xdr_stream *xdr,
                          struct gssx_name *name)
 {
-        struct xdr_netobj dummy_netobj;
-        struct gssx_name_attr_array dummy_name_attr_array;
-        struct gssx_option_array dummy_option_array;
+        struct xdr_netobj dummy_netobj = { .len = 0 };
+        struct gssx_name_attr_array dummy_name_attr_array = { .count = 0 };
+        struct gssx_option_array dummy_option_array = { .count = 0 };
         int err;
 
         /* name->display_name */
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index d0347d148b34..09fb638bcaa4 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1180,6 +1180,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
                 gm = gss_mech_get_by_OID(&ud->mech_oid);
                 if (!gm)
                         goto out;
+                rsci.cred.cr_gss_mech = gm;
 
                 status = -EINVAL;
                 /* mech-specific data: */
@@ -1195,7 +1196,6 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
         rscp = rsc_update(cd, &rsci, rscp);
         status = 0;
 out:
-        gss_mech_put(gm);
         rsc_free(&rsci);
         if (rscp)
                 cache_put(&rscp->h, cd);
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 305374d4fb98..7762b9f8a8b7 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1193,7 +1193,9 @@ static int svc_tcp_has_wspace(struct svc_xprt *xprt)
         if (test_bit(XPT_LISTENER, &xprt->xpt_flags))
                 return 1;
         required = atomic_read(&xprt->xpt_reserved) + serv->sv_max_mesg;
-        if (sk_stream_wspace(svsk->sk_sk) >= required)
+        if (sk_stream_wspace(svsk->sk_sk) >= required ||
+            (sk_stream_min_wspace(svsk->sk_sk) == 0 &&
+             atomic_read(&xprt->xpt_reserved) == 0))
                 return 1;
         set_bit(SOCK_NOSPACE, &svsk->sk_sock->flags);
         return 0;
diff --git a/net/tipc/server.c b/net/tipc/server.c
index 19da5abe0fa6..fd3fa57a410e 100644
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -355,8 +355,12 @@ static int tipc_open_listening_sock(struct tipc_server *s)
                 return PTR_ERR(con);
 
         sock = tipc_create_listen_sock(con);
-        if (!sock)
+        if (!sock) {
+                idr_remove(&s->conn_idr, con->conid);
+                s->idr_in_use--;
+                kfree(con);
                 return -EINVAL;
+        }
 
         tipc_register_callbacks(sock, con);
         return 0;
@@ -563,9 +567,14 @@ int tipc_server_start(struct tipc_server *s)
                 kmem_cache_destroy(s->rcvbuf_cache);
                 return ret;
         }
+        ret = tipc_open_listening_sock(s);
+        if (ret < 0) {
+                tipc_work_stop(s);
+                kmem_cache_destroy(s->rcvbuf_cache);
+                return ret;
+        }
         s->enabled = 1;
-
-        return tipc_open_listening_sock(s);
+        return ret;
 }
 
 void tipc_server_stop(struct tipc_server *s)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 1cc47aca7f05..25d217d90807 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4770,9 +4770,9 @@ do {									    \
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
                                   mask, NL80211_MESHCONF_FORWARDING,
                                   nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
-                                  nla_get_u32);
+                                  nla_get_s32);
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
                                   mask, NL80211_MESHCONF_HT_OPMODE,
                                   nla_get_u16);
@@ -6613,12 +6613,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
 
 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
 {
+        struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
         void *hdr = ((void **)skb->cb)[1];
         struct nlattr *data = ((void **)skb->cb)[2];
 
         nla_nest_end(skb, data);
         genlmsg_end(skb, hdr);
-        genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
+                                nl80211_testmode_mcgrp.id, gfp);
 }
 EXPORT_SYMBOL(cfg80211_testmode_event);
 #endif
@@ -10064,7 +10066,8 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
         return;
 
  nla_put_failure:
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 5a24c986f34b..de06d5d1287f 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2247,10 +2247,13 @@ int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env)
 
 void wiphy_regulatory_register(struct wiphy *wiphy)
 {
+        struct regulatory_request *lr;
+
         if (!reg_dev_ignore_cell_hint(wiphy))
                 reg_num_devs_support_basehint++;
 
-        wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
+        lr = get_last_request();
+        wiphy_update_regulatory(wiphy, lr->initiator);
 }
 
 void wiphy_regulatory_deregister(struct wiphy *wiphy)
@@ -2279,7 +2282,9 @@ void wiphy_regulatory_deregister(struct wiphy *wiphy)
 static void reg_timeout_work(struct work_struct *work)
 {
         REG_DBG_PRINT("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
+        rtnl_lock();
         restore_regulatory_settings(true);
+        rtnl_unlock();
 }
 
