186 files changed, 3275 insertions, 1042 deletions
diff --git a/Documentation/device-mapper/dm-raid.txt b/Documentation/device-mapper/dm-raid.txt
index 56fb62b09fc5..b428556197c9 100644
--- a/Documentation/device-mapper/dm-raid.txt
+++ b/Documentation/device-mapper/dm-raid.txt
@@ -30,6 +30,7 @@ The target is named "raid" and it accepts the following parameters:
  raid10        Various RAID10 inspired algorithms chosen by additional params
                - RAID10: Striped Mirrors (aka 'Striping on top of mirrors')
                - RAID1E: Integrated Adjacent Stripe Mirroring
+                - RAID1E: Integrated Offset Stripe Mirroring
                -  and other similar RAID10 variants
  Reference: Chapter 4 of
@@ -64,15 +65,15 @@ The target is named "raid" and it accepts the following parameters:
                synchronisation state for each region.
        [raid10_copies   <# copies>]
-        [raid10_format   near]
+        [raid10_format   <near|far|offset>]
                These two options are used to alter the default layout of
                a RAID10 configuration.  The number of copies is can be
-                specified, but the default is 2.  There are other variations
+                specified, but the default is 2.  There are also three
-                to how the copies are laid down - the default and only current
+                variations to how the copies are laid down - the default
-                option is "near".  Near copies are what most people think of
+                is "near".  Near copies are what most people think of with
-                with respect to mirroring.  If these options are left
+                respect to mirroring.  If these options are left unspecified,
-                unspecified, or 'raid10_copies 2' and/or 'raid10_format near'
+                or 'raid10_copies 2' and/or 'raid10_format near' are given,
-                are given, then the layouts for 2, 3 and 4 devices are:
+                then the layouts for 2, 3 and 4 devices are:
                2 drives         3 drives          4 drives
                --------         ----------        --------------
                A1  A1           A1  A1  A2        A1  A1  A2  A2
@@ -85,6 +86,33 @@ The target is named "raid" and it accepts the following parameters:
                3-device layout is what might be called a 'RAID1E - Integrated
                Adjacent Stripe Mirroring'.
+                If 'raid10_copies 2' and 'raid10_format far', then the layouts
+                for 2, 3 and 4 devices are:
+                2 drives             3 drives             4 drives
+                --------             --------------       --------------------
+                A1  A2               A1   A2   A3         A1   A2   A3   A4
+                A3  A4               A4   A5   A6         A5   A6   A7   A8
+                A5  A6               A7   A8   A9         A9   A10  A11  A12
+                ..  ..               ..   ..   ..         ..   ..   ..   ..
+                A2  A1               A3   A1   A2         A2   A1   A4   A3
+                A4  A3               A6   A4   A5         A6   A5   A8   A7
+                A6  A5               A9   A7   A8         A10  A9   A12  A11
+                ..  ..               ..   ..   ..         ..   ..   ..   ..
+                If 'raid10_copies 2' and 'raid10_format offset', then the
+                layouts for 2, 3 and 4 devices are:
+                2 drives       3 drives           4 drives
+                --------       ------------       -----------------
+                A1  A2         A1  A2  A3         A1  A2  A3  A4
+                A2  A1         A3  A1  A2         A2  A1  A4  A3
+                A3  A4         A4  A5  A6         A5  A6  A7  A8
+                A4  A3         A6  A4  A5         A6  A5  A8  A7
+                A5  A6         A7  A8  A9         A9  A10 A11 A12
+                A6  A5         A9  A7  A8         A10 A9  A12 A11
+                ..  ..         ..  ..  ..         ..  ..  ..  ..
+                Here we see layouts closely akin to 'RAID1E - Integrated
+                Offset Stripe Mirroring'.
 <#raid_devs>: The number of devices composing the array.
        Each device consists of two entries.  The first is the device
        containing the metadata (if any); the second is the one containing the
@@ -142,3 +170,5 @@ Version History
 1.3.0   Added support for RAID 10
 1.3.1   Allow device replacement/rebuild for RAID 10
 1.3.2   Fix/improve redundancy checking for RAID10
+1.4.0   Non-functional change.  Removes arg from mapping function.
+1.4.1   Add RAID10 "far" and "offset" algorithm support.
diff --git a/Documentation/hwmon/adm1275 b/Documentation/hwmon/adm1275
index 2cfa25667123..15b4a20d5062 100644
--- a/Documentation/hwmon/adm1275
+++ b/Documentation/hwmon/adm1275
@@ -15,7 +15,7 @@ Supported chips:
    Addresses scanned: -
    Datasheet: www.analog.com/static/imported-files/data_sheets/ADM1276.pdf
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/hwmon/adt7410 b/Documentation/hwmon/adt7410
index 96004000dc2a..58150c480e56 100644
--- a/Documentation/hwmon/adt7410
+++ b/Documentation/hwmon/adt7410
@@ -4,9 +4,14 @@ Kernel driver adt7410
 Supported chips:
  * Analog Devices ADT7410
    Prefix: 'adt7410'
-    Addresses scanned: I2C 0x48 - 0x4B
+    Addresses scanned: None
    Datasheet: Publicly available at the Analog Devices website
               http://www.analog.com/static/imported-files/data_sheets/ADT7410.pdf
+  * Analog Devices ADT7420
+    Prefix: 'adt7420'
+    Addresses scanned: None
+    Datasheet: Publicly available at the Analog Devices website
+               http://www.analog.com/static/imported-files/data_sheets/ADT7420.pdf
 Author: Hartmut Knaack <knaack.h@gmx.de>
@@ -27,6 +32,10 @@ value per second or even justget one sample on demand for power saving.
 Besides, it can completely power down its ADC, if power management is
 required.
+The ADT7420 is register compatible, the only differences being the package,
+a slightly narrower operating temperature range (-40°C to +150°C), and a
+better accuracy (0.25°C instead of 0.50°C.)
 Configuration Notes
 -------------------
diff --git a/Documentation/hwmon/jc42 b/Documentation/hwmon/jc42
index 165077121238..868d74d6b773 100644
--- a/Documentation/hwmon/jc42
+++ b/Documentation/hwmon/jc42
@@ -49,7 +49,7 @@ Supported chips:
    Addresses scanned: I2C 0x18 - 0x1f
 Author:
-        Guenter Roeck <guenter.roeck@ericsson.com>
+        Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/hwmon/lineage-pem b/Documentation/hwmon/lineage-pem
index 2ba5ed126858..83b2ddc160c8 100644
--- a/Documentation/hwmon/lineage-pem
+++ b/Documentation/hwmon/lineage-pem
@@ -8,7 +8,7 @@ Supported devices:
    Documentation:
        http://www.lineagepower.com/oem/pdf/CPLI2C.pdf
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/hwmon/lm25066 b/Documentation/hwmon/lm25066
index a21db81c4591..26025e419d35 100644
--- a/Documentation/hwmon/lm25066
+++ b/Documentation/hwmon/lm25066
@@ -19,7 +19,7 @@ Supported chips:
    Datasheet:
        http://www.national.com/pf/LM/LM5066.html
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/hwmon/ltc2978 b/Documentation/hwmon/ltc2978
index c365f9beb5dd..e4d75c606c97 100644
--- a/Documentation/hwmon/ltc2978
+++ b/Documentation/hwmon/ltc2978
@@ -5,13 +5,13 @@ Supported chips:
  * Linear Technology LTC2978
    Prefix: 'ltc2978'
    Addresses scanned: -
-    Datasheet: http://cds.linear.com/docs/Datasheet/2978fa.pdf
+    Datasheet: http://www.linear.com/product/ltc2978
  * Linear Technology LTC3880
    Prefix: 'ltc3880'
    Addresses scanned: -
-    Datasheet: http://cds.linear.com/docs/Datasheet/3880f.pdf
+    Datasheet: http://www.linear.com/product/ltc3880
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/hwmon/ltc4261 b/Documentation/hwmon/ltc4261
index eba2e2c4b94d..9378a75c6134 100644
--- a/Documentation/hwmon/ltc4261
+++ b/Documentation/hwmon/ltc4261
@@ -8,7 +8,7 @@ Supported chips:
    Datasheet:
        http://cds.linear.com/docs/Datasheet/42612fb.pdf
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/hwmon/max16064 b/Documentation/hwmon/max16064
index f8b478076f6d..d59cc7829bec 100644
--- a/Documentation/hwmon/max16064
+++ b/Documentation/hwmon/max16064
@@ -7,7 +7,7 @@ Supported chips:
    Addresses scanned: -
    Datasheet: http://datasheets.maxim-ic.com/en/ds/MAX16064.pdf
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/hwmon/max16065 b/Documentation/hwmon/max16065
index c11f64a1f2ad..208a29e43010 100644
--- a/Documentation/hwmon/max16065
+++ b/Documentation/hwmon/max16065
@@ -24,7 +24,7 @@ Supported chips:
        http://datasheets.maxim-ic.com/en/ds/MAX16070-MAX16071.pdf
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/hwmon/max34440 b/Documentation/hwmon/max34440
index 47651ff341ae..37cbf472a19d 100644
--- a/Documentation/hwmon/max34440
+++ b/Documentation/hwmon/max34440
@@ -27,7 +27,7 @@ Supported chips:
    Addresses scanned: -
    Datasheet: http://datasheets.maximintegrated.com/en/ds/MAX34461.pdf
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/hwmon/max8688 b/Documentation/hwmon/max8688
index fe849871df32..e78078638b91 100644
--- a/Documentation/hwmon/max8688
+++ b/Documentation/hwmon/max8688
@@ -7,7 +7,7 @@ Supported chips:
    Addresses scanned: -
    Datasheet: http://datasheets.maxim-ic.com/en/ds/MAX8688.pdf
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/hwmon/pmbus b/Documentation/hwmon/pmbus
index 3d3a0f97f966..cf756ed48ff9 100644
--- a/Documentation/hwmon/pmbus
+++ b/Documentation/hwmon/pmbus
@@ -34,7 +34,7 @@ Supported chips:
    Addresses scanned: -
    Datasheet: n.a.
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/hwmon/smm665 b/Documentation/hwmon/smm665
index 59e316140542..a341eeedab75 100644
--- a/Documentation/hwmon/smm665
+++ b/Documentation/hwmon/smm665
@@ -29,7 +29,7 @@ Supported chips:
      http://www.summitmicro.com/prod_select/summary/SMM766/SMM766_2086.pdf
      http://www.summitmicro.com/prod_select/summary/SMM766B/SMM766B_2122.pdf
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Module Parameters
diff --git a/Documentation/hwmon/ucd9000 b/Documentation/hwmon/ucd9000
index 0df5f276505b..805e33edb978 100644
--- a/Documentation/hwmon/ucd9000
+++ b/Documentation/hwmon/ucd9000
@@ -11,7 +11,7 @@ Supported chips:
        http://focus.ti.com/lit/ds/symlink/ucd9090.pdf
        http://focus.ti.com/lit/ds/symlink/ucd90910.pdf
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/hwmon/ucd9200 b/Documentation/hwmon/ucd9200
index fd7d07b1908a..1e8060e631bd 100644
--- a/Documentation/hwmon/ucd9200
+++ b/Documentation/hwmon/ucd9200
@@ -15,7 +15,7 @@ Supported chips:
        http://focus.ti.com/lit/ds/symlink/ucd9246.pdf
        http://focus.ti.com/lit/ds/symlink/ucd9248.pdf
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/hwmon/zl6100 b/Documentation/hwmon/zl6100
index 3d924b6b59e9..756b57c6b73e 100644
--- a/Documentation/hwmon/zl6100
+++ b/Documentation/hwmon/zl6100
@@ -54,7 +54,7 @@ http://archive.ericsson.net/service/internet/picov/get?DocNo=28701-EN/LZT146401
 http://archive.ericsson.net/service/internet/picov/get?DocNo=28701-EN/LZT146256
-Author: Guenter Roeck <guenter.roeck@ericsson.com>
+Author: Guenter Roeck <linux@roeck-us.net>
 Description
diff --git a/Documentation/power/opp.txt b/Documentation/power/opp.txt
index 3035d00757ad..425c51d56aef 100644
--- a/Documentation/power/opp.txt
+++ b/Documentation/power/opp.txt
@@ -1,6 +1,5 @@
-*=============*
+Operating Performance Points (OPP) Library
-* OPP Library *
+==========================================
-*=============*
 (C) 2009-2010 Nishanth Menon <nm@ti.com>, Texas Instruments Incorporated
@@ -16,15 +15,31 @@ Contents
 1. Introduction
 ===============
+1.1 What is an Operating Performance Point (OPP)?
 Complex SoCs of today consists of a multiple sub-modules working in conjunction.
 In an operational system executing varied use cases, not all modules in the SoC
 need to function at their highest performing frequency all the time. To
 facilitate this, sub-modules in a SoC are grouped into domains, allowing some
-domains to run at lower voltage and frequency while other domains are loaded
+domains to run at lower voltage and frequency while other domains run at
-more. The set of discrete tuples consisting of frequency and voltage pairs that
+voltage/frequency pairs that are higher.
+The set of discrete tuples consisting of frequency and voltage pairs that
 the device will support per domain are called Operating Performance Points or
 OPPs.
+As an example:
+Let us consider an MPU device which supports the following:
+{300MHz at minimum voltage of 1V}, {800MHz at minimum voltage of 1.2V},
+{1GHz at minimum voltage of 1.3V}
+We can represent these as three OPPs as the following {Hz, uV} tuples:
+{300000000, 1000000}
+{800000000, 1200000}
+{1000000000, 1300000}
+1.2 Operating Performance Points Library
 OPP library provides a set of helper functions to organize and query the OPP
 information. The library is located in drivers/base/power/opp.c and the header
 is located in include/linux/opp.h. OPP library can be enabled by enabling
diff --git a/MAINTAINERS b/MAINTAINERS
index e95b1e944eb7..95616582c728 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -114,12 +114,6 @@ Maintainers List (try to look for most precise areas first)
                -----------------------------------
-3C505 NETWORK DRIVER
-M:      Philip Blundell <philb@gnu.org>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/ethernet/i825xx/3c505*
 3C59X NETWORK DRIVER
 M:      Steffen Klassert <klassert@mathematik.tu-chemnitz.de>
 L:      netdev@vger.kernel.org
@@ -2361,12 +2355,6 @@ W:	http://www.arm.linux.org.uk/
 S:      Maintained
 F:      drivers/video/cyber2000fb.*
-CYCLADES 2X SYNC CARD DRIVER
-M:      Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
-W:      http://oops.ghostprotocols.net:81/blog
-S:      Maintained
-F:      drivers/net/wan/cycx*
 CYCLADES ASYNC MUX DRIVER
 W:      http://www.cyclades.com/
 S:      Orphan
@@ -3067,12 +3055,6 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kristoffer/linux-hpc.git
 F:      drivers/video/s1d13xxxfb.c
 F:      include/video/s1d13xxxfb.h
-ETHEREXPRESS-16 NETWORK DRIVER
-M:      Philip Blundell <philb@gnu.org>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/ethernet/i825xx/eexpress.*
 ETHERNET BRIDGE
 M:      Stephen Hemminger <stephen@networkplumber.org>
 L:      bridge@lists.linux-foundation.org
diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
index 5cad8a6dadb0..afed28e37ea5 100644
--- a/arch/arm/boot/compressed/Makefile
+++ b/arch/arm/boot/compressed/Makefile
@@ -120,7 +120,7 @@ ORIG_CFLAGS := $(KBUILD_CFLAGS)
 KBUILD_CFLAGS = $(subst -pg, , $(ORIG_CFLAGS))
 endif
-ccflags-y := -fpic -fno-builtin -I$(obj)
+ccflags-y := -fpic -mno-single-pic-base -fno-builtin -I$(obj)
 asflags-y := -Wa,-march=all -DZIMAGE
 # Supply kernel BSS size to the decompressor via a linker symbol.
diff --git a/arch/arm/include/asm/mmu.h b/arch/arm/include/asm/mmu.h
index 9f77e7804f3b..e3d55547e755 100644
--- a/arch/arm/include/asm/mmu.h
+++ b/arch/arm/include/asm/mmu.h
@@ -5,15 +5,15 @@
 typedef struct {
 #ifdef CONFIG_CPU_HAS_ASID
-        u64 id;
+        atomic64_t      id;
 #endif
-        unsigned int vmalloc_seq;
+        unsigned int    vmalloc_seq;
 } mm_context_t;
 #ifdef CONFIG_CPU_HAS_ASID
 #define ASID_BITS       8
 #define ASID_MASK       ((~0ULL) << ASID_BITS)
-#define ASID(mm)        ((mm)->context.id & ~ASID_MASK)
+#define ASID(mm)        ((mm)->context.id.counter & ~ASID_MASK)
 #else
 #define ASID(mm)        (0)
 #endif
@@ -26,7 +26,7 @@ typedef struct {
 *  modified for 2.6 by Hyok S. Choi <hyok.choi@samsung.com>
 */
 typedef struct {
-        unsigned long           end_brk;
+        unsigned long   end_brk;
 } mm_context_t;
 #endif
diff --git a/arch/arm/include/asm/mmu_context.h b/arch/arm/include/asm/mmu_context.h
index e1f644bc7cc5..863a6611323c 100644
--- a/arch/arm/include/asm/mmu_context.h
+++ b/arch/arm/include/asm/mmu_context.h
@@ -25,7 +25,7 @@ void __check_vmalloc_seq(struct mm_struct *mm);
 #ifdef CONFIG_CPU_HAS_ASID
 void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk);
-#define init_new_context(tsk,mm)        ({ mm->context.id = 0; })
+#define init_new_context(tsk,mm)        ({ atomic64_set(&mm->context.id, 0); 0; })
 #else   /* !CONFIG_CPU_HAS_ASID */
diff --git a/arch/arm/include/asm/tlbflush.h b/arch/arm/include/asm/tlbflush.h
index 6e924d3a77eb..4db8c8820f0d 100644
--- a/arch/arm/include/asm/tlbflush.h
+++ b/arch/arm/include/asm/tlbflush.h
@@ -34,10 +34,13 @@
 #define TLB_V6_D_ASID   (1 << 17)
 #define TLB_V6_I_ASID   (1 << 18)
+#define TLB_V6_BP       (1 << 19)
 /* Unified Inner Shareable TLB operations (ARMv7 MP extensions) */
-#define TLB_V7_UIS_PAGE (1 << 19)
+#define TLB_V7_UIS_PAGE (1 << 20)
-#define TLB_V7_UIS_FULL (1 << 20)
+#define TLB_V7_UIS_FULL (1 << 21)
-#define TLB_V7_UIS_ASID (1 << 21)
+#define TLB_V7_UIS_ASID (1 << 22)
+#define TLB_V7_UIS_BP   (1 << 23)
 #define TLB_BARRIER     (1 << 28)
 #define TLB_L2CLEAN_FR  (1 << 29)               /* Feroceon */
@@ -150,7 +153,8 @@
 #define v6wbi_tlb_flags (TLB_WB | TLB_DCLEAN | TLB_BARRIER | \
                         TLB_V6_I_FULL | TLB_V6_D_FULL | \
                         TLB_V6_I_PAGE | TLB_V6_D_PAGE | \
-                         TLB_V6_I_ASID | TLB_V6_D_ASID)
+                         TLB_V6_I_ASID | TLB_V6_D_ASID | \
+                         TLB_V6_BP)
 #ifdef CONFIG_CPU_TLB_V6
 # define v6wbi_possible_flags   v6wbi_tlb_flags
@@ -166,9 +170,11 @@
 #endif
 #define v7wbi_tlb_flags_smp     (TLB_WB | TLB_DCLEAN | TLB_BARRIER | \
-                         TLB_V7_UIS_FULL | TLB_V7_UIS_PAGE | TLB_V7_UIS_ASID)
+                                 TLB_V7_UIS_FULL | TLB_V7_UIS_PAGE | \
+                                 TLB_V7_UIS_ASID | TLB_V7_UIS_BP)
 #define v7wbi_tlb_flags_up      (TLB_WB | TLB_DCLEAN | TLB_BARRIER | \
-                         TLB_V6_U_FULL | TLB_V6_U_PAGE | TLB_V6_U_ASID)
+                                 TLB_V6_U_FULL | TLB_V6_U_PAGE | \
+                                 TLB_V6_U_ASID | TLB_V6_BP)
 #ifdef CONFIG_CPU_TLB_V7
@@ -430,6 +436,20 @@ static inline void local_flush_tlb_kernel_page(unsigned long kaddr)
        }
 }
+static inline void local_flush_bp_all(void)
+{
+        const int zero = 0;
+        const unsigned int __tlb_flag = __cpu_tlb_flags;
+        if (tlb_flag(TLB_V7_UIS_BP))
+                asm("mcr p15, 0, %0, c7, c1, 6" : : "r" (zero));
+        else if (tlb_flag(TLB_V6_BP))
+                asm("mcr p15, 0, %0, c7, c5, 6" : : "r" (zero));
+        if (tlb_flag(TLB_BARRIER))
+                isb();
+}
 /*
 *      flush_pmd_entry
 *
@@ -480,6 +500,7 @@ static inline void clean_pmd_entry(void *pmd)
 #define flush_tlb_kernel_page   local_flush_tlb_kernel_page
 #define flush_tlb_range         local_flush_tlb_range
 #define flush_tlb_kernel_range  local_flush_tlb_kernel_range
+#define flush_bp_all            local_flush_bp_all
 #else
 extern void flush_tlb_all(void);
 extern void flush_tlb_mm(struct mm_struct *mm);
@@ -487,6 +508,7 @@ extern void flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr);
 extern void flush_tlb_kernel_page(unsigned long kaddr);
 extern void flush_tlb_range(struct vm_area_struct *vma, unsigned long start, unsigned long end);
 extern void flush_tlb_kernel_range(unsigned long start, unsigned long end);
+extern void flush_bp_all(void);
 #endif
 /*
diff --git a/arch/arm/include/uapi/asm/unistd.h b/arch/arm/include/uapi/asm/unistd.h
index 4da7cde70b5d..af33b44990ed 100644
--- a/arch/arm/include/uapi/asm/unistd.h
+++ b/arch/arm/include/uapi/asm/unistd.h
@@ -404,7 +404,7 @@
 #define __NR_setns                      (__NR_SYSCALL_BASE+375)
 #define __NR_process_vm_readv           (__NR_SYSCALL_BASE+376)
 #define __NR_process_vm_writev          (__NR_SYSCALL_BASE+377)
-                                        /* 378 for kcmp */
+#define __NR_kcmp                       (__NR_SYSCALL_BASE+378)
 #define __NR_finit_module               (__NR_SYSCALL_BASE+379)
 /*
diff --git a/arch/arm/kernel/asm-offsets.c b/arch/arm/kernel/asm-offsets.c
index 5ce738b43508..923eec7105cf 100644
--- a/arch/arm/kernel/asm-offsets.c
+++ b/arch/arm/kernel/asm-offsets.c
@@ -110,7 +110,7 @@ int main(void)
  BLANK();
 #endif
 #ifdef CONFIG_CPU_HAS_ASID
-  DEFINE(MM_CONTEXT_ID,         offsetof(struct mm_struct, context.id));
+  DEFINE(MM_CONTEXT_ID,         offsetof(struct mm_struct, context.id.counter));
  BLANK();
 #endif
  DEFINE(VMA_VM_MM,             offsetof(struct vm_area_struct, vm_mm));
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index 0cc57611fc4f..c6ca7e376773 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -387,7 +387,7 @@
 /* 375 */       CALL(sys_setns)
                CALL(sys_process_vm_readv)
                CALL(sys_process_vm_writev)
-                CALL(sys_ni_syscall)    /* reserved for sys_kcmp */
+                CALL(sys_kcmp)
                CALL(sys_finit_module)
 #ifndef syscalls_counted
 .equ syscalls_padding, ((NR_syscalls + 3) & ~3) - NR_syscalls
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 486a15ae9011..e0eb9a1cae77 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -184,13 +184,22 @@ __create_page_tables:
        orr     r3, r3, #3                      @ PGD block type
        mov     r6, #4                          @ PTRS_PER_PGD
        mov     r7, #1 << (55 - 32)             @ L_PGD_SWAPPER
-1:      str     r3, [r0], #4                    @ set bottom PGD entry bits
+1:
+#ifdef CONFIG_CPU_ENDIAN_BE8
        str     r7, [r0], #4                    @ set top PGD entry bits
+        str     r3, [r0], #4                    @ set bottom PGD entry bits
+#else
+        str     r3, [r0], #4                    @ set bottom PGD entry bits
+        str     r7, [r0], #4                    @ set top PGD entry bits
+#endif
        add     r3, r3, #0x1000                 @ next PMD table
        subs    r6, r6, #1
        bne     1b
        add     r4, r4, #0x1000                 @ point to the PMD tables
+#ifdef CONFIG_CPU_ENDIAN_BE8
+        add     r4, r4, #4                      @ we only write the bottom word
+#endif
 #endif
        ldr     r7, [r10, #PROCINFO_MM_MMUFLAGS] @ mm_mmuflags
@@ -258,6 +267,11 @@ __create_page_tables:
        addne   r6, r6, #1 << SECTION_SHIFT
        strne   r6, [r3]
+#if defined(CONFIG_LPAE) && defined(CONFIG_CPU_ENDIAN_BE8)
+        sub     r4, r4, #4                      @ Fixup page table pointer
+                                                @ for 64-bit descriptors
+#endif
 #ifdef CONFIG_DEBUG_LL
 #if !defined(CONFIG_DEBUG_ICEDCC) && !defined(CONFIG_DEBUG_SEMIHOSTING)
        /*
@@ -276,13 +290,17 @@ __create_page_tables:
        orr     r3, r7, r3, lsl #SECTION_SHIFT
 #ifdef CONFIG_ARM_LPAE
        mov     r7, #1 << (54 - 32)             @ XN
+#ifdef CONFIG_CPU_ENDIAN_BE8
+        str     r7, [r0], #4
+        str     r3, [r0], #4
 #else
-        orr     r3, r3, #PMD_SECT_XN
-#endif
        str     r3, [r0], #4
-#ifdef CONFIG_ARM_LPAE
        str     r7, [r0], #4
 #endif
+#else
+        orr     r3, r3, #PMD_SECT_XN
+        str     r3, [r0], #4
+#endif
 #else /* CONFIG_DEBUG_ICEDCC || CONFIG_DEBUG_SEMIHOSTING */
        /* we don't need any serial debugging mappings */
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index 5eae53e7a2e1..96093b75ab90 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -1023,7 +1023,7 @@ out_mdbgen:
 static int __cpuinit dbg_reset_notify(struct notifier_block *self,
                                      unsigned long action, void *cpu)
 {
-        if (action == CPU_ONLINE)
+        if ((action & ~CPU_TASKS_FROZEN) == CPU_ONLINE)
                smp_call_function_single((int)cpu, reset_ctrl_regs, NULL, 1);
        return NOTIFY_OK;
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 31e0eb353cd8..146157dfe27c 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -400,7 +400,7 @@ __hw_perf_event_init(struct perf_event *event)
        }
        if (event->group_leader != event) {
-                if (validate_group(event) != 0);
+                if (validate_group(event) != 0)
                        return -EINVAL;
        }
@@ -484,7 +484,7 @@ const struct dev_pm_ops armpmu_dev_pm_ops = {
        SET_RUNTIME_PM_OPS(armpmu_runtime_suspend, armpmu_runtime_resume, NULL)
 };
-static void __init armpmu_init(struct arm_pmu *armpmu)
+static void armpmu_init(struct arm_pmu *armpmu)
 {
        atomic_set(&armpmu->active_events, 0);
        mutex_init(&armpmu->reserve_mutex);
diff --git a/arch/arm/kernel/perf_event_v7.c b/arch/arm/kernel/perf_event_v7.c
index 8c79a9e70b83..039cffb053a7 100644
--- a/arch/arm/kernel/perf_event_v7.c
+++ b/arch/arm/kernel/perf_event_v7.c
@@ -774,7 +774,7 @@ static const unsigned armv7_a7_perf_cache_map[PERF_COUNT_HW_CACHE_MAX]
 /*
 * PMXEVTYPER: Event selection reg
 */
-#define ARMV7_EVTYPE_MASK       0xc00000ff      /* Mask for writable bits */
+#define ARMV7_EVTYPE_MASK       0xc80000ff      /* Mask for writable bits */
 #define ARMV7_EVTYPE_EVENT      0xff            /* Mask for EVENT bits */
 /*
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 1bdfd87c8e41..31644f1978d5 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -285,6 +285,7 @@ asmlinkage void __cpuinit secondary_start_kernel(void)
         * switch away from it before attempting any exclusive accesses.
         */
        cpu_switch_mm(mm->pgd, mm);
+        local_flush_bp_all();
        enter_lazy_tlb(mm, current);
        local_flush_tlb_all();
diff --git a/arch/arm/kernel/smp_tlb.c b/arch/arm/kernel/smp_tlb.c
index 02c5d2ce23bf..bd0300531399 100644
--- a/arch/arm/kernel/smp_tlb.c
+++ b/arch/arm/kernel/smp_tlb.c
@@ -64,6 +64,11 @@ static inline void ipi_flush_tlb_kernel_range(void *arg)
        local_flush_tlb_kernel_range(ta->ta_start, ta->ta_end);
 }
+static inline void ipi_flush_bp_all(void *ignored)
+{
+        local_flush_bp_all();
+}
 void flush_tlb_all(void)
 {
        if (tlb_ops_need_broadcast())
@@ -127,3 +132,10 @@ void flush_tlb_kernel_range(unsigned long start, unsigned long end)
                local_flush_tlb_kernel_range(start, end);
 }
+void flush_bp_all(void)
+{
+        if (tlb_ops_need_broadcast())
+                on_each_cpu(ipi_flush_bp_all, NULL, 1);
+        else
+                local_flush_bp_all();
+}
diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
index c092115d903a..3f2565037480 100644
--- a/arch/arm/kernel/smp_twd.c
+++ b/arch/arm/kernel/smp_twd.c
@@ -22,6 +22,7 @@
 #include <linux/of_irq.h>
 #include <linux/of_address.h>
+#include <asm/smp_plat.h>
 #include <asm/smp_twd.h>
 #include <asm/localtimer.h>
@@ -373,6 +374,9 @@ void __init twd_local_timer_of_register(void)
        struct device_node *np;
        int err;
+        if (!is_smp() || !setup_max_cpus)
+                return;
        np = of_find_matching_node(NULL, twd_of_match);
        if (!np)
                return;
diff --git a/arch/arm/kernel/suspend.c b/arch/arm/kernel/suspend.c
index 358bca3a995e..c59c97ea8268 100644
--- a/arch/arm/kernel/suspend.c
+++ b/arch/arm/kernel/suspend.c
@@ -68,6 +68,7 @@ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
        ret = __cpu_suspend(arg, fn);
        if (ret == 0) {
                cpu_switch_mm(mm->pgd, mm);
+                local_flush_bp_all();
                local_flush_tlb_all();
        }
diff --git a/arch/arm/lib/memset.S b/arch/arm/lib/memset.S
index 650d5923ab83..d912e7397ecc 100644
--- a/arch/arm/lib/memset.S
+++ b/arch/arm/lib/memset.S
@@ -19,9 +19,9 @@
 1:      subs    r2, r2, #4              @ 1 do we have enough
        blt     5f                      @ 1 bytes to align with?
        cmp     r3, #2                  @ 1
-        strltb  r1, [r0], #1            @ 1
+        strltb  r1, [ip], #1            @ 1
-        strleb  r1, [r0], #1            @ 1
+        strleb  r1, [ip], #1            @ 1
-        strb    r1, [r0], #1            @ 1
+        strb    r1, [ip], #1            @ 1
        add     r2, r2, r3              @ 1 (r2 = r2 - (4 - r3))
 /*
 * The pointer is now aligned and the length is adjusted.  Try doing the
@@ -29,10 +29,14 @@
 */
 ENTRY(memset)
-        ands    r3, r0, #3              @ 1 unaligned?
+/*
+ * Preserve the contents of r0 for the return value.
+ */
+        mov     ip, r0
+        ands    r3, ip, #3              @ 1 unaligned?
        bne     1b                      @ 1
 /*
- * we know that the pointer in r0 is aligned to a word boundary.
+ * we know that the pointer in ip is aligned to a word boundary.
 */
        orr     r1, r1, r1, lsl #8
        orr     r1, r1, r1, lsl #16
@@ -43,29 +47,28 @@ ENTRY(memset)
 #if ! CALGN(1)+0
 /*
- * We need an extra register for this loop - save the return address and
+ * We need 2 extra registers for this loop - use r8 and the LR
- * use the LR
 */
-        str     lr, [sp, #-4]!
+        stmfd   sp!, {r8, lr}
-        mov     ip, r1
+        mov     r8, r1
        mov     lr, r1
 2:      subs    r2, r2, #64
-        stmgeia r0!, {r1, r3, ip, lr}   @ 64 bytes at a time.
+        stmgeia ip!, {r1, r3, r8, lr}   @ 64 bytes at a time.
-        stmgeia r0!, {r1, r3, ip, lr}
+        stmgeia ip!, {r1, r3, r8, lr}
-        stmgeia r0!, {r1, r3, ip, lr}
+        stmgeia ip!, {r1, r3, r8, lr}
-        stmgeia r0!, {r1, r3, ip, lr}
+        stmgeia ip!, {r1, r3, r8, lr}
        bgt     2b
-        ldmeqfd sp!, {pc}               @ Now <64 bytes to go.
+        ldmeqfd sp!, {r8, pc}           @ Now <64 bytes to go.
 /*
 * No need to correct the count; we're only testing bits from now on
 */
        tst     r2, #32
-        stmneia r0!, {r1, r3, ip, lr}
+        stmneia ip!, {r1, r3, r8, lr}
-        stmneia r0!, {r1, r3, ip, lr}
+        stmneia ip!, {r1, r3, r8, lr}
        tst     r2, #16
-        stmneia r0!, {r1, r3, ip, lr}
+        stmneia ip!, {r1, r3, r8, lr}
-        ldr     lr, [sp], #4
+        ldmfd   sp!, {r8, lr}
 #else
@@ -74,54 +77,54 @@ ENTRY(memset)
 * whole cache lines at once.
 */
-        stmfd   sp!, {r4-r7, lr}
+        stmfd   sp!, {r4-r8, lr}
        mov     r4, r1
        mov     r5, r1
        mov     r6, r1
        mov     r7, r1
-        mov     ip, r1
+        mov     r8, r1
        mov     lr, r1
        cmp     r2, #96
-        tstgt   r0, #31
+        tstgt   ip, #31
        ble     3f
-        and     ip, r0, #31
+        and     r8, ip, #31
-        rsb     ip, ip, #32
+        rsb     r8, r8, #32
-        sub     r2, r2, ip
+        sub     r2, r2, r8
-        movs    ip, ip, lsl #(32 - 4)
+        movs    r8, r8, lsl #(32 - 4)
-        stmcsia r0!, {r4, r5, r6, r7}
+        stmcsia ip!, {r4, r5, r6, r7}
-        stmmiia r0!, {r4, r5}
+        stmmiia ip!, {r4, r5}
-        tst     ip, #(1 << 30)
+        tst     r8, #(1 << 30)
-        mov     ip, r1
+        mov     r8, r1
-        strne   r1, [r0], #4
+        strne   r1, [ip], #4
 3:      subs    r2, r2, #64
-        stmgeia r0!, {r1, r3-r7, ip, lr}
+        stmgeia ip!, {r1, r3-r8, lr}
-        stmgeia r0!, {r1, r3-r7, ip, lr}
+        stmgeia ip!, {r1, r3-r8, lr}
        bgt     3b
-        ldmeqfd sp!, {r4-r7, pc}
+        ldmeqfd sp!, {r4-r8, pc}
        tst     r2, #32
-        stmneia r0!, {r1, r3-r7, ip, lr}
+        stmneia ip!, {r1, r3-r8, lr}
        tst     r2, #16
-        stmneia r0!, {r4-r7}
+        stmneia ip!, {r4-r7}
-        ldmfd   sp!, {r4-r7, lr}
+        ldmfd   sp!, {r4-r8, lr}
 #endif
 4:      tst     r2, #8
-        stmneia r0!, {r1, r3}
+        stmneia ip!, {r1, r3}
        tst     r2, #4
-        strne   r1, [r0], #4
+        strne   r1, [ip], #4
 /*
 * When we get here, we've got less than 4 bytes to zero.  We
 * may have an unaligned pointer as well.
