82 files changed, 836 insertions, 511 deletions
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 9b74d1e3ad44..6aa7b3266c80 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -612,9 +612,15 @@ static int esd_usb2_start(struct esd_usb2_net_priv *priv)
 {
        struct esd_usb2 *dev = priv->usb2;
        struct net_device *netdev = priv->netdev;
-        struct esd_usb2_msg msg;
+        struct esd_usb2_msg *msg;
        int err, i;
+        msg = kmalloc(sizeof(*msg), GFP_KERNEL);
+        if (!msg) {
+                err = -ENOMEM;
+                goto out;
+        }
        /*
         * Enable all IDs
         * The IDADD message takes up to 64 32 bit bitmasks (2048 bits).
@@ -628,33 +634,32 @@ static int esd_usb2_start(struct esd_usb2_net_priv *priv)
         * the number of the starting bitmask (0..64) to the filter.option
         * field followed by only some bitmasks.
         */
-        msg.msg.hdr.cmd = CMD_IDADD;
+        msg->msg.hdr.cmd = CMD_IDADD;
-        msg.msg.hdr.len = 2 + ESD_MAX_ID_SEGMENT;
+        msg->msg.hdr.len = 2 + ESD_MAX_ID_SEGMENT;
-        msg.msg.filter.net = priv->index;
+        msg->msg.filter.net = priv->index;
-        msg.msg.filter.option = ESD_ID_ENABLE; /* start with segment 0 */
+        msg->msg.filter.option = ESD_ID_ENABLE; /* start with segment 0 */
        for (i = 0; i < ESD_MAX_ID_SEGMENT; i++)
-                msg.msg.filter.mask[i] = cpu_to_le32(0xffffffff);
+                msg->msg.filter.mask[i] = cpu_to_le32(0xffffffff);
        /* enable 29bit extended IDs */
-        msg.msg.filter.mask[ESD_MAX_ID_SEGMENT] = cpu_to_le32(0x00000001);
+        msg->msg.filter.mask[ESD_MAX_ID_SEGMENT] = cpu_to_le32(0x00000001);
-        err = esd_usb2_send_msg(dev, &msg);
+        err = esd_usb2_send_msg(dev, msg);
        if (err)
-                goto failed;
+                goto out;
        err = esd_usb2_setup_rx_urbs(dev);
        if (err)
-                goto failed;
+                goto out;
        priv->can.state = CAN_STATE_ERROR_ACTIVE;
-        return 0;
+out:
-failed:
        if (err == -ENODEV)
                netif_device_detach(netdev);
+        if (err)
+                netdev_err(netdev, "couldn't start device: %d\n", err);
-        netdev_err(netdev, "couldn't start device: %d\n", err);
+        kfree(msg);
        return err;
 }
@@ -833,26 +838,30 @@ nourbmem:
 static int esd_usb2_close(struct net_device *netdev)
 {
        struct esd_usb2_net_priv *priv = netdev_priv(netdev);
-        struct esd_usb2_msg msg;
+        struct esd_usb2_msg *msg;
        int i;
+        msg = kmalloc(sizeof(*msg), GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
        /* Disable all IDs (see esd_usb2_start()) */
-        msg.msg.hdr.cmd = CMD_IDADD;
+        msg->msg.hdr.cmd = CMD_IDADD;
-        msg.msg.hdr.len = 2 + ESD_MAX_ID_SEGMENT;
+        msg->msg.hdr.len = 2 + ESD_MAX_ID_SEGMENT;
-        msg.msg.filter.net = priv->index;
+        msg->msg.filter.net = priv->index;
-        msg.msg.filter.option = ESD_ID_ENABLE; /* start with segment 0 */
+        msg->msg.filter.option = ESD_ID_ENABLE; /* start with segment 0 */
        for (i = 0; i <= ESD_MAX_ID_SEGMENT; i++)
-                msg.msg.filter.mask[i] = 0;
+                msg->msg.filter.mask[i] = 0;
-        if (esd_usb2_send_msg(priv->usb2, &msg) < 0)
+        if (esd_usb2_send_msg(priv->usb2, msg) < 0)
                netdev_err(netdev, "sending idadd message failed\n");
        /* set CAN controller to reset mode */
-        msg.msg.hdr.len = 2;
+        msg->msg.hdr.len = 2;
-        msg.msg.hdr.cmd = CMD_SETBAUD;
+        msg->msg.hdr.cmd = CMD_SETBAUD;
-        msg.msg.setbaud.net = priv->index;
+        msg->msg.setbaud.net = priv->index;
-        msg.msg.setbaud.rsvd = 0;
+        msg->msg.setbaud.rsvd = 0;
-        msg.msg.setbaud.baud = cpu_to_le32(ESD_USB2_NO_BAUDRATE);
+        msg->msg.setbaud.baud = cpu_to_le32(ESD_USB2_NO_BAUDRATE);
-        if (esd_usb2_send_msg(priv->usb2, &msg) < 0)
+        if (esd_usb2_send_msg(priv->usb2, msg) < 0)
                netdev_err(netdev, "sending setbaud message failed\n");
        priv->can.state = CAN_STATE_STOPPED;
@@ -861,6 +870,8 @@ static int esd_usb2_close(struct net_device *netdev)
        close_candev(netdev);
+        kfree(msg);
        return 0;
 }
@@ -886,7 +897,8 @@ static int esd_usb2_set_bittiming(struct net_device *netdev)
 {
        struct esd_usb2_net_priv *priv = netdev_priv(netdev);
        struct can_bittiming *bt = &priv->can.bittiming;
-        struct esd_usb2_msg msg;
+        struct esd_usb2_msg *msg;
+        int err;
        u32 canbtr;
        int sjw_shift;
@@ -912,15 +924,22 @@ static int esd_usb2_set_bittiming(struct net_device *netdev)
        if (priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES)
                canbtr |= ESD_USB2_3_SAMPLES;
-        msg.msg.hdr.len = 2;
+        msg = kmalloc(sizeof(*msg), GFP_KERNEL);
-        msg.msg.hdr.cmd = CMD_SETBAUD;
+        if (!msg)
-        msg.msg.setbaud.net = priv->index;
+                return -ENOMEM;
-        msg.msg.setbaud.rsvd = 0;
-        msg.msg.setbaud.baud = cpu_to_le32(canbtr);
+        msg->msg.hdr.len = 2;
+        msg->msg.hdr.cmd = CMD_SETBAUD;
+        msg->msg.setbaud.net = priv->index;
+        msg->msg.setbaud.rsvd = 0;
+        msg->msg.setbaud.baud = cpu_to_le32(canbtr);
        netdev_info(netdev, "setting BTR=%#x\n", canbtr);
-        return esd_usb2_send_msg(priv->usb2, &msg);
+        err = esd_usb2_send_msg(priv->usb2, msg);
+        kfree(msg);
+        return err;
 }
 static int esd_usb2_get_berr_counter(const struct net_device *netdev,
@@ -1022,7 +1041,7 @@ static int esd_usb2_probe(struct usb_interface *intf,
                         const struct usb_device_id *id)
 {
        struct esd_usb2 *dev;
-        struct esd_usb2_msg msg;
+        struct esd_usb2_msg *msg;
        int i, err;
        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
@@ -1037,27 +1056,33 @@ static int esd_usb2_probe(struct usb_interface *intf,
        usb_set_intfdata(intf, dev);
+        msg = kmalloc(sizeof(*msg), GFP_KERNEL);
+        if (!msg) {
+                err = -ENOMEM;
+                goto free_msg;
+        }
        /* query number of CAN interfaces (nets) */
-        msg.msg.hdr.cmd = CMD_VERSION;
+        msg->msg.hdr.cmd = CMD_VERSION;
-        msg.msg.hdr.len = 2;
+        msg->msg.hdr.len = 2;
-        msg.msg.version.rsvd = 0;
+        msg->msg.version.rsvd = 0;
-        msg.msg.version.flags = 0;
+        msg->msg.version.flags = 0;
-        msg.msg.version.drv_version = 0;
+        msg->msg.version.drv_version = 0;
-        err = esd_usb2_send_msg(dev, &msg);
+        err = esd_usb2_send_msg(dev, msg);
        if (err < 0) {
                dev_err(&intf->dev, "sending version message failed\n");
-                goto free_dev;
+                goto free_msg;
        }
-        err = esd_usb2_wait_msg(dev, &msg);
+        err = esd_usb2_wait_msg(dev, msg);
        if (err < 0) {
                dev_err(&intf->dev, "no version message answer\n");
-                goto free_dev;
+                goto free_msg;
        }
-        dev->net_count = (int)msg.msg.version_reply.nets;
+        dev->net_count = (int)msg->msg.version_reply.nets;
-        dev->version = le32_to_cpu(msg.msg.version_reply.version);
+        dev->version = le32_to_cpu(msg->msg.version_reply.version);
        if (device_create_file(&intf->dev, &dev_attr_firmware))
                dev_err(&intf->dev,
@@ -1075,10 +1100,10 @@ static int esd_usb2_probe(struct usb_interface *intf,
        for (i = 0; i < dev->net_count; i++)
                esd_usb2_probe_one_net(intf, i);
-        return 0;
+free_msg:
+        kfree(msg);
-free_dev:
+        if (err)
-        kfree(dev);
+                kfree(dev);
 done:
        return err;
 }
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 45cb9f3c1324..3b9546588240 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -136,6 +136,9 @@
 #define KVASER_CTRL_MODE_SELFRECEPTION  3
 #define KVASER_CTRL_MODE_OFF            4
+/* log message */
+#define KVASER_EXTENDED_FRAME           BIT(31)
 struct kvaser_msg_simple {
        u8 tid;
        u8 channel;
@@ -817,8 +820,13 @@ static void kvaser_usb_rx_can_msg(const struct kvaser_usb *dev,
        priv = dev->nets[channel];
        stats = &priv->netdev->stats;
-        if (msg->u.rx_can.flag & (MSG_FLAG_ERROR_FRAME | MSG_FLAG_NERR |
+        if ((msg->u.rx_can.flag & MSG_FLAG_ERROR_FRAME) &&
-                                  MSG_FLAG_OVERRUN)) {
+            (msg->id == CMD_LOG_MESSAGE)) {
+                kvaser_usb_rx_error(dev, msg);
+                return;
+        } else if (msg->u.rx_can.flag & (MSG_FLAG_ERROR_FRAME |
+                                         MSG_FLAG_NERR |
+                                         MSG_FLAG_OVERRUN)) {
                kvaser_usb_rx_can_err(priv, msg);
                return;
        } else if (msg->u.rx_can.flag & ~MSG_FLAG_REMOTE_FRAME) {
@@ -834,22 +842,40 @@ static void kvaser_usb_rx_can_msg(const struct kvaser_usb *dev,
                return;
        }
-        cf->can_id = ((msg->u.rx_can.msg[0] & 0x1f) << 6) |
+        if (msg->id == CMD_LOG_MESSAGE) {
-                     (msg->u.rx_can.msg[1] & 0x3f);
+                cf->can_id = le32_to_cpu(msg->u.log_message.id);
-        cf->can_dlc = get_can_dlc(msg->u.rx_can.msg[5]);
+                if (cf->can_id & KVASER_EXTENDED_FRAME)
+                        cf->can_id &= CAN_EFF_MASK | CAN_EFF_FLAG;
+                else
+                        cf->can_id &= CAN_SFF_MASK;
-        if (msg->id == CMD_RX_EXT_MESSAGE) {
+                cf->can_dlc = get_can_dlc(msg->u.log_message.dlc);
-                cf->can_id <<= 18;
-                cf->can_id |= ((msg->u.rx_can.msg[2] & 0x0f) << 14) |
-                              ((msg->u.rx_can.msg[3] & 0xff) << 6) |
-                              (msg->u.rx_can.msg[4] & 0x3f);
-                cf->can_id |= CAN_EFF_FLAG;
-        }
-        if (msg->u.rx_can.flag & MSG_FLAG_REMOTE_FRAME)
+                if (msg->u.log_message.flags & MSG_FLAG_REMOTE_FRAME)
-                cf->can_id |= CAN_RTR_FLAG;
+                        cf->can_id |= CAN_RTR_FLAG;
-        else
+                else
-                memcpy(cf->data, &msg->u.rx_can.msg[6], cf->can_dlc);
+                        memcpy(cf->data, &msg->u.log_message.data,
+                               cf->can_dlc);
+        } else {
+                cf->can_id = ((msg->u.rx_can.msg[0] & 0x1f) << 6) |
+                             (msg->u.rx_can.msg[1] & 0x3f);
+                if (msg->id == CMD_RX_EXT_MESSAGE) {
+                        cf->can_id <<= 18;
+                        cf->can_id |= ((msg->u.rx_can.msg[2] & 0x0f) << 14) |
+                                      ((msg->u.rx_can.msg[3] & 0xff) << 6) |
+                                      (msg->u.rx_can.msg[4] & 0x3f);
+                        cf->can_id |= CAN_EFF_FLAG;
+                }
+                cf->can_dlc = get_can_dlc(msg->u.rx_can.msg[5]);
+                if (msg->u.rx_can.flag & MSG_FLAG_REMOTE_FRAME)
+                        cf->can_id |= CAN_RTR_FLAG;
+                else
+                        memcpy(cf->data, &msg->u.rx_can.msg[6],
+                               cf->can_dlc);
+        }
        netif_rx(skb);
@@ -911,6 +937,7 @@ static void kvaser_usb_handle_message(const struct kvaser_usb *dev,
        case CMD_RX_STD_MESSAGE:
        case CMD_RX_EXT_MESSAGE:
+        case CMD_LOG_MESSAGE:
                kvaser_usb_rx_can_msg(dev, msg);
                break;
@@ -919,11 +946,6 @@ static void kvaser_usb_handle_message(const struct kvaser_usb *dev,
                kvaser_usb_rx_error(dev, msg);
                break;
-        case CMD_LOG_MESSAGE:
-                if (msg->u.log_message.flags & MSG_FLAG_ERROR_FRAME)