 int __init regulatory_init(void)
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 1d3cfb1a3f28..81c8a10d743c 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -34,8 +34,10 @@ struct cfg80211_conn {
                 CFG80211_CONN_SCAN_AGAIN,
                 CFG80211_CONN_AUTHENTICATE_NEXT,
                 CFG80211_CONN_AUTHENTICATING,
+                CFG80211_CONN_AUTH_FAILED,
                 CFG80211_CONN_ASSOCIATE_NEXT,
                 CFG80211_CONN_ASSOCIATING,
+                CFG80211_CONN_ASSOC_FAILED,
                 CFG80211_CONN_DEAUTH,
                 CFG80211_CONN_CONNECTED,
         } state;
@@ -164,6 +166,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                           NULL, 0,
                                           params->key, params->key_len,
                                           params->key_idx, NULL, 0);
+        case CFG80211_CONN_AUTH_FAILED:
+                return -ENOTCONN;
         case CFG80211_CONN_ASSOCIATE_NEXT:
                 BUG_ON(!rdev->ops->assoc);
                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
@@ -188,10 +192,17 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                              WLAN_REASON_DEAUTH_LEAVING,
                                              false);
                 return err;
+        case CFG80211_CONN_ASSOC_FAILED:
+                cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+                                     NULL, 0,
+                                     WLAN_REASON_DEAUTH_LEAVING, false);
+                return -ENOTCONN;
         case CFG80211_CONN_DEAUTH:
                 cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
                                      NULL, 0,
                                      WLAN_REASON_DEAUTH_LEAVING, false);
+                /* free directly, disconnected event already sent */
+                cfg80211_sme_free(wdev);
                 return 0;
         default:
                 return 0;
@@ -371,7 +382,7 @@ bool cfg80211_sme_rx_assoc_resp(struct wireless_dev *wdev, u16 status)
                 return true;
         }
 
-        wdev->conn->state = CFG80211_CONN_DEAUTH;
+        wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
         schedule_work(&rdev->conn_work);
         return false;
 }
@@ -383,7 +394,13 @@ void cfg80211_sme_deauth(struct wireless_dev *wdev)
 
 void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
 {
-        cfg80211_sme_free(wdev);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+
+        if (!wdev->conn)
+                return;
+
+        wdev->conn->state = CFG80211_CONN_AUTH_FAILED;
+        schedule_work(&rdev->conn_work);
 }
 
 void cfg80211_sme_disassoc(struct wireless_dev *wdev)
@@ -399,7 +416,13 @@ void cfg80211_sme_disassoc(struct wireless_dev *wdev)
 
 void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
 {
-        cfg80211_sme_disassoc(wdev);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+
+        if (!wdev->conn)
+                return;
+
+        wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
+        schedule_work(&rdev->conn_work);
 }
 
 static int cfg80211_sme_connect(struct wireless_dev *wdev,
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 99db892d7299..98969541cbcc 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -743,7 +743,7 @@ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
         mutex_lock(&stream->device->lock);
         switch (_IOC_NR(cmd)) {
         case _IOC_NR(SNDRV_COMPRESS_IOCTL_VERSION):
-                put_user(SNDRV_COMPRESS_VERSION,
+                retval = put_user(SNDRV_COMPRESS_VERSION,
                                 (int __user *)arg) ? -EFAULT : 0;
                 break;
         case _IOC_NR(SNDRV_COMPRESS_GET_CAPS):
diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c
index 7c11d46b84d3..48a9d004d6d9 100644
--- a/sound/pci/hda/hda_auto_parser.c
+++ b/sound/pci/hda/hda_auto_parser.c
@@ -860,7 +860,7 @@ void snd_hda_pick_fixup(struct hda_codec *codec,
                 }
         }
         if (id < 0 && quirk) {
-                for (q = quirk; q->subvendor; q++) {
+                for (q = quirk; q->subvendor || q->subdevice; q++) {
                         unsigned int vendorid =
                                 q->subdevice | (q->subvendor << 16);
                         unsigned int mask = 0xffff0000 | q->subdevice_mask;
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 92b9b4324372..6d1924c19abf 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -2819,6 +2819,7 @@ static const struct hda_pintbl ecs202_pin_configs[] = {
 
 /* codec SSIDs for Intel Mac sharing the same PCI SSID 8384:7680 */
 static const struct snd_pci_quirk stac922x_intel_mac_fixup_tbl[] = {
+        SND_PCI_QUIRK(0x0000, 0x0100, "Mac Mini", STAC_INTEL_MAC_V3),
         SND_PCI_QUIRK(0x106b, 0x0800, "Mac", STAC_INTEL_MAC_V1),
         SND_PCI_QUIRK(0x106b, 0x0600, "Mac", STAC_INTEL_MAC_V2),
         SND_PCI_QUIRK(0x106b, 0x0700, "Mac", STAC_INTEL_MAC_V2),
diff --git a/sound/soc/au1x/ac97c.c b/sound/soc/au1x/ac97c.c
index d6f7694fcad4..c8a2de103c5f 100644
--- a/sound/soc/au1x/ac97c.c
+++ b/sound/soc/au1x/ac97c.c
@@ -341,7 +341,7 @@ static struct platform_driver au1xac97c_driver = {
         .remove         = au1xac97c_drvremove,
 };
 