 */
 5:      tst     r2, #2
-        strneb  r1, [r0], #1
+        strneb  r1, [ip], #1
-        strneb  r1, [r0], #1
+        strneb  r1, [ip], #1
        tst     r2, #1
-        strneb  r1, [r0], #1
+        strneb  r1, [ip], #1
        mov     pc, lr
 ENDPROC(memset)
diff --git a/arch/arm/mach-netx/generic.c b/arch/arm/mach-netx/generic.c
index 27c2cb7ab813..1504b68f4c66 100644
--- a/arch/arm/mach-netx/generic.c
+++ b/arch/arm/mach-netx/generic.c
@@ -168,7 +168,7 @@ void __init netx_init_irq(void)
 {
        int irq;
-        vic_init(io_p2v(NETX_PA_VIC), 0, ~0, 0);
+        vic_init(io_p2v(NETX_PA_VIC), NETX_IRQ_VIC_START, ~0, 0);
        for (irq = NETX_IRQ_HIF_CHAINED(0); irq <= NETX_IRQ_HIF_LAST; irq++) {
                irq_set_chip_and_handler(irq, &netx_hif_chip,
diff --git a/arch/arm/mach-netx/include/mach/irqs.h b/arch/arm/mach-netx/include/mach/irqs.h
index 6ce914d54a30..8f74a844a775 100644
--- a/arch/arm/mach-netx/include/mach/irqs.h
+++ b/arch/arm/mach-netx/include/mach/irqs.h
@@ -17,42 +17,42 @@
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
-#define NETX_IRQ_VIC_START   0
+#define NETX_IRQ_VIC_START      64
-#define NETX_IRQ_SOFTINT     0
+#define NETX_IRQ_SOFTINT        (NETX_IRQ_VIC_START + 0)
-#define NETX_IRQ_TIMER0      1
+#define NETX_IRQ_TIMER0         (NETX_IRQ_VIC_START + 1)
-#define NETX_IRQ_TIMER1      2
+#define NETX_IRQ_TIMER1         (NETX_IRQ_VIC_START + 2)
-#define NETX_IRQ_TIMER2      3
+#define NETX_IRQ_TIMER2         (NETX_IRQ_VIC_START + 3)
-#define NETX_IRQ_SYSTIME_NS  4
+#define NETX_IRQ_SYSTIME_NS     (NETX_IRQ_VIC_START + 4)
-#define NETX_IRQ_SYSTIME_S   5
+#define NETX_IRQ_SYSTIME_S      (NETX_IRQ_VIC_START + 5)
-#define NETX_IRQ_GPIO_15     6
+#define NETX_IRQ_GPIO_15        (NETX_IRQ_VIC_START + 6)
-#define NETX_IRQ_WATCHDOG    7
+#define NETX_IRQ_WATCHDOG       (NETX_IRQ_VIC_START + 7)
-#define NETX_IRQ_UART0       8
+#define NETX_IRQ_UART0          (NETX_IRQ_VIC_START + 8)
-#define NETX_IRQ_UART1       9
+#define NETX_IRQ_UART1          (NETX_IRQ_VIC_START + 9)
-#define NETX_IRQ_UART2      10
+#define NETX_IRQ_UART2          (NETX_IRQ_VIC_START + 10)
-#define NETX_IRQ_USB        11
+#define NETX_IRQ_USB            (NETX_IRQ_VIC_START + 11)
-#define NETX_IRQ_SPI        12
+#define NETX_IRQ_SPI            (NETX_IRQ_VIC_START + 12)
-#define NETX_IRQ_I2C        13
+#define NETX_IRQ_I2C            (NETX_IRQ_VIC_START + 13)
-#define NETX_IRQ_LCD        14
+#define NETX_IRQ_LCD            (NETX_IRQ_VIC_START + 14)
-#define NETX_IRQ_HIF        15
+#define NETX_IRQ_HIF            (NETX_IRQ_VIC_START + 15)
-#define NETX_IRQ_GPIO_0_14  16
+#define NETX_IRQ_GPIO_0_14      (NETX_IRQ_VIC_START + 16)
-#define NETX_IRQ_XPEC0      17
+#define NETX_IRQ_XPEC0          (NETX_IRQ_VIC_START + 17)
-#define NETX_IRQ_XPEC1      18
+#define NETX_IRQ_XPEC1          (NETX_IRQ_VIC_START + 18)
-#define NETX_IRQ_XPEC2      19
+#define NETX_IRQ_XPEC2          (NETX_IRQ_VIC_START + 19)
-#define NETX_IRQ_XPEC3      20
+#define NETX_IRQ_XPEC3          (NETX_IRQ_VIC_START + 20)
-#define NETX_IRQ_XPEC(no)   (17 + (no))
+#define NETX_IRQ_XPEC(no)       (NETX_IRQ_VIC_START + 17 + (no))
-#define NETX_IRQ_MSYNC0     21
+#define NETX_IRQ_MSYNC0         (NETX_IRQ_VIC_START + 21)
-#define NETX_IRQ_MSYNC1     22
+#define NETX_IRQ_MSYNC1         (NETX_IRQ_VIC_START + 22)
-#define NETX_IRQ_MSYNC2     23
+#define NETX_IRQ_MSYNC2         (NETX_IRQ_VIC_START + 23)
-#define NETX_IRQ_MSYNC3     24
+#define NETX_IRQ_MSYNC3         (NETX_IRQ_VIC_START + 24)
-#define NETX_IRQ_IRQ_PHY    25
+#define NETX_IRQ_IRQ_PHY        (NETX_IRQ_VIC_START + 25)
-#define NETX_IRQ_ISO_AREA   26
+#define NETX_IRQ_ISO_AREA       (NETX_IRQ_VIC_START + 26)
 /* int 27 is reserved */
 /* int 28 is reserved */
-#define NETX_IRQ_TIMER3     29
+#define NETX_IRQ_TIMER3         (NETX_IRQ_VIC_START + 29)
-#define NETX_IRQ_TIMER4     30
+#define NETX_IRQ_TIMER4         (NETX_IRQ_VIC_START + 30)
 /* int 31 is reserved */
-#define NETX_IRQS 32
+#define NETX_IRQS               (NETX_IRQ_VIC_START + 32)
 /* for multiplexed irqs on gpio 0..14 */
 #define NETX_IRQ_GPIO(x) (NETX_IRQS + (x))
diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
index 7a0511191f6b..a5a4b2bc42ba 100644
--- a/arch/arm/mm/context.c
+++ b/arch/arm/mm/context.c
@@ -152,9 +152,9 @@ static int is_reserved_asid(u64 asid)
        return 0;
 }
-static void new_context(struct mm_struct *mm, unsigned int cpu)
+static u64 new_context(struct mm_struct *mm, unsigned int cpu)
 {
-        u64 asid = mm->context.id;
+        u64 asid = atomic64_read(&mm->context.id);
        u64 generation = atomic64_read(&asid_generation);
        if (asid != 0 && is_reserved_asid(asid)) {
@@ -181,13 +181,14 @@ static void new_context(struct mm_struct *mm, unsigned int cpu)
                cpumask_clear(mm_cpumask(mm));
        }
-        mm->context.id = asid;
+        return asid;
 }
 void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk)
 {
        unsigned long flags;
        unsigned int cpu = smp_processor_id();
+        u64 asid;
        if (unlikely(mm->context.vmalloc_seq != init_mm.context.vmalloc_seq))
                __check_vmalloc_seq(mm);
@@ -198,20 +199,26 @@ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk)
         */
        cpu_set_reserved_ttbr0();
-        if (!((mm->context.id ^ atomic64_read(&asid_generation)) >> ASID_BITS)
+        asid = atomic64_read(&mm->context.id);
-            && atomic64_xchg(&per_cpu(active_asids, cpu), mm->context.id))
+        if (!((asid ^ atomic64_read(&asid_generation)) >> ASID_BITS)
+            && atomic64_xchg(&per_cpu(active_asids, cpu), asid))
                goto switch_mm_fastpath;
        raw_spin_lock_irqsave(&cpu_asid_lock, flags);
        /* Check that our ASID belongs to the current generation. */
-        if ((mm->context.id ^ atomic64_read(&asid_generation)) >> ASID_BITS)
+        asid = atomic64_read(&mm->context.id);
-                new_context(mm, cpu);
+        if ((asid ^ atomic64_read(&asid_generation)) >> ASID_BITS) {
+                asid = new_context(mm, cpu);
-        atomic64_set(&per_cpu(active_asids, cpu), mm->context.id);
+                atomic64_set(&mm->context.id, asid);
-        cpumask_set_cpu(cpu, mm_cpumask(mm));
+        }
-        if (cpumask_test_and_clear_cpu(cpu, &tlb_flush_pending))
+        if (cpumask_test_and_clear_cpu(cpu, &tlb_flush_pending)) {
+                local_flush_bp_all();
                local_flush_tlb_all();
+        }
+        atomic64_set(&per_cpu(active_asids, cpu), asid);
+        cpumask_set_cpu(cpu, mm_cpumask(mm));
        raw_spin_unlock_irqrestore(&cpu_asid_lock, flags);
 switch_mm_fastpath:
diff --git a/arch/arm/mm/idmap.c b/arch/arm/mm/idmap.c
index 2dffc010cc41..5ee505c937d1 100644
--- a/arch/arm/mm/idmap.c
+++ b/arch/arm/mm/idmap.c
@@ -141,6 +141,7 @@ void setup_mm_for_reboot(void)
 {
        /* Switch to the identity mapping. */
        cpu_switch_mm(idmap_pgd, &init_mm);
+        local_flush_bp_all();
 #ifdef CONFIG_CPU_HAS_ASID
        /*
diff --git a/arch/arm/mm/proc-v7-3level.S b/arch/arm/mm/proc-v7-3level.S
index 50bf1dafc9ea..6ffd78c0f9ab 100644
--- a/arch/arm/mm/proc-v7-3level.S
+++ b/arch/arm/mm/proc-v7-3level.S
@@ -48,7 +48,7 @@
 ENTRY(cpu_v7_switch_mm)
 #ifdef CONFIG_MMU
        mmid    r1, r1                          @ get mm->context.id
-        and     r3, r1, #0xff
+        asid    r3, r1
        mov     r3, r3, lsl #(48 - 32)          @ ASID
        mcrr    p15, 0, r0, r3, c2              @ set TTB 0
        isb
diff --git a/arch/powerpc/crypto/sha1-powerpc-asm.S b/arch/powerpc/crypto/sha1-powerpc-asm.S
index a5f8264d2d3c..125e16520061 100644
--- a/arch/powerpc/crypto/sha1-powerpc-asm.S
+++ b/arch/powerpc/crypto/sha1-powerpc-asm.S
@@ -113,7 +113,7 @@
        STEPUP4((t)+16, fn)
 _GLOBAL(powerpc_sha_transform)
-        PPC_STLU r1,-STACKFRAMESIZE(r1)
+        PPC_STLU r1,-INT_FRAME_SIZE(r1)
        SAVE_8GPRS(14, r1)
        SAVE_10GPRS(22, r1)
@@ -175,5 +175,5 @@ _GLOBAL(powerpc_sha_transform)
        REST_8GPRS(14, r1)
        REST_10GPRS(22, r1)
-        addi    r1,r1,STACKFRAMESIZE
+        addi    r1,r1,INT_FRAME_SIZE
        blr
diff --git a/arch/powerpc/include/asm/bitops.h b/arch/powerpc/include/asm/bitops.h
index ef918a2328bb..08bd299c75b1 100644
--- a/arch/powerpc/include/asm/bitops.h
+++ b/arch/powerpc/include/asm/bitops.h
@@ -52,8 +52,6 @@
 #define smp_mb__before_clear_bit()      smp_mb()
 #define smp_mb__after_clear_bit()       smp_mb()
-#define BITOP_LE_SWIZZLE        ((BITS_PER_LONG-1) & ~0x7)
 /* Macro for generating the ***_bits() functions */
 #define DEFINE_BITOP(fn, op, prefix, postfix)   \
 static __inline__ void fn(unsigned long mask,   \
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index e66586122030..c9c67fc888c9 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -266,7 +266,8 @@
 #define SPRN_HSRR0      0x13A   /* Hypervisor Save/Restore 0 */
 #define SPRN_HSRR1      0x13B   /* Hypervisor Save/Restore 1 */
 #define SPRN_FSCR       0x099   /* Facility Status & Control Register */
-#define FSCR_TAR        (1<<8)  /* Enable Target Adress Register */
+#define   FSCR_TAR      (1 << (63-55)) /* Enable Target Address Register */
+#define   FSCR_DSCR     (1 << (63-61)) /* Enable Data Stream Control Register */
 #define SPRN_TAR        0x32f   /* Target Address Register */
 #define SPRN_LPCR       0x13E   /* LPAR Control Register */
 #define   LPCR_VPM0     (1ul << (63-0))
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index 535b6d8a41cc..ebbec52d21bd 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -358,3 +358,4 @@ SYSCALL_SPU(setns)
 COMPAT_SYS(process_vm_readv)
 COMPAT_SYS(process_vm_writev)
 SYSCALL(finit_module)
+SYSCALL(ni_syscall) /* sys_kcmp */
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index f25b5c45c435..1487f0f12293 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -12,7 +12,7 @@
 #include <uapi/asm/unistd.h>
-#define __NR_syscalls           354
+#define __NR_syscalls           355
 #define __NR__exit __NR_exit
 #define NR_syscalls     __NR_syscalls
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index 8c478c6c6b1e..74cb4d72d673 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -376,6 +376,7 @@
 #define __NR_process_vm_readv   351
 #define __NR_process_vm_writev  352
 #define __NR_finit_module       353
+#define __NR_kcmp               354
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S
index d29facbf9a28..ea847abb0d0a 100644
--- a/arch/powerpc/kernel/cpu_setup_power.S
+++ b/arch/powerpc/kernel/cpu_setup_power.S
@@ -48,6 +48,7 @@ _GLOBAL(__restore_cpu_power7)
 _GLOBAL(__setup_cpu_power8)
        mflr    r11
+        bl      __init_FSCR
        bl      __init_hvmode_206
        mtlr    r11
        beqlr
@@ -56,13 +57,13 @@ _GLOBAL(__setup_cpu_power8)
        mfspr   r3,SPRN_LPCR
        oris    r3, r3, LPCR_AIL_3@h
        bl      __init_LPCR
-        bl      __init_FSCR
        bl      __init_TLB
        mtlr    r11
        blr
 _GLOBAL(__restore_cpu_power8)
        mflr    r11
+        bl      __init_FSCR
        mfmsr   r3
        rldicl. r0,r3,4,63
        beqlr
@@ -115,7 +116,7 @@ __init_LPCR:
 __init_FSCR:
        mfspr   r3,SPRN_FSCR
-        ori     r3,r3,FSCR_TAR
+        ori     r3,r3,FSCR_TAR|FSCR_DSCR
        mtspr   SPRN_FSCR,r3
        blr
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index a8a5361fb70c..87ef8f5ee5bc 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -74,13 +74,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_REAL_LE)				\
        mflr    r10 ;                                           \
        ld      r12,PACAKBASE(r13) ;                            \
        LOAD_HANDLER(r12, system_call_entry_direct) ;           \
-        mtlr    r12 ;                                           \
+        mtctr   r12 ;                                           \
        mfspr   r12,SPRN_SRR1 ;                                 \
        /* Re-use of r13... No spare regs to do this */ \
        li      r13,MSR_RI ;                                    \
        mtmsrd  r13,1 ;                                         \
        GET_PACA(r13) ; /* get r13 back */                      \
-        blr ;
+        bctr ;
 #else
        /* We can branch directly */
 #define SYSCALL_PSERIES_2_DIRECT                                \
diff --git a/arch/powerpc/platforms/pseries/hvcserver.c b/arch/powerpc/platforms/pseries/hvcserver.c
index fcf4b4cbeaf3..4557e91626c4 100644
--- a/arch/powerpc/platforms/pseries/hvcserver.c
+++ b/arch/powerpc/platforms/pseries/hvcserver.c
@@ -23,6 +23,7 @@
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/string.h>
 #include <asm/hvcall.h>
 #include <asm/hvcserver.h>
@@ -188,9 +189,9 @@ int hvcs_get_partner_info(uint32_t unit_address, struct list_head *head,
                        = (unsigned int)last_p_partition_ID;
                /* copy the Null-term char too */
-                strncpy(&next_partner_info->location_code[0],
+                strlcpy(&next_partner_info->location_code[0],
                        (char *)&pi_buff[2],
-                        strlen((char *)&pi_buff[2]) + 1);
+                        sizeof(next_partner_info->location_code));
                list_add_tail(&(next_partner_info->node), head);
                next_partner_info = NULL;
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index ef6f155469b5..40a84cc6740c 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -36,12 +36,11 @@ int register_acpi_bus_type(struct acpi_bus_type *type)
 {
        if (acpi_disabled)
                return -ENODEV;
-        if (type && type->bus && type->find_device) {
+        if (type && type->match && type->find_device) {
                down_write(&bus_type_sem);
                list_add_tail(&type->list, &bus_type_list);
                up_write(&bus_type_sem);
-                printk(KERN_INFO PREFIX "bus type %s registered\n",
+                printk(KERN_INFO PREFIX "bus type %s registered\n", type->name);
-                       type->bus->name);
                return 0;
        }
        return -ENODEV;
@@ -56,24 +55,21 @@ int unregister_acpi_bus_type(struct acpi_bus_type *type)
                down_write(&bus_type_sem);
                list_del_init(&type->list);
                up_write(&bus_type_sem);
-                printk(KERN_INFO PREFIX "ACPI bus type %s unregistered\n",
+                printk(KERN_INFO PREFIX "bus type %s unregistered\n",
-                       type->bus->name);
+                       type->name);
                return 0;
        }
        return -ENODEV;
 }
 EXPORT_SYMBOL_GPL(unregister_acpi_bus_type);
-static struct acpi_bus_type *acpi_get_bus_type(struct bus_type *type)
+static struct acpi_bus_type *acpi_get_bus_type(struct device *dev)
 {
        struct acpi_bus_type *tmp, *ret = NULL;
-        if (!type)
-                return NULL;
        down_read(&bus_type_sem);
        list_for_each_entry(tmp, &bus_type_list, list) {
-                if (tmp->bus == type) {
+                if (tmp->match(dev)) {
                        ret = tmp;
                        break;
                }
@@ -82,22 +78,6 @@ static struct acpi_bus_type *acpi_get_bus_type(struct bus_type *type)
        return ret;
 }
-static int acpi_find_bridge_device(struct device *dev, acpi_handle * handle)
-{
-        struct acpi_bus_type *tmp;
-        int ret = -ENODEV;
-        down_read(&bus_type_sem);
-        list_for_each_entry(tmp, &bus_type_list, list) {
-                if (tmp->find_bridge && !tmp->find_bridge(dev, handle)) {
-                        ret = 0;
-                        break;
-                }
-        }
-        up_read(&bus_type_sem);
-        return ret;
-}
 static acpi_status do_acpi_find_child(acpi_handle handle, u32 lvl_not_used,
                                      void *addr_p, void **ret_p)
 {
@@ -261,29 +241,12 @@ err:
 static int acpi_platform_notify(struct device *dev)
 {
-        struct acpi_bus_type *type;
+        struct acpi_bus_type *type = acpi_get_bus_type(dev);
        acpi_handle handle;
        int ret;
        ret = acpi_bind_one(dev, NULL);
-        if (ret && (!dev->bus || !dev->parent)) {
+        if (ret && type) {
-                /* bridge devices genernally haven't bus or parent */
-                ret = acpi_find_bridge_device(dev, &handle);
-                if (!ret) {
-                        ret = acpi_bind_one(dev, handle);
-                        if (ret)
-                                goto out;
-                }
-        }
-        type = acpi_get_bus_type(dev->bus);
-        if (ret) {
-                if (!type || !type->find_device) {
-                        DBG("No ACPI bus support for %s\n", dev_name(dev));
-                        ret = -EINVAL;
-                        goto out;
-                }
                ret = type->find_device(dev, &handle);
                if (ret) {
                        DBG("Unable to get handle for %s\n", dev_name(dev));
@@ -316,7 +279,7 @@ static int acpi_platform_notify_remove(struct device *dev)
 {
        struct acpi_bus_type *type;
-        type = acpi_get_bus_type(dev->bus);
+        type = acpi_get_bus_type(dev);
        if (type && type->cleanup)
                type->cleanup(dev);
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index eff722278ff5..164d49569aeb 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -158,8 +158,7 @@ static int map_mat_entry(acpi_handle handle, int type, u32 acpi_id)
        }
 exit:
-        if (buffer.pointer)
+        kfree(buffer.pointer);
-                kfree(buffer.pointer);
        return apic_id;
 }
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index df34bd04ae62..bec717ffd25f 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -559,7 +559,7 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device)
                return 0;
 #endif
-        BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
+        BUG_ON(pr->id >= nr_cpu_ids);
        /*
         * Buggy BIOS check
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 6d3a06a629a1..24213033fbae 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -599,7 +599,6 @@ static void acpi_sleep_suspend_setup(void)
                status = acpi_get_sleep_type_data(i, &type_a, &type_b);
                if (ACPI_SUCCESS(status)) {
                        sleep_states[i] = 1;
-                        pr_cont(" S%d", i);
                }
        }
@@ -742,7 +741,6 @@ static void acpi_sleep_hibernate_setup(void)
        hibernation_set_ops(old_suspend_ordering ?
                        &acpi_hibernation_ops_old : &acpi_hibernation_ops);
        sleep_states[ACPI_STATE_S4] = 1;
-        pr_cont(KERN_CONT " S4");
        if (nosigcheck)
                return;
@@ -788,6 +786,9 @@ int __init acpi_sleep_init(void)
 {
        acpi_status status;
        u8 type_a, type_b;
+        char supported[ACPI_S_STATE_COUNT * 3 + 1];
+        char *pos = supported;
+        int i;
        if (acpi_disabled)
                return 0;
@@ -795,7 +796,6 @@ int __init acpi_sleep_init(void)
        acpi_sleep_dmi_check();
        sleep_states[ACPI_STATE_S0] = 1;
-        pr_info(PREFIX "(supports S0");
        acpi_sleep_suspend_setup();
        acpi_sleep_hibernate_setup();
@@ -803,11 +803,17 @@ int __init acpi_sleep_init(void)
        status = acpi_get_sleep_type_data(ACPI_STATE_S5, &type_a, &type_b);
        if (ACPI_SUCCESS(status)) {
                sleep_states[ACPI_STATE_S5] = 1;
-                pr_cont(" S5");
                pm_power_off_prepare = acpi_power_off_prepare;
                pm_power_off = acpi_power_off;
        }
-        pr_cont(")\n");
+        supported[0] = 0;
+        for (i = 0; i < ACPI_S_STATE_COUNT; i++) {
+                if (sleep_states[i])
+                        pos += sprintf(pos, " S%d", i);
+        }
+        pr_info(PREFIX "(supports%s)\n", supported);
        /*
         * Register the tts_notifier to reboot notifier list so that the _TTS
         * object can also be evaluated when the system enters S5.
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index 0ea1018280bd..beea3115577e 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -1144,13 +1144,8 @@ static int ata_acpi_find_device(struct device *dev, acpi_handle *handle)
                return -ENODEV;
 }
-static int ata_acpi_find_dummy(struct device *dev, acpi_handle *handle)
-{
-        return -ENODEV;
-}
 static struct acpi_bus_type ata_acpi_bus = {
-        .find_bridge = ata_acpi_find_dummy,
+        .name = "ATA",
        .find_device = ata_acpi_find_device,
 };
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 2b7f77d3fcb0..15beb500a4e4 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -99,7 +99,6 @@ void device_pm_add(struct device *dev)
                dev_warn(dev, "parent %s should not be sleeping\n",
                        dev_name(dev->parent));
        list_add_tail(&dev->power.entry, &dpm_list);
-        dev_pm_qos_constraints_init(dev);
        mutex_unlock(&dpm_list_mtx);
 }
@@ -113,7 +112,6 @@ void device_pm_remove(struct device *dev)
                 dev->bus ? dev->bus->name : "No Bus", dev_name(dev));
        complete_all(&dev->power.completion);
        mutex_lock(&dpm_list_mtx);
-        dev_pm_qos_constraints_destroy(dev);
        list_del_init(&dev->power.entry);
        mutex_unlock(&dpm_list_mtx);
        device_wakeup_disable(dev);
diff --git a/drivers/base/power/power.h b/drivers/base/power/power.h
index b16686a0a5a2..cfc3226ec492 100644
--- a/drivers/base/power/power.h
+++ b/drivers/base/power/power.h
@@ -4,7 +4,7 @@ static inline void device_pm_init_common(struct device *dev)
 {
        if (!dev->power.early_init) {
                spin_lock_init(&dev->power.lock);
-                dev->power.power_state = PMSG_INVALID;
+                dev->power.qos = NULL;
                dev->power.early_init = true;
        }
 }
@@ -56,14 +56,10 @@ extern void device_pm_move_last(struct device *);
 static inline void device_pm_sleep_init(struct device *dev) {}
-static inline void device_pm_add(struct device *dev)
+static inline void device_pm_add(struct device *dev) {}
-{
-        dev_pm_qos_constraints_init(dev);
-}
 static inline void device_pm_remove(struct device *dev)
 {
-        dev_pm_qos_constraints_destroy(dev);
        pm_runtime_remove(dev);
 }
diff --git a/drivers/base/power/qos.c b/drivers/base/power/qos.c
index 3d4d1f8aac5c..5f74587ef258 100644
--- a/drivers/base/power/qos.c
+++ b/drivers/base/power/qos.c
@@ -41,6 +41,7 @@
 #include <linux/mutex.h>
 #include <linux/export.h>
 #include <linux/pm_runtime.h>
+#include <linux/err.h>
 #include "power.h"
@@ -61,7 +62,7 @@ enum pm_qos_flags_status __dev_pm_qos_flags(struct device *dev, s32 mask)
        struct pm_qos_flags *pqf;
        s32 val;
-        if (!qos)
+        if (IS_ERR_OR_NULL(qos))
                return PM_QOS_FLAGS_UNDEFINED;
        pqf = &qos->flags;
@@ -101,7 +102,8 @@ EXPORT_SYMBOL_GPL(dev_pm_qos_flags);
 */
 s32 __dev_pm_qos_read_value(struct device *dev)
 {
-        return dev->power.qos ? pm_qos_read_value(&dev->power.qos->latency) : 0;
+        return IS_ERR_OR_NULL(dev->power.qos) ?
+                0 : pm_qos_read_value(&dev->power.qos->latency);
 }
 /**
@@ -198,20 +200,8 @@ static int dev_pm_qos_constraints_allocate(struct device *dev)
        return 0;
 }
-/**
+static void __dev_pm_qos_hide_latency_limit(struct device *dev);
- * dev_pm_qos_constraints_init - Initalize device's PM QoS constraints pointer.
+static void __dev_pm_qos_hide_flags(struct device *dev);
- * @dev: target device
- *
- * Called from the device PM subsystem during device insertion under
- * device_pm_lock().
- */
-void dev_pm_qos_constraints_init(struct device *dev)
-{
-        mutex_lock(&dev_pm_qos_mtx);
-        dev->power.qos = NULL;
-        dev->power.power_state = PMSG_ON;
-        mutex_unlock(&dev_pm_qos_mtx);
-}
 /**
 * dev_pm_qos_constraints_destroy
@@ -226,16 +216,15 @@ void dev_pm_qos_constraints_destroy(struct device *dev)
        struct pm_qos_constraints *c;
        struct pm_qos_flags *f;
+        mutex_lock(&dev_pm_qos_mtx);
        /*
         * If the device's PM QoS resume latency limit or PM QoS flags have been
         * exposed to user space, they have to be hidden at this point.
         */
-        dev_pm_qos_hide_latency_limit(dev);
+        __dev_pm_qos_hide_latency_limit(dev);
-        dev_pm_qos_hide_flags(dev);
+        __dev_pm_qos_hide_flags(dev);
-        mutex_lock(&dev_pm_qos_mtx);
-        dev->power.power_state = PMSG_INVALID;
        qos = dev->power.qos;
        if (!qos)
                goto out;
@@ -257,7 +246,7 @@ void dev_pm_qos_constraints_destroy(struct device *dev)
        }
        spin_lock_irq(&dev->power.lock);
-        dev->power.qos = NULL;
+        dev->power.qos = ERR_PTR(-ENODEV);
        spin_unlock_irq(&dev->power.lock);
        kfree(c->notifiers);
@@ -301,32 +290,19 @@ int dev_pm_qos_add_request(struct device *dev, struct dev_pm_qos_request *req,
                 "%s() called for already added request\n", __func__))
                return -EINVAL;
-        req->dev = dev;
        mutex_lock(&dev_pm_qos_mtx);
-        if (!dev->power.qos) {
+        if (IS_ERR(dev->power.qos))
-                if (dev->power.power_state.event == PM_EVENT_INVALID) {
+                ret = -ENODEV;
-                        /* The device has been removed from the system. */
+        else if (!dev->power.qos)
-                        req->dev = NULL;
+                ret = dev_pm_qos_constraints_allocate(dev);
-                        ret = -ENODEV;
-                        goto out;
-                } else {
-                        /*
-                         * Allocate the constraints data on the first call to
-                         * add_request, i.e. only if the data is not already
-                         * allocated and if the device has not been removed.
-                         */
-                        ret = dev_pm_qos_constraints_allocate(dev);
-                }
-        }
        if (!ret) {
+                req->dev = dev;
                req->type = type;
                ret = apply_constraint(req, PM_QOS_ADD_REQ, value);
        }
- out:
        mutex_unlock(&dev_pm_qos_mtx);
        return ret;
@@ -344,7 +320,14 @@ static int __dev_pm_qos_update_request(struct dev_pm_qos_request *req,
        s32 curr_value;
        int ret = 0;
-        if (!req->dev->power.qos)
+        if (!req) /*guard against callers passing in null */
+                return -EINVAL;
+        if (WARN(!dev_pm_qos_request_active(req),
+                 "%s() called for unknown object\n", __func__))
+                return -EINVAL;
+        if (IS_ERR_OR_NULL(req->dev->power.qos))
                return -ENODEV;
        switch(req->type) {
@@ -386,6 +369,17 @@ int dev_pm_qos_update_request(struct dev_pm_qos_request *req, s32 new_value)
 {
        int ret;
+        mutex_lock(&dev_pm_qos_mtx);
+        ret = __dev_pm_qos_update_request(req, new_value);
+        mutex_unlock(&dev_pm_qos_mtx);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(dev_pm_qos_update_request);
+static int __dev_pm_qos_remove_request(struct dev_pm_qos_request *req)
+{
+        int ret;
        if (!req) /*guard against callers passing in null */
                return -EINVAL;
@@ -393,13 +387,13 @@ int dev_pm_qos_update_request(struct dev_pm_qos_request *req, s32 new_value)
                 "%s() called for unknown object\n", __func__))
                return -EINVAL;
-        mutex_lock(&dev_pm_qos_mtx);
+        if (IS_ERR_OR_NULL(req->dev->power.qos))
-        ret = __dev_pm_qos_update_request(req, new_value);
+                return -ENODEV;
-        mutex_unlock(&dev_pm_qos_mtx);
+        ret = apply_constraint(req, PM_QOS_REMOVE_REQ, PM_QOS_DEFAULT_VALUE);
+        memset(req, 0, sizeof(*req));
        return ret;
 }
-EXPORT_SYMBOL_GPL(dev_pm_qos_update_request);
 /**
 * dev_pm_qos_remove_request - modifies an existing qos request
@@ -418,26 +412,10 @@ EXPORT_SYMBOL_GPL(dev_pm_qos_update_request);
 */
 int dev_pm_qos_remove_request(struct dev_pm_qos_request *req)
 {
-        int ret = 0;
+        int ret;
-        if (!req) /*guard against callers passing in null */
-                return -EINVAL;
-        if (WARN(!dev_pm_qos_request_active(req),
-                 "%s() called for unknown object\n", __func__))
-                return -EINVAL;
        mutex_lock(&dev_pm_qos_mtx);
+        ret = __dev_pm_qos_remove_request(req);
-        if (req->dev->power.qos) {
-                ret = apply_constraint(req, PM_QOS_REMOVE_REQ,
-                                       PM_QOS_DEFAULT_VALUE);
-                memset(req, 0, sizeof(*req));
-        } else {
-                /* Return if the device has been removed */
-                ret = -ENODEV;
-        }
        mutex_unlock(&dev_pm_qos_mtx);
        return ret;
 }
@@ -462,9 +440,10 @@ int dev_pm_qos_add_notifier(struct device *dev, struct notifier_block *notifier)
        mutex_lock(&dev_pm_qos_mtx);
-        if (!dev->power.qos)
+        if (IS_ERR(dev->power.qos))
-                ret = dev->power.power_state.event != PM_EVENT_INVALID ?
+                ret = -ENODEV;
-                        dev_pm_qos_constraints_allocate(dev) : -ENODEV;
+        else if (!dev->power.qos)
+                ret = dev_pm_qos_constraints_allocate(dev);
        if (!ret)
                ret = blocking_notifier_chain_register(
@@ -493,7 +472,7 @@ int dev_pm_qos_remove_notifier(struct device *dev,
        mutex_lock(&dev_pm_qos_mtx);
        /* Silently return if the constraints object is not present. */
-        if (dev->power.qos)
+        if (!IS_ERR_OR_NULL(dev->power.qos))
                retval = blocking_notifier_chain_unregister(
                                dev->power.qos->latency.notifiers,
                                notifier);
@@ -563,16 +542,20 @@ EXPORT_SYMBOL_GPL(dev_pm_qos_add_ancestor_request);
 static void __dev_pm_qos_drop_user_request(struct device *dev,
                                           enum dev_pm_qos_req_type type)
 {
+        struct dev_pm_qos_request *req = NULL;
        switch(type) {
        case DEV_PM_QOS_LATENCY:
-                dev_pm_qos_remove_request(dev->power.qos->latency_req);
+                req = dev->power.qos->latency_req;
                dev->power.qos->latency_req = NULL;
                break;
        case DEV_PM_QOS_FLAGS:
-                dev_pm_qos_remove_request(dev->power.qos->flags_req);
+                req = dev->power.qos->flags_req;
                dev->power.qos->flags_req = NULL;
                break;
        }
+        __dev_pm_qos_remove_request(req);
+        kfree(req);
 }
 /**
@@ -588,36 +571,57 @@ int dev_pm_qos_expose_latency_limit(struct device *dev, s32 value)
        if (!device_is_registered(dev) || value < 0)
                return -EINVAL;
-        if (dev->power.qos && dev->power.qos->latency_req)
-                return -EEXIST;
        req = kzalloc(sizeof(*req), GFP_KERNEL);
        if (!req)
                return -ENOMEM;
        ret = dev_pm_qos_add_request(dev, req, DEV_PM_QOS_LATENCY, value);
-        if (ret < 0)
+        if (ret < 0) {
+                kfree(req);
                return ret;
+        }
+        mutex_lock(&dev_pm_qos_mtx);
+        if (IS_ERR_OR_NULL(dev->power.qos))
+                ret = -ENODEV;
+        else if (dev->power.qos->latency_req)
+                ret = -EEXIST;
+        if (ret < 0) {
+                __dev_pm_qos_remove_request(req);
+                kfree(req);
+                goto out;
+        }
        dev->power.qos->latency_req = req;
        ret = pm_qos_sysfs_add_latency(dev);
        if (ret)
                __dev_pm_qos_drop_user_request(dev, DEV_PM_QOS_LATENCY);
+ out:
+        mutex_unlock(&dev_pm_qos_mtx);
        return ret;
 }
 EXPORT_SYMBOL_GPL(dev_pm_qos_expose_latency_limit);
+static void __dev_pm_qos_hide_latency_limit(struct device *dev)
+{
+        if (!IS_ERR_OR_NULL(dev->power.qos) && dev->power.qos->latency_req) {
+                pm_qos_sysfs_remove_latency(dev);
+                __dev_pm_qos_drop_user_request(dev, DEV_PM_QOS_LATENCY);
+        }
+}
 /**
 * dev_pm_qos_hide_latency_limit - Hide PM QoS latency limit from user space.
 * @dev: Device whose PM QoS latency limit is to be hidden from user space.
 */
 void dev_pm_qos_hide_latency_limit(struct device *dev)
 {
-        if (dev->power.qos && dev->power.qos->latency_req) {
+        mutex_lock(&dev_pm_qos_mtx);
-                pm_qos_sysfs_remove_latency(dev);
+        __dev_pm_qos_hide_latency_limit(dev);
-                __dev_pm_qos_drop_user_request(dev, DEV_PM_QOS_LATENCY);
+        mutex_unlock(&dev_pm_qos_mtx);
-        }
 }
 EXPORT_SYMBOL_GPL(dev_pm_qos_hide_latency_limit);
@@ -634,41 +638,61 @@ int dev_pm_qos_expose_flags(struct device *dev, s32 val)
        if (!device_is_registered(dev))
                return -EINVAL;
-        if (dev->power.qos && dev->power.qos->flags_req)
-                return -EEXIST;
        req = kzalloc(sizeof(*req), GFP_KERNEL);
        if (!req)
                return -ENOMEM;
-        pm_runtime_get_sync(dev);
        ret = dev_pm_qos_add_request(dev, req, DEV_PM_QOS_FLAGS, val);
-        if (ret < 0)
+        if (ret < 0) {
-                goto fail;
+                kfree(req);
+                return ret;
+        }
+        pm_runtime_get_sync(dev);
+        mutex_lock(&dev_pm_qos_mtx);
+        if (IS_ERR_OR_NULL(dev->power.qos))
+                ret = -ENODEV;
+        else if (dev->power.qos->flags_req)
+                ret = -EEXIST;
+        if (ret < 0) {
+                __dev_pm_qos_remove_request(req);
+                kfree(req);
+                goto out;
+        }
        dev->power.qos->flags_req = req;
        ret = pm_qos_sysfs_add_flags(dev);
        if (ret)
                __dev_pm_qos_drop_user_request(dev, DEV_PM_QOS_FLAGS);
-fail:
+ out:
+        mutex_unlock(&dev_pm_qos_mtx);
        pm_runtime_put(dev);
        return ret;
 }
 EXPORT_SYMBOL_GPL(dev_pm_qos_expose_flags);
+static void __dev_pm_qos_hide_flags(struct device *dev)
+{
+        if (!IS_ERR_OR_NULL(dev->power.qos) && dev->power.qos->flags_req) {
+                pm_qos_sysfs_remove_flags(dev);
+                __dev_pm_qos_drop_user_request(dev, DEV_PM_QOS_FLAGS);
+        }
+}
 /**
 * dev_pm_qos_hide_flags - Hide PM QoS flags of a device from user space.
 * @dev: Device whose PM QoS flags are to be hidden from user space.