-                        kvaser_usb_rx_error(dev, msg);
-                break;
        case CMD_TX_ACKNOWLEDGE:
                kvaser_usb_tx_acknowledge(dev, msg);
                break;
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index 30d79bfa5b10..8ee9d1556e6e 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -504,15 +504,24 @@ static int pcan_usb_pro_restart_async(struct peak_usb_device *dev,
        return usb_submit_urb(urb, GFP_ATOMIC);
 }
-static void pcan_usb_pro_drv_loaded(struct peak_usb_device *dev, int loaded)
+static int pcan_usb_pro_drv_loaded(struct peak_usb_device *dev, int loaded)
 {
-        u8 buffer[16];
+        u8 *buffer;
+        int err;
+        buffer = kmalloc(PCAN_USBPRO_FCT_DRVLD_REQ_LEN, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
        buffer[0] = 0;
        buffer[1] = !!loaded;
-        pcan_usb_pro_send_req(dev, PCAN_USBPRO_REQ_FCT,
+        err = pcan_usb_pro_send_req(dev, PCAN_USBPRO_REQ_FCT,
-                              PCAN_USBPRO_FCT_DRVLD, buffer, sizeof(buffer));
+                                    PCAN_USBPRO_FCT_DRVLD, buffer,
+                                    PCAN_USBPRO_FCT_DRVLD_REQ_LEN);
+        kfree(buffer);
+        return err;
 }
 static inline
@@ -851,21 +860,24 @@ static int pcan_usb_pro_stop(struct peak_usb_device *dev)
 */
 static int pcan_usb_pro_init(struct peak_usb_device *dev)
 {
-        struct pcan_usb_pro_interface *usb_if;
        struct pcan_usb_pro_device *pdev =
                        container_of(dev, struct pcan_usb_pro_device, dev);
+        struct pcan_usb_pro_interface *usb_if = NULL;
+        struct pcan_usb_pro_fwinfo *fi = NULL;
+        struct pcan_usb_pro_blinfo *bi = NULL;
+        int err;
        /* do this for 1st channel only */
        if (!dev->prev_siblings) {
-                struct pcan_usb_pro_fwinfo fi;
-                struct pcan_usb_pro_blinfo bi;
-                int err;
                /* allocate netdevices common structure attached to first one */
                usb_if = kzalloc(sizeof(struct pcan_usb_pro_interface),
                                 GFP_KERNEL);
-                if (!usb_if)
+                fi = kmalloc(sizeof(struct pcan_usb_pro_fwinfo), GFP_KERNEL);
-                        return -ENOMEM;
+                bi = kmalloc(sizeof(struct pcan_usb_pro_blinfo), GFP_KERNEL);
+                if (!usb_if || !fi || !bi) {
+                        err = -ENOMEM;
+                        goto err_out;
+                }
                /* number of ts msgs to ignore before taking one into account */
                usb_if->cm_ignore_count = 5;
@@ -877,34 +889,34 @@ static int pcan_usb_pro_init(struct peak_usb_device *dev)
                 */
                err = pcan_usb_pro_send_req(dev, PCAN_USBPRO_REQ_INFO,
                                            PCAN_USBPRO_INFO_FW,
-                                            &fi, sizeof(fi));
+                                            fi, sizeof(*fi));
                if (err) {
-                        kfree(usb_if);
                        dev_err(dev->netdev->dev.parent,
                                "unable to read %s firmware info (err %d)\n",
                                pcan_usb_pro.name, err);
-                        return err;
+                        goto err_out;
                }
                err = pcan_usb_pro_send_req(dev, PCAN_USBPRO_REQ_INFO,
                                            PCAN_USBPRO_INFO_BL,
-                                            &bi, sizeof(bi));
+                                            bi, sizeof(*bi));
                if (err) {
-                        kfree(usb_if);
                        dev_err(dev->netdev->dev.parent,
                                "unable to read %s bootloader info (err %d)\n",
                                pcan_usb_pro.name, err);
-                        return err;
+                        goto err_out;
                }
+                /* tell the device the can driver is running */
+                err = pcan_usb_pro_drv_loaded(dev, 1);
+                if (err)
+                        goto err_out;
                dev_info(dev->netdev->dev.parent,
                     "PEAK-System %s hwrev %u serial %08X.%08X (%u channels)\n",
                     pcan_usb_pro.name,
-                     bi.hw_rev, bi.serial_num_hi, bi.serial_num_lo,
+                     bi->hw_rev, bi->serial_num_hi, bi->serial_num_lo,
                     pcan_usb_pro.ctrl_count);
-                /* tell the device the can driver is running */
-                pcan_usb_pro_drv_loaded(dev, 1);
        } else {
                usb_if = pcan_usb_pro_dev_if(dev->prev_siblings);
        }
@@ -916,6 +928,13 @@ static int pcan_usb_pro_init(struct peak_usb_device *dev)
        pcan_usb_pro_set_led(dev, 0, 1);
        return 0;
+ err_out:
+        kfree(bi);
+        kfree(fi);
+        kfree(usb_if);
+        return err;
 }
 static void pcan_usb_pro_exit(struct peak_usb_device *dev)
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.h b/drivers/net/can/usb/peak_usb/pcan_usb_pro.h
index a869918c5620..32275af547e0 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.h
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.h
@@ -29,6 +29,7 @@
 /* Vendor Request value for XXX_FCT */
 #define PCAN_USBPRO_FCT_DRVLD           5 /* tell device driver is loaded */
+#define PCAN_USBPRO_FCT_DRVLD_REQ_LEN   16
 /* PCAN_USBPRO_INFO_BL vendor request record type */
 struct __packed pcan_usb_pro_blinfo {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index be59ec4b2c30..638e55435b04 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3192,11 +3192,11 @@ static u32 bnx2x_xmit_type(struct bnx2x *bp, struct sk_buff *skb)
                rc |= XMIT_CSUM_TCP;
        if (skb_is_gso_v6(skb)) {
-                rc |= (XMIT_GSO_V6 | XMIT_CSUM_TCP | XMIT_CSUM_V6);
+                rc |= (XMIT_GSO_V6 | XMIT_CSUM_TCP);
                if (rc & XMIT_CSUM_ENC)
                        rc |= XMIT_GSO_ENC_V6;
        } else if (skb_is_gso(skb)) {
-                rc |= (XMIT_GSO_V4 | XMIT_CSUM_V4 | XMIT_CSUM_TCP);
+                rc |= (XMIT_GSO_V4 | XMIT_CSUM_TCP);
                if (rc & XMIT_CSUM_ENC)
                        rc |= XMIT_GSO_ENC_V4;
        }
@@ -3483,19 +3483,18 @@ static void bnx2x_update_pbds_gso_enc(struct sk_buff *skb,
 {
        u16 hlen_w = 0;
        u8 outerip_off, outerip_len = 0;
        /* from outer IP to transport */
        hlen_w = (skb_inner_transport_header(skb) -
                  skb_network_header(skb)) >> 1;
        /* transport len */
-        if (xmit_type & XMIT_CSUM_TCP)
+        hlen_w += inner_tcp_hdrlen(skb) >> 1;
-                hlen_w += inner_tcp_hdrlen(skb) >> 1;
-        else
-                hlen_w += sizeof(struct udphdr) >> 1;
        pbd2->fw_ip_hdr_to_payload_w = hlen_w;
-        if (xmit_type & XMIT_CSUM_ENC_V4) {
+        /* outer IP header info */
+        if (xmit_type & XMIT_CSUM_V4) {
                struct iphdr *iph = ip_hdr(skb);
                pbd2->fw_ip_csum_wo_len_flags_frag =
                        bswab16(csum_fold((~iph->check) -
@@ -3818,8 +3817,7 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                        bnx2x_set_pbd_gso_e2(skb, &pbd_e2_parsing_data,
                                             xmit_type);
                else
-                        bnx2x_set_pbd_gso(skb, pbd_e1x, tx_start_bd,
+                        bnx2x_set_pbd_gso(skb, pbd_e1x, first_bd, xmit_type);
-                                          xmit_type);
        }
        /* Set the PBD's parsing_data field if not zero
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 1f2dd928888a..0f493c8dc28b 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -9468,6 +9468,14 @@ static void tg3_rss_write_indir_tbl(struct tg3 *tp)
        }
 }
+static inline u32 tg3_lso_rd_dma_workaround_bit(struct tg3 *tp)
+{
+        if (tg3_asic_rev(tp) == ASIC_REV_5719)
+                return TG3_LSO_RD_DMA_TX_LENGTH_WA_5719;
+        else
+                return TG3_LSO_RD_DMA_TX_LENGTH_WA_5720;
+}
 /* tp->lock is held. */
 static int tg3_reset_hw(struct tg3 *tp, bool reset_phy)
 {
@@ -10153,16 +10161,17 @@ static int tg3_reset_hw(struct tg3 *tp, bool reset_phy)
        tw32_f(RDMAC_MODE, rdmac_mode);
        udelay(40);
-        if (tg3_asic_rev(tp) == ASIC_REV_5719) {
+        if (tg3_asic_rev(tp) == ASIC_REV_5719 ||
+            tg3_asic_rev(tp) == ASIC_REV_5720) {
                for (i = 0; i < TG3_NUM_RDMA_CHANNELS; i++) {
                        if (tr32(TG3_RDMA_LENGTH + (i << 2)) > TG3_MAX_MTU(tp))
                                break;
                }
                if (i < TG3_NUM_RDMA_CHANNELS) {
                        val = tr32(TG3_LSO_RD_DMA_CRPTEN_CTRL);
-                        val |= TG3_LSO_RD_DMA_TX_LENGTH_WA;
+                        val |= tg3_lso_rd_dma_workaround_bit(tp);
                        tw32(TG3_LSO_RD_DMA_CRPTEN_CTRL, val);
-                        tg3_flag_set(tp, 5719_RDMA_BUG);
+                        tg3_flag_set(tp, 5719_5720_RDMA_BUG);
                }
        }
@@ -10526,15 +10535,15 @@ static void tg3_periodic_fetch_stats(struct tg3 *tp)
        TG3_STAT_ADD32(&sp->tx_ucast_packets, MAC_TX_STATS_UCAST);
        TG3_STAT_ADD32(&sp->tx_mcast_packets, MAC_TX_STATS_MCAST);
        TG3_STAT_ADD32(&sp->tx_bcast_packets, MAC_TX_STATS_BCAST);
-        if (unlikely(tg3_flag(tp, 5719_RDMA_BUG) &&
+        if (unlikely(tg3_flag(tp, 5719_5720_RDMA_BUG) &&
                     (sp->tx_ucast_packets.low + sp->tx_mcast_packets.low +
                      sp->tx_bcast_packets.low) > TG3_NUM_RDMA_CHANNELS)) {
                u32 val;
                val = tr32(TG3_LSO_RD_DMA_CRPTEN_CTRL);
-                val &= ~TG3_LSO_RD_DMA_TX_LENGTH_WA;
+                val &= ~tg3_lso_rd_dma_workaround_bit(tp);
                tw32(TG3_LSO_RD_DMA_CRPTEN_CTRL, val);
-                tg3_flag_clear(tp, 5719_RDMA_BUG);
+                tg3_flag_clear(tp, 5719_5720_RDMA_BUG);
        }
        TG3_STAT_ADD32(&sp->rx_octets, MAC_RX_STATS_OCTETS);
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index 9b2d3ac2474a..ff6e30eeae35 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -1422,7 +1422,8 @@
 #define TG3_LSO_RD_DMA_CRPTEN_CTRL      0x00004910
 #define TG3_LSO_RD_DMA_CRPTEN_CTRL_BLEN_BD_4K    0x00030000
 #define TG3_LSO_RD_DMA_CRPTEN_CTRL_BLEN_LSO_4K   0x000c0000
-#define TG3_LSO_RD_DMA_TX_LENGTH_WA      0x02000000
+#define TG3_LSO_RD_DMA_TX_LENGTH_WA_5719         0x02000000
+#define TG3_LSO_RD_DMA_TX_LENGTH_WA_5720         0x00200000
 /* 0x4914 --> 0x4be0 unused */
 #define TG3_NUM_RDMA_CHANNELS           4
@@ -3059,7 +3060,7 @@ enum TG3_FLAGS {
        TG3_FLAG_APE_HAS_NCSI,
        TG3_FLAG_TX_TSTAMP_EN,
        TG3_FLAG_4K_FIFO_LIMIT,
-        TG3_FLAG_5719_RDMA_BUG,
+        TG3_FLAG_5719_5720_RDMA_BUG,
        TG3_FLAG_RESET_TASK_PENDING,
        TG3_FLAG_PTP_CAPABLE,
        TG3_FLAG_5705_PLUS,
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index f544b297c9ab..0a510684e468 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -262,6 +262,7 @@ struct be_rx_compl_info {
        u8 ipv6;
        u8 vtm;
        u8 pkt_type;
+        u8 ip_frag;
 };
 struct be_rx_obj {
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index a236ecd27cf3..1db2df61b8af 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -562,7 +562,7 @@ int lancer_test_and_set_rdy_state(struct be_adapter *adapter)
        resource_error = lancer_provisioning_error(adapter);
        if (resource_error)
-                return -1;
+                return -EAGAIN;
        status = lancer_wait_ready(adapter);
        if (!status) {
@@ -590,8 +590,8 @@ int lancer_test_and_set_rdy_state(struct be_adapter *adapter)
         * when PF provisions resources.