-module_platform_driver(&au1xac97c_driver);
+module_platform_driver(au1xac97c_driver);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Au1000/1500/1100 AC97C ASoC driver");
diff --git a/sound/soc/blackfin/bf5xx-ac97.c b/sound/soc/blackfin/bf5xx-ac97.c
index efb1daecd0dd..e82eb373a731 100644
--- a/sound/soc/blackfin/bf5xx-ac97.c
+++ b/sound/soc/blackfin/bf5xx-ac97.c
@@ -294,11 +294,12 @@ static int asoc_bfin_ac97_probe(struct platform_device *pdev)
         /* Request PB3 as reset pin */
         ret = devm_gpio_request_one(&pdev->dev,
                                     CONFIG_SND_BF5XX_RESET_GPIO_NUM,
-                                    GPIOF_OUT_INIT_HIGH, "SND_AD198x RESET") {
+                                    GPIOF_OUT_INIT_HIGH, "SND_AD198x RESET");
+        if (ret) {
                 dev_err(&pdev->dev,
                         "Failed to request GPIO_%d for reset: %d\n",
                         CONFIG_SND_BF5XX_RESET_GPIO_NUM, ret);
-                goto gpio_err;
+                return ret;
         }
 #endif
 
diff --git a/sound/soc/blackfin/bf5xx-ac97.h b/sound/soc/blackfin/bf5xx-ac97.h
index 15c635e33f4d..0c3e22d90a8d 100644
--- a/sound/soc/blackfin/bf5xx-ac97.h
+++ b/sound/soc/blackfin/bf5xx-ac97.h
@@ -9,7 +9,6 @@
 #ifndef _BF5XX_AC97_H
 #define _BF5XX_AC97_H
 
-extern struct snd_ac97_bus_ops bf5xx_ac97_ops;
 extern struct snd_ac97 *ac97;
 /* Frame format in memory, only support stereo currently */
 struct ac97_frame {
diff --git a/sound/soc/codecs/wm0010.c b/sound/soc/codecs/wm0010.c
index f5e835662cdc..10adc4145d46 100644
--- a/sound/soc/codecs/wm0010.c
+++ b/sound/soc/codecs/wm0010.c
@@ -410,6 +410,16 @@ static int wm0010_firmware_load(const char *name, struct snd_soc_codec *codec)
                         rec->command, rec->length);
                 len = rec->length + 8;
 
+                xfer = kzalloc(sizeof(*xfer), GFP_KERNEL);
+                if (!xfer) {
+                        dev_err(codec->dev, "Failed to allocate xfer\n");
+                        ret = -ENOMEM;
+                        goto abort;
+                }
+
+                xfer->codec = codec;
+                list_add_tail(&xfer->list, &xfer_list);
+
                 out = kzalloc(len, GFP_KERNEL);
                 if (!out) {
                         dev_err(codec->dev,
@@ -417,6 +427,7 @@ static int wm0010_firmware_load(const char *name, struct snd_soc_codec *codec)
                         ret = -ENOMEM;
                         goto abort1;
                 }
+                xfer->t.rx_buf = out;
 
                 img = kzalloc(len, GFP_KERNEL);
                 if (!img) {
@@ -425,24 +436,13 @@ static int wm0010_firmware_load(const char *name, struct snd_soc_codec *codec)
                         ret = -ENOMEM;
                         goto abort1;
                 }
+                xfer->t.tx_buf = img;
 
                 byte_swap_64((u64 *)&rec->command, img, len);
 
-                xfer = kzalloc(sizeof(*xfer), GFP_KERNEL);
-                if (!xfer) {
-                        dev_err(codec->dev, "Failed to allocate xfer\n");
-                        ret = -ENOMEM;
-                        goto abort1;
-                }
-
-                xfer->codec = codec;
-                list_add_tail(&xfer->list, &xfer_list);
-
                 spi_message_init(&xfer->m);
                 xfer->m.complete = wm0010_boot_xfer_complete;
                 xfer->m.context = xfer;
-                xfer->t.tx_buf = img;
-                xfer->t.rx_buf = out;
                 xfer->t.len = len;
                 xfer->t.bits_per_word = 8;
 
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index b94190820e8c..bd16010441cc 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2733,7 +2733,7 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol,
         }
 
         mutex_unlock(&card->dapm_mutex);
-        return 0;
+        return change;
 }
 EXPORT_SYMBOL_GPL(snd_soc_dapm_put_volsw);
 
@@ -2861,7 +2861,6 @@ int snd_soc_dapm_put_enum_virt(struct snd_kcontrol *kcontrol,
         struct soc_enum *e =
                 (struct soc_enum *)kcontrol->private_value;
         int change;
-        int ret = 0;
         int wi;
 
         if (ucontrol->value.enumerated.item[0] >= e->max)
@@ -2881,7 +2880,7 @@ int snd_soc_dapm_put_enum_virt(struct snd_kcontrol *kcontrol,
         }
 
         mutex_unlock(&card->dapm_mutex);
-        return ret;
+        return change;
 }
 EXPORT_SYMBOL_GPL(snd_soc_dapm_put_enum_virt);