 */
 void dev_pm_qos_hide_flags(struct device *dev)
 {
-        if (dev->power.qos && dev->power.qos->flags_req) {
+        pm_runtime_get_sync(dev);
-                pm_qos_sysfs_remove_flags(dev);
+        mutex_lock(&dev_pm_qos_mtx);
-                pm_runtime_get_sync(dev);
+        __dev_pm_qos_hide_flags(dev);
-                __dev_pm_qos_drop_user_request(dev, DEV_PM_QOS_FLAGS);
+        mutex_unlock(&dev_pm_qos_mtx);
-                pm_runtime_put(dev);
+        pm_runtime_put(dev);
-        }
 }
 EXPORT_SYMBOL_GPL(dev_pm_qos_hide_flags);
@@ -683,12 +707,14 @@ int dev_pm_qos_update_flags(struct device *dev, s32 mask, bool set)
        s32 value;
        int ret;
-        if (!dev->power.qos || !dev->power.qos->flags_req)
-                return -EINVAL;
        pm_runtime_get_sync(dev);
        mutex_lock(&dev_pm_qos_mtx);
+        if (IS_ERR_OR_NULL(dev->power.qos) || !dev->power.qos->flags_req) {
+                ret = -EINVAL;
+                goto out;
+        }
        value = dev_pm_qos_requested_flags(dev);
        if (set)
                value |= mask;
@@ -697,9 +723,12 @@ int dev_pm_qos_update_flags(struct device *dev, s32 mask, bool set)
        ret = __dev_pm_qos_update_request(dev->power.qos->flags_req, value);
+ out:
        mutex_unlock(&dev_pm_qos_mtx);
        pm_runtime_put(dev);
        return ret;
 }
+#else /* !CONFIG_PM_RUNTIME */
+static void __dev_pm_qos_hide_latency_limit(struct device *dev) {}
+static void __dev_pm_qos_hide_flags(struct device *dev) {}
 #endif /* CONFIG_PM_RUNTIME */
diff --git a/drivers/base/power/sysfs.c b/drivers/base/power/sysfs.c
index 50d16e3cb0a9..a53ebd265701 100644
--- a/drivers/base/power/sysfs.c
+++ b/drivers/base/power/sysfs.c
@@ -708,6 +708,7 @@ void rpm_sysfs_remove(struct device *dev)
 void dpm_sysfs_remove(struct device *dev)
 {
+        dev_pm_qos_constraints_destroy(dev);
        rpm_sysfs_remove(dev);
        sysfs_unmerge_group(&dev->kobj, &pm_wakeup_attr_group);
        sysfs_remove_group(&dev->kobj, &pm_attr_group);
diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 4706c63d0bc6..020ea2b9fd2f 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -184,6 +184,7 @@ static irqreturn_t regmap_irq_thread(int irq, void *d)
                if (ret < 0) {
                        dev_err(map->dev, "IRQ thread failed to resume: %d\n",
                                ret);
+                        pm_runtime_put(map->dev);
                        return IRQ_NONE;
                }
        }
diff --git a/drivers/bcma/driver_pci_host.c b/drivers/bcma/driver_pci_host.c
index d3bde6cec927..30629a3d44cc 100644
--- a/drivers/bcma/driver_pci_host.c
+++ b/drivers/bcma/driver_pci_host.c
@@ -404,6 +404,8 @@ void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
                return;
        }
+        spin_lock_init(&pc_host->cfgspace_lock);
        pc->host_controller = pc_host;
        pc_host->pci_controller.io_resource = &pc_host->io_resource;
        pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 1bafb40ec8a2..69ae5972713c 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -40,6 +40,7 @@
 #include <linux/init.h>
 #include <linux/miscdevice.h>
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
@@ -52,8 +53,12 @@ static struct hwrng *current_rng;
 static LIST_HEAD(rng_list);
 static DEFINE_MUTEX(rng_mutex);
 static int data_avail;
-static u8 rng_buffer[SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES]
+static u8 *rng_buffer;
-        __cacheline_aligned;
+static size_t rng_buffer_size(void)
+{
+        return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES;
+}
 static inline int hwrng_init(struct hwrng *rng)
 {
@@ -116,7 +121,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf,
                if (!data_avail) {
                        bytes_read = rng_get_data(current_rng, rng_buffer,
-                                sizeof(rng_buffer),
+                                rng_buffer_size(),
                                !(filp->f_flags & O_NONBLOCK));
                        if (bytes_read < 0) {
                                err = bytes_read;
@@ -307,6 +312,14 @@ int hwrng_register(struct hwrng *rng)
        mutex_lock(&rng_mutex);
+        /* kmalloc makes this safe for virt_to_page() in virtio_rng.c */
+        err = -ENOMEM;
+        if (!rng_buffer) {
+                rng_buffer = kmalloc(rng_buffer_size(), GFP_KERNEL);
+                if (!rng_buffer)
+                        goto out_unlock;
+        }
        /* Must not register two RNGs with the same name. */
        err = -EEXIST;
        list_for_each_entry(tmp, &rng_list, list) {
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index fce2000eec31..1110478dd0fd 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -313,6 +313,12 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
            (task_active_pid_ns(current) != &init_pid_ns))
                return;
+        /* Can only change if privileged. */
+        if (!capable(CAP_NET_ADMIN)) {
+                err = EPERM;
+                goto out;
+        }
        mc_op = (enum proc_cn_mcast_op *)msg->data;
        switch (*mc_op) {
        case PROC_CN_MCAST_LISTEN:
@@ -325,6 +331,8 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
                err = EINVAL;
                break;
        }
+out:
        cn_proc_ack(err, msg->seq, msg->ack);
 }
diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h
index d2ac91150600..46bde01eee62 100644
--- a/drivers/cpufreq/cpufreq_governor.h
+++ b/drivers/cpufreq/cpufreq_governor.h
@@ -64,7 +64,7 @@ static void *get_cpu_dbs_info_s(int cpu)				\
 * dbs: used as a shortform for demand based switching It helps to keep variable
 *      names smaller, simpler
 * cdbs: common dbs
- * on_*: On-demand governor
+ * od_*: On-demand governor
 * cs_*: Conservative governor
 */
diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c
index 66e3a71b81a3..b61b5a3fad64 100644
--- a/drivers/cpufreq/highbank-cpufreq.c
+++ b/drivers/cpufreq/highbank-cpufreq.c
@@ -28,13 +28,7 @@
 static int hb_voltage_change(unsigned int freq)
 {
-        int i;
+        u32 msg[HB_CPUFREQ_IPC_LEN] = {HB_CPUFREQ_CHANGE_NOTE, freq / 1000000};
-        u32 msg[HB_CPUFREQ_IPC_LEN];
-        msg[0] = HB_CPUFREQ_CHANGE_NOTE;
-        msg[1] = freq / 1000000;
-        for (i = 2; i < HB_CPUFREQ_IPC_LEN; i++)
-                msg[i] = 0;
        return pl320_ipc_transmit(msg);
 }
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 096fde0ebcb5..f6dd1e761129 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -662,6 +662,9 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
        cpu = all_cpu_data[policy->cpu];
+        if (!policy->cpuinfo.max_freq)
+                return -ENODEV;
        intel_pstate_get_min_max(cpu, &min, &max);
        limits.min_perf_pct = (policy->min * 100) / policy->cpuinfo.max_freq;
@@ -747,37 +750,11 @@ static struct cpufreq_driver intel_pstate_driver = {
        .owner          = THIS_MODULE,
 };
-static void intel_pstate_exit(void)
-{
-        int cpu;
-        sysfs_remove_group(intel_pstate_kobject,
-                                &intel_pstate_attr_group);
-        debugfs_remove_recursive(debugfs_parent);
-        cpufreq_unregister_driver(&intel_pstate_driver);
-        if (!all_cpu_data)
-                return;
-        get_online_cpus();
-        for_each_online_cpu(cpu) {
-                if (all_cpu_data[cpu]) {
-                        del_timer_sync(&all_cpu_data[cpu]->timer);
-                        kfree(all_cpu_data[cpu]);
-                }
-        }
-        put_online_cpus();
-        vfree(all_cpu_data);
-}
-module_exit(intel_pstate_exit);
 static int __initdata no_load;
 static int __init intel_pstate_init(void)
 {
-        int rc = 0;
+        int cpu, rc = 0;
        const struct x86_cpu_id *id;
        if (no_load)
@@ -802,7 +779,16 @@ static int __init intel_pstate_init(void)
        intel_pstate_sysfs_expose_params();
        return rc;
 out:
-        intel_pstate_exit();
+        get_online_cpus();
+        for_each_online_cpu(cpu) {
+                if (all_cpu_data[cpu]) {
+                        del_timer_sync(&all_cpu_data[cpu]->timer);
+                        kfree(all_cpu_data[cpu]);
+                }
+        }
+        put_online_cpus();
+        vfree(all_cpu_data);
        return -ENODEV;
 }
 device_initcall(intel_pstate_init);
diff --git a/drivers/gpio/gpio-ich.c b/drivers/gpio/gpio-ich.c
index 6f2306db8591..f9dbd503fc40 100644
--- a/drivers/gpio/gpio-ich.c
+++ b/drivers/gpio/gpio-ich.c
@@ -128,9 +128,9 @@ static int ichx_read_bit(int reg, unsigned nr)
        return data & (1 << bit) ? 1 : 0;
 }
-static int ichx_gpio_check_available(struct gpio_chip *gpio, unsigned nr)
+static bool ichx_gpio_check_available(struct gpio_chip *gpio, unsigned nr)
 {
-        return (ichx_priv.use_gpio & (1 << (nr / 32))) ? 0 : -ENXIO;
+        return ichx_priv.use_gpio & (1 << (nr / 32));
 }
 static int ichx_gpio_direction_input(struct gpio_chip *gpio, unsigned nr)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index fff9786cdc64..c2534d62911c 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -88,13 +88,14 @@ static int gpiod_request(struct gpio_desc *desc, const char *label);
 static void gpiod_free(struct gpio_desc *desc);
 static int gpiod_direction_input(struct gpio_desc *desc);
 static int gpiod_direction_output(struct gpio_desc *desc, int value);
+static int gpiod_get_direction(const struct gpio_desc *desc);
 static int gpiod_set_debounce(struct gpio_desc *desc, unsigned debounce);
-static int gpiod_get_value_cansleep(struct gpio_desc *desc);
+static int gpiod_get_value_cansleep(const struct gpio_desc *desc);
 static void gpiod_set_value_cansleep(struct gpio_desc *desc, int value);
-static int gpiod_get_value(struct gpio_desc *desc);
+static int gpiod_get_value(const struct gpio_desc *desc);
 static void gpiod_set_value(struct gpio_desc *desc, int value);
-static int gpiod_cansleep(struct gpio_desc *desc);
+static int gpiod_cansleep(const struct gpio_desc *desc);
-static int gpiod_to_irq(struct gpio_desc *desc);
+static int gpiod_to_irq(const struct gpio_desc *desc);
 static int gpiod_export(struct gpio_desc *desc, bool direction_may_change);
 static int gpiod_export_link(struct device *dev, const char *name,
                             struct gpio_desc *desc);
@@ -171,12 +172,12 @@ static int gpio_ensure_requested(struct gpio_desc *desc)
        return 0;
 }
-/* caller holds gpio_lock *OR* gpio is marked as requested */
+static struct gpio_chip *gpiod_to_chip(const struct gpio_desc *desc)
-static struct gpio_chip *gpiod_to_chip(struct gpio_desc *desc)
 {
-        return desc->chip;
+        return desc ? desc->chip : NULL;
 }
+/* caller holds gpio_lock *OR* gpio is marked as requested */
 struct gpio_chip *gpio_to_chip(unsigned gpio)
 {
        return gpiod_to_chip(gpio_to_desc(gpio));
@@ -207,7 +208,7 @@ static int gpiochip_find_base(int ngpio)
 }
 /* caller ensures gpio is valid and requested, chip->get_direction may sleep  */
-static int gpiod_get_direction(struct gpio_desc *desc)
+static int gpiod_get_direction(const struct gpio_desc *desc)
 {
        struct gpio_chip        *chip;
        unsigned                offset;
@@ -223,11 +224,13 @@ static int gpiod_get_direction(struct gpio_desc *desc)
        if (status > 0) {
                /* GPIOF_DIR_IN, or other positive */
                status = 1;
-                clear_bit(FLAG_IS_OUT, &desc->flags);
+                /* FLAG_IS_OUT is just a cache of the result of get_direction(),
+                 * so it does not affect constness per se */
+                clear_bit(FLAG_IS_OUT, &((struct gpio_desc *)desc)->flags);
        }
        if (status == 0) {
                /* GPIOF_DIR_OUT */
-                set_bit(FLAG_IS_OUT, &desc->flags);
+                set_bit(FLAG_IS_OUT, &((struct gpio_desc *)desc)->flags);
        }
        return status;
 }
@@ -263,7 +266,7 @@ static DEFINE_MUTEX(sysfs_lock);
 static ssize_t gpio_direction_show(struct device *dev,
                struct device_attribute *attr, char *buf)
 {
-        struct gpio_desc        *desc = dev_get_drvdata(dev);
+        const struct gpio_desc  *desc = dev_get_drvdata(dev);
        ssize_t                 status;
        mutex_lock(&sysfs_lock);
@@ -654,6 +657,11 @@ static ssize_t export_store(struct class *class,
                goto done;
        desc = gpio_to_desc(gpio);
+        /* reject invalid GPIOs */
+        if (!desc) {
+                pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
+                return -EINVAL;
+        }
        /* No extra locking here; FLAG_SYSFS just signifies that the
         * request and export were done by on behalf of userspace, so
@@ -690,12 +698,14 @@ static ssize_t unexport_store(struct class *class,
        if (status < 0)
                goto done;
-        status = -EINVAL;
        desc = gpio_to_desc(gpio);
        /* reject bogus commands (gpio_unexport ignores them) */
-        if (!desc)
+        if (!desc) {
-                goto done;
+                pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
+                return -EINVAL;
+        }
+        status = -EINVAL;
        /* No extra locking here; FLAG_SYSFS just signifies that the
         * request and export were done by on behalf of userspace, so
@@ -846,8 +856,10 @@ static int gpiod_export_link(struct device *dev, const char *name,
 {
        int                     status = -EINVAL;
-        if (!desc)
+        if (!desc) {
-                goto done;
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
        mutex_lock(&sysfs_lock);
@@ -865,7 +877,6 @@ static int gpiod_export_link(struct device *dev, const char *name,
        mutex_unlock(&sysfs_lock);
-done:
        if (status)
                pr_debug("%s: gpio%d status %d\n", __func__, desc_to_gpio(desc),
                         status);
@@ -896,8 +907,10 @@ static int gpiod_sysfs_set_active_low(struct gpio_desc *desc, int value)
        struct device           *dev = NULL;
        int                     status = -EINVAL;
-        if (!desc)
+        if (!desc) {
-                goto done;
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
        mutex_lock(&sysfs_lock);
@@ -914,7 +927,6 @@ static int gpiod_sysfs_set_active_low(struct gpio_desc *desc, int value)
 unlock:
        mutex_unlock(&sysfs_lock);
-done:
        if (status)
                pr_debug("%s: gpio%d status %d\n", __func__, desc_to_gpio(desc),
                         status);
@@ -940,8 +952,8 @@ static void gpiod_unexport(struct gpio_desc *desc)
        struct device           *dev = NULL;
        if (!desc) {
-                status = -EINVAL;
+                pr_warn("%s: invalid GPIO\n", __func__);
-                goto done;
+                return;
        }
        mutex_lock(&sysfs_lock);
@@ -962,7 +974,7 @@ static void gpiod_unexport(struct gpio_desc *desc)
                device_unregister(dev);
                put_device(dev);
        }
-done:
        if (status)
                pr_debug("%s: gpio%d status %d\n", __func__, desc_to_gpio(desc),
                         status);
@@ -1384,12 +1396,13 @@ static int gpiod_request(struct gpio_desc *desc, const char *label)
        int                     status = -EPROBE_DEFER;
        unsigned long           flags;
-        spin_lock_irqsave(&gpio_lock, flags);
        if (!desc) {
-                status = -EINVAL;
+                pr_warn("%s: invalid GPIO\n", __func__);
-                goto done;
+                return -EINVAL;
        }
+        spin_lock_irqsave(&gpio_lock, flags);
        chip = desc->chip;
        if (chip == NULL)
                goto done;
@@ -1432,8 +1445,7 @@ static int gpiod_request(struct gpio_desc *desc, const char *label)
 done:
        if (status)
                pr_debug("_gpio_request: gpio-%d (%s) status %d\n",
-                         desc ? desc_to_gpio(desc) : -1,
+                         desc_to_gpio(desc), label ? : "?", status);
-                         label ? : "?", status);
        spin_unlock_irqrestore(&gpio_lock, flags);
        return status;
 }
@@ -1616,10 +1628,13 @@ static int gpiod_direction_input(struct gpio_desc *desc)
        int                     status = -EINVAL;
        int                     offset;
+        if (!desc) {
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
        spin_lock_irqsave(&gpio_lock, flags);
-        if (!desc)
-                goto fail;
        chip = desc->chip;
        if (!chip || !chip->get || !chip->direction_input)
                goto fail;
@@ -1655,13 +1670,9 @@ lose:
        return status;
 fail:
        spin_unlock_irqrestore(&gpio_lock, flags);
-        if (status) {
+        if (status)
-                int gpio = -1;
+                pr_debug("%s: gpio-%d status %d\n", __func__,
-                if (desc)
+                         desc_to_gpio(desc), status);
-                        gpio = desc_to_gpio(desc);
-                pr_debug("%s: gpio-%d status %d\n",
-                        __func__, gpio, status);
-        }
        return status;
 }
@@ -1678,6 +1689,11 @@ static int gpiod_direction_output(struct gpio_desc *desc, int value)
        int                     status = -EINVAL;
        int offset;
+        if (!desc) {
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
        /* Open drain pin should not be driven to 1 */
        if (value && test_bit(FLAG_OPEN_DRAIN,  &desc->flags))
                return gpiod_direction_input(desc);
@@ -1688,8 +1704,6 @@ static int gpiod_direction_output(struct gpio_desc *desc, int value)
        spin_lock_irqsave(&gpio_lock, flags);
-        if (!desc)
-                goto fail;
        chip = desc->chip;
        if (!chip || !chip->set || !chip->direction_output)
                goto fail;
@@ -1725,13 +1739,9 @@ lose:
        return status;
 fail:
        spin_unlock_irqrestore(&gpio_lock, flags);
-        if (status) {
+        if (status)
-                int gpio = -1;
+                pr_debug("%s: gpio-%d status %d\n", __func__,
-                if (desc)
+                         desc_to_gpio(desc), status);
-                        gpio = desc_to_gpio(desc);
-                pr_debug("%s: gpio-%d status %d\n",
-                        __func__, gpio, status);
-        }
        return status;
 }
@@ -1753,10 +1763,13 @@ static int gpiod_set_debounce(struct gpio_desc *desc, unsigned debounce)
        int                     status = -EINVAL;
        int                     offset;
+        if (!desc) {
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
        spin_lock_irqsave(&gpio_lock, flags);
-        if (!desc)
-                goto fail;
        chip = desc->chip;
        if (!chip || !chip->set || !chip->set_debounce)
                goto fail;
@@ -1776,13 +1789,9 @@ static int gpiod_set_debounce(struct gpio_desc *desc, unsigned debounce)
 fail:
        spin_unlock_irqrestore(&gpio_lock, flags);
-        if (status) {
+        if (status)
-                int gpio = -1;
+                pr_debug("%s: gpio-%d status %d\n", __func__,
-                if (desc)
+                         desc_to_gpio(desc), status);
-                        gpio = desc_to_gpio(desc);
-                pr_debug("%s: gpio-%d status %d\n",
-                        __func__, gpio, status);
-        }
        return status;
 }
@@ -1824,12 +1833,14 @@ EXPORT_SYMBOL_GPL(gpio_set_debounce);
 * It returns the zero or nonzero value provided by the associated
 * gpio_chip.get() method; or zero if no such method is provided.
 */
-static int gpiod_get_value(struct gpio_desc *desc)
+static int gpiod_get_value(const struct gpio_desc *desc)
 {
        struct gpio_chip        *chip;
        int value;
        int offset;
+        if (!desc)
+                return 0;
        chip = desc->chip;
        offset = gpio_chip_hwgpio(desc);
        /* Should be using gpio_get_value_cansleep() */
@@ -1912,6 +1923,8 @@ static void gpiod_set_value(struct gpio_desc *desc, int value)
 {
        struct gpio_chip        *chip;
+        if (!desc)
+                return;
        chip = desc->chip;
        /* Should be using gpio_set_value_cansleep() */
        WARN_ON(chip->can_sleep);
@@ -1938,8 +1951,10 @@ EXPORT_SYMBOL_GPL(__gpio_set_value);
 * This is used directly or indirectly to implement gpio_cansleep().  It
 * returns nonzero if access reading or writing the GPIO value can sleep.
 */
-static int gpiod_cansleep(struct gpio_desc *desc)
+static int gpiod_cansleep(const struct gpio_desc *desc)
 {
+        if (!desc)
+                return 0;
        /* only call this on GPIOs that are valid! */
        return desc->chip->can_sleep;
 }
@@ -1959,11 +1974,13 @@ EXPORT_SYMBOL_GPL(__gpio_cansleep);
 * It returns the number of the IRQ signaled by this (input) GPIO,
 * or a negative errno.
 */
-static int gpiod_to_irq(struct gpio_desc *desc)
+static int gpiod_to_irq(const struct gpio_desc *desc)
 {
        struct gpio_chip        *chip;
        int                     offset;
+        if (!desc)
+                return -EINVAL;
        chip = desc->chip;
        offset = gpio_chip_hwgpio(desc);
        return chip->to_irq ? chip->to_irq(chip, offset) : -ENXIO;
@@ -1980,13 +1997,15 @@ EXPORT_SYMBOL_GPL(__gpio_to_irq);
 * Common examples include ones connected to I2C or SPI chips.
 */
-static int gpiod_get_value_cansleep(struct gpio_desc *desc)
+static int gpiod_get_value_cansleep(const struct gpio_desc *desc)
 {
        struct gpio_chip        *chip;
        int value;
        int offset;
        might_sleep_if(extra_checks);
+        if (!desc)
+                return 0;
        chip = desc->chip;
        offset = gpio_chip_hwgpio(desc);
        value = chip->get ? chip->get(chip, offset) : 0;
@@ -2005,6 +2024,8 @@ static void gpiod_set_value_cansleep(struct gpio_desc *desc, int value)
        struct gpio_chip        *chip;
        might_sleep_if(extra_checks);
+        if (!desc)
+                return;
        chip = desc->chip;
        trace_gpio_value(desc_to_gpio(desc), 0, value);
        if (test_bit(FLAG_OPEN_DRAIN,  &desc->flags))
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index c5b8c81b9440..0a8eceb75902 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -379,15 +379,15 @@ static const struct pci_device_id pciidlist[] = {		/* aka */
        INTEL_VGA_DEVICE(0x0A06, &intel_haswell_m_info), /* ULT GT1 mobile */
        INTEL_VGA_DEVICE(0x0A16, &intel_haswell_m_info), /* ULT GT2 mobile */
        INTEL_VGA_DEVICE(0x0A26, &intel_haswell_m_info), /* ULT GT2 mobile */
-        INTEL_VGA_DEVICE(0x0D12, &intel_haswell_d_info), /* CRW GT1 desktop */
+        INTEL_VGA_DEVICE(0x0D02, &intel_haswell_d_info), /* CRW GT1 desktop */
+        INTEL_VGA_DEVICE(0x0D12, &intel_haswell_d_info), /* CRW GT2 desktop */
        INTEL_VGA_DEVICE(0x0D22, &intel_haswell_d_info), /* CRW GT2 desktop */
-        INTEL_VGA_DEVICE(0x0D32, &intel_haswell_d_info), /* CRW GT2 desktop */
+        INTEL_VGA_DEVICE(0x0D0A, &intel_haswell_d_info), /* CRW GT1 server */
-        INTEL_VGA_DEVICE(0x0D1A, &intel_haswell_d_info), /* CRW GT1 server */
+        INTEL_VGA_DEVICE(0x0D1A, &intel_haswell_d_info), /* CRW GT2 server */
        INTEL_VGA_DEVICE(0x0D2A, &intel_haswell_d_info), /* CRW GT2 server */
-        INTEL_VGA_DEVICE(0x0D3A, &intel_haswell_d_info), /* CRW GT2 server */
+        INTEL_VGA_DEVICE(0x0D06, &intel_haswell_m_info), /* CRW GT1 mobile */
-        INTEL_VGA_DEVICE(0x0D16, &intel_haswell_m_info), /* CRW GT1 mobile */
+        INTEL_VGA_DEVICE(0x0D16, &intel_haswell_m_info), /* CRW GT2 mobile */
        INTEL_VGA_DEVICE(0x0D26, &intel_haswell_m_info), /* CRW GT2 mobile */
-        INTEL_VGA_DEVICE(0x0D36, &intel_haswell_m_info), /* CRW GT2 mobile */
        INTEL_VGA_DEVICE(0x0f30, &intel_valleyview_m_info),
        INTEL_VGA_DEVICE(0x0157, &intel_valleyview_m_info),
        INTEL_VGA_DEVICE(0x0155, &intel_valleyview_d_info),
@@ -495,6 +495,7 @@ static int i915_drm_freeze(struct drm_device *dev)
                intel_modeset_disable(dev);
                drm_irq_uninstall(dev);
+                dev_priv->enable_hotplug_processing = false;
        }
        i915_save_state(dev);
@@ -568,10 +569,20 @@ static int __i915_drm_thaw(struct drm_device *dev)
                error = i915_gem_init_hw(dev);
                mutex_unlock(&dev->struct_mutex);
+                /* We need working interrupts for modeset enabling ... */
+                drm_irq_install(dev);
                intel_modeset_init_hw(dev);
                intel_modeset_setup_hw_state(dev, false);
-                drm_irq_install(dev);
+                /*
+                 * ... but also need to make sure that hotplug processing
+                 * doesn't cause havoc. Like in the driver load code we don't
+                 * bother with the tiny race here where we might loose hotplug
+                 * notifications.
+                 * */
                intel_hpd_init(dev);
+                dev_priv->enable_hotplug_processing = true;
        }
        intel_opregion_init(dev);
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 2cd97d1cc920..3c7bb0410b51 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -701,7 +701,7 @@ static irqreturn_t ivybridge_irq_handler(int irq, void *arg)
 {
        struct drm_device *dev = (struct drm_device *) arg;
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
-        u32 de_iir, gt_iir, de_ier, pm_iir;
+        u32 de_iir, gt_iir, de_ier, pm_iir, sde_ier;
        irqreturn_t ret = IRQ_NONE;
        int i;
@@ -711,6 +711,15 @@ static irqreturn_t ivybridge_irq_handler(int irq, void *arg)
        de_ier = I915_READ(DEIER);
        I915_WRITE(DEIER, de_ier & ~DE_MASTER_IRQ_CONTROL);
+        /* Disable south interrupts. We'll only write to SDEIIR once, so further
+         * interrupts will will be stored on its back queue, and then we'll be
+         * able to process them after we restore SDEIER (as soon as we restore
+         * it, we'll get an interrupt if SDEIIR still has something to process
+         * due to its back queue). */
+        sde_ier = I915_READ(SDEIER);
+        I915_WRITE(SDEIER, 0);
+        POSTING_READ(SDEIER);
        gt_iir = I915_READ(GTIIR);
        if (gt_iir) {
                snb_gt_irq_handler(dev, dev_priv, gt_iir);
@@ -759,6 +768,8 @@ static irqreturn_t ivybridge_irq_handler(int irq, void *arg)
        I915_WRITE(DEIER, de_ier);
        POSTING_READ(DEIER);
+        I915_WRITE(SDEIER, sde_ier);
+        POSTING_READ(SDEIER);
        return ret;
 }
@@ -778,7 +789,7 @@ static irqreturn_t ironlake_irq_handler(int irq, void *arg)
        struct drm_device *dev = (struct drm_device *) arg;
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
        int ret = IRQ_NONE;
-        u32 de_iir, gt_iir, de_ier, pm_iir;
+        u32 de_iir, gt_iir, de_ier, pm_iir, sde_ier;
        atomic_inc(&dev_priv->irq_received);
@@ -787,6 +798,15 @@ static irqreturn_t ironlake_irq_handler(int irq, void *arg)
        I915_WRITE(DEIER, de_ier & ~DE_MASTER_IRQ_CONTROL);
        POSTING_READ(DEIER);
+        /* Disable south interrupts. We'll only write to SDEIIR once, so further
+         * interrupts will will be stored on its back queue, and then we'll be
+         * able to process them after we restore SDEIER (as soon as we restore
+         * it, we'll get an interrupt if SDEIIR still has something to process
+         * due to its back queue). */
+        sde_ier = I915_READ(SDEIER);
+        I915_WRITE(SDEIER, 0);
+        POSTING_READ(SDEIER);
        de_iir = I915_READ(DEIIR);
        gt_iir = I915_READ(GTIIR);
        pm_iir = I915_READ(GEN6_PMIIR);
@@ -849,6 +869,8 @@ static irqreturn_t ironlake_irq_handler(int irq, void *arg)
 done:
        I915_WRITE(DEIER, de_ier);
        POSTING_READ(DEIER);
+        I915_WRITE(SDEIER, sde_ier);
+        POSTING_READ(SDEIER);
        return ret;
 }
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 527b664d3434..848992f67d56 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -1613,9 +1613,9 @@
 #define   ADPA_CRT_HOTPLUG_FORCE_TRIGGER (1<<16)
 #define   ADPA_USE_VGA_HVPOLARITY (1<<15)
 #define   ADPA_SETS_HVPOLARITY  0
-#define   ADPA_VSYNC_CNTL_DISABLE (1<<11)
+#define   ADPA_VSYNC_CNTL_DISABLE (1<<10)
 #define   ADPA_VSYNC_CNTL_ENABLE 0
-#define   ADPA_HSYNC_CNTL_DISABLE (1<<10)
+#define   ADPA_HSYNC_CNTL_DISABLE (1<<11)
 #define   ADPA_HSYNC_CNTL_ENABLE 0
 #define   ADPA_VSYNC_ACTIVE_HIGH (1<<4)
 #define   ADPA_VSYNC_ACTIVE_LOW 0
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 969d08c72d10..32a3693905ec 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -88,7 +88,7 @@ static void intel_disable_crt(struct intel_encoder *encoder)
        u32 temp;
        temp = I915_READ(crt->adpa_reg);
-        temp &= ~(ADPA_HSYNC_CNTL_DISABLE | ADPA_VSYNC_CNTL_DISABLE);
+        temp |= ADPA_HSYNC_CNTL_DISABLE | ADPA_VSYNC_CNTL_DISABLE;
        temp &= ~ADPA_DAC_ENABLE;
        I915_WRITE(crt->adpa_reg, temp);
 }
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index d64af5aa4a1c..8d0bac3c35d7 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1391,8 +1391,8 @@ void intel_ddi_prepare_link_retrain(struct drm_encoder *encoder)
        struct intel_dp *intel_dp = &intel_dig_port->dp;
        struct drm_i915_private *dev_priv = encoder->dev->dev_private;
        enum port port = intel_dig_port->port;
-        bool wait;
        uint32_t val;
+        bool wait = false;
        if (I915_READ(DP_TP_CTL(port)) & DP_TP_CTL_ENABLE) {
                val = I915_READ(DDI_BUF_CTL(port));
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index a05ac2c91ba2..287b42c9d1a8 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3604,6 +3604,30 @@ static void intel_crtc_dpms_overlay(struct intel_crtc *intel_crtc, bool enable)
         */
 }
+/**
+ * i9xx_fixup_plane - ugly workaround for G45 to fire up the hardware
+ * cursor plane briefly if not already running after enabling the display
+ * plane.
+ * This workaround avoids occasional blank screens when self refresh is
+ * enabled.
+ */
+static void
+g4x_fixup_plane(struct drm_i915_private *dev_priv, enum pipe pipe)
+{
+        u32 cntl = I915_READ(CURCNTR(pipe));
+        if ((cntl & CURSOR_MODE) == 0) {
+                u32 fw_bcl_self = I915_READ(FW_BLC_SELF);
+                I915_WRITE(FW_BLC_SELF, fw_bcl_self & ~FW_BLC_SELF_EN);
+                I915_WRITE(CURCNTR(pipe), CURSOR_MODE_64_ARGB_AX);
+                intel_wait_for_vblank(dev_priv->dev, pipe);
+                I915_WRITE(CURCNTR(pipe), cntl);
+                I915_WRITE(CURBASE(pipe), I915_READ(CURBASE(pipe)));
+                I915_WRITE(FW_BLC_SELF, fw_bcl_self);
+        }
+}
 static void i9xx_crtc_enable(struct drm_crtc *crtc)
 {
        struct drm_device *dev = crtc->dev;
@@ -3629,6 +3653,8 @@ static void i9xx_crtc_enable(struct drm_crtc *crtc)
        intel_enable_pipe(dev_priv, pipe, false);
        intel_enable_plane(dev_priv, plane, pipe);
+        if (IS_G4X(dev))
+                g4x_fixup_plane(dev_priv, pipe);
        intel_crtc_load_lut(crtc);
        intel_update_fbc(dev);
@@ -7256,8 +7282,8 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
 {
        struct drm_device *dev = crtc->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_framebuffer *intel_fb;
+        struct drm_framebuffer *old_fb = crtc->fb;
-        struct drm_i915_gem_object *obj;
+        struct drm_i915_gem_object *obj = to_intel_framebuffer(fb)->obj;
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        struct intel_unpin_work *work;
        unsigned long flags;
@@ -7282,8 +7308,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        work->event = event;
        work->crtc = crtc;
-        intel_fb = to_intel_framebuffer(crtc->fb);
+        work->old_fb_obj = to_intel_framebuffer(old_fb)->obj;
-        work->old_fb_obj = intel_fb->obj;
        INIT_WORK(&work->work, intel_unpin_work_fn);
        ret = drm_vblank_get(dev, intel_crtc->pipe);
@@ -7303,9 +7328,6 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        intel_crtc->unpin_work = work;
        spin_unlock_irqrestore(&dev->event_lock, flags);
-        intel_fb = to_intel_framebuffer(fb);
-        obj = intel_fb->obj;
        if (atomic_read(&intel_crtc->unpin_work_count) >= 2)
                flush_workqueue(dev_priv->wq);
@@ -7340,6 +7362,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
 cleanup_pending:
        atomic_dec(&intel_crtc->unpin_work_count);
+        crtc->fb = old_fb;
        drm_gem_object_unreference(&work->old_fb_obj->base);
        drm_gem_object_unreference(&obj->base);
        mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index f61cb7998c72..6f728e5ee793 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -353,7 +353,8 @@ intel_dp_aux_wait_done(struct intel_dp *intel_dp, bool has_aux_irq)
 #define C (((status = I915_READ_NOTRACE(ch_ctl)) & DP_AUX_CH_CTL_SEND_BUSY) == 0)
        if (has_aux_irq)
-                done = wait_event_timeout(dev_priv->gmbus_wait_queue, C, 10);
+                done = wait_event_timeout(dev_priv->gmbus_wait_queue, C,
+                                          msecs_to_jiffies(10));
        else
                done = wait_for_atomic(C, 10) == 0;
        if (!done)
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 61fee7fcdc2c..a1794c6df1bf 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2574,7 +2574,7 @@ static void gen6_enable_rps(struct drm_device *dev)
        I915_WRITE(GEN6_RC_SLEEP, 0);
        I915_WRITE(GEN6_RC1e_THRESHOLD, 1000);
        I915_WRITE(GEN6_RC6_THRESHOLD, 50000);
-        I915_WRITE(GEN6_RC6p_THRESHOLD, 100000);
+        I915_WRITE(GEN6_RC6p_THRESHOLD, 150000);
        I915_WRITE(GEN6_RC6pp_THRESHOLD, 64000); /* unused */
        /* Check if we are enabling RC6 */
diff --git a/drivers/gpu/drm/mgag200/mgag200_drv.h b/drivers/gpu/drm/mgag200/mgag200_drv.h
index 5ea5033eae0a..4d932c46725d 100644
--- a/drivers/gpu/drm/mgag200/mgag200_drv.h
+++ b/drivers/gpu/drm/mgag200/mgag200_drv.h
@@ -112,7 +112,6 @@ struct mga_framebuffer {
 struct mga_fbdev {
        struct drm_fb_helper helper;
        struct mga_framebuffer mfb;
-        struct list_head fbdev_list;
        void *sysram;
        int size;
        struct ttm_bo_kmap_obj mapping;
diff --git a/drivers/gpu/drm/mgag200/mgag200_i2c.c b/drivers/gpu/drm/mgag200/mgag200_i2c.c
index 5a88ec51b513..d3dcf54e6233 100644
--- a/drivers/gpu/drm/mgag200/mgag200_i2c.c
+++ b/drivers/gpu/drm/mgag200/mgag200_i2c.c
@@ -92,6 +92,7 @@ struct mga_i2c_chan *mgag200_i2c_create(struct drm_device *dev)
        int ret;
        int data, clock;
+        WREG_DAC(MGA1064_GEN_IO_CTL2, 1);
        WREG_DAC(MGA1064_GEN_IO_DATA, 0xff);
        WREG_DAC(MGA1064_GEN_IO_CTL, 0);
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index d3d99a28ddef..a274b9906ef8 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -1406,6 +1406,14 @@ static int mga_vga_get_modes(struct drm_connector *connector)
 static int mga_vga_mode_valid(struct drm_connector *connector,
                                 struct drm_display_mode *mode)
 {
+        struct drm_device *dev = connector->dev;
+        struct mga_device *mdev = (struct mga_device*)dev->dev_private;
+        struct mga_fbdev *mfbdev = mdev->mfbdev;
+        struct drm_fb_helper *fb_helper = &mfbdev->helper;
+        struct drm_fb_helper_connector *fb_helper_conn = NULL;
+        int bpp = 32;
+        int i = 0;
        /* FIXME: Add bandwidth and g200se limitations */
        if (mode->crtc_hdisplay > 2048 || mode->crtc_hsync_start > 4096 ||
@@ -1415,6 +1423,25 @@ static int mga_vga_mode_valid(struct drm_connector *connector,
                return MODE_BAD;
        }
+        /* Validate the mode input by the user */
+        for (i = 0; i < fb_helper->connector_count; i++) {
+                if (fb_helper->connector_info[i]->connector == connector) {
+                        /* Found the helper for this connector */
+                        fb_helper_conn = fb_helper->connector_info[i];
+                        if (fb_helper_conn->cmdline_mode.specified) {
+                                if (fb_helper_conn->cmdline_mode.bpp_specified) {
+                                        bpp = fb_helper_conn->cmdline_mode.bpp;
+                                }
+                        }
+                }
+        }
+        if ((mode->hdisplay * mode->vdisplay * (bpp/8)) > mdev->mc.vram_size) {
+                if (fb_helper_conn)
+                        fb_helper_conn->cmdline_mode.specified = false;
+                return MODE_BAD;
+        }
        return MODE_OK;
 }
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/nve0.c b/drivers/gpu/drm/nouveau/core/engine/graph/nve0.c
index 61cec0f6ff1c..4857f913efdd 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nve0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nve0.c
@@ -350,7 +350,7 @@ nve0_graph_init_gpc_0(struct nvc0_graph_priv *priv)
                nv_wr32(priv, GPC_UNIT(gpc, 0x0918), magicgpc918);
        }
-        nv_wr32(priv, GPC_BCAST(0x1bd4), magicgpc918);
+        nv_wr32(priv, GPC_BCAST(0x3fd4), magicgpc918);
        nv_wr32(priv, GPC_BCAST(0x08ac), nv_rd32(priv, 0x100800));
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
index 2cc1e6a5eb6a..9c41b58d57e2 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
@@ -869,7 +869,7 @@ init_idx_addr_latched(struct nvbios_init *init)
                init->offset += 2;
                init_wr32(init, dreg, idata);
-                init_mask(init, creg, ~mask, data | idata);
+                init_mask(init, creg, ~mask, data | iaddr);
        }
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c b/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c
index a114a0ed7e98..2e98e8a3f1aa 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c
@@ -142,6 +142,7 @@ nouveau_i2c_port_create_(struct nouveau_object *parent,
        /* drop port's i2c subdev refcount, i2c handles this itself */
        if (ret == 0) {
                list_add_tail(&port->head, &i2c->ports);
+                atomic_dec(&parent->refcount);
                atomic_dec(&engine->refcount);
        }
diff --git a/drivers/gpu/drm/nouveau/nouveau_agp.c b/drivers/gpu/drm/nouveau/nouveau_agp.c
index d28430cd2ba6..6e7a55f93a85 100644
--- a/drivers/gpu/drm/nouveau/nouveau_agp.c
+++ b/drivers/gpu/drm/nouveau/nouveau_agp.c
@@ -47,6 +47,18 @@ nouveau_agp_enabled(struct nouveau_drm *drm)
        if (drm->agp.stat == UNKNOWN) {
                if (!nouveau_agpmode)
                        return false;
+#ifdef __powerpc__
+                /* Disable AGP by default on all PowerPC machines for
+                 * now -- At least some UniNorth-2 AGP bridges are
+                 * known to be broken: DMA from the host to the card
+                 * works just fine, but writeback from the card to the
+                 * host goes straight to memory untranslated bypassing
+                 * the GATT somehow, making them quite painful to deal
+                 * with...