         */
        resource_error = lancer_provisioning_error(adapter);
-        if (status == -1 && !resource_error)
+        if (resource_error)
-                adapter->eeh_error = true;
+                status = -EAGAIN;
        return status;
 }
diff --git a/drivers/net/ethernet/emulex/benet/be_hw.h b/drivers/net/ethernet/emulex/benet/be_hw.h
index 3c1099b47f2a..8780183c6d1c 100644
--- a/drivers/net/ethernet/emulex/benet/be_hw.h
+++ b/drivers/net/ethernet/emulex/benet/be_hw.h
@@ -356,7 +356,7 @@ struct amap_eth_rx_compl_v0 {
        u8 ip_version;          /* dword 1 */
        u8 macdst[6];           /* dword 1 */
        u8 vtp;                 /* dword 1 */
-        u8 rsvd0;               /* dword 1 */
+        u8 ip_frag;             /* dword 1 */
        u8 fragndx[10];         /* dword 1 */
        u8 ct[2];               /* dword 1 */
        u8 sw;                  /* dword 1 */
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index ca2967b0f18b..8bc1b21b1c79 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1599,6 +1599,8 @@ static void be_parse_rx_compl_v0(struct be_eth_rx_compl *compl,
                                               compl);
        }
        rxcp->port = AMAP_GET_BITS(struct amap_eth_rx_compl_v0, port, compl);
+        rxcp->ip_frag = AMAP_GET_BITS(struct amap_eth_rx_compl_v0,
+                                      ip_frag, compl);
 }
 static struct be_rx_compl_info *be_rx_compl_get(struct be_rx_obj *rxo)
@@ -1620,6 +1622,9 @@ static struct be_rx_compl_info *be_rx_compl_get(struct be_rx_obj *rxo)
        else
                be_parse_rx_compl_v0(compl, rxcp);
+        if (rxcp->ip_frag)
+                rxcp->l4_csum = 0;
        if (rxcp->vlanf) {
                /* vlanf could be wrongly set in some cards.
                 * ignore if vtm is not set */
@@ -2168,7 +2173,7 @@ static irqreturn_t be_msix(int irq, void *dev)
 static inline bool do_gro(struct be_rx_compl_info *rxcp)
 {
-        return (rxcp->tcpf && !rxcp->err) ? true : false;
+        return (rxcp->tcpf && !rxcp->err && rxcp->l4_csum) ? true : false;
 }
 static int be_process_rx(struct be_rx_obj *rxo, struct napi_struct *napi,
@@ -4093,6 +4098,7 @@ static int be_get_initial_config(struct be_adapter *adapter)
 static int lancer_recover_func(struct be_adapter *adapter)
 {
+        struct device *dev = &adapter->pdev->dev;
        int status;
        status = lancer_test_and_set_rdy_state(adapter);
@@ -4104,8 +4110,7 @@ static int lancer_recover_func(struct be_adapter *adapter)
        be_clear(adapter);
-        adapter->hw_error = false;
+        be_clear_all_error(adapter);
-        adapter->fw_timeout = false;
        status = be_setup(adapter);
        if (status)
@@ -4117,13 +4122,13 @@ static int lancer_recover_func(struct be_adapter *adapter)
                        goto err;
        }
-        dev_err(&adapter->pdev->dev,
+        dev_err(dev, "Error recovery successful\n");
-                "Adapter SLIPORT recovery succeeded\n");
        return 0;
 err:
-        if (adapter->eeh_error)
+        if (status == -EAGAIN)
-                dev_err(&adapter->pdev->dev,
+                dev_err(dev, "Waiting for resource provisioning\n");
-                        "Adapter SLIPORT recovery failed\n");
+        else
+                dev_err(dev, "Error recovery failed\n");
        return status;
 }
@@ -4132,28 +4137,27 @@ static void be_func_recovery_task(struct work_struct *work)
 {
        struct be_adapter *adapter =
                container_of(work, struct be_adapter,  func_recovery_work.work);
-        int status;
+        int status = 0;
        be_detect_error(adapter);
        if (adapter->hw_error && lancer_chip(adapter)) {
-                if (adapter->eeh_error)
-                        goto out;
                rtnl_lock();
                netif_device_detach(adapter->netdev);
                rtnl_unlock();
                status = lancer_recover_func(adapter);
                if (!status)
                        netif_device_attach(adapter->netdev);
        }
-out:
+        /* In Lancer, for all errors other than provisioning error (-EAGAIN),
-        schedule_delayed_work(&adapter->func_recovery_work,
+         * no need to attempt further recovery.
-                              msecs_to_jiffies(1000));
+         */
+        if (!status || status == -EAGAIN)
+                schedule_delayed_work(&adapter->func_recovery_work,
+                                      msecs_to_jiffies(1000));
 }
 static void be_worker(struct work_struct *work)
@@ -4436,20 +4440,19 @@ static pci_ers_result_t be_eeh_err_detected(struct pci_dev *pdev,
        dev_err(&adapter->pdev->dev, "EEH error detected\n");
-        adapter->eeh_error = true;
+        if (!adapter->eeh_error) {
+                adapter->eeh_error = true;
-        cancel_delayed_work_sync(&adapter->func_recovery_work);
-        rtnl_lock();
+                cancel_delayed_work_sync(&adapter->func_recovery_work);
-        netif_device_detach(netdev);
-        rtnl_unlock();
-        if (netif_running(netdev)) {
                rtnl_lock();
-                be_close(netdev);
+                netif_device_detach(netdev);
+                if (netif_running(netdev))
+                        be_close(netdev);
                rtnl_unlock();
+                be_clear(adapter);
        }
-        be_clear(adapter);
        if (state == pci_channel_io_perm_failure)
                return PCI_ERS_RESULT_DISCONNECT;
@@ -4474,7 +4477,6 @@ static pci_ers_result_t be_eeh_reset(struct pci_dev *pdev)
        int status;
        dev_info(&adapter->pdev->dev, "EEH reset\n");
-        be_clear_all_error(adapter);
        status = pci_enable_device(pdev);
        if (status)
@@ -4492,6 +4494,7 @@ static pci_ers_result_t be_eeh_reset(struct pci_dev *pdev)
                return PCI_ERS_RESULT_DISCONNECT;
        pci_cleanup_aer_uncorrect_error_status(pdev);
+        be_clear_all_error(adapter);
        return PCI_ERS_RESULT_RECOVERED;
 }
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 85a06037b242..a667015be22a 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1038,6 +1038,18 @@ static void fec_get_mac(struct net_device *ndev)
                iap = &tmpaddr[0];
        }
+        /*
+         * 5) random mac address
+         */
+        if (!is_valid_ether_addr(iap)) {
+                /* Report it and use a random ethernet address instead */
+                netdev_err(ndev, "Invalid MAC address: %pM\n", iap);
+                eth_hw_addr_random(ndev);
+                netdev_info(ndev, "Using random MAC address: %pM\n",
+                            ndev->dev_addr);
+                return;
+        }
        memcpy(ndev->dev_addr, iap, ETH_ALEN);
        /* Adjust MAC if using macaddr */
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index 1df56cc50ee9..0e572a527154 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -222,8 +222,6 @@ static int mlx4_comm_cmd_poll(struct mlx4_dev *dev, u8 cmd, u16 param,
                 * FLR process. The only non-zero result in the RESET command
                 * is MLX4_DELAY_RESET_SLAVE*/
                if ((MLX4_COMM_CMD_RESET == cmd)) {
-                        mlx4_warn(dev, "Got slave FLRed from Communication"
-                                  " channel (ret:0x%x)\n", ret_from_pending);
                        err = MLX4_DELAY_RESET_SLAVE;
                } else {
                        mlx4_warn(dev, "Communication channel timed out\n");
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index b35f94700093..89c47ea84b50 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1323,6 +1323,7 @@ static void mlx4_en_auto_moderation(struct mlx4_en_priv *priv)
                        priv->last_moder_time[ring] = moder_time;
                        cq = &priv->rx_cq[ring];
                        cq->moder_time = moder_time;
+                        cq->moder_cnt = priv->rx_frames;
                        err = mlx4_en_set_cq_moder(priv, cq);
                        if (err)
                                en_err(priv, "Failed modifying moderation for cq:%d\n",
@@ -2118,6 +2119,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
        struct mlx4_en_priv *priv;
        int i;
        int err;
+        u64 mac_u64;
        dev = alloc_etherdev_mqs(sizeof(struct mlx4_en_priv),
                                 MAX_TX_RINGS, MAX_RX_RINGS);
@@ -2191,10 +2193,17 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
        dev->addr_len = ETH_ALEN;
        mlx4_en_u64_to_mac(dev->dev_addr, mdev->dev->caps.def_mac[priv->port]);
        if (!is_valid_ether_addr(dev->dev_addr)) {
-                en_err(priv, "Port: %d, invalid mac burned: %pM, quiting\n",
+                if (mlx4_is_slave(priv->mdev->dev)) {
-                       priv->port, dev->dev_addr);
+                        eth_hw_addr_random(dev);
-                err = -EINVAL;
+                        en_warn(priv, "Assigned random MAC address %pM\n", dev->dev_addr);
-                goto out;
+                        mac_u64 = mlx4_en_mac_to_u64(dev->dev_addr);
+                        mdev->dev->caps.def_mac[priv->port] = mac_u64;
+                } else {
+                        en_err(priv, "Port: %d, invalid mac burned: %pM, quiting\n",
+                               priv->port, dev->dev_addr);
+                        err = -EINVAL;
+                        goto out;
+                }
        }
        memcpy(priv->prev_mac, dev->dev_addr, sizeof(priv->prev_mac));
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 58a8e535d698..2c97901c6a6d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -840,12 +840,16 @@ int mlx4_QUERY_PORT_wrapper(struct mlx4_dev *dev, int slave,
                           MLX4_CMD_NATIVE);
        if (!err && dev->caps.function != slave) {
-                /* set slave default_mac address */
-                MLX4_GET(def_mac, outbox->buf, QUERY_PORT_MAC_OFFSET);
-                def_mac += slave << 8;
                /* if config MAC in DB use it */
                if (priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac)
                        def_mac = priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac;
+                else {
+                        /* set slave default_mac address */
+                        MLX4_GET(def_mac, outbox->buf, QUERY_PORT_MAC_OFFSET);
+                        def_mac += slave << 8;
+                        priv->mfunc.master.vf_admin[slave].vport[vhcr->in_modifier].mac = def_mac;
+                }
                MLX4_PUT(outbox->buf, def_mac, QUERY_PORT_MAC_OFFSET);
                /* get port type - currently only eth is enabled */
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 0d32a82458bf..2f4a26039e80 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1290,7 +1290,6 @@ static int mlx4_init_slave(struct mlx4_dev *dev)
 {
        struct mlx4_priv *priv = mlx4_priv(dev);
        u64 dma = (u64) priv->mfunc.vhcr_dma;
-        int num_of_reset_retries = NUM_OF_RESET_RETRIES;
        int ret_from_reset = 0;
        u32 slave_read;
        u32 cmd_channel_ver;
@@ -1304,18 +1303,10 @@ static int mlx4_init_slave(struct mlx4_dev *dev)
         * NUM_OF_RESET_RETRIES times before leaving.*/
        if (ret_from_reset) {
                if (MLX4_DELAY_RESET_SLAVE == ret_from_reset) {
-                        msleep(SLEEP_TIME_IN_RESET);
+                        mlx4_warn(dev, "slave is currently in the "
-                        while (ret_from_reset && num_of_reset_retries) {
+                                  "middle of FLR. Deferring probe.\n");
-                                mlx4_warn(dev, "slave is currently in the"
+                        mutex_unlock(&priv->cmd.slave_cmd_mutex);
-                                          "middle of FLR. retrying..."
+                        return -EPROBE_DEFER;
-                                          "(try num:%d)\n",
-                                          (NUM_OF_RESET_RETRIES -
-                                           num_of_reset_retries  + 1));
-                                ret_from_reset =
-                                        mlx4_comm_cmd(dev, MLX4_COMM_CMD_RESET,
-                                                      0, MLX4_COMM_TIME);
-                                num_of_reset_retries = num_of_reset_retries - 1;
-                        }
                } else
                        goto err;
        }
@@ -1526,7 +1517,8 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
        } else {
                err = mlx4_init_slave(dev);
                if (err) {
-                        mlx4_err(dev, "Failed to initialize slave\n");
+                        if (err != -EPROBE_DEFER)
+                                mlx4_err(dev, "Failed to initialize slave\n");
                        return err;
                }
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 50235d201592..f87cc216045b 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -4717,6 +4717,7 @@ static int qlge_probe(struct pci_dev *pdev,
                dev_err(&pdev->dev, "net device registration failed.\n");
                ql_release_all(pdev);
                pci_disable_device(pdev);
+                free_netdev(ndev);
                return err;
        }
        /* Start up the timer to trigger EEH if
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 919b983114e9..b7268b3dae77 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -946,7 +946,8 @@ static int xemaclite_open(struct net_device *dev)
                phy_write(lp->phy_dev, MII_CTRL1000, 0);
                /* Advertise only 10 and 100mbps full/half duplex speeds */
-                phy_write(lp->phy_dev, MII_ADVERTISE, ADVERTISE_ALL);
+                phy_write(lp->phy_dev, MII_ADVERTISE, ADVERTISE_ALL |
+                          ADVERTISE_CSMA);
                /* Restart auto negotiation */
                bmcr = phy_read(lp->phy_dev, MII_BMCR);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 088c55496191..ab2307b5d9a7 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -31,6 +31,7 @@
 #include <linux/inetdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/skbuff.h>
+#include <linux/if_vlan.h>
 #include <linux/in.h>
 #include <linux/slab.h>
 #include <net/arp.h>
@@ -284,7 +285,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
        skb->protocol = eth_type_trans(skb, net);
        skb->ip_summed = CHECKSUM_NONE;
-        skb->vlan_tci = packet->vlan_tci;
+        __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), packet->vlan_tci);
        net->stats.rx_packets++;
        net->stats.rx_bytes += packet->total_data_buflen;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index c14f14741b3f..38f0b312ff85 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -1044,7 +1044,7 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
                adv = mmd_eee_adv_to_ethtool_adv_t(eee_adv);
                lp = mmd_eee_adv_to_ethtool_adv_t(eee_lp);
                idx = phy_find_setting(phydev->speed, phydev->duplex);
-                if ((lp & adv & settings[idx].setting))
+                if (!(lp & adv & settings[idx].setting))
                        goto eee_exit;
                if (clk_stop_enable) {
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 7c43261975bd..d016a76ad44b 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2374,7 +2374,8 @@ static int team_nl_send_port_list_get(struct team *team, u32 portid, u32 seq,
        bool incomplete;
        int i;
-        port = list_first_entry(&team->port_list, struct team_port, list);
+        port = list_first_entry_or_null(&team->port_list,
+                                        struct team_port, list);
 start_again:
        err = __send_and_alloc_skb(&skb, team, portid, send_func);
@@ -2402,8 +2403,8 @@ start_again:
                err = team_nl_fill_one_port_get(skb, one_port);
                if (err)
                        goto errout;
-        } else {
+        } else if (port) {
-                list_for_each_entry(port, &team->port_list, list) {
+                list_for_each_entry_from(port, &team->port_list, list) {
                        err = team_nl_fill_one_port_get(skb, port);
                        if (err) {
                                if (err == -EMSGSIZE) {
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index f042b0373e5d..89776c592151 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1585,6 +1585,10 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                else
                        return -EINVAL;
+                if (!!(ifr->ifr_flags & IFF_MULTI_QUEUE) !=
+                    !!(tun->flags & TUN_TAP_MQ))
+                        return -EINVAL;
                if (tun_not_capable(tun))
                        return -EPERM;
                err = security_tun_dev_open(tun->security);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
index 54ba42f4108a..874f6570bd1c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
@@ -68,13 +68,16 @@
 #define AR9300_BASE_ADDR 0x3ff
 #define AR9300_BASE_ADDR_512 0x1ff
-#define AR9300_OTP_BASE                 (AR_SREV_9340(ah) ? 0x30000 : 0x14000)
+#define AR9300_OTP_BASE \
-#define AR9300_OTP_STATUS               (AR_SREV_9340(ah) ? 0x30018 : 0x15f18)
+                ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x30000 : 0x14000)
+#define AR9300_OTP_STATUS \
+                ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x30018 : 0x15f18)
 #define AR9300_OTP_STATUS_TYPE          0x7
 #define AR9300_OTP_STATUS_VALID         0x4
 #define AR9300_OTP_STATUS_ACCESS_BUSY   0x2
 #define AR9300_OTP_STATUS_SM_BUSY       0x1
-#define AR9300_OTP_READ_DATA            (AR_SREV_9340(ah) ? 0x3001c : 0x15f1c)
+#define AR9300_OTP_READ_DATA \
+                ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x3001c : 0x15f1c)
 enum targetPowerHTRates {
        HT_TARGET_RATE_0_8_16,
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 2bf6548dd143..e1714d7c9eeb 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -334,7 +334,8 @@ static void ar9003_hw_spur_ofdm(struct ath_hw *ah,
        REG_RMW_FIELD(ah, AR_PHY_SPUR_REG,
                      AR_PHY_SPUR_REG_EN_VIT_SPUR_RSSI, 1);
-        if (REG_READ_FIELD(ah, AR_PHY_MODE,
+        if (!AR_SREV_9340(ah) &&
+            REG_READ_FIELD(ah, AR_PHY_MODE,
                           AR_PHY_MODE_DYNAMIC) == 0x1)
                REG_RMW_FIELD(ah, AR_PHY_SPUR_REG,
                              AR_PHY_SPUR_REG_ENABLE_NF_RSSI_SPUR_MIT, 1);
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 366002f266f8..42b03dc39d14 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -251,10 +251,9 @@ struct ath_atx_tid {
        int tidno;
        int baw_head;   /* first un-acked tx buffer */
        int baw_tail;   /* next unused tx buffer slot */
-        int sched;
+        bool sched;
-        int paused;
+        bool paused;
-        u8 state;
+        bool active;
-        bool stop_cb;
 };
 struct ath_node {
@@ -275,10 +274,6 @@ struct ath_node {
 #endif
 };
-#define AGGR_CLEANUP         BIT(1)
-#define AGGR_ADDBA_COMPLETE  BIT(2)
-#define AGGR_ADDBA_PROGRESS  BIT(3)
 struct ath_tx_control {
        struct ath_txq *txq;
        struct ath_node *an;
@@ -352,8 +347,7 @@ void ath_tx_tasklet(struct ath_softc *sc);
 void ath_tx_edma_tasklet(struct ath_softc *sc);
 int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
                      u16 tid, u16 *ssn);
-bool ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid,
+void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
-                      bool flush);
 void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
 void ath_tx_aggr_wakeup(struct ath_softc *sc, struct ath_node *an);
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 7f25da8444fe..15dfefcf2d0f 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1172,6 +1172,7 @@ u32 ath9k_regd_get_ctl(struct ath_regulatory *reg, struct ath9k_channel *chan)
 static inline void ath9k_hw_set_dma(struct ath_hw *ah)
 {
        struct ath_common *common = ath9k_hw_common(ah);
+        int txbuf_size;
        ENABLE_REGWRITE_BUFFER(ah);
@@ -1225,13 +1226,17 @@ static inline void ath9k_hw_set_dma(struct ath_hw *ah)
                 * So set the usable tx buf size also to half to
                 * avoid data/delimiter underruns
                 */
-                REG_WRITE(ah, AR_PCU_TXBUF_CTRL,
+                txbuf_size = AR_9285_PCU_TXBUF_CTRL_USABLE_SIZE;
-                          AR_9285_PCU_TXBUF_CTRL_USABLE_SIZE);
+        } else if (AR_SREV_9340_13_OR_LATER(ah)) {
-        } else if (!AR_SREV_9271(ah)) {
+                /* Uses fewer entries for AR934x v1.3+ to prevent rx overruns */
-                REG_WRITE(ah, AR_PCU_TXBUF_CTRL,
+                txbuf_size = AR_9340_PCU_TXBUF_CTRL_USABLE_SIZE;
-                          AR_PCU_TXBUF_CTRL_USABLE_SIZE);
+        } else {
+                txbuf_size = AR_PCU_TXBUF_CTRL_USABLE_SIZE;
        }
+        if (!AR_SREV_9271(ah))
+                REG_WRITE(ah, AR_PCU_TXBUF_CTRL, txbuf_size);
        REGWRITE_BUFFER_FLUSH(ah);
        if (AR_SREV_9300_20_OR_LATER(ah))
@@ -1306,9 +1311,13 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
                        AR_RTC_RC_COLD_RESET | AR_RTC_RC_WARM_RESET;
        } else {
                tmpReg = REG_READ(ah, AR_INTR_SYNC_CAUSE);
-                if (tmpReg &
+                if (AR_SREV_9340(ah))
-                    (AR_INTR_SYNC_LOCAL_TIMEOUT |
+                        tmpReg &= AR9340_INTR_SYNC_LOCAL_TIMEOUT;
-                     AR_INTR_SYNC_RADM_CPL_TIMEOUT)) {
+                else
+                        tmpReg &= AR_INTR_SYNC_LOCAL_TIMEOUT |
+                                  AR_INTR_SYNC_RADM_CPL_TIMEOUT;
+                if (tmpReg) {
                        u32 val;