+                 */
+                if (nouveau_agpmode == -1)
+                        return false;
+#endif
                return true;
        }
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index a6237c9cbbc3..87a5a56ed358 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -55,9 +55,9 @@
 /* offsets in shared sync bo of various structures */
 #define EVO_SYNC(c, o) ((c) * 0x0100 + (o))
-#define EVO_MAST_NTFY     EVO_SYNC(  0, 0x00)
+#define EVO_MAST_NTFY     EVO_SYNC(      0, 0x00)
-#define EVO_FLIP_SEM0(c)  EVO_SYNC((c), 0x00)
+#define EVO_FLIP_SEM0(c)  EVO_SYNC((c) + 1, 0x00)
-#define EVO_FLIP_SEM1(c)  EVO_SYNC((c), 0x10)
+#define EVO_FLIP_SEM1(c)  EVO_SYNC((c) + 1, 0x10)
 #define EVO_CORE_HANDLE      (0xd1500000)
 #define EVO_CHAN_HANDLE(t,i) (0xd15c0000 | (((t) & 0x00ff) << 8) | (i))
@@ -341,10 +341,8 @@ struct nv50_curs {
 struct nv50_sync {
        struct nv50_dmac base;
-        struct {
+        u32 addr;
-                u32 offset;
+        u32 data;
-                u16 value;
-        } sem;
 };
 struct nv50_ovly {
@@ -471,13 +469,33 @@ nv50_display_crtc_sema(struct drm_device *dev, int crtc)
        return nv50_disp(dev)->sync;
 }
+struct nv50_display_flip {
+        struct nv50_disp *disp;
+        struct nv50_sync *chan;
+};
+static bool
+nv50_display_flip_wait(void *data)
+{
+        struct nv50_display_flip *flip = data;
+        if (nouveau_bo_rd32(flip->disp->sync, flip->chan->addr / 4) ==
+                                              flip->chan->data);
+                return true;
+        usleep_range(1, 2);
+        return false;
+}
 void
 nv50_display_flip_stop(struct drm_crtc *crtc)
 {
-        struct nv50_sync *sync = nv50_sync(crtc);
+        struct nouveau_device *device = nouveau_dev(crtc->dev);
+        struct nv50_display_flip flip = {
+                .disp = nv50_disp(crtc->dev),
+                .chan = nv50_sync(crtc),
+        };
        u32 *push;
-        push = evo_wait(sync, 8);
+        push = evo_wait(flip.chan, 8);
        if (push) {
                evo_mthd(push, 0x0084, 1);
                evo_data(push, 0x00000000);
@@ -487,8 +505,10 @@ nv50_display_flip_stop(struct drm_crtc *crtc)
                evo_data(push, 0x00000000);
                evo_mthd(push, 0x0080, 1);
                evo_data(push, 0x00000000);
-                evo_kick(push, sync);
+                evo_kick(push, flip.chan);
        }
+        nv_wait_cb(device, nv50_display_flip_wait, &flip);
 }
 int
@@ -496,11 +516,10 @@ nv50_display_flip_next(struct drm_crtc *crtc, struct drm_framebuffer *fb,
                       struct nouveau_channel *chan, u32 swap_interval)
 {
        struct nouveau_framebuffer *nv_fb = nouveau_framebuffer(fb);
-        struct nv50_disp *disp = nv50_disp(crtc->dev);
        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
        struct nv50_sync *sync = nv50_sync(crtc);
+        int head = nv_crtc->index, ret;
        u32 *push;
-        int ret;
        swap_interval <<= 4;
        if (swap_interval == 0)
@@ -510,58 +529,64 @@ nv50_display_flip_next(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        if (unlikely(push == NULL))
                return -EBUSY;
-        /* synchronise with the rendering channel, if necessary */
+        if (chan && nv_mclass(chan->object) < NV84_CHANNEL_IND_CLASS) {
-        if (likely(chan)) {
+                ret = RING_SPACE(chan, 8);
+                if (ret)
+                        return ret;
+                BEGIN_NV04(chan, 0, NV11_SUBCHAN_DMA_SEMAPHORE, 2);
+                OUT_RING  (chan, NvEvoSema0 + head);
+                OUT_RING  (chan, sync->addr ^ 0x10);
+                BEGIN_NV04(chan, 0, NV11_SUBCHAN_SEMAPHORE_RELEASE, 1);
+                OUT_RING  (chan, sync->data + 1);
+                BEGIN_NV04(chan, 0, NV11_SUBCHAN_SEMAPHORE_OFFSET, 2);
+                OUT_RING  (chan, sync->addr);
+                OUT_RING  (chan, sync->data);
+        } else
+        if (chan && nv_mclass(chan->object) < NVC0_CHANNEL_IND_CLASS) {
+                u64 addr = nv84_fence_crtc(chan, head) + sync->addr;
+                ret = RING_SPACE(chan, 12);
+                if (ret)
+                        return ret;
+                BEGIN_NV04(chan, 0, NV11_SUBCHAN_DMA_SEMAPHORE, 1);
+                OUT_RING  (chan, chan->vram);
+                BEGIN_NV04(chan, 0, NV84_SUBCHAN_SEMAPHORE_ADDRESS_HIGH, 4);
+                OUT_RING  (chan, upper_32_bits(addr ^ 0x10));
+                OUT_RING  (chan, lower_32_bits(addr ^ 0x10));
+                OUT_RING  (chan, sync->data + 1);
+                OUT_RING  (chan, NV84_SUBCHAN_SEMAPHORE_TRIGGER_WRITE_LONG);
+                BEGIN_NV04(chan, 0, NV84_SUBCHAN_SEMAPHORE_ADDRESS_HIGH, 4);
+                OUT_RING  (chan, upper_32_bits(addr));
+                OUT_RING  (chan, lower_32_bits(addr));
+                OUT_RING  (chan, sync->data);
+                OUT_RING  (chan, NV84_SUBCHAN_SEMAPHORE_TRIGGER_ACQUIRE_EQUAL);
+        } else
+        if (chan) {
+                u64 addr = nv84_fence_crtc(chan, head) + sync->addr;
                ret = RING_SPACE(chan, 10);
                if (ret)
                        return ret;
-                if (nv_mclass(chan->object) < NV84_CHANNEL_IND_CLASS) {
+                BEGIN_NVC0(chan, 0, NV84_SUBCHAN_SEMAPHORE_ADDRESS_HIGH, 4);
-                        BEGIN_NV04(chan, 0, NV11_SUBCHAN_DMA_SEMAPHORE, 2);
+                OUT_RING  (chan, upper_32_bits(addr ^ 0x10));
-                        OUT_RING  (chan, NvEvoSema0 + nv_crtc->index);
+                OUT_RING  (chan, lower_32_bits(addr ^ 0x10));
-                        OUT_RING  (chan, sync->sem.offset);
+                OUT_RING  (chan, sync->data + 1);
-                        BEGIN_NV04(chan, 0, NV11_SUBCHAN_SEMAPHORE_RELEASE, 1);
+                OUT_RING  (chan, NV84_SUBCHAN_SEMAPHORE_TRIGGER_WRITE_LONG |
-                        OUT_RING  (chan, 0xf00d0000 | sync->sem.value);
+                                 NVC0_SUBCHAN_SEMAPHORE_TRIGGER_YIELD);
-                        BEGIN_NV04(chan, 0, NV11_SUBCHAN_SEMAPHORE_OFFSET, 2);
+                BEGIN_NVC0(chan, 0, NV84_SUBCHAN_SEMAPHORE_ADDRESS_HIGH, 4);
-                        OUT_RING  (chan, sync->sem.offset ^ 0x10);
+                OUT_RING  (chan, upper_32_bits(addr));
-                        OUT_RING  (chan, 0x74b1e000);
+                OUT_RING  (chan, lower_32_bits(addr));
-                        BEGIN_NV04(chan, 0, NV11_SUBCHAN_DMA_SEMAPHORE, 1);
+                OUT_RING  (chan, sync->data);
-                        OUT_RING  (chan, NvSema);
+                OUT_RING  (chan, NV84_SUBCHAN_SEMAPHORE_TRIGGER_ACQUIRE_EQUAL |
-                } else
+                                 NVC0_SUBCHAN_SEMAPHORE_TRIGGER_YIELD);
-                if (nv_mclass(chan->object) < NVC0_CHANNEL_IND_CLASS) {
+        }
-                        u64 offset = nv84_fence_crtc(chan, nv_crtc->index);
-                        offset += sync->sem.offset;
-                        BEGIN_NV04(chan, 0, NV84_SUBCHAN_SEMAPHORE_ADDRESS_HIGH, 4);
-                        OUT_RING  (chan, upper_32_bits(offset));
-                        OUT_RING  (chan, lower_32_bits(offset));
-                        OUT_RING  (chan, 0xf00d0000 | sync->sem.value);
-                        OUT_RING  (chan, 0x00000002);
-                        BEGIN_NV04(chan, 0, NV84_SUBCHAN_SEMAPHORE_ADDRESS_HIGH, 4);
-                        OUT_RING  (chan, upper_32_bits(offset));
-                        OUT_RING  (chan, lower_32_bits(offset ^ 0x10));
-                        OUT_RING  (chan, 0x74b1e000);
-                        OUT_RING  (chan, 0x00000001);
-                } else {
-                        u64 offset = nv84_fence_crtc(chan, nv_crtc->index);
-                        offset += sync->sem.offset;
-                        BEGIN_NVC0(chan, 0, NV84_SUBCHAN_SEMAPHORE_ADDRESS_HIGH, 4);
-                        OUT_RING  (chan, upper_32_bits(offset));
-                        OUT_RING  (chan, lower_32_bits(offset));
-                        OUT_RING  (chan, 0xf00d0000 | sync->sem.value);
-                        OUT_RING  (chan, 0x00001002);
-                        BEGIN_NVC0(chan, 0, NV84_SUBCHAN_SEMAPHORE_ADDRESS_HIGH, 4);
-                        OUT_RING  (chan, upper_32_bits(offset));
-                        OUT_RING  (chan, lower_32_bits(offset ^ 0x10));
-                        OUT_RING  (chan, 0x74b1e000);
-                        OUT_RING  (chan, 0x00001001);
-                }
+        if (chan) {
+                sync->addr ^= 0x10;
+                sync->data++;
                FIRE_RING (chan);
        } else {
-                nouveau_bo_wr32(disp->sync, sync->sem.offset / 4,
-                                0xf00d0000 | sync->sem.value);
                evo_sync(crtc->dev);
        }
@@ -575,9 +600,9 @@ nv50_display_flip_next(struct drm_crtc *crtc, struct drm_framebuffer *fb,
                evo_data(push, 0x40000000);
        }
        evo_mthd(push, 0x0088, 4);
-        evo_data(push, sync->sem.offset);
+        evo_data(push, sync->addr);
-        evo_data(push, 0xf00d0000 | sync->sem.value);
+        evo_data(push, sync->data++);
-        evo_data(push, 0x74b1e000);
+        evo_data(push, sync->data);
        evo_data(push, NvEvoSync);
        evo_mthd(push, 0x00a0, 2);
        evo_data(push, 0x00000000);
@@ -605,9 +630,6 @@ nv50_display_flip_next(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        evo_mthd(push, 0x0080, 1);
        evo_data(push, 0x00000000);
        evo_kick(push, sync);
-        sync->sem.offset ^= 0x10;
-        sync->sem.value++;
        return 0;
 }
@@ -1379,7 +1401,8 @@ nv50_crtc_create(struct drm_device *dev, struct nouveau_object *core, int index)
        if (ret)
                goto out;
-        head->sync.sem.offset = EVO_SYNC(1 + index, 0x00);
+        head->sync.addr = EVO_FLIP_SEM0(index);
+        head->sync.data = 0x00000000;
        /* allocate overlay resources */
        ret = nv50_pioc_create(disp->core, NV50_DISP_OIMM_CLASS, index,
@@ -2112,15 +2135,23 @@ nv50_display_fini(struct drm_device *dev)
 int
 nv50_display_init(struct drm_device *dev)
 {
-        u32 *push = evo_wait(nv50_mast(dev), 32);
+        struct nv50_disp *disp = nv50_disp(dev);
-        if (push) {
+        struct drm_crtc *crtc;
-                evo_mthd(push, 0x0088, 1);
+        u32 *push;
-                evo_data(push, NvEvoSync);
-                evo_kick(push, nv50_mast(dev));
+        push = evo_wait(nv50_mast(dev), 32);
-                return 0;
+        if (!push)
+                return -EBUSY;
+        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+                struct nv50_sync *sync = nv50_sync(crtc);
+                nouveau_bo_wr32(disp->sync, sync->addr / 4, sync->data);
        }
-        return -EBUSY;
+        evo_mthd(push, 0x0088, 1);
+        evo_data(push, NvEvoSync);
+        evo_kick(push, nv50_mast(dev));
+        return 0;
 }
 void
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 3c38ea46531c..305a657bf215 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2438,6 +2438,12 @@ static u32 evergreen_gpu_check_soft_reset(struct radeon_device *rdev)
        if (tmp & L2_BUSY)
                reset_mask |= RADEON_RESET_VMC;
+        /* Skip MC reset as it's mostly likely not hung, just busy */
+        if (reset_mask & RADEON_RESET_MC) {
+                DRM_DEBUG("MC busy: 0x%08X, clearing.\n", reset_mask);
+                reset_mask &= ~RADEON_RESET_MC;
+        }
        return reset_mask;
 }
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 99fb13286fd0..eb8ac315f92f 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -834,7 +834,7 @@ static int evergreen_cs_track_validate_texture(struct radeon_cs_parser *p,
                         __func__, __LINE__, toffset, surf.base_align);
                return -EINVAL;
        }
-        if (moffset & (surf.base_align - 1)) {
+        if (surf.nsamples <= 1 && moffset & (surf.base_align - 1)) {
                dev_warn(p->dev, "%s:%d mipmap bo base %ld not aligned with %ld\n",
                         __func__, __LINE__, moffset, surf.base_align);
                return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 7cead763be9e..d4c633e12863 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -1381,6 +1381,12 @@ static u32 cayman_gpu_check_soft_reset(struct radeon_device *rdev)
        if (tmp & L2_BUSY)
                reset_mask |= RADEON_RESET_VMC;
+        /* Skip MC reset as it's mostly likely not hung, just busy */
+        if (reset_mask & RADEON_RESET_MC) {
+                DRM_DEBUG("MC busy: 0x%08X, clearing.\n", reset_mask);
+                reset_mask &= ~RADEON_RESET_MC;
+        }
        return reset_mask;
 }
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 6d4b5611daf4..0740db3fcd22 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1394,6 +1394,12 @@ static u32 r600_gpu_check_soft_reset(struct radeon_device *rdev)
        if (r600_is_display_hung(rdev))
                reset_mask |= RADEON_RESET_DISPLAY;
+        /* Skip MC reset as it's mostly likely not hung, just busy */
+        if (reset_mask & RADEON_RESET_MC) {
+                DRM_DEBUG("MC busy: 0x%08X, clearing.\n", reset_mask);
+                reset_mask &= ~RADEON_RESET_MC;
+        }
        return reset_mask;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 3e403bdda58f..78edadc9e86b 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -970,6 +970,15 @@ struct radeon_encoder_primary_dac *radeon_combios_get_primary_dac_info(struct
                        found = 1;
        }
+        /* quirks */
+        /* Radeon 9100 (R200) */
+        if ((dev->pdev->device == 0x514D) &&
+            (dev->pdev->subsystem_vendor == 0x174B) &&
+            (dev->pdev->subsystem_device == 0x7149)) {
+                /* vbios value is bad, use the default */
+                found = 0;
+        }
        if (!found) /* fallback to defaults */
                radeon_legacy_get_primary_dac_info_from_table(rdev, p_dac);
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 167758488ed6..66a7f0fd9620 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -70,9 +70,10 @@
 *   2.27.0 - r600-SI: Add CS ioctl support for async DMA
 *   2.28.0 - r600-eg: Add MEM_WRITE packet support
 *   2.29.0 - R500 FP16 color clear registers
+ *   2.30.0 - fix for FMASK texturing
 */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        29
+#define KMS_DRIVER_MINOR        30
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
index 90374dd77960..48f80cd42d8f 100644
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -400,6 +400,9 @@ void radeon_irq_kms_enable_afmt(struct radeon_device *rdev, int block)
 {
        unsigned long irqflags;
+        if (!rdev->ddev->irq_enabled)
+                return;
        spin_lock_irqsave(&rdev->irq.lock, irqflags);
        rdev->irq.afmt[block] = true;
        radeon_irq_set(rdev);
@@ -419,6 +422,9 @@ void radeon_irq_kms_disable_afmt(struct radeon_device *rdev, int block)
 {
        unsigned long irqflags;
+        if (!rdev->ddev->irq_enabled)
+                return;
        spin_lock_irqsave(&rdev->irq.lock, irqflags);
        rdev->irq.afmt[block] = false;
        radeon_irq_set(rdev);
@@ -438,6 +444,9 @@ void radeon_irq_kms_enable_hpd(struct radeon_device *rdev, unsigned hpd_mask)
        unsigned long irqflags;
        int i;
+        if (!rdev->ddev->irq_enabled)
+                return;
        spin_lock_irqsave(&rdev->irq.lock, irqflags);
        for (i = 0; i < RADEON_MAX_HPD_PINS; ++i)
                rdev->irq.hpd[i] |= !!(hpd_mask & (1 << i));
@@ -458,6 +467,9 @@ void radeon_irq_kms_disable_hpd(struct radeon_device *rdev, unsigned hpd_mask)
        unsigned long irqflags;
        int i;
+        if (!rdev->ddev->irq_enabled)
+                return;
        spin_lock_irqsave(&rdev->irq.lock, irqflags);
        for (i = 0; i < RADEON_MAX_HPD_PINS; ++i)
                rdev->irq.hpd[i] &= !(hpd_mask & (1 << i));
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 80979ed951eb..9128120da044 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2284,6 +2284,12 @@ static u32 si_gpu_check_soft_reset(struct radeon_device *rdev)
        if (tmp & L2_BUSY)
                reset_mask |= RADEON_RESET_VMC;
+        /* Skip MC reset as it's mostly likely not hung, just busy */
+        if (reset_mask & RADEON_RESET_MC) {
+                DRM_DEBUG("MC busy: 0x%08X, clearing.\n", reset_mask);
+                reset_mask &= ~RADEON_RESET_MC;
+        }
        return reset_mask;
 }
diff --git a/drivers/gpu/drm/tegra/Kconfig b/drivers/gpu/drm/tegra/Kconfig
index c92955df0658..be1daf7344d3 100644
--- a/drivers/gpu/drm/tegra/Kconfig
+++ b/drivers/gpu/drm/tegra/Kconfig
@@ -4,7 +4,6 @@ config DRM_TEGRA
        select DRM_KMS_HELPER
        select DRM_GEM_CMA_HELPER
        select DRM_KMS_CMA_HELPER
-        select DRM_HDMI
        select FB_CFB_FILLRECT
        select FB_CFB_COPYAREA
        select FB_CFB_IMAGEBLIT
diff --git a/drivers/hwmon/pmbus/ltc2978.c b/drivers/hwmon/pmbus/ltc2978.c
index 9652a2c92a24..a58de38e23d8 100644
--- a/drivers/hwmon/pmbus/ltc2978.c
+++ b/drivers/hwmon/pmbus/ltc2978.c
@@ -62,7 +62,7 @@ struct ltc2978_data {
        int temp_min, temp_max;
        int vout_min[8], vout_max[8];
        int iout_max[2];
-        int temp2_max[2];
+        int temp2_max;
        struct pmbus_driver_info info;
 };
@@ -204,10 +204,9 @@ static int ltc3880_read_word_data(struct i2c_client *client, int page, int reg)
                ret = pmbus_read_word_data(client, page,
                                           LTC3880_MFR_TEMPERATURE2_PEAK);
                if (ret >= 0) {
-                        if (lin11_to_val(ret)
+                        if (lin11_to_val(ret) > lin11_to_val(data->temp2_max))
-                            > lin11_to_val(data->temp2_max[page]))
+                                data->temp2_max = ret;
-                                data->temp2_max[page] = ret;
+                        ret = data->temp2_max;
-                        ret = data->temp2_max[page];
                }
                break;
        case PMBUS_VIRT_READ_VIN_MIN:
@@ -248,11 +247,11 @@ static int ltc2978_write_word_data(struct i2c_client *client, int page,
        switch (reg) {
        case PMBUS_VIRT_RESET_IOUT_HISTORY:
-                data->iout_max[page] = 0x7fff;
+                data->iout_max[page] = 0x7c00;
                ret = ltc2978_clear_peaks(client, page, data->id);
                break;
        case PMBUS_VIRT_RESET_TEMP2_HISTORY:
-                data->temp2_max[page] = 0x7fff;
+                data->temp2_max = 0x7c00;
                ret = ltc2978_clear_peaks(client, page, data->id);
                break;
        case PMBUS_VIRT_RESET_VOUT_HISTORY:
@@ -262,12 +261,12 @@ static int ltc2978_write_word_data(struct i2c_client *client, int page,
                break;
        case PMBUS_VIRT_RESET_VIN_HISTORY:
                data->vin_min = 0x7bff;
-                data->vin_max = 0;
+                data->vin_max = 0x7c00;
                ret = ltc2978_clear_peaks(client, page, data->id);
                break;
        case PMBUS_VIRT_RESET_TEMP_HISTORY:
                data->temp_min = 0x7bff;
-                data->temp_max = 0x7fff;
+                data->temp_max = 0x7c00;
                ret = ltc2978_clear_peaks(client, page, data->id);
                break;
        default:
@@ -321,12 +320,13 @@ static int ltc2978_probe(struct i2c_client *client,
        info = &data->info;
        info->write_word_data = ltc2978_write_word_data;
-        data->vout_min[0] = 0xffff;
        data->vin_min = 0x7bff;
+        data->vin_max = 0x7c00;
        data->temp_min = 0x7bff;
-        data->temp_max = 0x7fff;
+        data->temp_max = 0x7c00;
+        data->temp2_max = 0x7c00;
-        switch (id->driver_data) {
+        switch (data->id) {
        case ltc2978:
                info->read_word_data = ltc2978_read_word_data;
                info->pages = 8;
@@ -336,7 +336,6 @@ static int ltc2978_probe(struct i2c_client *client,
                for (i = 1; i < 8; i++) {
                        info->func[i] = PMBUS_HAVE_VOUT
                          | PMBUS_HAVE_STATUS_VOUT;
-                        data->vout_min[i] = 0xffff;
                }
                break;
        case ltc3880:
@@ -352,11 +351,14 @@ static int ltc2978_probe(struct i2c_client *client,
                  | PMBUS_HAVE_IOUT | PMBUS_HAVE_STATUS_IOUT
                  | PMBUS_HAVE_POUT
                  | PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP;
-                data->vout_min[1] = 0xffff;
+                data->iout_max[0] = 0x7c00;
+                data->iout_max[1] = 0x7c00;
                break;
        default:
                return -ENODEV;
        }
+        for (i = 0; i < info->pages; i++)
+                data->vout_min[i] = 0xffff;
        return pmbus_do_probe(client, id, info);
 }
diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
index bfe326e896df..2507f902fb7a 100644
--- a/drivers/hwmon/sht15.c
+++ b/drivers/hwmon/sht15.c
@@ -965,7 +965,13 @@ static int sht15_probe(struct platform_device *pdev)
                if (voltage)
                        data->supply_uv = voltage;
-                regulator_enable(data->reg);
+                ret = regulator_enable(data->reg);
+                if (ret != 0) {
+                        dev_err(&pdev->dev,
+                                "failed to enable regulator: %d\n", ret);
+                        return ret;
+                }
                /*
                 * Setup a notifier block to update this if another device
                 * causes the voltage to change
diff --git a/drivers/isdn/hisax/st5481_usb.c b/drivers/isdn/hisax/st5481_usb.c
index 017c67ea3f4c..ead0a4fb7448 100644
--- a/drivers/isdn/hisax/st5481_usb.c
+++ b/drivers/isdn/hisax/st5481_usb.c
@@ -294,13 +294,13 @@ int st5481_setup_usb(struct st5481_adapter *adapter)
        // Allocate URBs and buffers for interrupt endpoint
        urb = usb_alloc_urb(0, GFP_KERNEL);
        if (!urb) {
-                return -ENOMEM;
+                goto err1;
        }
        intr->urb = urb;
        buf = kmalloc(INT_PKT_SIZE, GFP_KERNEL);
        if (!buf) {
-                return -ENOMEM;
+                goto err2;
        }
        endpoint = &altsetting->endpoint[EP_INT-1];
@@ -313,6 +313,14 @@ int st5481_setup_usb(struct st5481_adapter *adapter)
                         endpoint->desc.bInterval);
        return 0;
+err2:
+        usb_free_urb(intr->urb);
+        intr->urb = NULL;
+err1:
+        usb_free_urb(ctrl->urb);
+        ctrl->urb = NULL;
+        return -ENOMEM;
 }
 /*
diff --git a/drivers/mailbox/pl320-ipc.c b/drivers/mailbox/pl320-ipc.c
index c45b3aedafba..d873cbae2fbb 100644
--- a/drivers/mailbox/pl320-ipc.c
+++ b/drivers/mailbox/pl320-ipc.c
@@ -138,8 +138,7 @@ int pl320_ipc_unregister_notifier(struct notifier_block *nb)
 }
 EXPORT_SYMBOL_GPL(pl320_ipc_unregister_notifier);
-static int __init pl320_probe(struct amba_device *adev,
+static int pl320_probe(struct amba_device *adev, const struct amba_id *id)
-                                const struct amba_id *id)
 {
        int ret;
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index e30b490055aa..4d8d90b4fe78 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -154,17 +154,6 @@ config MD_RAID456
          If unsure, say Y.
-config MULTICORE_RAID456
-        bool "RAID-4/RAID-5/RAID-6 Multicore processing (EXPERIMENTAL)"
-        depends on MD_RAID456
-        depends on SMP
-        depends on EXPERIMENTAL
-        ---help---
-          Enable the raid456 module to dispatch per-stripe raid operations to a
-          thread pool.
-          If unsure, say N.
 config MD_MULTIPATH
        tristate "Multipath I/O support"
        depends on BLK_DEV_MD
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 9a01d1e4c783..311e3d35b272 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -91,15 +91,44 @@ static struct raid_type {
        {"raid6_nc", "RAID6 (N continue)",              2, 4, 6, ALGORITHM_ROTATING_N_CONTINUE}
 };
+static char *raid10_md_layout_to_format(int layout)
+{
+        /*
+         * Bit 16 and 17 stand for "offset" and "use_far_sets"
+         * Refer to MD's raid10.c for details
+         */
+        if ((layout & 0x10000) && (layout & 0x20000))
+                return "offset";
+        if ((layout & 0xFF) > 1)
+                return "near";
+        return "far";
+}
 static unsigned raid10_md_layout_to_copies(int layout)
 {
-        return layout & 0xFF;
+        if ((layout & 0xFF) > 1)
+                return layout & 0xFF;
+        return (layout >> 8) & 0xFF;
 }
 static int raid10_format_to_md_layout(char *format, unsigned copies)
 {
-        /* 1 "far" copy, and 'copies' "near" copies */
+        unsigned n = 1, f = 1;
-        return (1 << 8) | (copies & 0xFF);
+        if (!strcmp("near", format))
+                n = copies;
+        else
+                f = copies;
+        if (!strcmp("offset", format))
+                return 0x30000 | (f << 8) | n;
+        if (!strcmp("far", format))
+                return 0x20000 | (f << 8) | n;
+        return (f << 8) | n;
 }
 static struct raid_type *get_raid_type(char *name)
@@ -352,6 +381,7 @@ static int validate_raid_redundancy(struct raid_set *rs)
 {
        unsigned i, rebuild_cnt = 0;
        unsigned rebuilds_per_group, copies, d;
+        unsigned group_size, last_group_start;
        for (i = 0; i < rs->md.raid_disks; i++)
                if (!test_bit(In_sync, &rs->dev[i].rdev.flags) ||
@@ -379,9 +409,6 @@ static int validate_raid_redundancy(struct raid_set *rs)
                 * as long as the failed devices occur in different mirror
                 * groups (i.e. different stripes).
                 *
-                 * Right now, we only allow for "near" copies.  When other
-                 * formats are added, we will have to check those too.
-                 *
                 * When checking "near" format, make sure no adjacent devices
                 * have failed beyond what can be handled.  In addition to the
                 * simple case where the number of devices is a multiple of the
@@ -391,14 +418,41 @@ static int validate_raid_redundancy(struct raid_set *rs)
                 *          A    A    B    B    C
                 *          C    D    D    E    E
                 */
-                for (i = 0; i < rs->md.raid_disks * copies; i++) {
+                if (!strcmp("near", raid10_md_layout_to_format(rs->md.layout))) {
-                        if (!(i % copies))
+                        for (i = 0; i < rs->md.raid_disks * copies; i++) {
+                                if (!(i % copies))
+                                        rebuilds_per_group = 0;
+                                d = i % rs->md.raid_disks;
+                                if ((!rs->dev[d].rdev.sb_page ||
+                                     !test_bit(In_sync, &rs->dev[d].rdev.flags)) &&
+                                    (++rebuilds_per_group >= copies))
+                                        goto too_many;
+                        }
+                        break;
+                }
+                /*
+                 * When checking "far" and "offset" formats, we need to ensure
+                 * that the device that holds its copy is not also dead or
+                 * being rebuilt.  (Note that "far" and "offset" formats only
+                 * support two copies right now.  These formats also only ever
+                 * use the 'use_far_sets' variant.)
+                 *
+                 * This check is somewhat complicated by the need to account
+                 * for arrays that are not a multiple of (far) copies.  This
+                 * results in the need to treat the last (potentially larger)
+                 * set differently.
+                 */
+                group_size = (rs->md.raid_disks / copies);
+                last_group_start = (rs->md.raid_disks / group_size) - 1;
+                last_group_start *= group_size;
+                for (i = 0; i < rs->md.raid_disks; i++) {
+                        if (!(i % copies) && !(i > last_group_start))
                                rebuilds_per_group = 0;
-                        d = i % rs->md.raid_disks;
+                        if ((!rs->dev[i].rdev.sb_page ||
-                        if ((!rs->dev[d].rdev.sb_page ||
+                             !test_bit(In_sync, &rs->dev[i].rdev.flags)) &&
-                             !test_bit(In_sync, &rs->dev[d].rdev.flags)) &&
                            (++rebuilds_per_group >= copies))
-                                goto too_many;
+                                        goto too_many;
                }
                break;
        default:
@@ -433,7 +487,7 @@ too_many:
 *
 * RAID10-only options:
 *    [raid10_copies <# copies>]        Number of copies.  (Default: 2)
- *    [raid10_format <near>]            Layout algorithm.  (Default: near)
+ *    [raid10_format <near|far|offset>] Layout algorithm.  (Default: near)
 */
 static int parse_raid_params(struct raid_set *rs, char **argv,
                             unsigned num_raid_params)
@@ -520,7 +574,9 @@ static int parse_raid_params(struct raid_set *rs, char **argv,
                                rs->ti->error = "'raid10_format' is an invalid parameter for this RAID type";
                                return -EINVAL;
                        }
-                        if (strcmp("near", argv[i])) {
+                        if (strcmp("near", argv[i]) &&
+                            strcmp("far", argv[i]) &&
+                            strcmp("offset", argv[i])) {
                                rs->ti->error = "Invalid 'raid10_format' value given";
                                return -EINVAL;
                        }
@@ -644,6 +700,15 @@ static int parse_raid_params(struct raid_set *rs, char **argv,
                        return -EINVAL;
                }
+                /*
+                 * If the format is not "near", we only support
+                 * two copies at the moment.
+                 */
+                if (strcmp("near", raid10_format) && (raid10_copies > 2)) {
+                        rs->ti->error = "Too many copies for given RAID10 format.";
+                        return -EINVAL;
+                }
                /* (Len * #mirrors) / #devices */
                sectors_per_dev = rs->ti->len * raid10_copies;
                sector_div(sectors_per_dev, rs->md.raid_disks);
@@ -854,17 +919,30 @@ static int super_init_validation(struct mddev *mddev, struct md_rdev *rdev)
        /*
         * Reshaping is not currently allowed
         */
-        if ((le32_to_cpu(sb->level) != mddev->level) ||
+        if (le32_to_cpu(sb->level) != mddev->level) {
-            (le32_to_cpu(sb->layout) != mddev->layout) ||
+                DMERR("Reshaping arrays not yet supported. (RAID level change)");
-            (le32_to_cpu(sb->stripe_sectors) != mddev->chunk_sectors)) {
+                return -EINVAL;
-                DMERR("Reshaping arrays not yet supported.");
+        }
+        if (le32_to_cpu(sb->layout) != mddev->layout) {
+                DMERR("Reshaping arrays not yet supported. (RAID layout change)");
+                DMERR("  0x%X vs 0x%X", le32_to_cpu(sb->layout), mddev->layout);
+                DMERR("  Old layout: %s w/ %d copies",
+                      raid10_md_layout_to_format(le32_to_cpu(sb->layout)),
+                      raid10_md_layout_to_copies(le32_to_cpu(sb->layout)));
+                DMERR("  New layout: %s w/ %d copies",
+                      raid10_md_layout_to_format(mddev->layout),
+                      raid10_md_layout_to_copies(mddev->layout));
+                return -EINVAL;
+        }
+        if (le32_to_cpu(sb->stripe_sectors) != mddev->chunk_sectors) {
+                DMERR("Reshaping arrays not yet supported. (stripe sectors change)");
                return -EINVAL;
        }
        /* We can only change the number of devices in RAID1 right now */
        if ((rs->raid_type->level != 1) &&
            (le32_to_cpu(sb->num_devices) != mddev->raid_disks)) {
-                DMERR("Reshaping arrays not yet supported.");
+                DMERR("Reshaping arrays not yet supported. (device count change)");
                return -EINVAL;
        }
@@ -1329,7 +1407,8 @@ static void raid_status(struct dm_target *ti, status_type_t type,
                               raid10_md_layout_to_copies(rs->md.layout));
                if (rs->print_flags & DMPF_RAID10_FORMAT)
-                        DMEMIT(" raid10_format near");
+                        DMEMIT(" raid10_format %s",
+                               raid10_md_layout_to_format(rs->md.layout));
                DMEMIT(" %d", rs->md.raid_disks);
                for (i = 0; i < rs->md.raid_disks; i++) {
@@ -1418,6 +1497,10 @@ static struct target_type raid_target = {
 static int __init dm_raid_init(void)
 {
+        DMINFO("Loading target version %u.%u.%u",
+               raid_target.version[0],
+               raid_target.version[1],
+               raid_target.version[2]);
        return dm_register_target(&raid_target);
 }
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 3db3d1b271f7..fcb878f88796 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -307,6 +307,10 @@ static void md_make_request(struct request_queue *q, struct bio *bio)
                bio_io_error(bio);
                return;
        }
+        if (mddev->ro == 1 && unlikely(rw == WRITE)) {
+                bio_endio(bio, bio_sectors(bio) == 0 ? 0 : -EROFS);
+                return;
+        }
        smp_rmb(); /* Ensure implications of  'active' are visible */
        rcu_read_lock();
        if (mddev->suspended) {
@@ -2994,6 +2998,9 @@ rdev_size_store(struct md_rdev *rdev, const char *buf, size_t len)
                } else if (!sectors)
                        sectors = (i_size_read(rdev->bdev->bd_inode) >> 9) -
                                rdev->data_offset;
+                if (!my_mddev->pers->resize)
+                        /* Cannot change size for RAID0 or Linear etc */
+                        return -EINVAL;
        }
        if (sectors < my_mddev->dev_sectors)
                return -EINVAL; /* component must fit device */
@@ -6525,7 +6532,17 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
                        mddev->ro = 0;
                        sysfs_notify_dirent_safe(mddev->sysfs_state);
                        set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
-                        md_wakeup_thread(mddev->thread);
+                        /* mddev_unlock will wake thread */
+                        /* If a device failed while we were read-only, we
+                         * need to make sure the metadata is updated now.
+                         */
+                        if (test_bit(MD_CHANGE_DEVS, &mddev->flags)) {
+                                mddev_unlock(mddev);
+                                wait_event(mddev->sb_wait,
+                                           !test_bit(MD_CHANGE_DEVS, &mddev->flags) &&
+                                           !test_bit(MD_CHANGE_PENDING, &mddev->flags));
+                                mddev_lock(mddev);
+                        }
                } else {
                        err = -EROFS;
                        goto abort_unlock;
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 24b359717a7e..0505452de8d6 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -175,7 +175,13 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
                        rdev1->new_raid_disk = j;
                }
-                if (j < 0 || j >= mddev->raid_disks) {
+                if (j < 0) {
+                        printk(KERN_ERR
+                               "md/raid0:%s: remove inactive devices before converting to RAID0\n",
+                               mdname(mddev));
+                        goto abort;
+                }
+                if (j >= mddev->raid_disks) {
                        printk(KERN_ERR "md/raid0:%s: bad disk number %d - "
                               "aborting!\n", mdname(mddev), j);
                        goto abort;
@@ -289,7 +295,7 @@ abort:
        kfree(conf->strip_zone);
        kfree(conf->devlist);
        kfree(conf);
-        *private_conf = NULL;
+        *private_conf = ERR_PTR(err);
        return err;
 }
@@ -411,7 +417,8 @@ static sector_t raid0_size(struct mddev *mddev, sector_t sectors, int raid_disks
                  "%s does not support generic reshape\n", __func__);
        rdev_for_each(rdev, mddev)
-                array_sectors += rdev->sectors;
+                array_sectors += (rdev->sectors &
+                                  ~(sector_t)(mddev->chunk_sectors-1));
        return array_sectors;
 }
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index d5bddfc4010e..fd86b372692d 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -967,6 +967,7 @@ static void raid1_unplug(struct blk_plug_cb *cb, bool from_schedule)
                bio_list_merge(&conf->pending_bio_list, &plug->pending);
                conf->pending_count += plug->pending_cnt;
                spin_unlock_irq(&conf->device_lock);
+                wake_up(&conf->wait_barrier);
                md_wakeup_thread(mddev->thread);
                kfree(plug);
                return;
@@ -1000,6 +1001,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
        const unsigned long do_flush_fua = (bio->bi_rw & (REQ_FLUSH | REQ_FUA));
        const unsigned long do_discard = (bio->bi_rw
                                          & (REQ_DISCARD | REQ_SECURE));
+        const unsigned long do_same = (bio->bi_rw & REQ_WRITE_SAME);
        struct md_rdev *blocked_rdev;
        struct blk_plug_cb *cb;
        struct raid1_plug_cb *plug = NULL;
@@ -1301,7 +1303,8 @@ read_again:
                                   conf->mirrors[i].rdev->data_offset);
                mbio->bi_bdev = conf->mirrors[i].rdev->bdev;
                mbio->bi_end_io = raid1_end_write_request;
-                mbio->bi_rw = WRITE | do_flush_fua | do_sync | do_discard;
+                mbio->bi_rw =
+                        WRITE | do_flush_fua | do_sync | do_discard | do_same;
                mbio->bi_private = r1_bio;
                atomic_inc(&r1_bio->remaining);
@@ -2818,6 +2821,9 @@ static int run(struct mddev *mddev)
        if (IS_ERR(conf))
                return PTR_ERR(conf);
+        if (mddev->queue)
+                blk_queue_max_write_same_sectors(mddev->queue,
+                                                 mddev->chunk_sectors);
        rdev_for_each(rdev, mddev) {
                if (!mddev->gendisk)
                        continue;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 64d48249c03b..77b562d18a90 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -38,21 +38,36 @@
 *    near_copies (stored in low byte of layout)
 *    far_copies (stored in second byte of layout)
 *    far_offset (stored in bit 16 of layout )
+ *    use_far_sets (stored in bit 17 of layout )
 *
- * The data to be stored is divided into chunks using chunksize.
+ * The data to be stored is divided into chunks using chunksize.  Each device
- * Each device is divided into far_copies sections.
+ * is divided into far_copies sections.   In each section, chunks are laid out
- * In each section, chunks are laid out in a style similar to raid0, but
+ * in a style similar to raid0, but near_copies copies of each chunk is stored
- * near_copies copies of each chunk is stored (each on a different drive).
+ * (each on a different drive).  The starting device for each section is offset
- * The starting device for each section is offset near_copies from the starting
+ * near_copies from the starting device of the previous section.  Thus there
- * device of the previous section.
+ * are (near_copies * far_copies) of each chunk, and each is on a different
- * Thus they are (near_copies*far_copies) of each chunk, and each is on a different
+ * drive.  near_copies and far_copies must be at least one, and their product
- * drive.
+ * is at most raid_disks.
- * near_copies and far_copies must be at least one, and their product is at most
- * raid_disks.
 *
 * If far_offset is true, then the far_copies are handled a bit differently.
- * The copies are still in different stripes, but instead of be very far apart
+ * The copies are still in different stripes, but instead of being very far
- * on disk, there are adjacent stripes.
+ * apart on disk, there are adjacent stripes.
+ *
+ * The far and offset algorithms are handled slightly differently if
+ * 'use_far_sets' is true.  In this case, the array's devices are grouped into
+ * sets that are (near_copies * far_copies) in size.  The far copied stripes
+ * are still shifted by 'near_copies' devices, but this shifting stays confined
+ * to the set rather than the entire array.  This is done to improve the number
+ * of device combinations that can fail without causing the array to fail.
+ * Example 'far' algorithm w/o 'use_far_sets' (each letter represents a chunk
+ * on a device):
+ *    A B C D    A B C D E
+ *      ...         ...
+ *    D A B C    E A B C D
+ * Example 'far' algorithm w/ 'use_far_sets' enabled (sets illustrated w/ []'s):
+ *    [A B] [C D]    [A B] [C D E]
+ *    |...| |...|    |...| | ... |
+ *    [B A] [D C]    [B A] [E C D]
 */
 /*
@@ -535,6 +550,13 @@ static void __raid10_find_phys(struct geom *geo, struct r10bio *r10bio)
        sector_t stripe;
        int dev;
        int slot = 0;
+        int last_far_set_start, last_far_set_size;
+        last_far_set_start = (geo->raid_disks / geo->far_set_size) - 1;
+        last_far_set_start *= geo->far_set_size;
+        last_far_set_size = geo->far_set_size;
+        last_far_set_size += (geo->raid_disks % geo->far_set_size);
        /* now calculate first sector/dev */
        chunk = r10bio->sector >> geo->chunk_shift;
@@ -551,15 +573,25 @@ static void __raid10_find_phys(struct geom *geo, struct r10bio *r10bio)
        /* and calculate all the others */
        for (n = 0; n < geo->near_copies; n++) {
                int d = dev;
+                int set;
                sector_t s = sector;
-                r10bio->devs[slot].addr = sector;
                r10bio->devs[slot].devnum = d;
+                r10bio->devs[slot].addr = s;
                slot++;
                for (f = 1; f < geo->far_copies; f++) {
+                        set = d / geo->far_set_size;
                        d += geo->near_copies;
-                        if (d >= geo->raid_disks)
-                                d -= geo->raid_disks;
+                        if ((geo->raid_disks % geo->far_set_size) &&
+                            (d > last_far_set_start)) {
+                                d -= last_far_set_start;
+                                d %= last_far_set_size;
+                                d += last_far_set_start;
+                        } else {
+                                d %= geo->far_set_size;
+                                d += geo->far_set_size * set;
+                        }
                        s += geo->stride;
                        r10bio->devs[slot].devnum = d;
                        r10bio->devs[slot].addr = s;
@@ -595,6 +627,20 @@ static sector_t raid10_find_virt(struct r10conf *conf, sector_t sector, int dev)
         * or recovery, so reshape isn't happening
         */
        struct geom *geo = &conf->geo;
+        int far_set_start = (dev / geo->far_set_size) * geo->far_set_size;
+        int far_set_size = geo->far_set_size;
+        int last_far_set_start;
+        if (geo->raid_disks % geo->far_set_size) {
+                last_far_set_start = (geo->raid_disks / geo->far_set_size) - 1;
+                last_far_set_start *= geo->far_set_size;
+                if (dev >= last_far_set_start) {
+                        far_set_size = geo->far_set_size;
+                        far_set_size += (geo->raid_disks % geo->far_set_size);
+                        far_set_start = last_far_set_start;
+                }
+        }
        offset = sector & geo->chunk_mask;
        if (geo->far_offset) {
@@ -602,13 +648,13 @@ static sector_t raid10_find_virt(struct r10conf *conf, sector_t sector, int dev)
                chunk = sector >> geo->chunk_shift;
                fc = sector_div(chunk, geo->far_copies);
                dev -= fc * geo->near_copies;
-                if (dev < 0)
+                if (dev < far_set_start)
-                        dev += geo->raid_disks;
+                        dev += far_set_size;
        } else {
                while (sector >= geo->stride) {
                        sector -= geo->stride;
-                        if (dev < geo->near_copies)
+                        if (dev < (geo->near_copies + far_set_start))
-                                dev += geo->raid_disks - geo->near_copies;
+                                dev += far_set_size - geo->near_copies;
                        else
                                dev -= geo->near_copies;
                }
@@ -1073,6 +1119,7 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)
                bio_list_merge(&conf->pending_bio_list, &plug->pending);
                conf->pending_count += plug->pending_cnt;
                spin_unlock_irq(&conf->device_lock);
+                wake_up(&conf->wait_barrier);
                md_wakeup_thread(mddev->thread);
                kfree(plug);
                return;
@@ -1105,6 +1152,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
        const unsigned long do_fua = (bio->bi_rw & REQ_FUA);
        const unsigned long do_discard = (bio->bi_rw
                                          & (REQ_DISCARD | REQ_SECURE));
+        const unsigned long do_same = (bio->bi_rw & REQ_WRITE_SAME);
        unsigned long flags;
        struct md_rdev *blocked_rdev;
        struct blk_plug_cb *cb;
@@ -1460,7 +1508,8 @@ retry_write:
                                                              rdev));
                        mbio->bi_bdev = rdev->bdev;
                        mbio->bi_end_io = raid10_end_write_request;
-                        mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
+                        mbio->bi_rw =
+                                WRITE | do_sync | do_fua | do_discard | do_same;
                        mbio->bi_private = r10_bio;
                        atomic_inc(&r10_bio->remaining);
@@ -1502,7 +1551,8 @@ retry_write:
                                                   r10_bio, rdev));
                        mbio->bi_bdev = rdev->bdev;
                        mbio->bi_end_io = raid10_end_write_request;
-                        mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
+                        mbio->bi_rw =
+                                WRITE | do_sync | do_fua | do_discard | do_same;
                        mbio->bi_private = r10_bio;
                        atomic_inc(&r10_bio->remaining);
@@ -3436,7 +3486,7 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new)
                disks = mddev->raid_disks + mddev->delta_disks;
                break;
        }
-        if (layout >> 17)
+        if (layout >> 18)
                return -1;
        if (chunk < (PAGE_SIZE >> 9) ||
            !is_power_of_2(chunk))
@@ -3448,6 +3498,7 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new)
        geo->near_copies = nc;
        geo->far_copies = fc;
        geo->far_offset = fo;
+        geo->far_set_size = (layout & (1<<17)) ? disks / fc : disks;
        geo->chunk_mask = chunk - 1;
        geo->chunk_shift = ffz(~chunk);
        return nc*fc;
@@ -3569,6 +3620,8 @@ static int run(struct mddev *mddev)
        if (mddev->queue) {
                blk_queue_max_discard_sectors(mddev->queue,
                                              mddev->chunk_sectors);
+                blk_queue_max_write_same_sectors(mddev->queue,
+                                                 mddev->chunk_sectors);
                blk_queue_io_min(mddev->queue, chunk_size);
                if (conf->geo.raid_disks % conf->geo.near_copies)
                        blk_queue_io_opt(mddev->queue, chunk_size * conf->geo.raid_disks);
diff --git a/drivers/md/raid10.h b/drivers/md/raid10.h
index 1054cf602345..157d69e83ff4 100644
--- a/drivers/md/raid10.h
+++ b/drivers/md/raid10.h
@@ -33,6 +33,11 @@ struct r10conf {
                                               * far_offset, in which case it is
                                               * 1 stripe.
                                               */
+                int             far_set_size; /* The number of devices in a set,
+                                               * where a 'set' are devices that
+                                               * contain far/offset copies of
+                                               * each other.
+                                               */
                int             chunk_shift; /* shift from chunks to sectors */
                sector_t        chunk_mask;
        } prev, geo;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 5af2d2709081..3ee2912889e7 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1403,7 +1403,7 @@ static void ops_run_check_pq(struct stripe_head *sh, struct raid5_percpu *percpu
                           &sh->ops.zero_sum_result, percpu->spare_page, &submit);
 }
-static void __raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
+static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
 {
        int overlap_clear = 0, i, disks = sh->disks;
        struct dma_async_tx_descriptor *tx = NULL;
@@ -1468,36 +1468,6 @@ static void __raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
        put_cpu();
 }
-#ifdef CONFIG_MULTICORE_RAID456
-static void async_run_ops(void *param, async_cookie_t cookie)
-{
-        struct stripe_head *sh = param;
-        unsigned long ops_request = sh->ops.request;
-        clear_bit_unlock(STRIPE_OPS_REQ_PENDING, &sh->state);
-        wake_up(&sh->ops.wait_for_ops);
-        __raid_run_ops(sh, ops_request);
-        release_stripe(sh);
-}
-static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
-{
-        /* since handle_stripe can be called outside of raid5d context
-         * we need to ensure sh->ops.request is de-staged before another
-         * request arrives
-         */
-        wait_event(sh->ops.wait_for_ops,
-                   !test_and_set_bit_lock(STRIPE_OPS_REQ_PENDING, &sh->state));
-        sh->ops.request = ops_request;
-        atomic_inc(&sh->count);
-        async_schedule(async_run_ops, sh);
-}
-#else
-#define raid_run_ops __raid_run_ops
-#endif
 static int grow_one_stripe(struct r5conf *conf)
 {
        struct stripe_head *sh;
@@ -1506,9 +1476,6 @@ static int grow_one_stripe(struct r5conf *conf)
                return 0;
        sh->raid_conf = conf;
-        #ifdef CONFIG_MULTICORE_RAID456
-        init_waitqueue_head(&sh->ops.wait_for_ops);
-        #endif
        spin_lock_init(&sh->stripe_lock);
@@ -1627,9 +1594,6 @@ static int resize_stripes(struct r5conf *conf, int newsize)
                        break;
                nsh->raid_conf = conf;
-                #ifdef CONFIG_MULTICORE_RAID456
-                init_waitqueue_head(&nsh->ops.wait_for_ops);
-                #endif
                spin_lock_init(&nsh->stripe_lock);
                list_add(&nsh->lru, &newstripes);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 11d01d67b3f5..7bd068a6056a 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1629,7 +1629,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        /* If this is the first slave, then we need to set the master's hardware
         * address to be the same as the slave's. */
-        if (bond->dev_addr_from_first)
+        if (bond->slave_cnt == 0 && bond->dev_addr_from_first)
                bond_set_dev_addr(bond->dev, slave_dev);
        new_slave = kzalloc(sizeof(struct slave), GFP_KERNEL);
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index 639049d7e92d..da5f4397f87c 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -301,12 +301,16 @@ static int bgmac_dma_rx_read(struct bgmac *bgmac, struct bgmac_dma_ring *ring,
                        bgmac_err(bgmac, "Found poisoned packet at slot %d, DMA issue!\n",
                                  ring->start);
                } else {
+                        /* Omit CRC. */
+                        len -= ETH_FCS_LEN;
                        new_skb = netdev_alloc_skb_ip_align(bgmac->net_dev, len);
                        if (new_skb) {
                                skb_put(new_skb, len);
                                skb_copy_from_linear_data_offset(skb, BGMAC_RX_FRAME_OFFSET,
                                                                 new_skb->data,
                                                                 len);
+                                skb_checksum_none_assert(skb);
                                new_skb->protocol =
                                        eth_type_trans(new_skb, bgmac->net_dev);
                                netif_receive_skb(new_skb);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index ecac04a3687c..a923bc4d5a1f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3142,7 +3142,7 @@ static inline __le16 bnx2x_csum_fix(unsigned char *t_header, u16 csum, s8 fix)
                tsum = ~csum_fold(csum_add((__force __wsum) csum,
                                  csum_partial(t_header, -fix, 0)));
-        return bswab16(csum);
+        return bswab16(tsum);
 }
 static inline u32 bnx2x_xmit_type(struct bnx2x *bp, struct sk_buff *skb)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 9a674b14b403..edfa67adf2f9 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -281,6 +281,8 @@ static int bnx2x_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                        cmd->lp_advertising |= ADVERTISED_2500baseX_Full;
                if (status & LINK_STATUS_LINK_PARTNER_10GXFD_CAPABLE)
                        cmd->lp_advertising |= ADVERTISED_10000baseT_Full;
+                if (status & LINK_STATUS_LINK_PARTNER_20GXFD_CAPABLE)
+                        cmd->lp_advertising |= ADVERTISED_20000baseKR2_Full;
        }
        cmd->maxtxpkt = 0;
@@ -463,6 +465,10 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                                                ADVERTISED_10000baseKR_Full))
                                bp->link_params.speed_cap_mask[cfg_idx] |=
                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_10G;
+                        if (cmd->advertising & ADVERTISED_20000baseKR2_Full)
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_20G;
                }
        } else { /* forced speed */
                /* advertise the requested speed and duplex if supported */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index 1663e0b6b5a0..31c5787970db 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -10422,6 +10422,28 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                         MDIO_PMA_DEVAD,
                                         MDIO_PMA_REG_8481_LED1_MASK,
                                         0x0);
+                        if (phy->type ==
+                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84834) {
+                                /* Disable MI_INT interrupt before setting LED4
+                                 * source to constant off.
+                                 */
+                                if (REG_RD(bp, NIG_REG_MASK_INTERRUPT_PORT0 +
+                                           params->port*4) &
+                                    NIG_MASK_MI_INT) {
+                                        params->link_flags |=
+                                        LINK_FLAGS_INT_DISABLED;
+                                        bnx2x_bits_dis(
+                                                bp,
+                                                NIG_REG_MASK_INTERRUPT_PORT0 +
+                                                params->port*4,
+                                                NIG_MASK_MI_INT);
+                                }
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_SIGNAL_MASK,
+                                                 0x0);
+                        }
                }
                break;
        case LED_MODE_ON:
@@ -10468,6 +10490,28 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                         MDIO_PMA_DEVAD,
                                         MDIO_PMA_REG_8481_LED1_MASK,
                                         0x20);
+                        if (phy->type ==
+                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84834) {
+                                /* Disable MI_INT interrupt before setting LED4
+                                 * source to constant on.
+                                 */
+                                if (REG_RD(bp, NIG_REG_MASK_INTERRUPT_PORT0 +
+                                           params->port*4) &
+                                    NIG_MASK_MI_INT) {
+                                        params->link_flags |=
+                                        LINK_FLAGS_INT_DISABLED;
+                                        bnx2x_bits_dis(
+                                                bp,
+                                                NIG_REG_MASK_INTERRUPT_PORT0 +
+                                                params->port*4,
+                                                NIG_MASK_MI_INT);
+                                }
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_SIGNAL_MASK,
+                                                 0x20);
+                        }
                }
                break;
@@ -10532,6 +10576,22 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                         MDIO_PMA_DEVAD,
                                         MDIO_PMA_REG_8481_LINK_SIGNAL,
                                         val);
+                        if (phy->type ==
+                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84834) {
+                                /* Restore LED4 source to external link,
+                                 * and re-enable interrupts.
+                                 */
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_SIGNAL_MASK,
+                                                 0x40);
+                                if (params->link_flags &
+                                    LINK_FLAGS_INT_DISABLED) {
+                                        bnx2x_link_int_enable(params);
+                                        params->link_flags &=
+                                                ~LINK_FLAGS_INT_DISABLED;
+                                }
+                        }
                }
                break;
        }
@@ -11791,6 +11851,8 @@ static int bnx2x_populate_int_phy(struct bnx2x *bp, u32 shmem_base, u8 port,
                        phy->media_type = ETH_PHY_KR;
                        phy->flags |= FLAGS_WC_DUAL_MODE;
                        phy->supported &= (SUPPORTED_20000baseKR2_Full |
+                                           SUPPORTED_10000baseT_Full |
+                                           SUPPORTED_1000baseT_Full |
                                           SUPPORTED_Autoneg |
                                           SUPPORTED_FIBRE |
                                           SUPPORTED_Pause |
@@ -13437,7 +13499,7 @@ void bnx2x_period_func(struct link_params *params, struct link_vars *vars)
                struct bnx2x_phy *phy = &params->phy[INT_PHY];
                bnx2x_set_aer_mmd(params, phy);
                if ((phy->supported & SUPPORTED_20000baseKR2_Full) &&
-                    (phy->speed_cap_mask & SPEED_20000))
+                    (phy->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_20G))
                        bnx2x_check_kr2_wa(params, vars, phy);
                bnx2x_check_over_curr(params, vars);
                if (vars->rx_tx_asic_rst)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
index d25c7d79787a..be5c195d03dd 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
@@ -307,7 +307,8 @@ struct link_params {
        struct bnx2x *bp;
        u16 req_fc_auto_adv; /* Should be set to TX / BOTH when
                                req_flow_ctrl is set to AUTO */
-        u16 rsrv1;
+        u16 link_flags;
+#define LINK_FLAGS_INT_DISABLED         (1<<0)
        u32 lfa_base;
 };
diff --git a/drivers/net/ethernet/freescale/fec.c b/drivers/net/ethernet/freescale/fec.c
index fccc3bf2141d..069a155d16ed 100644
--- a/drivers/net/ethernet/freescale/fec.c
+++ b/drivers/net/ethernet/freescale/fec.c
@@ -246,14 +246,13 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
        struct bufdesc *bdp;
        void *bufaddr;
        unsigned short  status;
-        unsigned long flags;
+        unsigned int index;
        if (!fep->link) {
                /* Link is down or autonegotiation is in progress. */
                return NETDEV_TX_BUSY;
        }
-        spin_lock_irqsave(&fep->hw_lock, flags);
        /* Fill in a Tx ring entry */
        bdp = fep->cur_tx;
@@ -264,7 +263,6 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 * This should not happen, since ndev->tbusy should be set.
                 */
                printk("%s: tx queue full!.\n", ndev->name);
-                spin_unlock_irqrestore(&fep->hw_lock, flags);
                return NETDEV_TX_BUSY;
        }
@@ -280,13 +278,13 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         * 4-byte boundaries. Use bounce buffers to copy data
         * and get it aligned. Ugh.
         */
+        if (fep->bufdesc_ex)
+                index = (struct bufdesc_ex *)bdp -
+                        (struct bufdesc_ex *)fep->tx_bd_base;
+        else
+                index = bdp - fep->tx_bd_base;
        if (((unsigned long) bufaddr) & FEC_ALIGNMENT) {
-                unsigned int index;
-                if (fep->bufdesc_ex)
-                        index = (struct bufdesc_ex *)bdp -
-                                (struct bufdesc_ex *)fep->tx_bd_base;
-                else
-                        index = bdp - fep->tx_bd_base;
                memcpy(fep->tx_bounce[index], skb->data, skb->len);
                bufaddr = fep->tx_bounce[index];
        }
@@ -300,10 +298,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                swap_buffer(bufaddr, skb->len);
        /* Save skb pointer */
-        fep->tx_skbuff[fep->skb_cur] = skb;
+        fep->tx_skbuff[index] = skb;
-        ndev->stats.tx_bytes += skb->len;
-        fep->skb_cur = (fep->skb_cur+1) & TX_RING_MOD_MASK;
        /* Push the data cache so the CPM does not get stale memory
         * data.
@@ -331,26 +326,22 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                        ebdp->cbd_esc = BD_ENET_TX_INT;
                }
        }
-        /* Trigger transmission start */
-        writel(0, fep->hwp + FEC_X_DES_ACTIVE);
        /* If this was the last BD in the ring, start at the beginning again. */
        if (status & BD_ENET_TX_WRAP)
                bdp = fep->tx_bd_base;
        else
                bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
-        if (bdp == fep->dirty_tx) {
+        fep->cur_tx = bdp;
-                fep->tx_full = 1;
+        if (fep->cur_tx == fep->dirty_tx)
                netif_stop_queue(ndev);
-        }
-        fep->cur_tx = bdp;
+        /* Trigger transmission start */
+        writel(0, fep->hwp + FEC_X_DES_ACTIVE);
        skb_tx_timestamp(skb);
-        spin_unlock_irqrestore(&fep->hw_lock, flags);
        return NETDEV_TX_OK;
 }
@@ -406,11 +397,8 @@ fec_restart(struct net_device *ndev, int duplex)
                writel((unsigned long)fep->bd_dma + sizeof(struct bufdesc)
                        * RX_RING_SIZE, fep->hwp + FEC_X_DES_START);
-        fep->dirty_tx = fep->cur_tx = fep->tx_bd_base;
        fep->cur_rx = fep->rx_bd_base;
-        /* Reset SKB transmit buffers. */
-        fep->skb_cur = fep->skb_dirty = 0;
        for (i = 0; i <= TX_RING_MOD_MASK; i++) {
                if (fep->tx_skbuff[i]) {
                        dev_kfree_skb_any(fep->tx_skbuff[i]);
@@ -573,20 +561,35 @@ fec_enet_tx(struct net_device *ndev)
        struct bufdesc *bdp;
        unsigned short status;
        struct  sk_buff *skb;
+        int     index = 0;
        fep = netdev_priv(ndev);
-        spin_lock(&fep->hw_lock);
        bdp = fep->dirty_tx;
+        /* get next bdp of dirty_tx */
+        if (bdp->cbd_sc & BD_ENET_TX_WRAP)
+                bdp = fep->tx_bd_base;
+        else
+                bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
        while (((status = bdp->cbd_sc) & BD_ENET_TX_READY) == 0) {
-                if (bdp == fep->cur_tx && fep->tx_full == 0)
+                /* current queue is empty */
+                if (bdp == fep->cur_tx)
                        break;
+                if (fep->bufdesc_ex)
+                        index = (struct bufdesc_ex *)bdp -
+                                (struct bufdesc_ex *)fep->tx_bd_base;
+                else
+                        index = bdp - fep->tx_bd_base;
                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
                                FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
                bdp->cbd_bufaddr = 0;
-                skb = fep->tx_skbuff[fep->skb_dirty];
+                skb = fep->tx_skbuff[index];
                /* Check for errors. */
                if (status & (BD_ENET_TX_HB | BD_ENET_TX_LC |
                                   BD_ENET_TX_RL | BD_ENET_TX_UN |
@@ -631,8 +634,9 @@ fec_enet_tx(struct net_device *ndev)
                /* Free the sk buffer associated with this last transmit */
                dev_kfree_skb_any(skb);
-                fep->tx_skbuff[fep->skb_dirty] = NULL;
+                fep->tx_skbuff[index] = NULL;
-                fep->skb_dirty = (fep->skb_dirty + 1) & TX_RING_MOD_MASK;
+                fep->dirty_tx = bdp;
                /* Update pointer to next buffer descriptor to be transmitted */
                if (status & BD_ENET_TX_WRAP)
@@ -642,14 +646,12 @@ fec_enet_tx(struct net_device *ndev)
                /* Since we have freed up a buffer, the ring is no longer full
                 */
-                if (fep->tx_full) {
+                if (fep->dirty_tx != fep->cur_tx) {
-                        fep->tx_full = 0;
                        if (netif_queue_stopped(ndev))
                                netif_wake_queue(ndev);
                }
        }
-        fep->dirty_tx = bdp;
+        return;
-        spin_unlock(&fep->hw_lock);
 }
@@ -816,7 +818,7 @@ fec_enet_interrupt(int irq, void *dev_id)
                int_events = readl(fep->hwp + FEC_IEVENT);
                writel(int_events, fep->hwp + FEC_IEVENT);
-                if (int_events & FEC_ENET_RXF) {
+                if (int_events & (FEC_ENET_RXF | FEC_ENET_TXF)) {
                        ret = IRQ_HANDLED;
                        /* Disable the RX interrupt */
@@ -827,15 +829,6 @@ fec_enet_interrupt(int irq, void *dev_id)
                        }
                }
-                /* Transmit OK, or non-fatal error. Update the buffer
-                 * descriptors. FEC handles all errors, we just discover
-                 * them as part of the transmit process.
-                 */
-                if (int_events & FEC_ENET_TXF) {
-                        ret = IRQ_HANDLED;
-                        fec_enet_tx(ndev);
-                }
                if (int_events & FEC_ENET_MII) {
                        ret = IRQ_HANDLED;
                        complete(&fep->mdio_done);
@@ -851,6 +844,8 @@ static int fec_enet_rx_napi(struct napi_struct *napi, int budget)
        int pkts = fec_enet_rx(ndev, budget);
        struct fec_enet_private *fep = netdev_priv(ndev);
+        fec_enet_tx(ndev);
        if (pkts < budget) {
                napi_complete(napi);
                writel(FEC_DEFAULT_IMASK, fep->hwp + FEC_IMASK);
@@ -1646,6 +1641,7 @@ static int fec_enet_init(struct net_device *ndev)
        /* ...and the same for transmit */
        bdp = fep->tx_bd_base;
+        fep->cur_tx = bdp;
        for (i = 0; i < TX_RING_SIZE; i++) {
                /* Initialize the BD for every fragment in the page. */
@@ -1657,6 +1653,7 @@ static int fec_enet_init(struct net_device *ndev)
        /* Set the last buffer to wrap */
        bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
        bdp->cbd_sc |= BD_SC_WRAP;
+        fep->dirty_tx = bdp;
        fec_restart(ndev, 0);
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index 01579b8e37c4..f5390071efd0 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -97,6 +97,13 @@ struct bufdesc {
        unsigned short cbd_sc;  /* Control and status info */
        unsigned long cbd_bufaddr;      /* Buffer address */
 };
+#else
+struct bufdesc {
+        unsigned short  cbd_sc;                 /* Control and status info */
+        unsigned short  cbd_datlen;             /* Data length */
+        unsigned long   cbd_bufaddr;            /* Buffer address */
+};
+#endif
 struct bufdesc_ex {
        struct bufdesc desc;
@@ -107,14 +114,6 @@ struct bufdesc_ex {
        unsigned short res0[4];
 };
-#else
-struct bufdesc {
-        unsigned short  cbd_sc;                 /* Control and status info */
-        unsigned short  cbd_datlen;             /* Data length */
-        unsigned long   cbd_bufaddr;            /* Buffer address */
-};
-#endif
 /*
 *      The following definitions courtesy of commproc.h, which where
 *      Copyright (c) 1997 Dan Malek (dmalek@jlc.net).
@@ -214,8 +213,6 @@ struct fec_enet_private {
        unsigned char *tx_bounce[TX_RING_SIZE];
        struct  sk_buff *tx_skbuff[TX_RING_SIZE];
        struct  sk_buff *rx_skbuff[RX_RING_SIZE];
-        ushort  skb_cur;
-        ushort  skb_dirty;
        /* CPM dual port RAM relative addresses */
        dma_addr_t      bd_dma;
@@ -227,7 +224,6 @@ struct fec_enet_private {
        /* The ring entries to be free()ed */
        struct bufdesc  *dirty_tx;
-        uint    tx_full;
        /* hold while accessing the HW like ringbuffer for tx/rx but not MAC */
        spinlock_t hw_lock;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 8900398ba103..28fb50a1e9c3 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -4765,8 +4765,10 @@ static void rtl_hw_start_8168bb(struct rtl8169_private *tp)
        RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
-        rtl_tx_performance_tweak(pdev,
+        if (tp->dev->mtu <= ETH_DATA_LEN) {
-                (0x5 << MAX_READ_REQUEST_SHIFT) | PCI_EXP_DEVCTL_NOSNOOP_EN);
+                rtl_tx_performance_tweak(pdev, (0x5 << MAX_READ_REQUEST_SHIFT) |
+                                         PCI_EXP_DEVCTL_NOSNOOP_EN);
+        }
 }
 static void rtl_hw_start_8168bef(struct rtl8169_private *tp)
@@ -4789,7 +4791,8 @@ static void __rtl_hw_start_8168cp(struct rtl8169_private *tp)
        RTL_W8(Config3, RTL_R8(Config3) & ~Beacon_en);
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
        rtl_disable_clock_request(pdev);
@@ -4822,7 +4825,8 @@ static void rtl_hw_start_8168cp_2(struct rtl8169_private *tp)
        RTL_W8(Config3, RTL_R8(Config3) & ~Beacon_en);
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
        RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
 }
@@ -4841,7 +4845,8 @@ static void rtl_hw_start_8168cp_3(struct rtl8169_private *tp)
        RTL_W8(MaxTxPacketSize, TxPacketMax);
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
        RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
 }
@@ -4901,7 +4906,8 @@ static void rtl_hw_start_8168d(struct rtl8169_private *tp)
        RTL_W8(MaxTxPacketSize, TxPacketMax);
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
        RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
 }
@@ -4913,7 +4919,8 @@ static void rtl_hw_start_8168dp(struct rtl8169_private *tp)
        rtl_csi_access_enable_1(tp);
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
        RTL_W8(MaxTxPacketSize, TxPacketMax);
@@ -4972,7 +4979,8 @@ static void rtl_hw_start_8168e_1(struct rtl8169_private *tp)
        rtl_ephy_init(tp, e_info_8168e_1, ARRAY_SIZE(e_info_8168e_1));
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
        RTL_W8(MaxTxPacketSize, TxPacketMax);
@@ -4998,7 +5006,8 @@ static void rtl_hw_start_8168e_2(struct rtl8169_private *tp)
        rtl_ephy_init(tp, e_info_8168e_2, ARRAY_SIZE(e_info_8168e_2));
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
        rtl_eri_write(tp, 0xc0, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
        rtl_eri_write(tp, 0xb8, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index bf57b3cb16ab..0bc00991d310 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -779,6 +779,7 @@ efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries)
                                                tx_queue->txd.entries);
        }
+        efx_device_detach_sync(efx);
        efx_stop_all(efx);
        efx_stop_interrupts(efx, true);
@@ -832,6 +833,7 @@ out:
        efx_start_interrupts(efx, true);
        efx_start_all(efx);
+        netif_device_attach(efx->net_dev);
        return rc;
 rollback:
@@ -1641,8 +1643,12 @@ static void efx_stop_all(struct efx_nic *efx)
        /* Flush efx_mac_work(), refill_workqueue, monitor_work */
        efx_flush_all(efx);
-        /* Stop the kernel transmit interface late, so the watchdog
+        /* Stop the kernel transmit interface.  This is only valid if
-         * timer isn't ticking over the flush */
+         * the device is stopped or detached; otherwise the watchdog
+         * may fire immediately.
+         */
+        WARN_ON(netif_running(efx->net_dev) &&
+                netif_device_present(efx->net_dev));
        netif_tx_disable(efx->net_dev);
        efx_stop_datapath(efx);
@@ -1963,16 +1969,18 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu)
        if (new_mtu > EFX_MAX_MTU)
                return -EINVAL;
-        efx_stop_all(efx);
        netif_dbg(efx, drv, efx->net_dev, "changing MTU to %d\n", new_mtu);
+        efx_device_detach_sync(efx);
+        efx_stop_all(efx);
        mutex_lock(&efx->mac_lock);
        net_dev->mtu = new_mtu;
        efx->type->reconfigure_mac(efx);
        mutex_unlock(&efx->mac_lock);
        efx_start_all(efx);
+        netif_device_attach(efx->net_dev);
        return 0;
 }
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index 2d756c1d7142..0a90abd2421b 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -210,6 +210,7 @@ struct efx_tx_queue {
 *      Will be %NULL if the buffer slot is currently free.
 * @page: The associated page buffer. Valif iff @flags & %EFX_RX_BUF_PAGE.
 *      Will be %NULL if the buffer slot is currently free.
+ * @page_offset: Offset within page. Valid iff @flags & %EFX_RX_BUF_PAGE.
 * @len: Buffer length, in bytes.
 * @flags: Flags for buffer and packet state.
 */
@@ -219,7 +220,8 @@ struct efx_rx_buffer {
                struct sk_buff *skb;
                struct page *page;
        } u;
-        unsigned int len;
+        u16 page_offset;
+        u16 len;
        u16 flags;
 };
 #define EFX_RX_BUF_PAGE         0x0001
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index d780a0d096b4..879ff5849bbd 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -90,11 +90,7 @@ static unsigned int rx_refill_threshold;
 static inline unsigned int efx_rx_buf_offset(struct efx_nic *efx,
                                             struct efx_rx_buffer *buf)
 {
-        /* Offset is always within one page, so we don't need to consider
+        return buf->page_offset + efx->type->rx_buffer_hash_size;
-         * the page order.
-         */
-        return ((unsigned int) buf->dma_addr & (PAGE_SIZE - 1)) +
-                efx->type->rx_buffer_hash_size;
 }
 static inline unsigned int efx_rx_buf_size(struct efx_nic *efx)
 {
@@ -187,6 +183,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
        struct efx_nic *efx = rx_queue->efx;
        struct efx_rx_buffer *rx_buf;
        struct page *page;
+        unsigned int page_offset;
        struct efx_rx_page_state *state;
        dma_addr_t dma_addr;
        unsigned index, count;
@@ -211,12 +208,14 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
                state->dma_addr = dma_addr;
                dma_addr += sizeof(struct efx_rx_page_state);
+                page_offset = sizeof(struct efx_rx_page_state);
        split:
                index = rx_queue->added_count & rx_queue->ptr_mask;
                rx_buf = efx_rx_buffer(rx_queue, index);
                rx_buf->dma_addr = dma_addr + EFX_PAGE_IP_ALIGN;
                rx_buf->u.page = page;
+                rx_buf->page_offset = page_offset;
                rx_buf->len = efx->rx_buffer_len - EFX_PAGE_IP_ALIGN;
                rx_buf->flags = EFX_RX_BUF_PAGE;
                ++rx_queue->added_count;
@@ -227,6 +226,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
                        /* Use the second half of the page */
                        get_page(page);
                        dma_addr += (PAGE_SIZE >> 1);
+                        page_offset += (PAGE_SIZE >> 1);
                        ++count;
                        goto split;
                }
@@ -236,7 +236,8 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
 }
 static void efx_unmap_rx_buffer(struct efx_nic *efx,
-                                struct efx_rx_buffer *rx_buf)
+                                struct efx_rx_buffer *rx_buf,
+                                unsigned int used_len)
 {
        if ((rx_buf->flags & EFX_RX_BUF_PAGE) && rx_buf->u.page) {
                struct efx_rx_page_state *state;
@@ -247,6 +248,10 @@ static void efx_unmap_rx_buffer(struct efx_nic *efx,
                                       state->dma_addr,
                                       efx_rx_buf_size(efx),
                                       DMA_FROM_DEVICE);
+                } else if (used_len) {
+                        dma_sync_single_for_cpu(&efx->pci_dev->dev,
+                                                rx_buf->dma_addr, used_len,
+                                                DMA_FROM_DEVICE);
                }
        } else if (!(rx_buf->flags & EFX_RX_BUF_PAGE) && rx_buf->u.skb) {
                dma_unmap_single(&efx->pci_dev->dev, rx_buf->dma_addr,
@@ -269,7 +274,7 @@ static void efx_free_rx_buffer(struct efx_nic *efx,
 static void efx_fini_rx_buffer(struct efx_rx_queue *rx_queue,
                               struct efx_rx_buffer *rx_buf)
 {
-        efx_unmap_rx_buffer(rx_queue->efx, rx_buf);
+        efx_unmap_rx_buffer(rx_queue->efx, rx_buf, 0);
        efx_free_rx_buffer(rx_queue->efx, rx_buf);
 }
@@ -535,10 +540,10 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
                goto out;
        }
-        /* Release card resources - assumes all RX buffers consumed in-order
+        /* Release and/or sync DMA mapping - assumes all RX buffers
-         * per RX queue
+         * consumed in-order per RX queue
         */
-        efx_unmap_rx_buffer(efx, rx_buf);
+        efx_unmap_rx_buffer(efx, rx_buf, len);
        /* Prefetch nice and early so data will (hopefully) be in cache by
         * the time we look at it.
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 7e93df6585e7..01ffbc486982 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -731,7 +731,7 @@ static inline void cpsw_add_default_vlan(struct cpsw_priv *priv)
        writel(vlan, &priv->host_port_regs->port_vlan);
-        for (i = 0; i < 2; i++)
+        for (i = 0; i < priv->data.slaves; i++)
                slave_write(priv->slaves + i, vlan, reg);
        cpsw_ale_add_vlan(priv->ale, vlan, ALE_ALL_PORTS << port,
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 29934446436a..abf7b6153d00 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -257,8 +257,7 @@ static struct phy_driver ksphy_driver[] = {
        .phy_id         = PHY_ID_KSZ9021,
        .phy_id_mask    = 0x000ffffe,
        .name           = "Micrel KSZ9021 Gigabit PHY",
-        .features       = (PHY_GBIT_FEATURES | SUPPORTED_Pause
+        .features       = (PHY_GBIT_FEATURES | SUPPORTED_Pause),
-                                | SUPPORTED_Asym_Pause),
        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
        .config_init    = kszphy_config_init,
        .config_aneg    = genphy_config_aneg,
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 9930f9999561..3657b4a29124 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -44,13 +44,13 @@ MODULE_LICENSE("GPL");
 void phy_device_free(struct phy_device *phydev)
 {
-        kfree(phydev);
+        put_device(&phydev->dev);
 }
 EXPORT_SYMBOL(phy_device_free);
 static void phy_device_release(struct device *dev)
 {
-        phy_device_free(to_phy_device(dev));
+        kfree(to_phy_device(dev));
 }
 static struct phy_driver genphy_driver;
@@ -201,6 +201,8 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
           there's no driver _already_ loaded. */
        request_module(MDIO_MODULE_PREFIX MDIO_ID_FMT, MDIO_ID_ARGS(phy_id));
+        device_initialize(&dev->dev);
        return dev;
 }
 EXPORT_SYMBOL(phy_device_create);
@@ -363,9 +365,9 @@ int phy_device_register(struct phy_device *phydev)
        /* Run all of the fixups for this PHY */
        phy_scan_fixups(phydev);
-        err = device_register(&phydev->dev);
+        err = device_add(&phydev->dev);
        if (err) {
-                pr_err("phy %d failed to register\n", phydev->addr);
+                pr_err("PHY %d failed to add\n", phydev->addr);
                goto out;
        }
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index da92ed3797aa..3b6e9b83342d 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -156,6 +156,24 @@ config USB_NET_AX8817X
          This driver creates an interface named "ethX", where X depends on
          what other networking devices you have in use.
+config USB_NET_AX88179_178A
+        tristate "ASIX AX88179/178A USB 3.0/2.0 to Gigabit Ethernet"
+        depends on USB_USBNET
+        select CRC32
+        select PHYLIB
+        default y
+        help
+          This option adds support for ASIX AX88179 based USB 3.0/2.0
+          to Gigabit Ethernet adapters.
+          This driver should work with at least the following devices:
+            * ASIX AX88179
+            * ASIX AX88178A
+            * Sitcomm LN-032
+          This driver creates an interface named "ethX", where X depends on
+          what other networking devices you have in use.
 config USB_NET_CDCETHER
        tristate "CDC Ethernet support (smart devices such as cable modems)"
        depends on USB_USBNET
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 478691326f37..119b06c9aa16 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_USB_RTL8150)	+= rtl8150.o
 obj-$(CONFIG_USB_HSO)           += hso.o
 obj-$(CONFIG_USB_NET_AX8817X)   += asix.o
 asix-y := asix_devices.o asix_common.o ax88172a.o
+obj-$(CONFIG_USB_NET_AX88179_178A)      += ax88179_178a.o
 obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o
 obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 2205dbc8d32f..709753469099 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -924,6 +924,29 @@ static const struct driver_info ax88178_info = {
        .tx_fixup = asix_tx_fixup,
 };
+/*
+ * USBLINK 20F9 "USB 2.0 LAN" USB ethernet adapter, typically found in
+ * no-name packaging.
+ * USB device strings are:
+ *   1: Manufacturer: USBLINK
+ *   2: Product: HG20F9 USB2.0
+ *   3: Serial: 000003
+ * Appears to be compatible with Asix 88772B.
+ */
+static const struct driver_info hg20f9_info = {
+        .description = "HG20F9 USB 2.0 Ethernet",
+        .bind = ax88772_bind,
+        .unbind = ax88772_unbind,
+        .status = asix_status,
+        .link_reset = ax88772_link_reset,
+        .reset = ax88772_reset,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |
+                 FLAG_MULTI_PACKET,
+        .rx_fixup = asix_rx_fixup_common,
+        .tx_fixup = asix_tx_fixup,
+        .data = FLAG_EEPROM_MAC,
+};
 extern const struct driver_info ax88172a_info;
 static const struct usb_device_id       products [] = {
@@ -1063,6 +1086,14 @@ static const struct usb_device_id	products [] = {
        /* ASIX 88172a demo board */
        USB_DEVICE(0x0b95, 0x172a),
        .driver_info = (unsigned long) &ax88172a_info,
+}, {
+        /*
+         * USBLINK HG20F9 "USB 2.0 LAN"
+         * Appears to have gazumped Linksys's manufacturer ID but
+         * doesn't (yet) conflict with any known Linksys product.