                        REG_WRITE(ah, AR_INTR_SYNC_ENABLE, 0);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 498fee04afa0..566109a40fb3 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -410,7 +410,7 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
        REG_WRITE(ah, AR_QMISC(q), AR_Q_MISC_DCU_EARLY_TERM_REQ);
-        if (AR_SREV_9340(ah))
+        if (AR_SREV_9340(ah) && !AR_SREV_9340_13_OR_LATER(ah))
                REG_WRITE(ah, AR_DMISC(q),
                          AR_D_MISC_CW_BKOFF_EN | AR_D_MISC_FRAG_WAIT_EN | 0x1);
        else
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 2382d1262e7f..5092ecae7706 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1709,7 +1709,8 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
                flush = true;
        case IEEE80211_AMPDU_TX_STOP_CONT:
                ath9k_ps_wakeup(sc);
-                if (ath_tx_aggr_stop(sc, sta, tid, flush))
+                ath_tx_aggr_stop(sc, sta, tid);
+                if (!flush)
                        ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                ath9k_ps_restore(sc);
                break;
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index aa4d368d8d3d..7eb1f4b458e4 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1227,10 +1227,7 @@ static bool ath_tx_aggr_check(struct ath_softc *sc, struct ieee80211_sta *sta,
                return false;
        txtid = ATH_AN_2_TID(an, tidno);
+        return !txtid->active;
-        if (!(txtid->state & (AGGR_ADDBA_COMPLETE | AGGR_ADDBA_PROGRESS)))
-                        return true;
-        return false;
 }
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index 5c4ab5026dca..f7c90cc58d56 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -798,6 +798,10 @@
 #define AR_SREV_REVISION_9485_10        0
 #define AR_SREV_REVISION_9485_11        1
 #define AR_SREV_VERSION_9340            0x300
+#define AR_SREV_REVISION_9340_10        0
+#define AR_SREV_REVISION_9340_11        1
+#define AR_SREV_REVISION_9340_12        2
+#define AR_SREV_REVISION_9340_13        3
 #define AR_SREV_VERSION_9580            0x1C0
 #define AR_SREV_REVISION_9580_10        4 /* AR9580 1.0 */
 #define AR_SREV_VERSION_9462            0x280
@@ -897,6 +901,10 @@
 #define AR_SREV_9340(_ah) \
        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9340))
+#define AR_SREV_9340_13_OR_LATER(_ah) \
+        (AR_SREV_9340((_ah)) && \
+         ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9340_13))
 #define AR_SREV_9285E_20(_ah) \
    (AR_SREV_9285_12_OR_LATER(_ah) && \
     ((REG_READ(_ah, AR_AN_SYNTH9) & 0x7) == 0x1))
@@ -1007,6 +1015,8 @@ enum {
                                AR_INTR_SYNC_LOCAL_TIMEOUT |
                                AR_INTR_SYNC_MAC_SLEEP_ACCESS),
+        AR9340_INTR_SYNC_LOCAL_TIMEOUT = 0x00000010,
        AR_INTR_SYNC_SPURIOUS = 0xFFFFFFFF,
 };
@@ -1881,6 +1891,7 @@ enum {
 #define AR_PCU_TXBUF_CTRL_SIZE_MASK     0x7FF
 #define AR_PCU_TXBUF_CTRL_USABLE_SIZE   0x700
 #define AR_9285_PCU_TXBUF_CTRL_USABLE_SIZE   0x380
+#define AR_9340_PCU_TXBUF_CTRL_USABLE_SIZE   0x500
 #define AR_PCU_MISC_MODE2               0x8344
 #define AR_PCU_MISC_MODE2_MGMT_CRYPTO_ENABLE           0x00000002
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 14bb3354ea64..1c9b1bac8b0d 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -125,24 +125,6 @@ static void ath_tx_queue_tid(struct ath_txq *txq, struct ath_atx_tid *tid)
        list_add_tail(&ac->list, &txq->axq_acq);
 }
-static void ath_tx_resume_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
-{
-        struct ath_txq *txq = tid->ac->txq;
-        WARN_ON(!tid->paused);
-        ath_txq_lock(sc, txq);
-        tid->paused = false;
-        if (skb_queue_empty(&tid->buf_q))
-                goto unlock;
-        ath_tx_queue_tid(txq, tid);
-        ath_txq_schedule(sc, txq);
-unlock:
-        ath_txq_unlock_complete(sc, txq);
-}
 static struct ath_frame_info *get_frame_info(struct sk_buff *skb)
 {
        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
@@ -164,20 +146,7 @@ static void ath_set_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
                               ARRAY_SIZE(bf->rates));
 }
-static void ath_tx_clear_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
+static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
-{
-        tid->state &= ~AGGR_ADDBA_COMPLETE;
-        tid->state &= ~AGGR_CLEANUP;
-        if (!tid->stop_cb)
-                return;
-        ieee80211_start_tx_ba_cb_irqsafe(tid->an->vif, tid->an->sta->addr,
-                                         tid->tidno);
-        tid->stop_cb = false;
-}
-static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid,
-                             bool flush_packets)
 {
        struct ath_txq *txq = tid->ac->txq;
        struct sk_buff *skb;
@@ -194,15 +163,16 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid,
        while ((skb = __skb_dequeue(&tid->buf_q))) {
                fi = get_frame_info(skb);
                bf = fi->bf;
-                if (!bf && !flush_packets)
-                        bf = ath_tx_setup_buffer(sc, txq, tid, skb);
                if (!bf) {
-                        ieee80211_free_txskb(sc->hw, skb);
+                        bf = ath_tx_setup_buffer(sc, txq, tid, skb);
-                        continue;
+                        if (!bf) {
+                                ieee80211_free_txskb(sc->hw, skb);
+                                continue;
+                        }
                }
-                if (fi->retries || flush_packets) {
+                if (fi->retries) {
                        list_add_tail(&bf->list, &bf_head);
                        ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
                        ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
@@ -213,10 +183,7 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid,
                }
        }
-        if (tid->baw_head == tid->baw_tail)
+        if (sendbar) {
-                ath_tx_clear_tid(sc, tid);
-        if (sendbar && !flush_packets) {
                ath_txq_unlock(sc, txq);
                ath_send_bar(tid, tid->seq_start);
                ath_txq_lock(sc, txq);
@@ -499,19 +466,19 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                tx_info = IEEE80211_SKB_CB(skb);
                fi = get_frame_info(skb);
-                if (ATH_BA_ISSET(ba, ATH_BA_INDEX(seq_st, seqno))) {
+                if (!BAW_WITHIN(tid->seq_start, tid->baw_size, seqno)) {
+                        /*
+                         * Outside of the current BlockAck window,
+                         * maybe part of a previous session
+                         */
+                        txfail = 1;
+                } else if (ATH_BA_ISSET(ba, ATH_BA_INDEX(seq_st, seqno))) {
                        /* transmit completion, subframe is
                         * acked by block ack */
                        acked_cnt++;
                } else if (!isaggr && txok) {
                        /* transmit completion */
                        acked_cnt++;
-                } else if (tid->state & AGGR_CLEANUP) {
-                        /*
-                         * cleanup in progress, just fail
-                         * the un-acked sub-frames
-                         */
-                        txfail = 1;
                } else if (flush) {
                        txpending = 1;
                } else if (fi->retries < ATH_MAX_SW_RETRIES) {
@@ -535,7 +502,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                if (bf_next != NULL || !bf_last->bf_stale)
                        list_move_tail(&bf->list, &bf_head);
-                if (!txpending || (tid->state & AGGR_CLEANUP)) {
+                if (!txpending) {
                        /*
                         * complete the acked-ones/xretried ones; update
                         * block-ack window
@@ -609,9 +576,6 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                ath_txq_lock(sc, txq);
        }
-        if (tid->state & AGGR_CLEANUP)
-                ath_tx_flush_tid(sc, tid, false);
        rcu_read_unlock();
        if (needreset)
@@ -1244,9 +1208,6 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
        an = (struct ath_node *)sta->drv_priv;
        txtid = ATH_AN_2_TID(an, tid);
-        if (txtid->state & (AGGR_CLEANUP | AGGR_ADDBA_COMPLETE))
-                return -EAGAIN;
        /* update ampdu factor/density, they may have changed. This may happen
         * in HT IBSS when a beacon with HT-info is received after the station
         * has already been added.
@@ -1258,7 +1219,7 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
                an->mpdudensity = density;
        }
-        txtid->state |= AGGR_ADDBA_PROGRESS;
+        txtid->active = true;
        txtid->paused = true;
        *ssn = txtid->seq_start = txtid->seq_next;
        txtid->bar_index = -1;
@@ -1269,45 +1230,17 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
        return 0;
 }
-bool ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid,
+void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
-                      bool flush)
 {
        struct ath_node *an = (struct ath_node *)sta->drv_priv;
        struct ath_atx_tid *txtid = ATH_AN_2_TID(an, tid);
        struct ath_txq *txq = txtid->ac->txq;
-        bool ret = !flush;
-        if (flush)
-                txtid->stop_cb = false;
-        if (txtid->state & AGGR_CLEANUP)
-                return false;
-        if (!(txtid->state & AGGR_ADDBA_COMPLETE)) {
-                txtid->state &= ~AGGR_ADDBA_PROGRESS;
-                return ret;
-        }
        ath_txq_lock(sc, txq);
+        txtid->active = false;
        txtid->paused = true;
+        ath_tx_flush_tid(sc, txtid);
-        /*
-         * If frames are still being transmitted for this TID, they will be
-         * cleaned up during tx completion. To prevent race conditions, this
-         * TID can only be reused after all in-progress subframes have been
-         * completed.