+         */
+        USB_DEVICE(0x066b, 0x20f9),
+        .driver_info = (unsigned long) &hg20f9_info,
 },
        { },            // END
 };
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
new file mode 100644
index 000000000000..71c27d8d214f
--- /dev/null
+++ b/drivers/net/usb/ax88179_178a.c
@@ -0,0 +1,1448 @@
+/*
+ * ASIX AX88179/178A USB 3.0/2.0 to Gigabit Ethernet Devices
+ *
+ * Copyright (C) 2011-2013 ASIX
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/usbnet.h>
+#define AX88179_PHY_ID                          0x03
+#define AX_EEPROM_LEN                           0x100
+#define AX88179_EEPROM_MAGIC                    0x17900b95
+#define AX_MCAST_FLTSIZE                        8
+#define AX_MAX_MCAST                            64
+#define AX_INT_PPLS_LINK                        ((u32)BIT(16))
+#define AX_RXHDR_L4_TYPE_MASK                   0x1c
+#define AX_RXHDR_L4_TYPE_UDP                    4
+#define AX_RXHDR_L4_TYPE_TCP                    16
+#define AX_RXHDR_L3CSUM_ERR                     2
+#define AX_RXHDR_L4CSUM_ERR                     1
+#define AX_RXHDR_CRC_ERR                        ((u32)BIT(31))
+#define AX_RXHDR_DROP_ERR                       ((u32)BIT(30))
+#define AX_ACCESS_MAC                           0x01
+#define AX_ACCESS_PHY                           0x02
+#define AX_ACCESS_EEPROM                        0x04
+#define AX_ACCESS_EFUS                          0x05
+#define AX_PAUSE_WATERLVL_HIGH                  0x54
+#define AX_PAUSE_WATERLVL_LOW                   0x55
+#define PHYSICAL_LINK_STATUS                    0x02
+        #define AX_USB_SS               0x04
+        #define AX_USB_HS               0x02
+#define GENERAL_STATUS                          0x03
+/* Check AX88179 version. UA1:Bit2 = 0,  UA2:Bit2 = 1 */
+        #define AX_SECLD                0x04
+#define AX_SROM_ADDR                            0x07
+#define AX_SROM_CMD                             0x0a
+        #define EEP_RD                  0x04
+        #define EEP_BUSY                0x10
+#define AX_SROM_DATA_LOW                        0x08
+#define AX_SROM_DATA_HIGH                       0x09
+#define AX_RX_CTL                               0x0b
+        #define AX_RX_CTL_DROPCRCERR    0x0100
+        #define AX_RX_CTL_IPE           0x0200
+        #define AX_RX_CTL_START         0x0080
+        #define AX_RX_CTL_AP            0x0020
+        #define AX_RX_CTL_AM            0x0010
+        #define AX_RX_CTL_AB            0x0008
+        #define AX_RX_CTL_AMALL         0x0002
+        #define AX_RX_CTL_PRO           0x0001
+        #define AX_RX_CTL_STOP          0x0000
+#define AX_NODE_ID                              0x10
+#define AX_MULFLTARY                            0x16
+#define AX_MEDIUM_STATUS_MODE                   0x22
+        #define AX_MEDIUM_GIGAMODE      0x01
+        #define AX_MEDIUM_FULL_DUPLEX   0x02
+        #define AX_MEDIUM_ALWAYS_ONE    0x04
+        #define AX_MEDIUM_EN_125MHZ     0x08
+        #define AX_MEDIUM_RXFLOW_CTRLEN 0x10
+        #define AX_MEDIUM_TXFLOW_CTRLEN 0x20
+        #define AX_MEDIUM_RECEIVE_EN    0x100
+        #define AX_MEDIUM_PS            0x200
+        #define AX_MEDIUM_JUMBO_EN      0x8040
+#define AX_MONITOR_MOD                          0x24
+        #define AX_MONITOR_MODE_RWLC    0x02
+        #define AX_MONITOR_MODE_RWMP    0x04
+        #define AX_MONITOR_MODE_PMEPOL  0x20
+        #define AX_MONITOR_MODE_PMETYPE 0x40
+#define AX_GPIO_CTRL                            0x25
+        #define AX_GPIO_CTRL_GPIO3EN    0x80
+        #define AX_GPIO_CTRL_GPIO2EN    0x40
+        #define AX_GPIO_CTRL_GPIO1EN    0x20
+#define AX_PHYPWR_RSTCTL                        0x26
+        #define AX_PHYPWR_RSTCTL_BZ     0x0010
+        #define AX_PHYPWR_RSTCTL_IPRL   0x0020
+        #define AX_PHYPWR_RSTCTL_AT     0x1000
+#define AX_RX_BULKIN_QCTRL                      0x2e
+#define AX_CLK_SELECT                           0x33
+        #define AX_CLK_SELECT_BCS       0x01
+        #define AX_CLK_SELECT_ACS       0x02
+        #define AX_CLK_SELECT_ULR       0x08
+#define AX_RXCOE_CTL                            0x34
+        #define AX_RXCOE_IP             0x01
+        #define AX_RXCOE_TCP            0x02
+        #define AX_RXCOE_UDP            0x04
+        #define AX_RXCOE_TCPV6          0x20
+        #define AX_RXCOE_UDPV6          0x40
+#define AX_TXCOE_CTL                            0x35
+        #define AX_TXCOE_IP             0x01
+        #define AX_TXCOE_TCP            0x02
+        #define AX_TXCOE_UDP            0x04
+        #define AX_TXCOE_TCPV6          0x20
+        #define AX_TXCOE_UDPV6          0x40
+#define AX_LEDCTRL                              0x73
+#define GMII_PHY_PHYSR                          0x11
+        #define GMII_PHY_PHYSR_SMASK    0xc000
+        #define GMII_PHY_PHYSR_GIGA     0x8000
+        #define GMII_PHY_PHYSR_100      0x4000
+        #define GMII_PHY_PHYSR_FULL     0x2000
+        #define GMII_PHY_PHYSR_LINK     0x400
+#define GMII_LED_ACT                            0x1a
+        #define GMII_LED_ACTIVE_MASK    0xff8f
+        #define GMII_LED0_ACTIVE        BIT(4)
+        #define GMII_LED1_ACTIVE        BIT(5)
+        #define GMII_LED2_ACTIVE        BIT(6)
+#define GMII_LED_LINK                           0x1c
+        #define GMII_LED_LINK_MASK      0xf888
+        #define GMII_LED0_LINK_10       BIT(0)
+        #define GMII_LED0_LINK_100      BIT(1)
+        #define GMII_LED0_LINK_1000     BIT(2)
+        #define GMII_LED1_LINK_10       BIT(4)
+        #define GMII_LED1_LINK_100      BIT(5)
+        #define GMII_LED1_LINK_1000     BIT(6)
+        #define GMII_LED2_LINK_10       BIT(8)
+        #define GMII_LED2_LINK_100      BIT(9)
+        #define GMII_LED2_LINK_1000     BIT(10)
+        #define LED0_ACTIVE             BIT(0)
+        #define LED0_LINK_10            BIT(1)
+        #define LED0_LINK_100           BIT(2)
+        #define LED0_LINK_1000          BIT(3)
+        #define LED0_FD                 BIT(4)
+        #define LED0_USB3_MASK          0x001f
+        #define LED1_ACTIVE             BIT(5)
+        #define LED1_LINK_10            BIT(6)
+        #define LED1_LINK_100           BIT(7)
+        #define LED1_LINK_1000          BIT(8)
+        #define LED1_FD                 BIT(9)
+        #define LED1_USB3_MASK          0x03e0
+        #define LED2_ACTIVE             BIT(10)
+        #define LED2_LINK_1000          BIT(13)
+        #define LED2_LINK_100           BIT(12)
+        #define LED2_LINK_10            BIT(11)
+        #define LED2_FD                 BIT(14)
+        #define LED_VALID               BIT(15)
+        #define LED2_USB3_MASK          0x7c00
+#define GMII_PHYPAGE                            0x1e
+#define GMII_PHY_PAGE_SELECT                    0x1f
+        #define GMII_PHY_PGSEL_EXT      0x0007
+        #define GMII_PHY_PGSEL_PAGE0    0x0000
+struct ax88179_data {
+        u16 rxctl;
+        u16 reserved;
+};
+struct ax88179_int_data {
+        __le32 intdata1;
+        __le32 intdata2;
+};
+static const struct {
+        unsigned char ctrl, timer_l, timer_h, size, ifg;
+} AX88179_BULKIN_SIZE[] =       {
+        {7, 0x4f, 0,    0x12, 0xff},
+        {7, 0x20, 3,    0x16, 0xff},
+        {7, 0xae, 7,    0x18, 0xff},
+        {7, 0xcc, 0x4c, 0x18, 8},
+};
+static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                              u16 size, void *data, int in_pm)
+{
+        int ret;
+        int (*fn)(struct usbnet *, u8, u8, u16, u16, void *, u16);
+        BUG_ON(!dev);
+        if (!in_pm)
+                fn = usbnet_read_cmd;
+        else
+                fn = usbnet_read_cmd_nopm;
+        ret = fn(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                 value, index, data, size);
+        if (unlikely(ret < 0))
+                netdev_warn(dev->net, "Failed to read reg index 0x%04x: %d\n",
+                            index, ret);
+        return ret;
+}
+static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                               u16 size, void *data, int in_pm)
+{
+        int ret;
+        int (*fn)(struct usbnet *, u8, u8, u16, u16, const void *, u16);
+        BUG_ON(!dev);
+        if (!in_pm)
+                fn = usbnet_write_cmd;
+        else
+                fn = usbnet_write_cmd_nopm;
+        ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                 value, index, data, size);
+        if (unlikely(ret < 0))
+                netdev_warn(dev->net, "Failed to write reg index 0x%04x: %d\n",
+                            index, ret);
+        return ret;
+}
+static void ax88179_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value,
+                                    u16 index, u16 size, void *data)
+{
+        u16 buf;
+        if (2 == size) {
+                buf = *((u16 *)data);
+                cpu_to_le16s(&buf);
+                usbnet_write_cmd_async(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR |
+                                       USB_RECIP_DEVICE, value, index, &buf,
+                                       size);
+        } else {
+                usbnet_write_cmd_async(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR |
+                                       USB_RECIP_DEVICE, value, index, data,
+                                       size);
+        }
+}
+static int ax88179_read_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value,
+                                 u16 index, u16 size, void *data)
+{
+        int ret;
+        if (2 == size) {
+                u16 buf;
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 1);
+                le16_to_cpus(&buf);
+                *((u16 *)data) = buf;
+        } else if (4 == size) {
+                u32 buf;
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 1);
+                le32_to_cpus(&buf);
+                *((u32 *)data) = buf;
+        } else {
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, data, 1);
+        }
+        return ret;
+}
+static int ax88179_write_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value,
+                                  u16 index, u16 size, void *data)
+{
+        int ret;
+        if (2 == size) {
+                u16 buf;
+                buf = *((u16 *)data);
+                cpu_to_le16s(&buf);
+                ret = __ax88179_write_cmd(dev, cmd, value, index,
+                                          size, &buf, 1);
+        } else {
+                ret = __ax88179_write_cmd(dev, cmd, value, index,
+                                          size, data, 1);
+        }
+        return ret;
+}
+static int ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                            u16 size, void *data)
+{
+        int ret;
+        if (2 == size) {
+                u16 buf;
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0);
+                le16_to_cpus(&buf);
+                *((u16 *)data) = buf;
+        } else if (4 == size) {
+                u32 buf;
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0);
+                le32_to_cpus(&buf);
+                *((u32 *)data) = buf;
+        } else {
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, data, 0);
+        }
+        return ret;
+}
+static int ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                             u16 size, void *data)
+{
+        int ret;
+        if (2 == size) {
+                u16 buf;
+                buf = *((u16 *)data);
+                cpu_to_le16s(&buf);
+                ret = __ax88179_write_cmd(dev, cmd, value, index,
+                                          size, &buf, 0);
+        } else {
+                ret = __ax88179_write_cmd(dev, cmd, value, index,
+                                          size, data, 0);
+        }
+        return ret;
+}
+static void ax88179_status(struct usbnet *dev, struct urb *urb)
+{
+        struct ax88179_int_data *event;
+        u32 link;
+        if (urb->actual_length < 8)
+                return;
+        event = urb->transfer_buffer;
+        le32_to_cpus((void *)&event->intdata1);
+        link = (((__force u32)event->intdata1) & AX_INT_PPLS_LINK) >> 16;
+        if (netif_carrier_ok(dev->net) != link) {
+                if (link)
+                        usbnet_defer_kevent(dev, EVENT_LINK_RESET);
+                else
+                        netif_carrier_off(dev->net);
+                netdev_info(dev->net, "ax88179 - Link status is: %d\n", link);
+        }
+}
+static int ax88179_mdio_read(struct net_device *netdev, int phy_id, int loc)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        u16 res;
+        ax88179_read_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res);
+        return res;
+}
+static void ax88179_mdio_write(struct net_device *netdev, int phy_id, int loc,
+                               int val)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        u16 res = (u16) val;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res);
+}
+static int ax88179_suspend(struct usb_interface *intf, pm_message_t message)
+{
+        struct usbnet *dev = usb_get_intfdata(intf);
+        u16 tmp16;
+        u8 tmp8;
+        usbnet_suspend(intf, message);
+        /* Disable RX path */
+        ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                              2, 2, &tmp16);
+        tmp16 &= ~AX_MEDIUM_RECEIVE_EN;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                               2, 2, &tmp16);
+        /* Force bulk-in zero length */
+        ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
+                              2, 2, &tmp16);
+        tmp16 |= AX_PHYPWR_RSTCTL_BZ | AX_PHYPWR_RSTCTL_IPRL;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
+                               2, 2, &tmp16);
+        /* change clock */
+        tmp8 = 0;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+        /* Configure RX control register => stop operation */
+        tmp16 = AX_RX_CTL_STOP;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, &tmp16);
+        return 0;
+}
+/* This function is used to enable the autodetach function. */
+/* This function is determined by offset 0x43 of EEPROM */
+static int ax88179_auto_detach(struct usbnet *dev, int in_pm)
+{
+        u16 tmp16;
+        u8 tmp8;
+        int (*fnr)(struct usbnet *, u8, u16, u16, u16, void *);
+        int (*fnw)(struct usbnet *, u8, u16, u16, u16, void *);
+        if (!in_pm) {
+                fnr = ax88179_read_cmd;
+                fnw = ax88179_write_cmd;
+        } else {
+                fnr = ax88179_read_cmd_nopm;
+                fnw = ax88179_write_cmd_nopm;
+        }
+        if (fnr(dev, AX_ACCESS_EEPROM, 0x43, 1, 2, &tmp16) < 0)
+                return 0;
+        if ((tmp16 == 0xFFFF) || (!(tmp16 & 0x0100)))
+                return 0;
+        /* Enable Auto Detach bit */
+        tmp8 = 0;
+        fnr(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+        tmp8 |= AX_CLK_SELECT_ULR;
+        fnw(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+        fnr(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16);
+        tmp16 |= AX_PHYPWR_RSTCTL_AT;
+        fnw(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16);
+        return 0;
+}
+static int ax88179_resume(struct usb_interface *intf)
+{
+        struct usbnet *dev = usb_get_intfdata(intf);
+        u16 tmp16;
+        u8 tmp8;
+        netif_carrier_off(dev->net);
+        /* Power up ethernet PHY */
+        tmp16 = 0;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
+                               2, 2, &tmp16);
+        udelay(1000);
+        tmp16 = AX_PHYPWR_RSTCTL_IPRL;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
+                               2, 2, &tmp16);
+        msleep(200);
+        /* Ethernet PHY Auto Detach*/
+        ax88179_auto_detach(dev, 1);
+        /* Enable clock */
+        ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC,  AX_CLK_SELECT, 1, 1, &tmp8);
+        tmp8 |= AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+        msleep(100);
+        /* Configure RX control register => start operation */
+        tmp16 = AX_RX_CTL_DROPCRCERR | AX_RX_CTL_IPE | AX_RX_CTL_START |
+                AX_RX_CTL_AP | AX_RX_CTL_AMALL | AX_RX_CTL_AB;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, &tmp16);
+        return usbnet_resume(intf);
+}
+static void
+ax88179_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u8 opt;
+        if (ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MONITOR_MOD,
+                             1, 1, &opt) < 0) {
+                wolinfo->supported = 0;
+                wolinfo->wolopts = 0;
+                return;
+        }
+        wolinfo->supported = WAKE_PHY | WAKE_MAGIC;
+        wolinfo->wolopts = 0;
+        if (opt & AX_MONITOR_MODE_RWLC)
+                wolinfo->wolopts |= WAKE_PHY;
+        if (opt & AX_MONITOR_MODE_RWMP)
+                wolinfo->wolopts |= WAKE_MAGIC;
+}
+static int
+ax88179_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u8 opt = 0;
+        if (wolinfo->wolopts & WAKE_PHY)
+                opt |= AX_MONITOR_MODE_RWLC;
+        if (wolinfo->wolopts & WAKE_MAGIC)
+                opt |= AX_MONITOR_MODE_RWMP;
+        if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MONITOR_MOD,
+                              1, 1, &opt) < 0)
+                return -EINVAL;
+        return 0;
+}
+static int ax88179_get_eeprom_len(struct net_device *net)
+{
+        return AX_EEPROM_LEN;
+}
+static int
+ax88179_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
+                   u8 *data)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u16 *eeprom_buff;
+        int first_word, last_word;
+        int i, ret;
+        if (eeprom->len == 0)
+                return -EINVAL;
+        eeprom->magic = AX88179_EEPROM_MAGIC;
+        first_word = eeprom->offset >> 1;
+        last_word = (eeprom->offset + eeprom->len - 1) >> 1;
+        eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
+                              GFP_KERNEL);
+        if (!eeprom_buff)
+                return -ENOMEM;
+        /* ax88179/178A returns 2 bytes from eeprom on read */
+        for (i = first_word; i <= last_word; i++) {
+                ret = __ax88179_read_cmd(dev, AX_ACCESS_EEPROM, i, 1, 2,
+                                         &eeprom_buff[i - first_word],
+                                         0);
+                if (ret < 0) {
+                        kfree(eeprom_buff);
+                        return -EIO;
+                }
+        }
+        memcpy(data, (u8 *)eeprom_buff + (eeprom->offset & 1), eeprom->len);
+        kfree(eeprom_buff);
+        return 0;
+}
+static int ax88179_get_settings(struct net_device *net, struct ethtool_cmd *cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return mii_ethtool_gset(&dev->mii, cmd);
+}
+static int ax88179_set_settings(struct net_device *net, struct ethtool_cmd *cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return mii_ethtool_sset(&dev->mii, cmd);
+}
+static int ax88179_ioctl(struct net_device *net, struct ifreq *rq, int cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return generic_mii_ioctl(&dev->mii, if_mii(rq), cmd, NULL);
+}
+static const struct ethtool_ops ax88179_ethtool_ops = {
+        .get_link               = ethtool_op_get_link,
+        .get_msglevel           = usbnet_get_msglevel,
+        .set_msglevel           = usbnet_set_msglevel,
+        .get_wol                = ax88179_get_wol,
+        .set_wol                = ax88179_set_wol,
+        .get_eeprom_len         = ax88179_get_eeprom_len,
+        .get_eeprom             = ax88179_get_eeprom,
+        .get_settings           = ax88179_get_settings,
+        .set_settings           = ax88179_set_settings,
+        .nway_reset             = usbnet_nway_reset,
+};
+static void ax88179_set_multicast(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct ax88179_data *data = (struct ax88179_data *)dev->data;
+        u8 *m_filter = ((u8 *)dev->data) + 12;
+        data->rxctl = (AX_RX_CTL_START | AX_RX_CTL_AB | AX_RX_CTL_IPE);
+        if (net->flags & IFF_PROMISC) {
+                data->rxctl |= AX_RX_CTL_PRO;
+        } else if (net->flags & IFF_ALLMULTI ||
+                   netdev_mc_count(net) > AX_MAX_MCAST) {
+                data->rxctl |= AX_RX_CTL_AMALL;
+        } else if (netdev_mc_empty(net)) {
+                /* just broadcast and directed */
+        } else {
+                /* We use the 20 byte dev->data for our 8 byte filter buffer
+                 * to avoid allocating memory that is tricky to free later
+                 */
+                u32 crc_bits;
+                struct netdev_hw_addr *ha;
+                memset(m_filter, 0, AX_MCAST_FLTSIZE);
+                netdev_for_each_mc_addr(ha, net) {
+                        crc_bits = ether_crc(ETH_ALEN, ha->addr) >> 26;
+                        *(m_filter + (crc_bits >> 3)) |= (1 << (crc_bits & 7));
+                }
+                ax88179_write_cmd_async(dev, AX_ACCESS_MAC, AX_MULFLTARY,
+                                        AX_MCAST_FLTSIZE, AX_MCAST_FLTSIZE,
+                                        m_filter);
+                data->rxctl |= AX_RX_CTL_AM;
+        }
+        ax88179_write_cmd_async(dev, AX_ACCESS_MAC, AX_RX_CTL,
+                                2, 2, &data->rxctl);
+}
+static int
+ax88179_set_features(struct net_device *net, netdev_features_t features)
+{
+        u8 tmp;
+        struct usbnet *dev = netdev_priv(net);
+        netdev_features_t changed = net->features ^ features;
+        if (changed & NETIF_F_IP_CSUM) {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+                tmp ^= AX_TXCOE_TCP | AX_TXCOE_UDP;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+        }
+        if (changed & NETIF_F_IPV6_CSUM) {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+                tmp ^= AX_TXCOE_TCPV6 | AX_TXCOE_UDPV6;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+        }
+        if (changed & NETIF_F_RXCSUM) {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp);
+                tmp ^= AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+                       AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp);
+        }
+        return 0;
+}
+static int ax88179_change_mtu(struct net_device *net, int new_mtu)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u16 tmp16;
+        if (new_mtu <= 0 || new_mtu > 4088)
+                return -EINVAL;
+        net->mtu = new_mtu;
+        dev->hard_mtu = net->mtu + net->hard_header_len;
+        if (net->mtu > 1500) {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                                 2, 2, &tmp16);
+                tmp16 |= AX_MEDIUM_JUMBO_EN;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                                  2, 2, &tmp16);
+        } else {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                                 2, 2, &tmp16);
+                tmp16 &= ~AX_MEDIUM_JUMBO_EN;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                                  2, 2, &tmp16);
+        }
+        return 0;
+}
+static int ax88179_set_mac_addr(struct net_device *net, void *p)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sockaddr *addr = p;
+        if (netif_running(net))
+                return -EBUSY;
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+        memcpy(net->dev_addr, addr->sa_data, ETH_ALEN);
+        /* Set the MAC address */
+        return ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
+                                 ETH_ALEN, net->dev_addr);
+}
+static const struct net_device_ops ax88179_netdev_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = ax88179_change_mtu,
+        .ndo_set_mac_address    = ax88179_set_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_do_ioctl           = ax88179_ioctl,
+        .ndo_set_rx_mode        = ax88179_set_multicast,
+        .ndo_set_features       = ax88179_set_features,
+};
+static int ax88179_check_eeprom(struct usbnet *dev)
+{
+        u8 i, buf, eeprom[20];
+        u16 csum, delay = HZ / 10;
+        unsigned long jtimeout;
+        /* Read EEPROM content */
+        for (i = 0; i < 6; i++) {
+                buf = i;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_SROM_ADDR,
+                                      1, 1, &buf) < 0)
+                        return -EINVAL;
+                buf = EEP_RD;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+                                      1, 1, &buf) < 0)
+                        return -EINVAL;
+                jtimeout = jiffies + delay;
+                do {
+                        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+                                         1, 1, &buf);
+                        if (time_after(jiffies, jtimeout))
+                                return -EINVAL;
+                } while (buf & EEP_BUSY);
+                __ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW,
+                                   2, 2, &eeprom[i * 2], 0);
+                if ((i == 0) && (eeprom[0] == 0xFF))
+                        return -EINVAL;
+        }
+        csum = eeprom[6] + eeprom[7] + eeprom[8] + eeprom[9];
+        csum = (csum >> 8) + (csum & 0xff);
+        if ((csum + eeprom[10]) != 0xff)
+                return -EINVAL;
+        return 0;
+}
+static int ax88179_check_efuse(struct usbnet *dev, u16 *ledmode)
+{
+        u8      i;
+        u8      efuse[64];
+        u16     csum = 0;
+        if (ax88179_read_cmd(dev, AX_ACCESS_EFUS, 0, 64, 64, efuse) < 0)
+                return -EINVAL;
+        if (*efuse == 0xFF)
+                return -EINVAL;
+        for (i = 0; i < 64; i++)
+                csum = csum + efuse[i];
+        while (csum > 255)
+                csum = (csum & 0x00FF) + ((csum >> 8) & 0x00FF);
+        if (csum != 0xFF)
+                return -EINVAL;
+        *ledmode = (efuse[51] << 8) | efuse[52];
+        return 0;
+}
+static int ax88179_convert_old_led(struct usbnet *dev, u16 *ledvalue)
+{
+        u16 led;
+        /* Loaded the old eFuse LED Mode */
+        if (ax88179_read_cmd(dev, AX_ACCESS_EEPROM, 0x3C, 1, 2, &led) < 0)
+                return -EINVAL;
+        led >>= 8;
+        switch (led) {
+        case 0xFF:
+                led = LED0_ACTIVE | LED1_LINK_10 | LED1_LINK_100 |
+                      LED1_LINK_1000 | LED2_ACTIVE | LED2_LINK_10 |
+                      LED2_LINK_100 | LED2_LINK_1000 | LED_VALID;
+                break;
+        case 0xFE:
+                led = LED0_ACTIVE | LED1_LINK_1000 | LED2_LINK_100 | LED_VALID;
+                break;
+        case 0xFD:
+                led = LED0_ACTIVE | LED1_LINK_1000 | LED2_LINK_100 |
+                      LED2_LINK_10 | LED_VALID;
+                break;
+        case 0xFC:
+                led = LED0_ACTIVE | LED1_ACTIVE | LED1_LINK_1000 | LED2_ACTIVE |
+                      LED2_LINK_100 | LED2_LINK_10 | LED_VALID;
+                break;
+        default:
+                led = LED0_ACTIVE | LED1_LINK_10 | LED1_LINK_100 |
+                      LED1_LINK_1000 | LED2_ACTIVE | LED2_LINK_10 |
+                      LED2_LINK_100 | LED2_LINK_1000 | LED_VALID;
+                break;
+        }
+        *ledvalue = led;
+        return 0;
+}
+static int ax88179_led_setting(struct usbnet *dev)
+{
+        u8 ledfd, value = 0;
+        u16 tmp, ledact, ledlink, ledvalue = 0, delay = HZ / 10;
+        unsigned long jtimeout;
+        /* Check AX88179 version. UA1 or UA2*/
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, GENERAL_STATUS, 1, 1, &value);
+        if (!(value & AX_SECLD)) {      /* UA1 */
+                value = AX_GPIO_CTRL_GPIO3EN | AX_GPIO_CTRL_GPIO2EN |
+                        AX_GPIO_CTRL_GPIO1EN;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_GPIO_CTRL,
+                                      1, 1, &value) < 0)
+                        return -EINVAL;
+        }
+        /* Check EEPROM */
+        if (!ax88179_check_eeprom(dev)) {
+                value = 0x42;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_SROM_ADDR,
+                                      1, 1, &value) < 0)
+                        return -EINVAL;
+                value = EEP_RD;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+                                      1, 1, &value) < 0)
+                        return -EINVAL;
+                jtimeout = jiffies + delay;
+                do {
+                        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+                                         1, 1, &value);
+                        if (time_after(jiffies, jtimeout))
+                                return -EINVAL;
+                } while (value & EEP_BUSY);
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_HIGH,
+                                 1, 1, &value);
+                ledvalue = (value << 8);
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW,
+                                 1, 1, &value);
+                ledvalue |= value;
+                /* load internal ROM for defaule setting */
+                if ((ledvalue == 0xFFFF) || ((ledvalue & LED_VALID) == 0))
+                        ax88179_convert_old_led(dev, &ledvalue);
+        } else if (!ax88179_check_efuse(dev, &ledvalue)) {
+                if ((ledvalue == 0xFFFF) || ((ledvalue & LED_VALID) == 0))
+                        ax88179_convert_old_led(dev, &ledvalue);
+        } else {
+                ax88179_convert_old_led(dev, &ledvalue);
+        }
+        tmp = GMII_PHY_PGSEL_EXT;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_PHY_PAGE_SELECT, 2, &tmp);
+        tmp = 0x2c;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_PHYPAGE, 2, &tmp);
+        ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                         GMII_LED_ACT, 2, &ledact);
+        ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                         GMII_LED_LINK, 2, &ledlink);
+        ledact &= GMII_LED_ACTIVE_MASK;
+        ledlink &= GMII_LED_LINK_MASK;
+        if (ledvalue & LED0_ACTIVE)
+                ledact |= GMII_LED0_ACTIVE;
+        if (ledvalue & LED1_ACTIVE)
+                ledact |= GMII_LED1_ACTIVE;
+        if (ledvalue & LED2_ACTIVE)
+                ledact |= GMII_LED2_ACTIVE;
+        if (ledvalue & LED0_LINK_10)
+                ledlink |= GMII_LED0_LINK_10;
+        if (ledvalue & LED1_LINK_10)
+                ledlink |= GMII_LED1_LINK_10;
+        if (ledvalue & LED2_LINK_10)
+                ledlink |= GMII_LED2_LINK_10;
+        if (ledvalue & LED0_LINK_100)
+                ledlink |= GMII_LED0_LINK_100;
+        if (ledvalue & LED1_LINK_100)
+                ledlink |= GMII_LED1_LINK_100;
+        if (ledvalue & LED2_LINK_100)
+                ledlink |= GMII_LED2_LINK_100;
+        if (ledvalue & LED0_LINK_1000)
+                ledlink |= GMII_LED0_LINK_1000;
+        if (ledvalue & LED1_LINK_1000)
+                ledlink |= GMII_LED1_LINK_1000;
+        if (ledvalue & LED2_LINK_1000)
+                ledlink |= GMII_LED2_LINK_1000;
+        tmp = ledact;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_LED_ACT, 2, &tmp);
+        tmp = ledlink;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_LED_LINK, 2, &tmp);
+        tmp = GMII_PHY_PGSEL_PAGE0;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_PHY_PAGE_SELECT, 2, &tmp);
+        /* LED full duplex setting */
+        ledfd = 0;
+        if (ledvalue & LED0_FD)
+                ledfd |= 0x01;
+        else if ((ledvalue & LED0_USB3_MASK) == 0)
+                ledfd |= 0x02;
+        if (ledvalue & LED1_FD)
+                ledfd |= 0x04;
+        else if ((ledvalue & LED1_USB3_MASK) == 0)
+                ledfd |= 0x08;
+        if (ledvalue & LED2_FD)
+                ledfd |= 0x10;
+        else if ((ledvalue & LED2_USB3_MASK) == 0)
+                ledfd |= 0x20;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_LEDCTRL, 1, 1, &ledfd);
+        return 0;
+}
+static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u8 buf[5];
+        u16 *tmp16;
+        u8 *tmp;
+        struct ax88179_data *ax179_data = (struct ax88179_data *)dev->data;
+        usbnet_get_endpoints(dev, intf);
+        tmp16 = (u16 *)buf;
+        tmp = (u8 *)buf;
+        memset(ax179_data, 0, sizeof(*ax179_data));
+        /* Power up ethernet PHY */
+        *tmp16 = 0;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
+        *tmp16 = AX_PHYPWR_RSTCTL_IPRL;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
+        msleep(200);
+        *tmp = AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, tmp);
+        msleep(100);
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
+                         ETH_ALEN, dev->net->dev_addr);
+        memcpy(dev->net->perm_addr, dev->net->dev_addr, ETH_ALEN);
+        /* RX bulk configuration */
+        memcpy(tmp, &AX88179_BULKIN_SIZE[0], 5);
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_BULKIN_QCTRL, 5, 5, tmp);
+        dev->rx_urb_size = 1024 * 20;
+        *tmp = 0x34;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PAUSE_WATERLVL_LOW, 1, 1, tmp);
+        *tmp = 0x52;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PAUSE_WATERLVL_HIGH,
+                          1, 1, tmp);
+        dev->net->netdev_ops = &ax88179_netdev_ops;
+        dev->net->ethtool_ops = &ax88179_ethtool_ops;
+        dev->net->needed_headroom = 8;
+        /* Initialize MII structure */
+        dev->mii.dev = dev->net;
+        dev->mii.mdio_read = ax88179_mdio_read;
+        dev->mii.mdio_write = ax88179_mdio_write;
+        dev->mii.phy_id_mask = 0xff;
+        dev->mii.reg_num_mask = 0xff;
+        dev->mii.phy_id = 0x03;
+        dev->mii.supports_gmii = 1;
+        dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+        dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+        /* Enable checksum offload */
+        *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+               AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, tmp);
+        *tmp = AX_TXCOE_IP | AX_TXCOE_TCP | AX_TXCOE_UDP |
+               AX_TXCOE_TCPV6 | AX_TXCOE_UDPV6;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, tmp);
+        /* Configure RX control register => start operation */
+        *tmp16 = AX_RX_CTL_DROPCRCERR | AX_RX_CTL_IPE | AX_RX_CTL_START |
+                 AX_RX_CTL_AP | AX_RX_CTL_AMALL | AX_RX_CTL_AB;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, tmp16);
+        *tmp = AX_MONITOR_MODE_PMETYPE | AX_MONITOR_MODE_PMEPOL |
+               AX_MONITOR_MODE_RWMP;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MONITOR_MOD, 1, 1, tmp);
+        /* Configure default medium type => giga */
+        *tmp16 = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
+                 AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_ALWAYS_ONE |
+                 AX_MEDIUM_FULL_DUPLEX | AX_MEDIUM_GIGAMODE;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                          2, 2, tmp16);
+        ax88179_led_setting(dev);
+        /* Restart autoneg */
+        mii_nway_restart(&dev->mii);
+        netif_carrier_off(dev->net);
+        return 0;
+}
+static void ax88179_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u16 tmp16;
+        /* Configure RX control register => stop operation */
+        tmp16 = AX_RX_CTL_STOP;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, &tmp16);
+        tmp16 = 0;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp16);
+        /* Power down ethernet PHY */
+        tmp16 = 0;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16);
+}
+static void
+ax88179_rx_checksum(struct sk_buff *skb, u32 *pkt_hdr)
+{
+        skb->ip_summed = CHECKSUM_NONE;
+        /* checksum error bit is set */
+        if ((*pkt_hdr & AX_RXHDR_L3CSUM_ERR) ||
+            (*pkt_hdr & AX_RXHDR_L4CSUM_ERR))
+                return;
+        /* It must be a TCP or UDP packet with a valid checksum */
+        if (((*pkt_hdr & AX_RXHDR_L4_TYPE_MASK) == AX_RXHDR_L4_TYPE_TCP) ||
+            ((*pkt_hdr & AX_RXHDR_L4_TYPE_MASK) == AX_RXHDR_L4_TYPE_UDP))
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+}
+static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        struct sk_buff *ax_skb;
+        int pkt_cnt;
+        u32 rx_hdr;
+        u16 hdr_off;
+        u32 *pkt_hdr;
+        skb_trim(skb, skb->len - 4);
+        memcpy(&rx_hdr, skb_tail_pointer(skb), 4);
+        le32_to_cpus(&rx_hdr);
+        pkt_cnt = (u16)rx_hdr;
+        hdr_off = (u16)(rx_hdr >> 16);
+        pkt_hdr = (u32 *)(skb->data + hdr_off);
+        while (pkt_cnt--) {
+                u16 pkt_len;
+                le32_to_cpus(pkt_hdr);
+                pkt_len = (*pkt_hdr >> 16) & 0x1fff;
+                /* Check CRC or runt packet */
+                if ((*pkt_hdr & AX_RXHDR_CRC_ERR) ||
+                    (*pkt_hdr & AX_RXHDR_DROP_ERR)) {
+                        skb_pull(skb, (pkt_len + 7) & 0xFFF8);
+                        pkt_hdr++;
+                        continue;
+                }
+                if (pkt_cnt == 0) {
+                        /* Skip IP alignment psudo header */
+                        skb_pull(skb, 2);
+                        skb->len = pkt_len;
+                        skb_set_tail_pointer(skb, pkt_len);
+                        skb->truesize = pkt_len + sizeof(struct sk_buff);
+                        ax88179_rx_checksum(skb, pkt_hdr);
+                        return 1;
+                }
+                ax_skb = skb_clone(skb, GFP_ATOMIC);
+                if (ax_skb) {
+                        ax_skb->len = pkt_len;
+                        ax_skb->data = skb->data + 2;
+                        skb_set_tail_pointer(ax_skb, pkt_len);
+                        ax_skb->truesize = pkt_len + sizeof(struct sk_buff);
+                        ax88179_rx_checksum(ax_skb, pkt_hdr);
+                        usbnet_skb_return(dev, ax_skb);
+                } else {
+                        return 0;
+                }
+                skb_pull(skb, (pkt_len + 7) & 0xFFF8);
+                pkt_hdr++;
+        }
+        return 1;
+}
+static struct sk_buff *
+ax88179_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
+{
+        u32 tx_hdr1, tx_hdr2;
+        int frame_size = dev->maxpacket;
+        int mss = skb_shinfo(skb)->gso_size;
+        int headroom;
+        int tailroom;
+        tx_hdr1 = skb->len;
+        tx_hdr2 = mss;
+        if (((skb->len + 8) % frame_size) == 0)
+                tx_hdr2 |= 0x80008000;  /* Enable padding */
+        skb_linearize(skb);
+        headroom = skb_headroom(skb);
+        tailroom = skb_tailroom(skb);
+        if (!skb_header_cloned(skb) &&
+            !skb_cloned(skb) &&
+            (headroom + tailroom) >= 8) {
+                if (headroom < 8) {
+                        skb->data = memmove(skb->head + 8, skb->data, skb->len);
+                        skb_set_tail_pointer(skb, skb->len);
+                }
+        } else {
+                struct sk_buff *skb2;
+                skb2 = skb_copy_expand(skb, 8, 0, flags);
+                dev_kfree_skb_any(skb);
+                skb = skb2;
+                if (!skb)
+                        return NULL;
+        }
+        skb_push(skb, 4);
+        cpu_to_le32s(&tx_hdr2);
+        skb_copy_to_linear_data(skb, &tx_hdr2, 4);
+        skb_push(skb, 4);
+        cpu_to_le32s(&tx_hdr1);
+        skb_copy_to_linear_data(skb, &tx_hdr1, 4);
+        return skb;
+}
+static int ax88179_link_reset(struct usbnet *dev)
+{
+        struct ax88179_data *ax179_data = (struct ax88179_data *)dev->data;
+        u8 tmp[5], link_sts;
+        u16 mode, tmp16, delay = HZ / 10;
+        u32 tmp32 = 0x40000000;
+        unsigned long jtimeout;
+        jtimeout = jiffies + delay;
+        while (tmp32 & 0x40000000) {
+                mode = 0;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, &mode);
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2,
+                                  &ax179_data->rxctl);
+                /*link up, check the usb device control TX FIFO full or empty*/
+                ax88179_read_cmd(dev, 0x81, 0x8c, 0, 4, &tmp32);
+                if (time_after(jiffies, jtimeout))
+                        return 0;
+        }
+        mode = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
+               AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_ALWAYS_ONE;
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, PHYSICAL_LINK_STATUS,
+                         1, 1, &link_sts);
+        ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                         GMII_PHY_PHYSR, 2, &tmp16);
+        if (!(tmp16 & GMII_PHY_PHYSR_LINK)) {
+                return 0;
+        } else if (GMII_PHY_PHYSR_GIGA == (tmp16 & GMII_PHY_PHYSR_SMASK)) {
+                mode |= AX_MEDIUM_GIGAMODE | AX_MEDIUM_EN_125MHZ;
+                if (dev->net->mtu > 1500)
+                        mode |= AX_MEDIUM_JUMBO_EN;
+                if (link_sts & AX_USB_SS)
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[0], 5);
+                else if (link_sts & AX_USB_HS)
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[1], 5);
+                else
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[3], 5);
+        } else if (GMII_PHY_PHYSR_100 == (tmp16 & GMII_PHY_PHYSR_SMASK)) {
+                mode |= AX_MEDIUM_PS;
+                if (link_sts & (AX_USB_SS | AX_USB_HS))
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[2], 5);
+                else
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[3], 5);
+        } else {
+                memcpy(tmp, &AX88179_BULKIN_SIZE[3], 5);
+        }
+        /* RX bulk configuration */
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_BULKIN_QCTRL, 5, 5, tmp);
+        dev->rx_urb_size = (1024 * (tmp[3] + 2));
+        if (tmp16 & GMII_PHY_PHYSR_FULL)
+                mode |= AX_MEDIUM_FULL_DUPLEX;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                          2, 2, &mode);
+        netif_carrier_on(dev->net);
+        return 0;
+}
+static int ax88179_reset(struct usbnet *dev)
+{
+        u8 buf[5];
+        u16 *tmp16;
+        u8 *tmp;
+        tmp16 = (u16 *)buf;
+        tmp = (u8 *)buf;
+        /* Power up ethernet PHY */
+        *tmp16 = 0;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
+        *tmp16 = AX_PHYPWR_RSTCTL_IPRL;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
+        msleep(200);
+        *tmp = AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, tmp);
+        msleep(100);
+        /* Ethernet PHY Auto Detach*/
+        ax88179_auto_detach(dev, 0);
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, ETH_ALEN,
+                         dev->net->dev_addr);
+        memcpy(dev->net->perm_addr, dev->net->dev_addr, ETH_ALEN);
+        /* RX bulk configuration */
+        memcpy(tmp, &AX88179_BULKIN_SIZE[0], 5);
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_BULKIN_QCTRL, 5, 5, tmp);
+        dev->rx_urb_size = 1024 * 20;
+        *tmp = 0x34;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PAUSE_WATERLVL_LOW, 1, 1, tmp);
+        *tmp = 0x52;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PAUSE_WATERLVL_HIGH,
+                          1, 1, tmp);
+        dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+        dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+        /* Enable checksum offload */
+        *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+               AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, tmp);
+        *tmp = AX_TXCOE_IP | AX_TXCOE_TCP | AX_TXCOE_UDP |
+               AX_TXCOE_TCPV6 | AX_TXCOE_UDPV6;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, tmp);
+        /* Configure RX control register => start operation */
+        *tmp16 = AX_RX_CTL_DROPCRCERR | AX_RX_CTL_IPE | AX_RX_CTL_START |
+                 AX_RX_CTL_AP | AX_RX_CTL_AMALL | AX_RX_CTL_AB;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, tmp16);
+        *tmp = AX_MONITOR_MODE_PMETYPE | AX_MONITOR_MODE_PMEPOL |
+               AX_MONITOR_MODE_RWMP;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MONITOR_MOD, 1, 1, tmp);
+        /* Configure default medium type => giga */
+        *tmp16 = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
+                 AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_ALWAYS_ONE |
+                 AX_MEDIUM_FULL_DUPLEX | AX_MEDIUM_GIGAMODE;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                          2, 2, tmp16);
+        ax88179_led_setting(dev);
+        /* Restart autoneg */
+        mii_nway_restart(&dev->mii);
+        netif_carrier_off(dev->net);
+        return 0;
+}
+static int ax88179_stop(struct usbnet *dev)
+{
+        u16 tmp16;
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                         2, 2, &tmp16);
+        tmp16 &= ~AX_MEDIUM_RECEIVE_EN;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                          2, 2, &tmp16);
+        return 0;
+}
+static const struct driver_info ax88179_info = {
+        .description = "ASIX AX88179 USB 3.0 Gigibit Ethernet",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+static const struct driver_info ax88178a_info = {
+        .description = "ASIX AX88178A USB 2.0 Gigibit Ethernet",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+static const struct driver_info sitecom_info = {
+        .description = "Sitecom USB 3.0 to Gigabit Adapter",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+static const struct usb_device_id products[] = {
+{
+        /* ASIX AX88179 10/100/1000 */
+        USB_DEVICE(0x0b95, 0x1790),
+        .driver_info = (unsigned long)&ax88179_info,
+}, {
+        /* ASIX AX88178A 10/100/1000 */
+        USB_DEVICE(0x0b95, 0x178a),
+        .driver_info = (unsigned long)&ax88178a_info,
+}, {
+        /* Sitecom USB 3.0 to Gigabit Adapter */
+        USB_DEVICE(0x0df6, 0x0072),
+        .driver_info = (unsigned long) &sitecom_info,
+},
+        { },
+};
+MODULE_DEVICE_TABLE(usb, products);
+static struct usb_driver ax88179_178a_driver = {
+        .name =         "ax88179_178a",
+        .id_table =     products,
+        .probe =        usbnet_probe,
+        .suspend =      ax88179_suspend,
+        .resume =       ax88179_resume,
+        .disconnect =   usbnet_disconnect,
+        .supports_autosuspend = 1,
+        .disable_hub_initiated_lpm = 1,
+};
+module_usb_driver(ax88179_178a_driver);
+MODULE_DESCRIPTION("ASIX AX88179/178A based USB 3.0/2.0 Gigabit Ethernet Devices");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 4a8c25a22294..61b74a2b89ac 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1213,6 +1213,14 @@ static const struct usb_device_id cdc_devs[] = {
          .driver_info = (unsigned long) &wwan_info,
        },
+        /* tag Huawei devices as wwan */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1,
+                                        USB_CLASS_COMM,
+                                        USB_CDC_SUBCLASS_NCM,
+                                        USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&wwan_info,
+        },
        /* Huawei NCM devices disguised as vendor specific */
        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x16),
          .driver_info = (unsigned long)&wwan_info,
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index 5f845beeb18b..050ca4a4850d 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -27,7 +27,7 @@
 #define WME_MAX_BA              WME_BA_BMP_SIZE
 #define ATH_TID_MAX_BUFS        (2 * WME_MAX_BA)
-#define ATH_RSSI_DUMMY_MARKER   0x127
+#define ATH_RSSI_DUMMY_MARKER   127
 #define ATH_RSSI_LPF_LEN                10
 #define RSSI_LPF_THRESHOLD              -20
 #define ATH_RSSI_EP_MULTIPLIER     (1<<7)
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 96bfb18078fa..d3b099d7898b 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -22,6 +22,7 @@
 #include <linux/firmware.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/leds.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 3ad1fd05c5e7..bd8251c1c749 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -1067,15 +1067,19 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
        last_rssi = priv->rx.last_rssi;
-        if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
+        if (ieee80211_is_beacon(hdr->frame_control) &&
-                rxbuf->rxstatus.rs_rssi = ATH_EP_RND(last_rssi,
+            !is_zero_ether_addr(common->curbssid) &&
-                                                     ATH_RSSI_EP_MULTIPLIER);
+            ether_addr_equal(hdr->addr3, common->curbssid)) {
+                s8 rssi = rxbuf->rxstatus.rs_rssi;
-        if (rxbuf->rxstatus.rs_rssi < 0)
+                if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
-                rxbuf->rxstatus.rs_rssi = 0;
+                        rssi = ATH_EP_RND(last_rssi, ATH_RSSI_EP_MULTIPLIER);
-        if (ieee80211_is_beacon(fc))
+                if (rssi < 0)
-                priv->ah->stats.avgbrssi = rxbuf->rxstatus.rs_rssi;
+                        rssi = 0;
+                priv->ah->stats.avgbrssi = rssi;
+        }
        rx_status->mactime = be64_to_cpu(rxbuf->rxstatus.rs_tstamp);
        rx_status->band = hw->conf.channel->band;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 2a2ae403e0e5..07e25260c31d 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1463,7 +1463,9 @@ static bool ath9k_hw_chip_reset(struct ath_hw *ah,
                        reset_type = ATH9K_RESET_POWER_ON;
                else
                        reset_type = ATH9K_RESET_COLD;
-        }
+        } else if (ah->chip_fullsleep || REG_READ(ah, AR_Q_TXE) ||
+                   (REG_READ(ah, AR_CR) & AR_CR_RXE))
+                reset_type = ATH9K_RESET_COLD;
        if (!ath9k_hw_set_reset_reg(ah, reset_type))
                return false;
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
index 9a0f45ec9e01..10f01793d7a6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
@@ -349,25 +349,23 @@ TRACE_EVENT(iwlwifi_dev_rx_data,
 TRACE_EVENT(iwlwifi_dev_hcmd,
        TP_PROTO(const struct device *dev,
                 struct iwl_host_cmd *cmd, u16 total_size,
-                 const void *hdr, size_t hdr_len),
+                 struct iwl_cmd_header *hdr),
-        TP_ARGS(dev, cmd, total_size, hdr, hdr_len),
+        TP_ARGS(dev, cmd, total_size, hdr),
        TP_STRUCT__entry(
                DEV_ENTRY
                __dynamic_array(u8, hcmd, total_size)
                __field(u32, flags)
        ),
        TP_fast_assign(
-                int i, offset = hdr_len;
+                int i, offset = sizeof(*hdr);
                DEV_ASSIGN;
                __entry->flags = cmd->flags;
-                memcpy(__get_dynamic_array(hcmd), hdr, hdr_len);
+                memcpy(__get_dynamic_array(hcmd), hdr, sizeof(*hdr));
                for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
                        if (!cmd->len[i])
                                continue;
-                        if (!(cmd->dataflags[i] & IWL_HCMD_DFL_NOCOPY))
-                                continue;
                        memcpy((u8 *)__get_dynamic_array(hcmd) + offset,
                               cmd->data[i], cmd->len[i]);
                        offset += cmd->len[i];
diff --git a/drivers/net/wireless/iwlwifi/iwl-phy-db.c b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
index 14fc8d39fc28..3392011a8768 100644
--- a/drivers/net/wireless/iwlwifi/iwl-phy-db.c
+++ b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
@@ -136,12 +136,6 @@ struct iwl_calib_res_notif_phy_db {
        u8 data[];
 } __packed;
-#define IWL_PHY_DB_STATIC_PIC cpu_to_le32(0x21436587)
-static inline void iwl_phy_db_test_pic(__le32 pic)
-{
-        WARN_ON(IWL_PHY_DB_STATIC_PIC != pic);
-}
 struct iwl_phy_db *iwl_phy_db_init(struct iwl_trans *trans)
 {
        struct iwl_phy_db *phy_db = kzalloc(sizeof(struct iwl_phy_db),
@@ -260,11 +254,6 @@ int iwl_phy_db_set_section(struct iwl_phy_db *phy_db, struct iwl_rx_packet *pkt,
                        (size - CHANNEL_NUM_SIZE) / phy_db->channel_num;
        }
-        /* Test PIC */
-        if (type != IWL_PHY_DB_CFG)
-                iwl_phy_db_test_pic(*(((__le32 *)phy_db_notif->data) +
-                                      (size / sizeof(__le32)) - 1));
        IWL_DEBUG_INFO(phy_db->trans,
                       "%s(%d): [PHYDB]SET: Type %d , Size: %d\n",
                       __func__, __LINE__, type, size);
@@ -372,11 +361,6 @@ int iwl_phy_db_get_section_data(struct iwl_phy_db *phy_db,
                *size = entry->size;
        }
-        /* Test PIC */
-        if (type != IWL_PHY_DB_CFG)
-                iwl_phy_db_test_pic(*(((__le32 *)*data) +
-                                      (*size / sizeof(__le32)) - 1));
        IWL_DEBUG_INFO(phy_db->trans,
                       "%s(%d): [PHYDB] GET: Type %d , Size: %d\n",
                       __func__, __LINE__, type, *size);
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index c64d864799cd..994c8c263dc0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -61,6 +61,7 @@
 *
 *****************************************************************************/
+#include <linux/etherdevice.h>
 #include <net/cfg80211.h>
 #include <net/ipv6.h>
 #include "iwl-modparams.h"
@@ -192,6 +193,11 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                                           sizeof(wkc), &wkc);
                data->error = ret != 0;
+                mvm->ptk_ivlen = key->iv_len;
+                mvm->ptk_icvlen = key->icv_len;
+                mvm->gtk_ivlen = key->iv_len;
+                mvm->gtk_icvlen = key->icv_len;
                /* don't upload key again */
                goto out_unlock;
        }
@@ -304,9 +310,13 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
         */
        if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
                key->hw_key_idx = 0;
+                mvm->ptk_ivlen = key->iv_len;
+                mvm->ptk_icvlen = key->icv_len;
        } else {
                data->gtk_key_idx++;
                key->hw_key_idx = data->gtk_key_idx;
+                mvm->gtk_ivlen = key->iv_len;
+                mvm->gtk_icvlen = key->icv_len;
        }
        ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, true);
@@ -649,6 +659,11 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
        /* We reprogram keys and shouldn't allocate new key indices */
        memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
+        mvm->ptk_ivlen = 0;
+        mvm->ptk_icvlen = 0;
+        mvm->ptk_ivlen = 0;
+        mvm->ptk_icvlen = 0;
        /*
         * The D3 firmware still hardcodes the AP station ID for the
         * BSS we're associated with as 0. As a result, we have to move
@@ -783,7 +798,6 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
        struct iwl_wowlan_status *status;
        u32 reasons;
        int ret, len;
-        bool pkt8023 = false;
        struct sk_buff *pkt = NULL;
        iwl_trans_read_mem_bytes(mvm->trans, base,
@@ -824,7 +838,8 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
        status = (void *)cmd.resp_pkt->data;
        if (len - sizeof(struct iwl_cmd_header) !=
-            sizeof(*status) + le32_to_cpu(status->wake_packet_bufsize)) {
+            sizeof(*status) +
+            ALIGN(le32_to_cpu(status->wake_packet_bufsize), 4)) {
                IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
                goto out;
        }
@@ -836,61 +851,96 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
                goto report;
        }
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_MAGIC_PACKET) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_MAGIC_PACKET)
                wakeup.magic_pkt = true;
-                pkt8023 = true;
-        }
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_PATTERN) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_PATTERN)
                wakeup.pattern_idx =
                        le16_to_cpu(status->pattern_number);
-                pkt8023 = true;
-        }
        if (reasons & (IWL_WOWLAN_WAKEUP_BY_DISCONNECTION_ON_MISSED_BEACON |
                       IWL_WOWLAN_WAKEUP_BY_DISCONNECTION_ON_DEAUTH))
                wakeup.disconnect = true;
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_GTK_REKEY_FAILURE) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_GTK_REKEY_FAILURE)
                wakeup.gtk_rekey_failure = true;
-                pkt8023 = true;
-        }
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_RFKILL_DEASSERTED) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_RFKILL_DEASSERTED)
                wakeup.rfkill_release = true;
-                pkt8023 = true;
-        }
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_EAPOL_REQUEST) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_EAPOL_REQUEST)
                wakeup.eap_identity_req = true;
-                pkt8023 = true;
-        }
-        if (reasons & IWL_WOWLAN_WAKEUP_BY_FOUR_WAY_HANDSHAKE) {
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_FOUR_WAY_HANDSHAKE)
                wakeup.four_way_handshake = true;
-                pkt8023 = true;
-        }
        if (status->wake_packet_bufsize) {
-                u32 pktsize = le32_to_cpu(status->wake_packet_bufsize);
+                int pktsize = le32_to_cpu(status->wake_packet_bufsize);
-                u32 pktlen = le32_to_cpu(status->wake_packet_length);
+                int pktlen = le32_to_cpu(status->wake_packet_length);
+                const u8 *pktdata = status->wake_packet;
+                struct ieee80211_hdr *hdr = (void *)pktdata;
+                int truncated = pktlen - pktsize;
+                /* this would be a firmware bug */
+                if (WARN_ON_ONCE(truncated < 0))
+                        truncated = 0;
+                if (ieee80211_is_data(hdr->frame_control)) {
+                        int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+                        int ivlen = 0, icvlen = 4; /* also FCS */
-                if (pkt8023) {
                        pkt = alloc_skb(pktsize, GFP_KERNEL);
                        if (!pkt)
                                goto report;
-                        memcpy(skb_put(pkt, pktsize), status->wake_packet,
-                               pktsize);
+                        memcpy(skb_put(pkt, hdrlen), pktdata, hdrlen);
+                        pktdata += hdrlen;
+                        pktsize -= hdrlen;
+                        if (ieee80211_has_protected(hdr->frame_control)) {
+                                if (is_multicast_ether_addr(hdr->addr1)) {
+                                        ivlen = mvm->gtk_ivlen;
+                                        icvlen += mvm->gtk_icvlen;
+                                } else {
+                                        ivlen = mvm->ptk_ivlen;
+                                        icvlen += mvm->ptk_icvlen;
+                                }
+                        }
+                        /* if truncated, FCS/ICV is (partially) gone */
+                        if (truncated >= icvlen) {
+                                icvlen = 0;
+                                truncated -= icvlen;
+                        } else {
+                                icvlen -= truncated;
+                                truncated = 0;
+                        }
+                        pktsize -= ivlen + icvlen;
+                        pktdata += ivlen;
+                        memcpy(skb_put(pkt, pktsize), pktdata, pktsize);
                        if (ieee80211_data_to_8023(pkt, vif->addr, vif->type))
                                goto report;
                        wakeup.packet = pkt->data;
                        wakeup.packet_present_len = pkt->len;
-                        wakeup.packet_len = pkt->len - (pktlen - pktsize);
+                        wakeup.packet_len = pkt->len - truncated;
                        wakeup.packet_80211 = false;
                } else {
+                        int fcslen = 4;
+                        if (truncated >= 4) {
+                                truncated -= 4;
+                                fcslen = 0;
+                        } else {
+                                fcslen -= truncated;
+                                truncated = 0;
+                        }
+                        pktsize -= fcslen;
                        wakeup.packet = status->wake_packet;
                        wakeup.packet_present_len = pktsize;
-                        wakeup.packet_len = pktlen;
+                        wakeup.packet_len = pktlen - truncated;
                        wakeup.packet_80211 = true;
                }
        }
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index e8264e11b12d..7e169b085afe 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -557,11 +557,9 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
        return ret;
 }
-static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
+static void iwl_mvm_prepare_mac_removal(struct iwl_mvm *mvm,
-                                         struct ieee80211_vif *vif)
+                                        struct ieee80211_vif *vif)
 {
-        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
        u32 tfd_msk = 0, ac;
        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
@@ -594,12 +592,21 @@ static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
                 */
                flush_work(&mvm->sta_drained_wk);
        }
+}
+static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
+                                         struct ieee80211_vif *vif)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        iwl_mvm_prepare_mac_removal(mvm, vif);
        mutex_lock(&mvm->mutex);
        /*
         * For AP/GO interface, the tear down of the resources allocated to the
-         * interface should be handled as part of the bss_info_changed flow.
+         * interface is be handled as part of the stop_ap flow.
         */
        if (vif->type == NL80211_IFTYPE_AP) {
                iwl_mvm_dealloc_int_sta(mvm, &mvmvif->bcast_sta);
@@ -763,6 +770,8 @@ static void iwl_mvm_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        iwl_mvm_prepare_mac_removal(mvm, vif);
        mutex_lock(&mvm->mutex);
        mvmvif->ap_active = false;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index 4e339ccfa800..537711b10478 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -327,6 +327,10 @@ struct iwl_mvm {
        struct led_classdev led;
        struct ieee80211_vif *p2p_device_vif;
+#ifdef CONFIG_PM_SLEEP
+        int gtk_ivlen, gtk_icvlen, ptk_ivlen, ptk_icvlen;
+#endif
 };
 /* Extract MVM priv from op_mode and _hw */
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index aa2a39a637dd..3d62e8055352 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -182,6 +182,15 @@ struct iwl_queue {
 #define TFD_TX_CMD_SLOTS 256
 #define TFD_CMD_SLOTS 32
+/*
+ * The FH will write back to the first TB only, so we need
+ * to copy some data into the buffer regardless of whether
+ * it should be mapped or not. This indicates how much to
+ * copy, even for HCMDs it must be big enough to fit the
+ * DRAM scratch from the TX cmd, at least 16 bytes.
+ */
+#define IWL_HCMD_MIN_COPY_SIZE  16
 struct iwl_pcie_txq_entry {
        struct iwl_device_cmd *cmd;
        struct iwl_device_cmd *copy_cmd;
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 8e9e3212fe78..8b625a7f5685 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1152,10 +1152,12 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
        void *dup_buf = NULL;
        dma_addr_t phys_addr;
        int idx;
-        u16 copy_size, cmd_size;
+        u16 copy_size, cmd_size, dma_size;
        bool had_nocopy = false;
        int i;
        u32 cmd_pos;
+        const u8 *cmddata[IWL_MAX_CMD_TFDS];
+        u16 cmdlen[IWL_MAX_CMD_TFDS];
        copy_size = sizeof(out_cmd->hdr);
        cmd_size = sizeof(out_cmd->hdr);
@@ -1164,8 +1166,23 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
        BUILD_BUG_ON(IWL_MAX_CMD_TFDS > IWL_NUM_OF_TBS - 1);
        for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
+                cmddata[i] = cmd->data[i];
+                cmdlen[i] = cmd->len[i];
                if (!cmd->len[i])
                        continue;
+                /* need at least IWL_HCMD_MIN_COPY_SIZE copied */
+                if (copy_size < IWL_HCMD_MIN_COPY_SIZE) {
+                        int copy = IWL_HCMD_MIN_COPY_SIZE - copy_size;
+                        if (copy > cmdlen[i])
+                                copy = cmdlen[i];
+                        cmdlen[i] -= copy;
+                        cmddata[i] += copy;
+                        copy_size += copy;
+                }
                if (cmd->dataflags[i] & IWL_HCMD_DFL_NOCOPY) {
                        had_nocopy = true;
                        if (WARN_ON(cmd->dataflags[i] & IWL_HCMD_DFL_DUP)) {
@@ -1185,7 +1202,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                                goto free_dup_buf;
                        }
-                        dup_buf = kmemdup(cmd->data[i], cmd->len[i],
+                        dup_buf = kmemdup(cmddata[i], cmdlen[i],
                                          GFP_ATOMIC);
                        if (!dup_buf)
                                return -ENOMEM;
@@ -1195,7 +1212,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                                idx = -EINVAL;
                                goto free_dup_buf;
                        }
-                        copy_size += cmd->len[i];
+                        copy_size += cmdlen[i];
                }
                cmd_size += cmd->len[i];
        }
@@ -1242,14 +1259,31 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
        /* and copy the data that needs to be copied */
        cmd_pos = offsetof(struct iwl_device_cmd, payload);
+        copy_size = sizeof(out_cmd->hdr);
        for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
-                if (!cmd->len[i])
+                int copy = 0;
+                if (!cmd->len)
                        continue;
-                if (cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
-                                         IWL_HCMD_DFL_DUP))
+                /* need at least IWL_HCMD_MIN_COPY_SIZE copied */
-                        break;
+                if (copy_size < IWL_HCMD_MIN_COPY_SIZE) {
-                memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], cmd->len[i]);
+                        copy = IWL_HCMD_MIN_COPY_SIZE - copy_size;
-                cmd_pos += cmd->len[i];
+                        if (copy > cmd->len[i])
+                                copy = cmd->len[i];
+                }
+                /* copy everything if not nocopy/dup */
+                if (!(cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
+                                           IWL_HCMD_DFL_DUP)))
+                        copy = cmd->len[i];
+                if (copy) {
+                        memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], copy);
+                        cmd_pos += copy;
+                        copy_size += copy;
+                }
        }
        WARN_ON_ONCE(txq->entries[idx].copy_cmd);
@@ -1275,7 +1309,14 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                     out_cmd->hdr.cmd, le16_to_cpu(out_cmd->hdr.sequence),
                     cmd_size, q->write_ptr, idx, trans_pcie->cmd_queue);
-        phys_addr = dma_map_single(trans->dev, &out_cmd->hdr, copy_size,
+        /*
+         * If the entire command is smaller than IWL_HCMD_MIN_COPY_SIZE, we must
+         * still map at least that many bytes for the hardware to write back to.
+         * We have enough space, so that's not a problem.
+         */
+        dma_size = max_t(u16, copy_size, IWL_HCMD_MIN_COPY_SIZE);
+        phys_addr = dma_map_single(trans->dev, &out_cmd->hdr, dma_size,
                                   DMA_BIDIRECTIONAL);
        if (unlikely(dma_mapping_error(trans->dev, phys_addr))) {
                idx = -ENOMEM;
@@ -1283,14 +1324,15 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
        }
        dma_unmap_addr_set(out_meta, mapping, phys_addr);
-        dma_unmap_len_set(out_meta, len, copy_size);
+        dma_unmap_len_set(out_meta, len, dma_size);
        iwl_pcie_txq_build_tfd(trans, txq, phys_addr, copy_size, 1);
+        /* map the remaining (adjusted) nocopy/dup fragments */
        for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
-                const void *data = cmd->data[i];
+                const void *data = cmddata[i];
-                if (!cmd->len[i])
+                if (!cmdlen[i])
                        continue;
                if (!(cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
                                           IWL_HCMD_DFL_DUP)))
@@ -1298,7 +1340,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                if (cmd->dataflags[i] & IWL_HCMD_DFL_DUP)
                        data = dup_buf;
                phys_addr = dma_map_single(trans->dev, (void *)data,
-                                           cmd->len[i], DMA_BIDIRECTIONAL);
+                                           cmdlen[i], DMA_BIDIRECTIONAL);
                if (dma_mapping_error(trans->dev, phys_addr)) {
                        iwl_pcie_tfd_unmap(trans, out_meta,
                                           &txq->tfds[q->write_ptr],
@@ -1307,7 +1349,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                        goto out;
                }
-                iwl_pcie_txq_build_tfd(trans, txq, phys_addr, cmd->len[i], 0);
+                iwl_pcie_txq_build_tfd(trans, txq, phys_addr, cmdlen[i], 0);
        }
        out_meta->flags = cmd->flags;
@@ -1317,8 +1359,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
        txq->need_update = 1;
-        trace_iwlwifi_dev_hcmd(trans->dev, cmd, cmd_size,
+        trace_iwlwifi_dev_hcmd(trans->dev, cmd, cmd_size, &out_cmd->hdr);
-                               &out_cmd->hdr, copy_size);
        /* start timer if queue currently empty */
        if (q->read_ptr == q->write_ptr && trans_pcie->wd_timeout)
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 739309e70d8b..45578335e420 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -825,6 +825,11 @@ static void if_sdio_finish_power_on(struct if_sdio_card *card)
        sdio_release_host(func);
+        /* Set fw_ready before queuing any commands so that
+         * lbs_thread won't block from sending them to firmware.
+         */
+        priv->fw_ready = 1;
        /*
         * FUNC_INIT is required for SD8688 WLAN/BT multiple functions
         */
@@ -839,7 +844,6 @@ static void if_sdio_finish_power_on(struct if_sdio_card *card)
                        netdev_alert(priv->dev, "CMD_FUNC_INIT cmd failed\n");
        }
-        priv->fw_ready = 1;
        wake_up(&card->pwron_waitq);
        if (!card->started) {
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 35c79722c361..5c395e2e6a2b 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -302,7 +302,7 @@ static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
                i++;
                usleep_range(10, 20);
                /* 50ms max wait */
-                if (i == 50000)
+                if (i == 5000)
                        break;
        }
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 1031db66474a..189744db65e0 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1236,8 +1236,10 @@ static inline void rt2x00lib_set_if_combinations(struct rt2x00_dev *rt2x00dev)
         */
        if_limit = &rt2x00dev->if_limits_ap;
        if_limit->max = rt2x00dev->ops->max_ap_intf;
-        if_limit->types = BIT(NL80211_IFTYPE_AP) |
+        if_limit->types = BIT(NL80211_IFTYPE_AP);
-                        BIT(NL80211_IFTYPE_MESH_POINT);
+#ifdef CONFIG_MAC80211_MESH
+        if_limit->types |= BIT(NL80211_IFTYPE_MESH_POINT);
+#endif
        /*
         * Build up AP interface combinations structure.
@@ -1309,7 +1311,9 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
                rt2x00dev->hw->wiphy->interface_modes |=
                    BIT(NL80211_IFTYPE_ADHOC) |
                    BIT(NL80211_IFTYPE_AP) |
+#ifdef CONFIG_MAC80211_MESH
                    BIT(NL80211_IFTYPE_MESH_POINT) |
+#endif
                    BIT(NL80211_IFTYPE_WDS);
        rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 39c937f9b426..dee5dddaa292 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -331,8 +331,14 @@ static void pci_acpi_cleanup(struct device *dev)
        }
 }
+static bool pci_acpi_bus_match(struct device *dev)
+{
+        return dev->bus == &pci_bus_type;
+}
 static struct acpi_bus_type acpi_pci_bus = {
-        .bus = &pci_bus_type,
+        .name = "PCI",
+        .match = pci_acpi_bus_match,
        .find_device = acpi_pci_find_device,
        .setup = pci_acpi_setup,
        .cleanup = pci_acpi_cleanup,
diff --git a/drivers/pnp/pnpacpi/core.c b/drivers/pnp/pnpacpi/core.c
index 8813fc03aa09..55cd459a3908 100644
--- a/drivers/pnp/pnpacpi/core.c
+++ b/drivers/pnp/pnpacpi/core.c
@@ -353,8 +353,14 @@ static int __init acpi_pnp_find_device(struct device *dev, acpi_handle * handle)
 /* complete initialization of a PNPACPI device includes having
 * pnpdev->dev.archdata.acpi_handle point to its ACPI sibling.
 */
+static bool acpi_pnp_bus_match(struct device *dev)
+{
+        return dev->bus == &pnp_bus_type;
+}
 static struct acpi_bus_type __initdata acpi_pnp_bus = {
-        .bus         = &pnp_bus_type,
+        .name        = "PNP",
+        .match       = acpi_pnp_bus_match,
        .find_device = acpi_pnp_find_device,
 };
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index da9782bd27d0..e3661c20cf38 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -2830,7 +2830,7 @@ EXPORT_SYMBOL_GPL(regulator_get_bypass_regmap);
 * regulator_allow_bypass - allow the regulator to go into bypass mode
 *
 * @regulator: Regulator to configure
- * @allow: enable or disable bypass mode
+ * @enable: enable or disable bypass mode
 *
 * Allow the regulator to go into bypass mode if all other consumers
 * for the regulator also enable bypass mode and the machine
@@ -3057,9 +3057,13 @@ int regulator_bulk_enable(int num_consumers,
        return 0;
 err:
-        pr_err("Failed to enable %s: %d\n", consumers[i].supply, ret);
+        for (i = 0; i < num_consumers; i++) {
-        while (--i >= 0)
+                if (consumers[i].ret < 0)
-                regulator_disable(consumers[i].consumer);
+                        pr_err("Failed to enable %s: %d\n", consumers[i].supply,
+                               consumers[i].ret);
+                else
+                        regulator_disable(consumers[i].consumer);
+        }
        return ret;
 }
diff --git a/drivers/regulator/db8500-prcmu.c b/drivers/regulator/db8500-prcmu.c
index 219d162b651e..a53c11a529d5 100644
--- a/drivers/regulator/db8500-prcmu.c
+++ b/drivers/regulator/db8500-prcmu.c
@@ -528,7 +528,7 @@ static int db8500_regulator_probe(struct platform_device *pdev)
        return 0;
 }
-static int __exit db8500_regulator_remove(struct platform_device *pdev)
+static int db8500_regulator_remove(struct platform_device *pdev)
 {
        int i;
@@ -553,7 +553,7 @@ static struct platform_driver db8500_regulator_driver = {
                .owner = THIS_MODULE,
        },
        .probe = db8500_regulator_probe,
-        .remove = __exit_p(db8500_regulator_remove),
+        .remove = db8500_regulator_remove,
 };
 static int __init db8500_regulator_init(void)
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index cde13bb5a8fb..39cf14606784 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -4,6 +4,7 @@
 * Copyright 2011-2012 Texas Instruments Inc.
 *
 * Author: Graeme Gregory <gg@slimlogic.co.uk>
+ * Author: Ian Lartey <ian@slimlogic.co.uk>
 *
 *  This program is free software; you can redistribute it and/or modify it
 *  under  the terms of the GNU General  Public License as published by the
@@ -156,7 +157,7 @@ static const struct regs_info palmas_regs_info[] = {
 *
 * So they are basically (maxV-minV)/stepV
 */
-#define PALMAS_SMPS_NUM_VOLTAGES        116
+#define PALMAS_SMPS_NUM_VOLTAGES        117
 #define PALMAS_SMPS10_NUM_VOLTAGES      2
 #define PALMAS_LDO_NUM_VOLTAGES         50
diff --git a/drivers/regulator/twl-regulator.c b/drivers/regulator/twl-regulator.c
index 74508cc62d67..f705d25b437c 100644
--- a/drivers/regulator/twl-regulator.c
+++ b/drivers/regulator/twl-regulator.c
@@ -471,24 +471,23 @@ twl4030ldo_set_voltage_sel(struct regulator_dev *rdev, unsigned selector)
                            selector);
 }
-static int twl4030ldo_get_voltage(struct regulator_dev *rdev)
+static int twl4030ldo_get_voltage_sel(struct regulator_dev *rdev)
 {
        struct twlreg_info      *info = rdev_get_drvdata(rdev);
-        int             vsel = twlreg_read(info, TWL_MODULE_PM_RECEIVER,
+        int vsel = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_VOLTAGE);
-                                                                VREG_VOLTAGE);
        if (vsel < 0)
                return vsel;
        vsel &= info->table_len - 1;
-        return LDO_MV(info->table[vsel]) * 1000;
+        return vsel;
 }
 static struct regulator_ops twl4030ldo_ops = {
        .list_voltage   = twl4030ldo_list_voltage,
        .set_voltage_sel = twl4030ldo_set_voltage_sel,
-        .get_voltage    = twl4030ldo_get_voltage,
+        .get_voltage_sel = twl4030ldo_get_voltage_sel,
        .enable         = twl4030reg_enable,
        .disable        = twl4030reg_disable,
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 765398c063c7..c31187d79343 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -71,9 +71,14 @@ struct kmem_cache *scsi_sdb_cache;
 #ifdef CONFIG_ACPI
 #include <acpi/acpi_bus.h>
+static bool acpi_scsi_bus_match(struct device *dev)
+{
+        return dev->bus == &scsi_bus_type;
+}
 int scsi_register_acpi_bus_type(struct acpi_bus_type *bus)
 {
-        bus->bus = &scsi_bus_type;
+        bus->match = acpi_scsi_bus_match;
        return register_acpi_bus_type(bus);
 }
 EXPORT_SYMBOL_GPL(scsi_register_acpi_bus_type);
diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
index 1956593ee89d..81e939e90c4c 100644
--- a/drivers/tty/hvc/hvcs.c
+++ b/drivers/tty/hvc/hvcs.c
@@ -881,17 +881,12 @@ static struct vio_driver hvcs_vio_driver = {
 /* Only called from hvcs_get_pi please */
 static void hvcs_set_pi(struct hvcs_partner_info *pi, struct hvcs_struct *hvcsd)
 {
-        int clclength;
        hvcsd->p_unit_address = pi->unit_address;
        hvcsd->p_partition_ID  = pi->partition_ID;
-        clclength = strlen(&pi->location_code[0]);
-        if (clclength > HVCS_CLC_LENGTH)
-                clclength = HVCS_CLC_LENGTH;
        /* copy the null-term char too */
-        strncpy(&hvcsd->p_location_code[0],
+        strlcpy(&hvcsd->p_location_code[0],
-                        &pi->location_code[0], clclength + 1);
+                        &pi->location_code[0], sizeof(hvcsd->p_location_code));
 }
 /*
diff --git a/drivers/usb/core/usb-acpi.c b/drivers/usb/core/usb-acpi.c
index cef4252bb31a..b6f4bad3f756 100644
--- a/drivers/usb/core/usb-acpi.c
+++ b/drivers/usb/core/usb-acpi.c
@@ -210,9 +210,14 @@ static int usb_acpi_find_device(struct device *dev, acpi_handle *handle)
        return 0;
 }
+static bool usb_acpi_bus_match(struct device *dev)
+{
+        return is_usb_device(dev) || is_usb_port(dev);
+}
 static struct acpi_bus_type usb_acpi_bus = {
-        .bus = &usb_bus_type,
+        .name = "USB",
-        .find_bridge = usb_acpi_find_device,
+        .match = usb_acpi_bus_match,
        .find_device = usb_acpi_find_device,
 };
diff --git a/fs/ecryptfs/Kconfig b/fs/ecryptfs/Kconfig
index e15ef38c24fa..434aa313f077 100644
--- a/fs/ecryptfs/Kconfig
+++ b/fs/ecryptfs/Kconfig
@@ -12,3 +12,11 @@ config ECRYPT_FS
          To compile this file system support as a module, choose M here: the
          module will be called ecryptfs.