-         */
-        if (txtid->baw_head != txtid->baw_tail) {
-                txtid->state |= AGGR_CLEANUP;
-                ret = false;
-                txtid->stop_cb = !flush;
-        } else {
-                txtid->state &= ~AGGR_ADDBA_COMPLETE;
-        }
-        ath_tx_flush_tid(sc, txtid, flush);
        ath_txq_unlock_complete(sc, txq);
-        return ret;
 }
 void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
@@ -1371,18 +1304,28 @@ void ath_tx_aggr_wakeup(struct ath_softc *sc, struct ath_node *an)
        }
 }
-void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
+void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta,
+                        u16 tidno)
 {
-        struct ath_atx_tid *txtid;
+        struct ath_atx_tid *tid;
        struct ath_node *an;
+        struct ath_txq *txq;
        an = (struct ath_node *)sta->drv_priv;
+        tid = ATH_AN_2_TID(an, tidno);
+        txq = tid->ac->txq;
-        txtid = ATH_AN_2_TID(an, tid);
+        ath_txq_lock(sc, txq);
-        txtid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
-        txtid->state |= AGGR_ADDBA_COMPLETE;
+        tid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
-        txtid->state &= ~AGGR_ADDBA_PROGRESS;
+        tid->paused = false;
-        ath_tx_resume_tid(sc, txtid);
+        if (!skb_queue_empty(&tid->buf_q)) {
+                ath_tx_queue_tid(txq, tid);
+                ath_txq_schedule(sc, txq);
+        }
+        ath_txq_unlock_complete(sc, txq);
 }
 /********************/
@@ -2431,13 +2374,10 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
                tid->baw_head  = tid->baw_tail = 0;
                tid->sched     = false;
                tid->paused    = false;
-                tid->state &= ~AGGR_CLEANUP;
+                tid->active        = false;
                __skb_queue_head_init(&tid->buf_q);
                acno = TID_TO_WME_AC(tidno);
                tid->ac = &an->ac[acno];
-                tid->state &= ~AGGR_ADDBA_COMPLETE;
-                tid->state &= ~AGGR_ADDBA_PROGRESS;
-                tid->stop_cb = false;
        }
        for (acno = 0, ac = &an->ac[acno];
@@ -2474,7 +2414,7 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
                }
                ath_tid_drain(sc, txq, tid);
-                ath_tx_clear_tid(sc, tid);
+                tid->active = false;
                ath_txq_unlock(sc, txq);
        }
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 830bb1d1f957..b827d51c30a3 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -1624,7 +1624,7 @@ struct net_device *init_atmel_card(unsigned short irq, unsigned long port,
        netif_carrier_off(dev);
-        if (!proc_create_data("driver/atmel", 0, NULL, &atmel_proc_fops, priv));
+        if (!proc_create_data("driver/atmel", 0, NULL, &atmel_proc_fops, priv))
                printk(KERN_WARNING "atmel: unable to create /proc entry.\n");
        printk(KERN_INFO "%s: Atmel at76c50x. Version %d.%d. MAC %pM\n",
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index be0787cab24f..9431af2465f3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -27,7 +27,6 @@
 #include "tracepoint.h"
 #define PKTFILTER_BUF_SIZE              128
-#define BRCMF_ARPOL_MODE                0xb     /* agent|snoop|peer_autoreply */
 #define BRCMF_DEFAULT_BCN_TIMEOUT       3
 #define BRCMF_DEFAULT_SCAN_CHANNEL_TIME 40
 #define BRCMF_DEFAULT_SCAN_UNASSOC_TIME 40
@@ -338,23 +337,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
                goto done;
        }
-        /* Try to set and enable ARP offload feature, this may fail */
-        err = brcmf_fil_iovar_int_set(ifp, "arp_ol", BRCMF_ARPOL_MODE);
-        if (err) {
-                brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
-                          BRCMF_ARPOL_MODE, err);
-                err = 0;
-        } else {
-                err = brcmf_fil_iovar_int_set(ifp, "arpoe", 1);
-                if (err) {
-                        brcmf_dbg(TRACE, "failed to enable ARP offload err = %d\n",
-                                  err);
-                        err = 0;
-                } else
-                        brcmf_dbg(TRACE, "successfully enabled ARP offload to 0x%x\n",
-                                  BRCMF_ARPOL_MODE);
-        }
        /* Setup packet filter */
        brcmf_c_pktfilter_offload_set(ifp, BRCMF_DEFAULT_PACKET_FILTER);
        brcmf_c_pktfilter_offload_enable(ifp, BRCMF_DEFAULT_PACKET_FILTER,
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 59c25463e428..b98f2235978e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -653,10 +653,13 @@ int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked)
        brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name);
+        ndev->destructor = free_netdev;
        return 0;
 fail:
+        drvr->iflist[ifp->bssidx] = NULL;
        ndev->netdev_ops = NULL;
+        free_netdev(ndev);
        return -EBADE;
 }
@@ -720,6 +723,9 @@ static int brcmf_net_p2p_attach(struct brcmf_if *ifp)
        return 0;
 fail:
+        ifp->drvr->iflist[ifp->bssidx] = NULL;
+        ndev->netdev_ops = NULL;
+        free_netdev(ndev);
        return -EBADE;
 }
@@ -788,6 +794,7 @@ void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx)
        struct brcmf_if *ifp;
        ifp = drvr->iflist[bssidx];
+        drvr->iflist[bssidx] = NULL;
        if (!ifp) {
                brcmf_err("Null interface, idx=%d\n", bssidx);
                return;
@@ -808,15 +815,13 @@ void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx)
                        cancel_work_sync(&ifp->setmacaddr_work);
                        cancel_work_sync(&ifp->multicast_work);
                }
+                /* unregister will take care of freeing it */
                unregister_netdev(ifp->ndev);
                if (bssidx == 0)
                        brcmf_cfg80211_detach(drvr->config);
-                free_netdev(ifp->ndev);
        } else {
                kfree(ifp);
        }
-        drvr->iflist[bssidx] = NULL;
 }
 int brcmf_attach(uint bus_hdrlen, struct device *dev)
@@ -925,8 +930,6 @@ fail:
                        brcmf_fws_del_interface(ifp);
                        brcmf_fws_deinit(drvr);
                }
-                free_netdev(ifp->ndev);
-                drvr->iflist[0] = NULL;
                if (p2p_ifp) {
                        free_netdev(p2p_ifp->ndev);
                        drvr->iflist[1] = NULL;
@@ -934,7 +937,8 @@ fail:
                return ret;
        }
        if ((brcmf_p2p_enable) && (p2p_ifp))
-                brcmf_net_p2p_attach(p2p_ifp);
+                if (brcmf_net_p2p_attach(p2p_ifp) < 0)
+                        brcmf_p2p_enable = 0;
        return 0;
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
index 5a64280e6485..83ee53a7c76e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
@@ -202,7 +202,8 @@ static void brcmf_fweh_handle_if_event(struct brcmf_pub *drvr,
                        return;
                brcmf_fws_add_interface(ifp);
                if (!drvr->fweh.evt_handler[BRCMF_E_IF])
-                        err = brcmf_net_attach(ifp, false);
+                        if (brcmf_net_attach(ifp, false) < 0)
+                                return;
        }
        if (ifevent->action == BRCMF_E_IF_CHANGE)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
index 0f2c83bc95dc..665ef69e974b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -23,6 +23,12 @@
 #define BRCMF_FIL_ACTION_FRAME_SIZE     1800
+/* ARP Offload feature flags for arp_ol iovar */
+#define BRCMF_ARP_OL_AGENT              0x00000001
+#define BRCMF_ARP_OL_SNOOP              0x00000002
+#define BRCMF_ARP_OL_HOST_AUTO_REPLY    0x00000004
+#define BRCMF_ARP_OL_PEER_AUTO_REPLY    0x00000008
 enum brcmf_fil_p2p_if_types {
        BRCMF_FIL_P2P_IF_CLIENT,
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
index e7a1a4770996..79555f006d53 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
@@ -47,6 +47,7 @@
 #define IS_P2P_SOCIAL_CHANNEL(channel) ((channel == SOCIAL_CHAN_1) || \
                                         (channel == SOCIAL_CHAN_2) || \
                                         (channel == SOCIAL_CHAN_3))
+#define BRCMF_P2P_TEMP_CHAN     SOCIAL_CHAN_3
 #define SOCIAL_CHAN_CNT         3
 #define AF_PEER_SEARCH_CNT      2
@@ -1954,21 +1955,21 @@ s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg)
                err = brcmf_fil_iovar_int_set(pri_ifp, "p2p_disc", 1);
                if (err < 0) {
                        brcmf_err("set p2p_disc error\n");
-                        brcmf_free_vif(p2p_vif);
+                        brcmf_free_vif(cfg, p2p_vif);
                        goto exit;
                }
                /* obtain bsscfg index for P2P discovery */
                err = brcmf_fil_iovar_int_get(pri_ifp, "p2p_dev", &bssidx);
                if (err < 0) {
                        brcmf_err("retrieving discover bsscfg index failed\n");
-                        brcmf_free_vif(p2p_vif);
+                        brcmf_free_vif(cfg, p2p_vif);
                        goto exit;
                }
                /* Verify that firmware uses same bssidx as driver !! */
                if (p2p_ifp->bssidx != bssidx) {
                        brcmf_err("Incorrect bssidx=%d, compared to p2p_ifp->bssidx=%d\n",
                                  bssidx, p2p_ifp->bssidx);
-                        brcmf_free_vif(p2p_vif);
+                        brcmf_free_vif(cfg, p2p_vif);
                        goto exit;
                }
@@ -1996,7 +1997,7 @@ void brcmf_p2p_detach(struct brcmf_p2p_info *p2p)
                brcmf_p2p_cancel_remain_on_channel(vif->ifp);
                brcmf_p2p_deinit_discovery(p2p);
                /* remove discovery interface */
-                brcmf_free_vif(vif);
+                brcmf_free_vif(p2p->cfg, vif);
                p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
        }
        /* just set it all to zero */
@@ -2013,17 +2014,30 @@ static void brcmf_p2p_get_current_chanspec(struct brcmf_p2p_info *p2p,
                                           u16 *chanspec)
 {
        struct brcmf_if *ifp;
-        struct brcmf_fil_chan_info_le ci;
+        u8 mac_addr[ETH_ALEN];
        struct brcmu_chan ch;
-        s32 err;
+        struct brcmf_bss_info_le *bi;
+        u8 *buf;
        ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
-        ch.chnum = 11;
+        if (brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSSID, mac_addr,
+                                   ETH_ALEN) == 0) {
-        err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_CHANNEL, &ci, sizeof(ci));
+                buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
-        if (!err)
+                if (buf != NULL) {
-                ch.chnum = le32_to_cpu(ci.hw_channel);
+                        *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
+                        if (brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
+                                                   buf, WL_BSS_INFO_MAX) == 0) {
+                                bi = (struct brcmf_bss_info_le *)(buf + 4);
+                                *chanspec = le16_to_cpu(bi->chanspec);
+                                kfree(buf);
+                                return;
+                        }
+                        kfree(buf);
+                }
+        }
+        /* Use default channel for P2P */
+        ch.chnum = BRCMF_P2P_TEMP_CHAN;
        ch.bw = BRCMU_CHAN_BW_20;
        p2p->cfg->d11inf.encchspec(&ch);
        *chanspec = ch.chspec;
@@ -2208,7 +2222,7 @@ static struct wireless_dev *brcmf_p2p_create_p2pdev(struct brcmf_p2p_info *p2p,
        return &p2p_vif->wdev;
 fail:
-        brcmf_free_vif(p2p_vif);
+        brcmf_free_vif(p2p->cfg, p2p_vif);
        return ERR_PTR(err);
 }
@@ -2217,13 +2231,31 @@ fail:
 *
 * @vif: virtual interface object to delete.
 */
-static void brcmf_p2p_delete_p2pdev(struct brcmf_cfg80211_vif *vif)
+static void brcmf_p2p_delete_p2pdev(struct brcmf_cfg80211_info *cfg,
+                                    struct brcmf_cfg80211_vif *vif)
 {
-        struct brcmf_p2p_info *p2p = &vif->ifp->drvr->config->p2p;
        cfg80211_unregister_wdev(&vif->wdev);
-        p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
+        cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
-        brcmf_free_vif(vif);
+        brcmf_free_vif(cfg, vif);
+}
+/**
+ * brcmf_p2p_free_p2p_if() - free up net device related data.
+ *
+ * @ndev: net device that needs to be freed.