+config ECRYPT_FS_MESSAGING
+        bool "Enable notifications for userspace key wrap/unwrap"
+        depends on ECRYPT_FS
+        help
+          Enables the /dev/ecryptfs entry for use by ecryptfsd. This allows
+          for userspace to wrap/unwrap file encryption keys by other
+          backends, like OpenSSL.
diff --git a/fs/ecryptfs/Makefile b/fs/ecryptfs/Makefile
index 2cc9ee4ad2eb..49678a69947d 100644
--- a/fs/ecryptfs/Makefile
+++ b/fs/ecryptfs/Makefile
@@ -1,7 +1,10 @@
 #
-# Makefile for the Linux 2.6 eCryptfs
+# Makefile for the Linux eCryptfs
 #
 obj-$(CONFIG_ECRYPT_FS) += ecryptfs.o
-ecryptfs-objs := dentry.o file.o inode.o main.o super.o mmap.o read_write.o crypto.o keystore.o messaging.o miscdev.o kthread.o debug.o
+ecryptfs-y := dentry.o file.o inode.o main.o super.o mmap.o read_write.o \
+              crypto.o keystore.o kthread.o debug.o
+ecryptfs-$(CONFIG_ECRYPT_FS_MESSAGING) += messaging.o miscdev.o
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index a7b0c2dfb3db..d5c25db4398f 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -301,17 +301,14 @@ int virt_to_scatterlist(const void *addr, int size, struct scatterlist *sg,
        while (size > 0 && i < sg_size) {
                pg = virt_to_page(addr);
                offset = offset_in_page(addr);
-                if (sg)
+                sg_set_page(&sg[i], pg, 0, offset);
-                        sg_set_page(&sg[i], pg, 0, offset);
                remainder_of_page = PAGE_CACHE_SIZE - offset;
                if (size >= remainder_of_page) {
-                        if (sg)
+                        sg[i].length = remainder_of_page;
-                                sg[i].length = remainder_of_page;
                        addr += remainder_of_page;
                        size -= remainder_of_page;
                } else {
-                        if (sg)
+                        sg[i].length = size;
-                                sg[i].length = size;
                        addr += size;
                        size = 0;
                }
diff --git a/fs/ecryptfs/dentry.c b/fs/ecryptfs/dentry.c
index 1b5d9af937df..bf12ba5dd223 100644
--- a/fs/ecryptfs/dentry.c
+++ b/fs/ecryptfs/dentry.c
@@ -45,14 +45,12 @@
 static int ecryptfs_d_revalidate(struct dentry *dentry, unsigned int flags)
 {
        struct dentry *lower_dentry;
-        struct vfsmount *lower_mnt;
        int rc = 1;
        if (flags & LOOKUP_RCU)
                return -ECHILD;
        lower_dentry = ecryptfs_dentry_to_lower(dentry);
-        lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry);
        if (!lower_dentry->d_op || !lower_dentry->d_op->d_revalidate)
                goto out;
        rc = lower_dentry->d_op->d_revalidate(lower_dentry, flags);
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 7e2c6f5d7985..dd299b389d4e 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -172,6 +172,19 @@ ecryptfs_get_key_payload_data(struct key *key)
 #define ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE 24
 #define ECRYPTFS_ENCRYPTED_DENTRY_NAME_LEN (18 + 1 + 4 + 1 + 32)
+#ifdef CONFIG_ECRYPT_FS_MESSAGING
+# define ECRYPTFS_VERSIONING_MASK_MESSAGING (ECRYPTFS_VERSIONING_DEVMISC \
+                                             | ECRYPTFS_VERSIONING_PUBKEY)
+#else
+# define ECRYPTFS_VERSIONING_MASK_MESSAGING 0
+#endif
+#define ECRYPTFS_VERSIONING_MASK (ECRYPTFS_VERSIONING_PASSPHRASE \
+                                  | ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH \
+                                  | ECRYPTFS_VERSIONING_XATTR \
+                                  | ECRYPTFS_VERSIONING_MULTKEY \
+                                  | ECRYPTFS_VERSIONING_MASK_MESSAGING \
+                                  | ECRYPTFS_VERSIONING_FILENAME_ENCRYPTION)
 struct ecryptfs_key_sig {
        struct list_head crypt_stat_list;
        char keysig[ECRYPTFS_SIG_SIZE_HEX + 1];
@@ -399,7 +412,9 @@ struct ecryptfs_daemon {
        struct hlist_node euid_chain;
 };
+#ifdef CONFIG_ECRYPT_FS_MESSAGING
 extern struct mutex ecryptfs_daemon_hash_mux;
+#endif
 static inline size_t
 ecryptfs_lower_header_size(struct ecryptfs_crypt_stat *crypt_stat)
@@ -610,6 +625,7 @@ int
 ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
                  size_t size, int flags);
 int ecryptfs_read_xattr_region(char *page_virt, struct inode *ecryptfs_inode);
+#ifdef CONFIG_ECRYPT_FS_MESSAGING
 int ecryptfs_process_response(struct ecryptfs_daemon *daemon,
                              struct ecryptfs_message *msg, u32 seq);
 int ecryptfs_send_message(char *data, int data_len,
@@ -618,6 +634,24 @@ int ecryptfs_wait_for_response(struct ecryptfs_msg_ctx *msg_ctx,
                               struct ecryptfs_message **emsg);
 int ecryptfs_init_messaging(void);
 void ecryptfs_release_messaging(void);
+#else
+static inline int ecryptfs_init_messaging(void)
+{
+        return 0;
+}
+static inline void ecryptfs_release_messaging(void)
+{ }
+static inline int ecryptfs_send_message(char *data, int data_len,
+                                        struct ecryptfs_msg_ctx **msg_ctx)
+{
+        return -ENOTCONN;
+}
+static inline int ecryptfs_wait_for_response(struct ecryptfs_msg_ctx *msg_ctx,
+                                             struct ecryptfs_message **emsg)
+{
+        return -ENOMSG;
+}
+#endif
 void
 ecryptfs_write_header_metadata(char *virt,
@@ -655,12 +689,11 @@ int ecryptfs_read_lower_page_segment(struct page *page_for_ecryptfs,
                                     size_t offset_in_page, size_t size,
                                     struct inode *ecryptfs_inode);
 struct page *ecryptfs_get_locked_page(struct inode *inode, loff_t index);
-int ecryptfs_exorcise_daemon(struct ecryptfs_daemon *daemon);
-int ecryptfs_find_daemon_by_euid(struct ecryptfs_daemon **daemon);
 int ecryptfs_parse_packet_length(unsigned char *data, size_t *size,
                                 size_t *length_size);
 int ecryptfs_write_packet_length(char *dest, size_t size,
                                 size_t *packet_size_length);
+#ifdef CONFIG_ECRYPT_FS_MESSAGING
 int ecryptfs_init_ecryptfs_miscdev(void);
 void ecryptfs_destroy_ecryptfs_miscdev(void);
 int ecryptfs_send_miscdev(char *data, size_t data_size,
@@ -669,6 +702,9 @@ int ecryptfs_send_miscdev(char *data, size_t data_size,
 void ecryptfs_msg_ctx_alloc_to_free(struct ecryptfs_msg_ctx *msg_ctx);
 int
 ecryptfs_spawn_daemon(struct ecryptfs_daemon **daemon, struct file *file);
+int ecryptfs_exorcise_daemon(struct ecryptfs_daemon *daemon);
+int ecryptfs_find_daemon_by_euid(struct ecryptfs_daemon **daemon);
+#endif
 int ecryptfs_init_kthread(void);
 void ecryptfs_destroy_kthread(void);
 int ecryptfs_privileged_open(struct file **lower_file,
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index 53acc9d0c138..63b1f54b6a1f 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -199,7 +199,6 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
        struct dentry *ecryptfs_dentry = file->f_path.dentry;
        /* Private value of ecryptfs_dentry allocated in
         * ecryptfs_lookup() */
-        struct dentry *lower_dentry;
        struct ecryptfs_file_info *file_info;
        mount_crypt_stat = &ecryptfs_superblock_to_private(
@@ -222,7 +221,6 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                rc = -ENOMEM;
                goto out;
        }
-        lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
        crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
        mutex_lock(&crypt_stat->cs_mutex);
        if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) {
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index e0f07fb6d56b..5eab400e2590 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -999,8 +999,8 @@ out:
        return rc;
 }
-int ecryptfs_getattr_link(struct vfsmount *mnt, struct dentry *dentry,
+static int ecryptfs_getattr_link(struct vfsmount *mnt, struct dentry *dentry,
-                          struct kstat *stat)
+                                 struct kstat *stat)
 {
        struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
        int rc = 0;
@@ -1021,8 +1021,8 @@ int ecryptfs_getattr_link(struct vfsmount *mnt, struct dentry *dentry,
        return rc;
 }
-int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
+static int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
-                     struct kstat *stat)
+                            struct kstat *stat)
 {
        struct kstat lower_stat;
        int rc;
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 2333203a120b..7d52806c2119 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1150,7 +1150,7 @@ decrypt_pki_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
        struct ecryptfs_message *msg = NULL;
        char *auth_tok_sig;
        char *payload;
-        size_t payload_len;
+        size_t payload_len = 0;
        int rc;
        rc = ecryptfs_get_auth_tok_sig(&auth_tok_sig, auth_tok);
@@ -1168,7 +1168,7 @@ decrypt_pki_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
        rc = ecryptfs_send_message(payload, payload_len, &msg_ctx);
        if (rc) {
                ecryptfs_printk(KERN_ERR, "Error sending message to "
-                                "ecryptfsd\n");
+                                "ecryptfsd: %d\n", rc);
                goto out;
        }
        rc = ecryptfs_wait_for_response(msg_ctx, &msg);
@@ -1202,8 +1202,7 @@ decrypt_pki_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
                                  crypt_stat->key_size);
        }
 out:
-        if (msg)
+        kfree(msg);
-                kfree(msg);
        return rc;
 }
@@ -1989,7 +1988,7 @@ pki_encrypt_session_key(struct key *auth_tok_key,
        rc = ecryptfs_send_message(payload, payload_len, &msg_ctx);
        if (rc) {
                ecryptfs_printk(KERN_ERR, "Error sending message to "
-                                "ecryptfsd\n");
+                                "ecryptfsd: %d\n", rc);
                goto out;
        }
        rc = ecryptfs_wait_for_response(msg_ctx, &msg);
diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
index 8d7a577ae497..49ff8ea08f1c 100644
--- a/fs/ecryptfs/messaging.c
+++ b/fs/ecryptfs/messaging.c
@@ -97,8 +97,7 @@ static void ecryptfs_msg_ctx_free_to_alloc(struct ecryptfs_msg_ctx *msg_ctx)
 void ecryptfs_msg_ctx_alloc_to_free(struct ecryptfs_msg_ctx *msg_ctx)
 {
        list_move(&(msg_ctx->node), &ecryptfs_msg_ctx_free_list);
-        if (msg_ctx->msg)
+        kfree(msg_ctx->msg);
-                kfree(msg_ctx->msg);
        msg_ctx->msg = NULL;
        msg_ctx->state = ECRYPTFS_MSG_CTX_STATE_FREE;
 }
@@ -283,7 +282,7 @@ ecryptfs_send_message_locked(char *data, int data_len, u8 msg_type,
        int rc;
        rc = ecryptfs_find_daemon_by_euid(&daemon);
-        if (rc || !daemon) {
+        if (rc) {
                rc = -ENOTCONN;
                goto out;
        }
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index e65278f560c4..22ba56e834e2 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -437,11 +437,9 @@ void acpi_remove_dir(struct acpi_device *);
 */
 struct acpi_bus_type {
        struct list_head list;
-        struct bus_type *bus;
+        const char *name;
-        /* For general devices under the bus */
+        bool (*match)(struct device *dev);
        int (*find_device) (struct device *, acpi_handle *);
-        /* For bridges, such as PCI root bridge, IDE controller */
-        int (*find_bridge) (struct device *, acpi_handle *);
        void (*setup)(struct device *);
        void (*cleanup)(struct device *);
 };
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index 8839b3a24660..e3e0d651c6ca 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -443,12 +443,12 @@ struct drm_crtc {
 * @dpms: set power state (see drm_crtc_funcs above)
 * @save: save connector state
 * @restore: restore connector state
- * @reset: reset connector after state has been invalidate (e.g. resume)
+ * @reset: reset connector after state has been invalidated (e.g. resume)
 * @detect: is this connector active?
 * @fill_modes: fill mode list for this connector
- * @set_property: property for this connector may need update
+ * @set_property: property for this connector may need an update
 * @destroy: make object go away
- * @force: notify the driver the connector is forced on
+ * @force: notify the driver that the connector is forced on
 *
 * Each CRTC may have one or more connectors attached to it.  The functions
 * below allow the core DRM code to control connectors, enumerate available modes,
diff --git a/include/linux/ecryptfs.h b/include/linux/ecryptfs.h
index 2224a8c0cb64..8d5ab998a222 100644
--- a/include/linux/ecryptfs.h
+++ b/include/linux/ecryptfs.h
@@ -6,9 +6,8 @@
 #define ECRYPTFS_VERSION_MINOR 0x04
 #define ECRYPTFS_SUPPORTED_FILE_VERSION 0x03
 /* These flags indicate which features are supported by the kernel
- * module; userspace tools such as the mount helper read
+ * module; userspace tools such as the mount helper read the feature
- * ECRYPTFS_VERSIONING_MASK from a sysfs handle in order to determine
+ * bits from a sysfs handle in order to determine how to behave. */
- * how to behave. */
 #define ECRYPTFS_VERSIONING_PASSPHRASE            0x00000001
 #define ECRYPTFS_VERSIONING_PUBKEY                0x00000002
 #define ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH 0x00000004
@@ -19,13 +18,6 @@
 #define ECRYPTFS_VERSIONING_HMAC                  0x00000080
 #define ECRYPTFS_VERSIONING_FILENAME_ENCRYPTION   0x00000100
 #define ECRYPTFS_VERSIONING_GCM                   0x00000200
-#define ECRYPTFS_VERSIONING_MASK (ECRYPTFS_VERSIONING_PASSPHRASE \
-                                  | ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH \
-                                  | ECRYPTFS_VERSIONING_PUBKEY \
-                                  | ECRYPTFS_VERSIONING_XATTR \
-                                  | ECRYPTFS_VERSIONING_MULTKEY \
-                                  | ECRYPTFS_VERSIONING_DEVMISC \
-                                  | ECRYPTFS_VERSIONING_FILENAME_ENCRYPTION)
 #define ECRYPTFS_MAX_PASSWORD_LENGTH 64
 #define ECRYPTFS_MAX_PASSPHRASE_BYTES ECRYPTFS_MAX_PASSWORD_LENGTH
 #define ECRYPTFS_SALT_SIZE 8
diff --git a/include/linux/hardirq.h b/include/linux/hardirq.h
index 29eb805ea4a6..c1d6555d2567 100644
--- a/include/linux/hardirq.h
+++ b/include/linux/hardirq.h
@@ -118,10 +118,8 @@
 #ifdef CONFIG_PREEMPT_COUNT
 # define preemptible()  (preempt_count() == 0 && !irqs_disabled())
-# define IRQ_EXIT_OFFSET (HARDIRQ_OFFSET-1)
 #else
 # define preemptible()  0
-# define IRQ_EXIT_OFFSET HARDIRQ_OFFSET
 #endif
 #if defined(CONFIG_SMP) || defined(CONFIG_GENERIC_HARDIRQS)
diff --git a/include/linux/netfilter/ipset/ip_set_ahash.h b/include/linux/netfilter/ipset/ip_set_ahash.h
index ef9acd3c8450..01d25e6fc792 100644
--- a/include/linux/netfilter/ipset/ip_set_ahash.h
+++ b/include/linux/netfilter/ipset/ip_set_ahash.h
@@ -854,6 +854,8 @@ type_pf_tresize(struct ip_set *set, bool retried)
 retry:
        ret = 0;
        htable_bits++;
+        pr_debug("attempt to resize set %s from %u to %u, t %p\n",
+                 set->name, orig->htable_bits, htable_bits, orig);
        if (!htable_bits) {
                /* In case we have plenty of memory :-) */
                pr_warning("Cannot increase the hashsize of set %s further\n",
@@ -873,7 +875,7 @@ retry:
                        data = ahash_tdata(n, j);
                        m = hbucket(t, HKEY(data, h->initval, htable_bits));
                        ret = type_pf_elem_tadd(m, data, AHASH_MAX(h), 0,
-                                                type_pf_data_timeout(data));
+                                                ip_set_timeout_get(type_pf_data_timeout(data)));
                        if (ret < 0) {
                                read_unlock_bh(&set->lock);
                                ahash_destroy(t);
diff --git a/include/linux/regulator/driver.h b/include/linux/regulator/driver.h
index 23070fd83872..7df93f52db08 100644
--- a/include/linux/regulator/driver.h
+++ b/include/linux/regulator/driver.h
@@ -199,6 +199,8 @@ enum regulator_type {
 *                output when using regulator_set_voltage_sel_regmap
 * @enable_reg: Register for control when using regmap enable/disable ops
 * @enable_mask: Mask for control when using regmap enable/disable ops
+ * @bypass_reg: Register for control when using regmap set_bypass
+ * @bypass_mask: Mask for control when using regmap set_bypass
 *
 * @enable_time: Time taken for initial enable of regulator (in uS).
 */
diff --git a/include/linux/smpboot.h b/include/linux/smpboot.h
index c65dee059913..13e929679550 100644
--- a/include/linux/smpboot.h
+++ b/include/linux/smpboot.h
@@ -24,6 +24,9 @@ struct smpboot_thread_data;
 *                      parked (cpu offline)
 * @unpark:             Optional unpark function, called when the thread is
 *                      unparked (cpu online)
+ * @pre_unpark:         Optional unpark function, called before the thread is
+ *                      unparked (cpu online). This is not guaranteed to be
+ *                      called on the target cpu of the thread. Careful!
 * @selfparking:        Thread is not parked by the park function.
 * @thread_comm:        The base name of the thread
 */
@@ -37,6 +40,7 @@ struct smp_hotplug_thread {
        void                            (*cleanup)(unsigned int cpu, bool online);
        void                            (*park)(unsigned int cpu);
        void                            (*unpark)(unsigned int cpu);
+        void                            (*pre_unpark)(unsigned int cpu);
        bool                            selfparking;
        const char                      *thread_comm;
 };
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 23f2e98d4b65..cf0694d4ad60 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1045,6 +1045,10 @@ static inline bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
        if (sysctl_tcp_low_latency || !tp->ucopy.task)
                return false;
+        if (skb->len <= tcp_hdrlen(skb) &&
+            skb_queue_len(&tp->ucopy.prequeue) == 0)
+                return false;
        __skb_queue_tail(&tp->ucopy.prequeue, skb);
        tp->ucopy.memory += skb->truesize;
        if (tp->ucopy.memory > sk->sk_rcvbuf) {
diff --git a/kernel/smpboot.c b/kernel/smpboot.c
index b9bde5727829..25d3d8b6e4e1 100644
--- a/kernel/smpboot.c
+++ b/kernel/smpboot.c
@@ -209,6 +209,8 @@ static void smpboot_unpark_thread(struct smp_hotplug_thread *ht, unsigned int cp
 {
        struct task_struct *tsk = *per_cpu_ptr(ht->store, cpu);
+        if (ht->pre_unpark)
+                ht->pre_unpark(cpu);
        kthread_unpark(tsk);
 }
diff --git a/kernel/softirq.c b/kernel/softirq.c
index b4d252fd195b..14d7758074aa 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -323,18 +323,10 @@ void irq_enter(void)
 static inline void invoke_softirq(void)
 {
-        if (!force_irqthreads) {
+        if (!force_irqthreads)
-#ifdef __ARCH_IRQ_EXIT_IRQS_DISABLED
                __do_softirq();
-#else
+        else
-                do_softirq();
-#endif
-        } else {
-                __local_bh_disable((unsigned long)__builtin_return_address(0),
-                                SOFTIRQ_OFFSET);
                wakeup_softirqd();
-                __local_bh_enable(SOFTIRQ_OFFSET);
-        }
 }
 /*
@@ -342,9 +334,15 @@ static inline void invoke_softirq(void)
 */
 void irq_exit(void)
 {
+#ifndef __ARCH_IRQ_EXIT_IRQS_DISABLED
+        local_irq_disable();
+#else
+        WARN_ON_ONCE(!irqs_disabled());
+#endif
        account_irq_exit_time(current);
        trace_hardirq_exit();
-        sub_preempt_count(IRQ_EXIT_OFFSET);
+        sub_preempt_count(HARDIRQ_OFFSET);
        if (!in_interrupt() && local_softirq_pending())
                invoke_softirq();
@@ -354,7 +352,6 @@ void irq_exit(void)
                tick_nohz_irq_exit();
 #endif
        rcu_irq_exit();
-        sched_preempt_enable_no_resched();
 }
 /*
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 95d178c62d5a..c09f2955ae30 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -336,7 +336,7 @@ static struct smp_hotplug_thread cpu_stop_threads = {
        .create                 = cpu_stop_create,
        .setup                  = cpu_stop_unpark,
        .park                   = cpu_stop_park,
-        .unpark                 = cpu_stop_unpark,
+        .pre_unpark             = cpu_stop_unpark,
        .selfparking            = true,
 };
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 1ae1d9cb278d..21760f008974 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -118,7 +118,7 @@ static struct caif_device_entry *caif_get(struct net_device *dev)
        return NULL;
 }
-void caif_flow_cb(struct sk_buff *skb)
+static void caif_flow_cb(struct sk_buff *skb)
 {
        struct caif_device_entry *caifd;
        void (*dtor)(struct sk_buff *skb) = NULL;
diff --git a/net/caif/caif_usb.c b/net/caif/caif_usb.c
index 3ebc8cbc91ff..ef8ebaa993cf 100644
--- a/net/caif/caif_usb.c
+++ b/net/caif/caif_usb.c
@@ -81,8 +81,8 @@ static void cfusbl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
                layr->up->ctrlcmd(layr->up, ctrl, layr->id);
 }
-struct cflayer *cfusbl_create(int phyid, u8 ethaddr[ETH_ALEN],
+static struct cflayer *cfusbl_create(int phyid, u8 ethaddr[ETH_ALEN],
-                                        u8 braddr[ETH_ALEN])
+                                      u8 braddr[ETH_ALEN])
 {
        struct cfusbl *this = kmalloc(sizeof(struct cfusbl), GFP_ATOMIC);
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 87abd3e2bd32..2bdf802e28e2 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -228,9 +228,11 @@ static int ip_local_deliver_finish(struct sk_buff *skb)
                                        icmp_send(skb, ICMP_DEST_UNREACH,
                                                  ICMP_PROT_UNREACH, 0);
                                }
-                        } else
+                                kfree_skb(skb);
+                        } else {
                                IP_INC_STATS_BH(net, IPSTATS_MIB_INDELIVERS);
-                        kfree_skb(skb);
+                                consume_skb(skb);
+                        }
                }
        }
 out:
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a759e19496d2..0d9bdacce99f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5485,6 +5485,9 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                                if (tcp_checksum_complete_user(sk, skb))
                                        goto csum_error;
+                                if ((int)skb->truesize > sk->sk_forward_alloc)
+                                        goto step5;
                                /* Predicted packet is in window by definition.
                                 * seq == rcv_nxt and rcv_wup <= rcv_nxt.
                                 * Hence, check seq<=rcv_wup reduces to:
@@ -5496,9 +5499,6 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                                tcp_rcv_rtt_measure_ts(sk, skb);
-                                if ((int)skb->truesize > sk->sk_forward_alloc)
-                                        goto step5;
                                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPHPHITS);
                                /* Bulk data transfer: receiver */
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 5b10414e619e..b1876e52091e 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -241,9 +241,11 @@ resubmit:
                                icmpv6_send(skb, ICMPV6_PARAMPROB,
                                            ICMPV6_UNK_NEXTHDR, nhoff);
                        }
-                } else
+                        kfree_skb(skb);
+                } else {
                        IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDELIVERS);
-                kfree_skb(skb);
+                        consume_skb(skb);
+                }
        }
        rcu_read_unlock();
        return 0;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 928266569689..e5fe0041adfa 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1915,7 +1915,8 @@ void rt6_purge_dflt_routers(struct net *net)
 restart:
        read_lock_bh(&table->tb6_lock);
        for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) {
-                if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) {
+                if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF) &&
+                    (!rt->rt6i_idev || rt->rt6i_idev->cnf.accept_ra != 2)) {
                        dst_hold(&rt->dst);
                        read_unlock_bh(&table->tb6_lock);
                        ip6_del_rt(rt);
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index e71e85ba2bf1..29340a9a6fb9 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -495,8 +495,11 @@ static void iriap_getvaluebyclass_confirm(struct iriap_cb *self,
 /*              case CS_ISO_8859_9: */
 /*              case CS_UNICODE: */
                default:
-                        IRDA_DEBUG(0, "%s(), charset %s, not supported\n",
+                        IRDA_DEBUG(0, "%s(), charset [%d] %s, not supported\n",
-                                   __func__, ias_charset_types[charset]);
+                                   __func__, charset,
+                                   charset < ARRAY_SIZE(ias_charset_types) ?
+                                        ias_charset_types[charset] :
+                                        "(unknown)");
                        /* Aborting, close connection! */
                        iriap_disconnect_request(self);
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 3f4e3afc191a..6a53371dba1f 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -355,6 +355,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
        l2tp_xmit_skb(session, skb, session->hdr_len);
        sock_put(ps->tunnel_sock);
+        sock_put(sk);
        return error;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 09d96a8f6c2c..808f5fcd1ced 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3285,13 +3285,19 @@ static int ieee80211_cfg_get_channel(struct wiphy *wiphy,
                                     struct cfg80211_chan_def *chandef)
 {
        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
        struct ieee80211_chanctx_conf *chanctx_conf;
        int ret = -ENODATA;
        rcu_read_lock();
-        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        if (local->use_chanctx) {
-        if (chanctx_conf) {
+                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-                *chandef = chanctx_conf->def;
+                if (chanctx_conf) {
+                        *chandef = chanctx_conf->def;
+                        ret = 0;
+                }
+        } else if (local->open_count == local->monitors) {
+                *chandef = local->monitor_chandef;
                ret = 0;
        }
        rcu_read_unlock();
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 2c059e54e885..640afab304d7 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -107,7 +107,7 @@ void ieee80211_recalc_idle(struct ieee80211_local *local)
        lockdep_assert_held(&local->mtx);
-        active = !list_empty(&local->chanctx_list);
+        active = !list_empty(&local->chanctx_list) || local->monitors;
        if (!local->ops->remain_on_channel) {
                list_for_each_entry(roc, &local->roc_list, list) {
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index de8548bf0a7f..ce78d1149f1d 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1231,34 +1231,40 @@ static bool ieee80211_tx_frags(struct ieee80211_local *local,
                if (local->queue_stop_reasons[q] ||
                    (!txpending && !skb_queue_empty(&local->pending[q]))) {
                        if (unlikely(info->flags &
-                                        IEEE80211_TX_INTFL_OFFCHAN_TX_OK &&
+                                     IEEE80211_TX_INTFL_OFFCHAN_TX_OK)) {
-                                     local->queue_stop_reasons[q] &
+                                if (local->queue_stop_reasons[q] &
-                                        ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL))) {
+                                    ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL)) {
+                                        /*
+                                         * Drop off-channel frames if queues
+                                         * are stopped for any reason other
+                                         * than off-channel operation. Never
+                                         * queue them.
+                                         */
+                                        spin_unlock_irqrestore(
+                                                &local->queue_stop_reason_lock,
+                                                flags);
+                                        ieee80211_purge_tx_queue(&local->hw,
+                                                                 skbs);
+                                        return true;
+                                }
+                        } else {
                                /*
-                                 * Drop off-channel frames if queues are stopped
+                                 * Since queue is stopped, queue up frames for
-                                 * for any reason other than off-channel
+                                 * later transmission from the tx-pending
-                                 * operation. Never queue them.
+                                 * tasklet when the queue is woken again.
                                 */
-                                spin_unlock_irqrestore(
+                                if (txpending)
-                                        &local->queue_stop_reason_lock, flags);
+                                        skb_queue_splice_init(skbs,
-                                ieee80211_purge_tx_queue(&local->hw, skbs);
+                                                              &local->pending[q]);
-                                return true;
+                                else
+                                        skb_queue_splice_tail_init(skbs,
+                                                                   &local->pending[q]);
+                                spin_unlock_irqrestore(&local->queue_stop_reason_lock,
+                                                       flags);
+                                return false;
                        }
-                        /*
-                         * Since queue is stopped, queue up frames for later
-                         * transmission from the tx-pending tasklet when the
-                         * queue is woken again.
-                         */
-                        if (txpending)
-                                skb_queue_splice_init(skbs, &local->pending[q]);
-                        else
-                                skb_queue_splice_tail_init(skbs,
-                                                           &local->pending[q]);
-                        spin_unlock_irqrestore(&local->queue_stop_reason_lock,
-                                               flags);
-                        return false;
                }
                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
@@ -1844,9 +1850,24 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                }
                if (!is_multicast_ether_addr(skb->data)) {
+                        struct sta_info *next_hop;
+                        bool mpp_lookup = true;
                        mpath = mesh_path_lookup(sdata, skb->data);
-                        if (!mpath)
+                        if (mpath) {
+                                mpp_lookup = false;
+                                next_hop = rcu_dereference(mpath->next_hop);
+                                if (!next_hop ||
+                                    !(mpath->flags & (MESH_PATH_ACTIVE |
+                                                      MESH_PATH_RESOLVING)))
+                                        mpp_lookup = true;
+                        }
+                        if (mpp_lookup)
                                mppath = mpp_path_lookup(sdata, skb->data);
+                        if (mppath && mpath)
+                                mesh_path_del(mpath->sdata, mpath->dst);
                }
                /*
@@ -2350,9 +2371,9 @@ static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
        if (local->tim_in_locked_section) {
                __ieee80211_beacon_add_tim(sdata, ps, skb);
        } else {
-                spin_lock(&local->tim_lock);
+                spin_lock_bh(&local->tim_lock);
                __ieee80211_beacon_add_tim(sdata, ps, skb);
-                spin_unlock(&local->tim_lock);
+                spin_unlock_bh(&local->tim_lock);
        }
        return 0;
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index f82b2e606cfd..1ba9dbc0e107 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1470,7 +1470,8 @@ ip_set_utest(struct sock *ctnl, struct sk_buff *skb,
        if (ret == -EAGAIN)
                ret = 1;
-        return ret < 0 ? ret : ret > 0 ? 0 : -IPSET_ERR_EXIST;
+        return (ret < 0 && ret != -ENOTEMPTY) ? ret :
+                ret > 0 ? 0 : -IPSET_ERR_EXIST;
 }
 /* Get headed data of a set */
diff --git a/net/rds/message.c b/net/rds/message.c
index f0a4658f3273..aba232f9f308 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -82,10 +82,7 @@ static void rds_message_purge(struct rds_message *rm)
 void rds_message_put(struct rds_message *rm)
 {
        rdsdebug("put rm %p ref %d\n", rm, atomic_read(&rm->m_refcount));
-        if (atomic_read(&rm->m_refcount) == 0) {
+        WARN(!atomic_read(&rm->m_refcount), "danger refcount zero on %p\n", rm);
-printk(KERN_CRIT "danger refcount zero on %p\n", rm);
-WARN_ON(1);
-        }
        if (atomic_dec_and_test(&rm->m_refcount)) {
                BUG_ON(!list_empty(&rm->m_sock_item));
                BUG_ON(!list_empty(&rm->m_conn_item));
@@ -197,6 +194,9 @@ struct rds_message *rds_message_alloc(unsigned int extra_len, gfp_t gfp)
 {
        struct rds_message *rm;
+        if (extra_len > KMALLOC_MAX_SIZE - sizeof(struct rds_message))
+                return NULL;
        rm = kzalloc(sizeof(struct rds_message) + extra_len, gfp);
        if (!rm)
                goto out;
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 2b3ef03c6098..12ed45dbe75d 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -155,7 +155,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
        /* SCTP-AUTH extensions*/
        INIT_LIST_HEAD(&ep->endpoint_shared_keys);
-        null_key = sctp_auth_shkey_create(0, GFP_KERNEL);
+        null_key = sctp_auth_shkey_create(0, gfp);
        if (!null_key)
                goto nomem;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c99458df3f3f..b9070736b8d9 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5653,6 +5653,9 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
        if (len < sizeof(sctp_assoc_t))
                return -EINVAL;
+        /* Allow the struct to grow and fill in as much as possible */
+        len = min_t(size_t, len, sizeof(sas));
        if (copy_from_user(&sas, optval, len))
                return -EFAULT;
@@ -5686,9 +5689,6 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
        /* Mark beginning of a new observation period */
        asoc->stats.max_obs_rto = asoc->rto_min;
-        /* Allow the struct to grow and fill in as much as possible */
-        len = min_t(size_t, len, sizeof(sas));
        if (put_user(len, optlen))
                return -EFAULT;
diff --git a/net/sctp/ssnmap.c b/net/sctp/ssnmap.c
index 442ad4ed6315..825ea94415b3 100644
--- a/net/sctp/ssnmap.c
+++ b/net/sctp/ssnmap.c
@@ -41,8 +41,6 @@
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
-#define MAX_KMALLOC_SIZE        131072
 static struct sctp_ssnmap *sctp_ssnmap_init(struct sctp_ssnmap *map, __u16 in,
                                            __u16 out);
@@ -65,7 +63,7 @@ struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out,
        int size;
        size = sctp_ssnmap_size(in, out);
-        if (size <= MAX_KMALLOC_SIZE)
+        if (size <= KMALLOC_MAX_SIZE)
                retval = kmalloc(size, gfp);
        else
                retval = (struct sctp_ssnmap *)
@@ -82,7 +80,7 @@ struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out,
        return retval;
 fail_map:
-        if (size <= MAX_KMALLOC_SIZE)
+        if (size <= KMALLOC_MAX_SIZE)
                kfree(retval);
        else
                free_pages((unsigned long)retval, get_order(size));
@@ -124,7 +122,7 @@ void sctp_ssnmap_free(struct sctp_ssnmap *map)
                int size;
                size = sctp_ssnmap_size(map->in.len, map->out.len);
-                if (size <= MAX_KMALLOC_SIZE)
+                if (size <= KMALLOC_MAX_SIZE)
                        kfree(map);
                else
                        free_pages((unsigned long)map, get_order(size));
diff --git a/net/sctp/tsnmap.c b/net/sctp/tsnmap.c
index 5f25e0c92c31..396c45174e5b 100644
--- a/net/sctp/tsnmap.c
+++ b/net/sctp/tsnmap.c
@@ -51,7 +51,7 @@
 static void sctp_tsnmap_update(struct sctp_tsnmap *map);
 static void sctp_tsnmap_find_gap_ack(unsigned long *map, __u16 off,
                                     __u16 len, __u16 *start, __u16 *end);
-static int sctp_tsnmap_grow(struct sctp_tsnmap *map, u16 gap);
+static int sctp_tsnmap_grow(struct sctp_tsnmap *map, u16 size);
 /* Initialize a block of memory as a tsnmap.  */
 struct sctp_tsnmap *sctp_tsnmap_init(struct sctp_tsnmap *map, __u16 len,
@@ -124,7 +124,7 @@ int sctp_tsnmap_mark(struct sctp_tsnmap *map, __u32 tsn,
        gap = tsn - map->base_tsn;
-        if (gap >= map->len && !sctp_tsnmap_grow(map, gap))
+        if (gap >= map->len && !sctp_tsnmap_grow(map, gap + 1))
                return -ENOMEM;
        if (!sctp_tsnmap_has_gap(map) && gap == 0) {
@@ -360,23 +360,24 @@ __u16 sctp_tsnmap_num_gabs(struct sctp_tsnmap *map,
        return ngaps;
 }
-static int sctp_tsnmap_grow(struct sctp_tsnmap *map, u16 gap)
+static int sctp_tsnmap_grow(struct sctp_tsnmap *map, u16 size)
 {
        unsigned long *new;
        unsigned long inc;
        u16  len;
-        if (gap >= SCTP_TSN_MAP_SIZE)
+        if (size > SCTP_TSN_MAP_SIZE)
                return 0;
-        inc = ALIGN((gap - map->len),BITS_PER_LONG) + SCTP_TSN_MAP_INCREMENT;
+        inc = ALIGN((size - map->len), BITS_PER_LONG) + SCTP_TSN_MAP_INCREMENT;
        len = min_t(u16, map->len + inc, SCTP_TSN_MAP_SIZE);
        new = kzalloc(len>>3, GFP_ATOMIC);
        if (!new)
                return 0;
-        bitmap_copy(new, map->tsn_map, map->max_tsn_seen - map->base_tsn);
+        bitmap_copy(new, map->tsn_map,
+                map->max_tsn_seen - map->cumulative_tsn_ack_point);
        kfree(map->tsn_map);
        map->tsn_map = new;
        map->len = len;
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index ada17464b65b..0fd5b3d2df03 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -106,6 +106,7 @@ int sctp_ulpq_tail_data(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
 {
        struct sk_buff_head temp;
        struct sctp_ulpevent *event;
+        int event_eor = 0;
        /* Create an event from the incoming chunk. */
        event = sctp_ulpevent_make_rcvmsg(chunk->asoc, chunk, gfp);
@@ -127,10 +128,12 @@ int sctp_ulpq_tail_data(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
        /* Send event to the ULP.  'event' is the sctp_ulpevent for
         * very first SKB on the 'temp' list.
         */
-        if (event)
+        if (event) {
+                event_eor = (event->msg_flags & MSG_EOR) ? 1 : 0;
                sctp_ulpq_tail_event(ulpq, event);
+        }
-        return 0;
+        return event_eor;
 }
 /* Add a new event for propagation to the ULP.  */
@@ -540,14 +543,19 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_partial(struct sctp_ulpq *ulpq)
                ctsn = cevent->tsn;
                switch (cevent->msg_flags & SCTP_DATA_FRAG_MASK) {
+                case SCTP_DATA_FIRST_FRAG:
+                        if (!first_frag)
+                                return NULL;
+                        goto done;
                case SCTP_DATA_MIDDLE_FRAG:
                        if (!first_frag) {
                                first_frag = pos;
                                next_tsn = ctsn + 1;
                                last_frag = pos;
-                        } else if (next_tsn == ctsn)
+                        } else if (next_tsn == ctsn) {
                                next_tsn++;
-                        else
+                                last_frag = pos;
+                        } else
                                goto done;
                        break;
                case SCTP_DATA_LAST_FRAG:
@@ -651,6 +659,14 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_first(struct sctp_ulpq *ulpq)
                        } else
                                goto done;
                        break;
+                case SCTP_DATA_LAST_FRAG:
+                        if (!first_frag)
+                                return NULL;
+                        else
+                                goto done;
+                        break;
                default:
                        return NULL;
                }
@@ -962,20 +978,43 @@ static __u16 sctp_ulpq_renege_list(struct sctp_ulpq *ulpq,
                struct sk_buff_head *list, __u16 needed)
 {
        __u16 freed = 0;
-        __u32 tsn;
+        __u32 tsn, last_tsn;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *flist, *last;
        struct sctp_ulpevent *event;
        struct sctp_tsnmap *tsnmap;
        tsnmap = &ulpq->asoc->peer.tsn_map;
-        while ((skb = __skb_dequeue_tail(list)) != NULL) {
+        while ((skb = skb_peek_tail(list)) != NULL) {
-                freed += skb_headlen(skb);
                event = sctp_skb2event(skb);
                tsn = event->tsn;
+                /* Don't renege below the Cumulative TSN ACK Point. */
+                if (TSN_lte(tsn, sctp_tsnmap_get_ctsn(tsnmap)))
+                        break;
+                /* Events in ordering queue may have multiple fragments
+                 * corresponding to additional TSNs.  Sum the total
+                 * freed space; find the last TSN.
+                 */
+                freed += skb_headlen(skb);
+                flist = skb_shinfo(skb)->frag_list;
+                for (last = flist; flist; flist = flist->next) {
+                        last = flist;
+                        freed += skb_headlen(last);
+                }
+                if (last)
+                        last_tsn = sctp_skb2event(last)->tsn;
+                else
+                        last_tsn = tsn;
+                /* Unlink the event, then renege all applicable TSNs. */
+                __skb_unlink(skb, list);
                sctp_ulpevent_free(event);
-                sctp_tsnmap_renege(tsnmap, tsn);
+                while (TSN_lte(tsn, last_tsn)) {
+                        sctp_tsnmap_renege(tsnmap, tsn);
+                        tsn++;
+                }
                if (freed >= needed)
                        return freed;
        }
@@ -1002,16 +1041,28 @@ void sctp_ulpq_partial_delivery(struct sctp_ulpq *ulpq,
        struct sctp_ulpevent *event;
        struct sctp_association *asoc;
        struct sctp_sock *sp;
+        __u32 ctsn;
+        struct sk_buff *skb;
        asoc = ulpq->asoc;
        sp = sctp_sk(asoc->base.sk);
        /* If the association is already in Partial Delivery mode
-         * we have noting to do.
+         * we have nothing to do.
         */
        if (ulpq->pd_mode)
                return;
+        /* Data must be at or below the Cumulative TSN ACK Point to
+         * start partial delivery.
+         */
+        skb = skb_peek(&asoc->ulpq.reasm);
+        if (skb != NULL) {
+                ctsn = sctp_skb2event(skb)->tsn;
+                if (!TSN_lte(ctsn, sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map)))
+                        return;
+        }
        /* If the user enabled fragment interleave socket option,
         * multiple associations can enter partial delivery.
         * Otherwise, we can only enter partial delivery if the
@@ -1054,12 +1105,16 @@ void sctp_ulpq_renege(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
        }
        /* If able to free enough room, accept this chunk. */
        if (chunk && (freed >= needed)) {
-                __u32 tsn;
+                int retval;
-                tsn = ntohl(chunk->subh.data_hdr->tsn);
+                retval = sctp_ulpq_tail_data(ulpq, chunk, gfp);
-                sctp_tsnmap_mark(&asoc->peer.tsn_map, tsn, chunk->transport);
+                /*
-                sctp_ulpq_tail_data(ulpq, chunk, gfp);
+                 * Enter partial delivery if chunk has not been
+                 * delivered; otherwise, drain the reassembly queue.
-                sctp_ulpq_partial_delivery(ulpq, gfp);
+                 */
+                if (retval <= 0)
+                        sctp_ulpq_partial_delivery(ulpq, gfp);
+                else if (retval == 1)
+                        sctp_ulpq_reasm_drain(ulpq);
        }
        sk_mem_reclaim(asoc->base.sk);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 35545ccc30fd..e652d05ff712 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -554,16 +554,9 @@ static int nl80211_msg_put_channel(struct sk_buff *msg,
        if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
                goto nla_put_failure;
-        if (chan->flags & IEEE80211_CHAN_RADAR) {
+        if ((chan->flags & IEEE80211_CHAN_RADAR) &&
-                u32 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
+            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
-                if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
+                goto nla_put_failure;
-                        goto nla_put_failure;
-                if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
-                                chan->dfs_state))
-                        goto nla_put_failure;
-                if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, time))
-                        goto nla_put_failure;
-        }
        if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
                goto nla_put_failure;
@@ -900,9 +893,6 @@ static int nl80211_put_iface_combinations(struct wiphy *wiphy,
                    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
                                c->max_interfaces))
                        goto nla_put_failure;
-                if (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
-                                c->radar_detect_widths))
-                        goto nla_put_failure;
                nla_nest_end(msg, nl_combi);
        }
@@ -914,48 +904,6 @@ nla_put_failure:
        return -ENOBUFS;
 }
-#ifdef CONFIG_PM
-static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
-                                        struct sk_buff *msg)
-{
-        const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
-        struct nlattr *nl_tcp;
-        if (!tcp)
-                return 0;
-        nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
-        if (!nl_tcp)
-                return -ENOBUFS;
-        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
-                        tcp->data_payload_max))
-                return -ENOBUFS;
-        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
-                        tcp->data_payload_max))
-                return -ENOBUFS;
-        if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
-                return -ENOBUFS;
-        if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
-                                sizeof(*tcp->tok), tcp->tok))
-                return -ENOBUFS;
-        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
-                        tcp->data_interval_max))
-                return -ENOBUFS;
-        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
-                        tcp->wake_payload_max))
-                return -ENOBUFS;
-        nla_nest_end(msg, nl_tcp);
-        return 0;
-}
-#endif
 static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
                              struct cfg80211_registered_device *dev)
 {
@@ -1330,9 +1278,6 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flag
                                goto nla_put_failure;
                }
-                if (nl80211_send_wowlan_tcp_caps(dev, msg))
-                        goto nla_put_failure;
                nla_nest_end(msg, nl_wowlan);
        }
 #endif