+ */
+static void brcmf_p2p_free_p2p_if(struct net_device *ndev)
+{
+        struct brcmf_cfg80211_info *cfg;
+        struct brcmf_cfg80211_vif *vif;
+        struct brcmf_if *ifp;
+        ifp = netdev_priv(ndev);
+        cfg = ifp->drvr->config;
+        vif = ifp->vif;
+        brcmf_free_vif(cfg, vif);
+        free_netdev(ifp->ndev);
 }
 /**
@@ -2303,6 +2335,9 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
                brcmf_err("Registering netdevice failed\n");
                goto fail;
        }
+        /* override destructor */
+        ifp->ndev->destructor = brcmf_p2p_free_p2p_if;
        cfg->p2p.bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = vif;
        /* Disable firmware roaming for P2P interface  */
        brcmf_fil_iovar_int_set(ifp, "roam_off", 1);
@@ -2314,7 +2349,7 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
        return &ifp->vif->wdev;
 fail:
-        brcmf_free_vif(vif);
+        brcmf_free_vif(cfg, vif);
        return ERR_PTR(err);
 }
@@ -2350,7 +2385,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
                break;
        case NL80211_IFTYPE_P2P_DEVICE:
-                brcmf_p2p_delete_p2pdev(vif);
+                brcmf_p2p_delete_p2pdev(cfg, vif);
                return 0;
        default:
                return -ENOTSUPP;
@@ -2378,7 +2413,6 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
                        err = 0;
        }
        brcmf_cfg80211_arm_vif_event(cfg, NULL);
-        brcmf_free_vif(vif);
        p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = NULL;
        return err;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 761f501959a9..301e572e8923 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -459,6 +459,38 @@ send_key_to_dongle(struct net_device *ndev, struct brcmf_wsec_key *key)
        return err;
 }
+static s32
+brcmf_configure_arp_offload(struct brcmf_if *ifp, bool enable)
+{
+        s32 err;
+        u32 mode;
+        if (enable)
+                mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
+        else
+                mode = 0;
+        /* Try to set and enable ARP offload feature, this may fail, then it  */
+        /* is simply not supported and err 0 will be returned                 */
+        err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
+        if (err) {
+                brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
+                          mode, err);
+                err = 0;
+        } else {
+                err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
+                if (err) {
+                        brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
+                                  enable, err);
+                        err = 0;
+                } else
+                        brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
+                                  enable, mode);
+        }
+        return err;
+}
 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
                                                     const char *name,
                                                     enum nl80211_iftype type,
@@ -2216,6 +2248,11 @@ brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
        }
        pm = enabled ? PM_FAST : PM_OFF;
+        /* Do not enable the power save after assoc if it is a p2p interface */
+        if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
+                brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
+                pm = PM_OFF;
+        }
        brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
@@ -3640,10 +3677,28 @@ brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
 }
 static s32
+brcmf_cfg80211_set_channel(struct brcmf_cfg80211_info *cfg,
+                           struct brcmf_if *ifp,
+                           struct ieee80211_channel *channel)
+{
+        u16 chanspec;
+        s32 err;
+        brcmf_dbg(TRACE, "band=%d, center_freq=%d\n", channel->band,
+                  channel->center_freq);
+        chanspec = channel_to_chanspec(&cfg->d11inf, channel);
+        err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
+        return err;
+}
+static s32
 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                        struct cfg80211_ap_settings *settings)
 {
        s32 ie_offset;
+        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
        struct brcmf_if *ifp = netdev_priv(ndev);
        struct brcmf_tlv *ssid_ie;
        struct brcmf_ssid_le ssid_le;
@@ -3683,6 +3738,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
        }
        brcmf_set_mpc(ifp, 0);
+        brcmf_configure_arp_offload(ifp, false);
        /* find the RSN_IE */
        rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
@@ -3713,6 +3769,12 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
        brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
+        err = brcmf_cfg80211_set_channel(cfg, ifp, settings->chandef.chan);
+        if (err < 0) {
+                brcmf_err("Set Channel failed, %d\n", err);
+                goto exit;
+        }
        if (settings->beacon_interval) {
                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
                                            settings->beacon_interval);
@@ -3789,8 +3851,10 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
        set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
 exit:
-        if (err)
+        if (err) {
                brcmf_set_mpc(ifp, 1);
+                brcmf_configure_arp_offload(ifp, true);
+        }
        return err;
 }
@@ -3831,6 +3895,7 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
                        brcmf_err("bss_enable config failed %d\n", err);
        }
        brcmf_set_mpc(ifp, 1);
+        brcmf_configure_arp_offload(ifp, true);
        set_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
        clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
@@ -4148,7 +4213,7 @@ static const struct ieee80211_iface_limit brcmf_iface_limits[] = {
 static const struct ieee80211_iface_combination brcmf_iface_combos[] = {
        {
                 .max_interfaces = BRCMF_IFACE_MAX_CNT,
-                 .num_different_channels = 1, /* no multi-channel for now */
+                 .num_different_channels = 2,
                 .n_limits = ARRAY_SIZE(brcmf_iface_limits),
                 .limits = brcmf_iface_limits
        }
@@ -4256,20 +4321,16 @@ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
        return vif;
 }
-void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
+void brcmf_free_vif(struct brcmf_cfg80211_info *cfg,
+                    struct brcmf_cfg80211_vif *vif)
 {
-        struct brcmf_cfg80211_info *cfg;
-        struct wiphy *wiphy;
-        wiphy = vif->wdev.wiphy;
-        cfg = wiphy_priv(wiphy);
        list_del(&vif->list);
        cfg->vif_cnt--;
        kfree(vif);
        if (!cfg->vif_cnt) {
-                wiphy_unregister(wiphy);
+                wiphy_unregister(cfg->wiphy);
-                wiphy_free(wiphy);
+                wiphy_free(cfg->wiphy);
        }
 }
@@ -4646,7 +4707,6 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
                return 0;
        case BRCMF_E_IF_DEL:
-                ifp->vif = NULL;
                mutex_unlock(&event->vif_event_lock);
                /* event may not be upon user request */
                if (brcmf_cfg80211_vif_event_armed(cfg))
@@ -4852,8 +4912,7 @@ cfg80211_p2p_attach_out:
        wl_deinit_priv(cfg);
 cfg80211_attach_out:
-        brcmf_free_vif(vif);
+        brcmf_free_vif(cfg, vif);
-        wiphy_free(wiphy);
        return NULL;
 }
@@ -4865,7 +4924,7 @@ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
        wl_deinit_priv(cfg);
        brcmf_btcoex_detach(cfg);
        list_for_each_entry_safe(vif, tmp, &cfg->vif_list, list) {
-                brcmf_free_vif(vif);
+                brcmf_free_vif(cfg, vif);
        }
 }
@@ -5229,6 +5288,8 @@ static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
        if (err)
                goto default_conf_out;
+        brcmf_configure_arp_offload(ifp, true);
        cfg->dongle_up = true;
 default_conf_out:
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
index a71cff84cdcf..d9bdaf9a72d0 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
@@ -487,7 +487,8 @@ enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
                                           enum nl80211_iftype type,
                                           bool pm_block);
-void brcmf_free_vif(struct brcmf_cfg80211_vif *vif);
+void brcmf_free_vif(struct brcmf_cfg80211_info *cfg,
+                    struct brcmf_cfg80211_vif *vif);
 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
                          const u8 *vndr_ie_buf, u32 vndr_ie_len);
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index db183b44e038..c3c13ce96eb0 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -735,7 +735,7 @@ void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
                                        memcpy(&lq, priv->stations[i].lq,
                                               sizeof(struct iwl_link_quality_cmd));
-                                if (!memcmp(&lq, &zero_lq, sizeof(lq)))
+                                if (memcmp(&lq, &zero_lq, sizeof(lq)))
                                        send_lq = true;
                        }
                        spin_unlock_bh(&priv->sta_lock);
diff --git a/drivers/nfc/Kconfig b/drivers/nfc/Kconfig
index 4775d4e61b88..74a852e4e41f 100644
--- a/drivers/nfc/Kconfig
+++ b/drivers/nfc/Kconfig
@@ -28,7 +28,7 @@ config NFC_WILINK
 config NFC_MEI_PHY
        tristate "MEI bus NFC device support"
-        depends on INTEL_MEI_BUS_NFC && NFC_HCI
+        depends on INTEL_MEI && NFC_HCI
        help
          This adds support to use an mei bus nfc device. Select this if you
          will use an HCI NFC driver for an NFC chip connected behind an
diff --git a/drivers/nfc/mei_phy.c b/drivers/nfc/mei_phy.c
index b8f8abc422f0..1201bdbfb791 100644
--- a/drivers/nfc/mei_phy.c
+++ b/drivers/nfc/mei_phy.c
@@ -64,6 +64,15 @@ int nfc_mei_phy_enable(void *phy_id)
                return r;
        }
+        r = mei_cl_register_event_cb(phy->device, nfc_mei_event_cb, phy);
+        if (r) {
+                pr_err("MEY_PHY: Event cb registration failed\n");
+                mei_cl_disable_device(phy->device);
+                phy->powered = 0;
+                return r;
+        }
        phy->powered = 1;
        return 0;
diff --git a/drivers/nfc/microread/mei.c b/drivers/nfc/microread/mei.c
index 1ad044dce7b6..cdf1bc53b257 100644
--- a/drivers/nfc/microread/mei.c
+++ b/drivers/nfc/microread/mei.c
@@ -43,24 +43,16 @@ static int microread_mei_probe(struct mei_cl_device *device,
                return -ENOMEM;
        }
-        r = mei_cl_register_event_cb(device, nfc_mei_event_cb, phy);
-        if (r) {
-                pr_err(MICROREAD_DRIVER_NAME ": event cb registration failed\n");
-                goto err_out;
-        }
        r = microread_probe(phy, &mei_phy_ops, LLC_NOP_NAME,
                            MEI_NFC_HEADER_SIZE, 0, MEI_NFC_MAX_HCI_PAYLOAD,
                            &phy->hdev);
-        if (r < 0)
+        if (r < 0) {
-                goto err_out;
+                nfc_mei_phy_free(phy);
-        return 0;
-err_out:
+                return r;
-        nfc_mei_phy_free(phy);
+        }
-        return r;
+        return 0;
 }
 static int microread_mei_remove(struct mei_cl_device *device)
@@ -71,8 +63,6 @@ static int microread_mei_remove(struct mei_cl_device *device)
        microread_remove(phy->hdev);
-        nfc_mei_phy_disable(phy);
        nfc_mei_phy_free(phy);
        return 0;
diff --git a/drivers/nfc/pn544/mei.c b/drivers/nfc/pn544/mei.c
index 1eb48848a35a..b5d3d18179eb 100644
--- a/drivers/nfc/pn544/mei.c
+++ b/drivers/nfc/pn544/mei.c
@@ -43,24 +43,16 @@ static int pn544_mei_probe(struct mei_cl_device *device,
                return -ENOMEM;
        }
-        r = mei_cl_register_event_cb(device, nfc_mei_event_cb, phy);
-        if (r) {
-                pr_err(PN544_DRIVER_NAME ": event cb registration failed\n");
-                goto err_out;
-        }
        r = pn544_hci_probe(phy, &mei_phy_ops, LLC_NOP_NAME,
                            MEI_NFC_HEADER_SIZE, 0, MEI_NFC_MAX_HCI_PAYLOAD,
                            &phy->hdev);
-        if (r < 0)
+        if (r < 0) {
-                goto err_out;
+                nfc_mei_phy_free(phy);
-        return 0;
-err_out:
+                return r;
-        nfc_mei_phy_free(phy);
+        }
-        return r;
+        return 0;
 }
 static int pn544_mei_remove(struct mei_cl_device *device)
@@ -71,8 +63,6 @@ static int pn544_mei_remove(struct mei_cl_device *device)
        pn544_hci_remove(phy->hdev);
-        nfc_mei_phy_disable(phy);
        nfc_mei_phy_free(phy);
        return 0;
diff --git a/drivers/ptp/ptp_pch.c b/drivers/ptp/ptp_pch.c
index bea94510ad2d..71a2559278d7 100644
--- a/drivers/ptp/ptp_pch.c
+++ b/drivers/ptp/ptp_pch.c
@@ -628,9 +628,10 @@ pch_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        chip->caps = ptp_pch_caps;
        chip->ptp_clock = ptp_clock_register(&chip->caps, &pdev->dev);
+        if (IS_ERR(chip->ptp_clock)) {
-        if (IS_ERR(chip->ptp_clock))
+                ret = PTR_ERR(chip->ptp_clock);
-                return PTR_ERR(chip->ptp_clock);
+                goto err_ptp_clock_reg;
+        }
        spin_lock_init(&chip->register_lock);
@@ -669,6 +670,7 @@ pch_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 err_req_irq:
        ptp_clock_unregister(chip->ptp_clock);
+err_ptp_clock_reg:
        iounmap(chip->regs);
        chip->regs = NULL;
diff --git a/include/linux/list.h b/include/linux/list.h
index 6a1f8df9144b..b83e5657365a 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -362,6 +362,17 @@ static inline void list_splice_tail_init(struct list_head *list,
        list_entry((ptr)->next, type, member)
 /**
+ * list_first_entry_or_null - get the first element from a list
+ * @ptr:        the list head to take the element from.
+ * @type:       the type of the struct this is embedded in.
+ * @member:     the name of the list_struct within the struct.
+ *
+ * Note that if the list is empty, it returns NULL.
+ */
+#define list_first_entry_or_null(ptr, type, member) \
+        (!list_empty(ptr) ? list_first_entry(ptr, type, member) : NULL)
+/**
 * list_for_each        -       iterate over a list
 * @pos:        the &struct list_head to use as a loop cursor.
 * @head:       the head for your list.
diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
index 98ffb54988b6..2d4df6ce043e 100644
--- a/include/linux/netfilter_ipv6.h
+++ b/include/linux/netfilter_ipv6.h
@@ -17,6 +17,22 @@ extern __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
 extern int ipv6_netfilter_init(void);
 extern void ipv6_netfilter_fini(void);
+/*
+ * Hook functions for ipv6 to allow xt_* modules to be built-in even
+ * if IPv6 is a module.
+ */
+struct nf_ipv6_ops {
+        int (*chk_addr)(struct net *net, const struct in6_addr *addr,
+                        const struct net_device *dev, int strict);
+};
+extern const struct nf_ipv6_ops __rcu *nf_ipv6_ops;
+static inline const struct nf_ipv6_ops *nf_get_ipv6_ops(void)
+{
+        return rcu_dereference(nf_ipv6_ops);
+}
 #else /* CONFIG_NETFILTER */
 static inline int ipv6_netfilter_init(void) { return 0; }
 static inline void ipv6_netfilter_fini(void) { return; }
diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
index 2ae13714828b..1c33dd7da4a7 100644
--- a/include/linux/rculist_nulls.h
+++ b/include/linux/rculist_nulls.h
@@ -105,9 +105,14 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n,
 * @head:       the head for your list.
 * @member:     the name of the hlist_nulls_node within the struct.
 *
+ * The barrier() is needed to make sure compiler doesn't cache first element [1],
+ * as this loop can be restarted [2]
+ * [1] Documentation/atomic_ops.txt around line 114
+ * [2] Documentation/RCU/rculist_nulls.txt around line 146
 */
 #define hlist_nulls_for_each_entry_rcu(tpos, pos, head, member)                 \
-        for (pos = rcu_dereference_raw(hlist_nulls_first_rcu(head));            \
+        for (({barrier();}),                                                    \
+             pos = rcu_dereference_raw(hlist_nulls_first_rcu(head));            \
                (!is_a_nulls(pos)) &&                                           \
                ({ tpos = hlist_nulls_entry(pos, typeof(*tpos), member); 1; }); \
                pos = rcu_dereference_raw(hlist_nulls_next_rcu(pos)))
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 2e0ced1af3b1..9c676eae3968 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2852,6 +2852,21 @@ static inline int skb_tnl_header_len(const struct sk_buff *inner_skb)
                SKB_GSO_CB(inner_skb)->mac_offset;
 }
+static inline int gso_pskb_expand_head(struct sk_buff *skb, int extra)
+{
+        int new_headroom, headroom;
+        int ret;
+        headroom = skb_headroom(skb);
+        ret = pskb_expand_head(skb, extra, 0, GFP_ATOMIC);
+        if (ret)
+                return ret;
+        new_headroom = skb_headroom(skb);
+        SKB_GSO_CB(skb)->mac_offset += (new_headroom - headroom);
+        return 0;
+}
 static inline bool skb_is_gso(const struct sk_buff *skb)
 {
        return skb_shinfo(skb)->gso_size;
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 84a6440f1f19..21f702704f24 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -65,7 +65,7 @@ extern int			addrconf_set_dstaddr(struct net *net,
 extern int                      ipv6_chk_addr(struct net *net,
                                              const struct in6_addr *addr,
-                                              struct net_device *dev,
+                                              const struct net_device *dev,
                                              int strict);
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index f10818fc8804..e7f4e21cc3e1 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -679,22 +679,26 @@ static inline struct sk_buff *skb_act_clone(struct sk_buff *skb, gfp_t gfp_mask,
 #endif
 struct psched_ratecfg {
-        u64 rate_bps;
+        u64     rate_bps;
-        u32 mult;
+        u32     mult;
-        u32 shift;
+        u16     overhead;
+        u8      shift;
 };
 static inline u64 psched_l2t_ns(const struct psched_ratecfg *r,
                                unsigned int len)
 {
-        return ((u64)len * r->mult) >> r->shift;
+        return ((u64)(len + r->overhead) * r->mult) >> r->shift;
 }
-extern void psched_ratecfg_precompute(struct psched_ratecfg *r, u32 rate);
+extern void psched_ratecfg_precompute(struct psched_ratecfg *r, const struct tc_ratespec *conf);
-static inline u32 psched_ratecfg_getrate(const struct psched_ratecfg *r)
+static inline void psched_ratecfg_getrate(struct tc_ratespec *res,
+                                          const struct psched_ratecfg *r)
 {
-        return r->rate_bps >> 3;
+        memset(res, 0, sizeof(*res));
+        res->rate = r->rate_bps >> 3;
+        res->overhead = r->overhead;
 }
 #endif
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index ae16531d0d35..94ce082b29dc 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1160,6 +1160,8 @@ static inline void xfrm_sk_free_policy(struct sock *sk)
        }
 }
+extern void xfrm_garbage_collect(struct net *net);
 #else
 static inline void xfrm_sk_free_policy(struct sock *sk) {}
@@ -1194,6 +1196,9 @@ static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
 {
        return 1;
 }
+static inline void xfrm_garbage_collect(struct net *net)
+{
+}
 #endif
 static __inline__
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index c013f38482a1..6cda4e2c2132 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -39,6 +39,7 @@ static int __hw_addr_create_ex(struct netdev_hw_addr_list *list,
        ha->refcount = 1;
        ha->global_use = global;
        ha->synced = sync;
+        ha->sync_cnt = 0;
        list_add_tail_rcu(&ha->list, &list->list);
        list->count++;
@@ -66,7 +67,7 @@ static int __hw_addr_add_ex(struct netdev_hw_addr_list *list,
                        }
                        if (sync) {
                                if (ha->synced)
-                                        return 0;
+                                        return -EEXIST;
                                else
                                        ha->synced = true;
                        }
@@ -139,10 +140,13 @@ static int __hw_addr_sync_one(struct netdev_hw_addr_list *to_list,
        err = __hw_addr_add_ex(to_list, ha->addr, addr_len, ha->type,
                               false, true);
-        if (err)
+        if (err && err != -EEXIST)
                return err;
-        ha->sync_cnt++;
-        ha->refcount++;
+        if (!err) {
+                ha->sync_cnt++;
+                ha->refcount++;
+        }
        return 0;
 }
@@ -159,7 +163,8 @@ static void __hw_addr_unsync_one(struct netdev_hw_addr_list *to_list,
        if (err)
                return;
        ha->sync_cnt--;
-        __hw_addr_del_entry(from_list, ha, false, true);
+        /* address on from list is not marked synced */
+        __hw_addr_del_entry(from_list, ha, false, false);
 }
 static int __hw_addr_sync_multiple(struct netdev_hw_addr_list *to_list,
@@ -796,7 +801,7 @@ int dev_mc_sync_multiple(struct net_device *to, struct net_device *from)
                return -EINVAL;
        netif_addr_lock_nested(to);
-        err = __hw_addr_sync(&to->mc, &from->mc, to->addr_len);
+        err = __hw_addr_sync_multiple(&to->mc, &from->mc, to->addr_len);
        if (!err)
                __dev_set_rx_mode(to);
        netif_addr_unlock(to);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index af9185d0be6a..cfd777bd6bd0 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -195,7 +195,7 @@ struct sk_buff *__alloc_skb_head(gfp_t gfp_mask, int node)
         * the tail pointer in struct sk_buff!
         */
        memset(skb, 0, offsetof(struct sk_buff, tail));
-        skb->data = NULL;
+        skb->head = NULL;
        skb->truesize = sizeof(struct sk_buff);
        atomic_set(&skb->users, 1);
@@ -611,7 +611,7 @@ static void skb_release_head_state(struct sk_buff *skb)
 static void skb_release_all(struct sk_buff *skb)
 {
        skb_release_head_state(skb);
-        if (likely(skb->data))
+        if (likely(skb->head))
                skb_release_data(skb);
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 6ba327da79e1..88868a9d21da 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -210,7 +210,7 @@ static const char *const af_family_key_strings[AF_MAX+1] = {
  "sk_lock-AF_TIPC"  , "sk_lock-AF_BLUETOOTH", "sk_lock-IUCV"        ,
  "sk_lock-AF_RXRPC" , "sk_lock-AF_ISDN"     , "sk_lock-AF_PHONET"   ,
  "sk_lock-AF_IEEE802154", "sk_lock-AF_CAIF" , "sk_lock-AF_ALG"      ,
-  "sk_lock-AF_NFC"   , "sk_lock-AF_MAX"
+  "sk_lock-AF_NFC"   , "sk_lock-AF_VSOCK"    , "sk_lock-AF_MAX"
 };
 static const char *const af_family_slock_key_strings[AF_MAX+1] = {
  "slock-AF_UNSPEC", "slock-AF_UNIX"     , "slock-AF_INET"     ,
@@ -226,7 +226,7 @@ static const char *const af_family_slock_key_strings[AF_MAX+1] = {
  "slock-AF_TIPC"  , "slock-AF_BLUETOOTH", "slock-AF_IUCV"     ,
  "slock-AF_RXRPC" , "slock-AF_ISDN"     , "slock-AF_PHONET"   ,
  "slock-AF_IEEE802154", "slock-AF_CAIF" , "slock-AF_ALG"      ,
-  "slock-AF_NFC"   , "slock-AF_MAX"
+  "slock-AF_NFC"   , "slock-AF_VSOCK"    ,"slock-AF_MAX"
 };
 static const char *const af_family_clock_key_strings[AF_MAX+1] = {
  "clock-AF_UNSPEC", "clock-AF_UNIX"     , "clock-AF_INET"     ,
@@ -242,7 +242,7 @@ static const char *const af_family_clock_key_strings[AF_MAX+1] = {
  "clock-AF_TIPC"  , "clock-AF_BLUETOOTH", "clock-AF_IUCV"     ,
  "clock-AF_RXRPC" , "clock-AF_ISDN"     , "clock-AF_PHONET"   ,
  "clock-AF_IEEE802154", "clock-AF_CAIF" , "clock-AF_ALG"      ,
-  "clock-AF_NFC"   , "clock-AF_MAX"
+  "clock-AF_NFC"   , "clock-AF_VSOCK"    , "clock-AF_MAX"
 };
 /*
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index e4147ec1665a..be2f8da0ae8e 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -503,6 +503,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
        inner_iph = (const struct iphdr *)skb_inner_network_header(skb);
+        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
        dst = tnl_params->daddr;
        if (dst == 0) {
                /* NBMA tunnel */
@@ -658,7 +659,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
        skb_dst_drop(skb);
        skb_dst_set(skb, &rt->dst);
-        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
        /* Push down and install the IP header. */
        skb_push(skb, sizeof(struct iphdr));
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index cf08218ddbcf..ff4b781b1056 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -231,8 +231,10 @@ static void ipt_ulog_packet(struct net *net,
        put_unaligned(tv.tv_usec, &pm->timestamp_usec);
        put_unaligned(skb->mark, &pm->mark);
        pm->hook = hooknum;
-        if (prefix != NULL)
+        if (prefix != NULL) {
-                strncpy(pm->prefix, prefix, sizeof(pm->prefix));
+                strncpy(pm->prefix, prefix, sizeof(pm->prefix) - 1);
+                pm->prefix[sizeof(pm->prefix) - 1] = '\0';
+        }
        else if (loginfo->prefix[0] != '\0')
                strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
        else
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 550781a17b34..d35bbf0cf404 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -737,10 +737,15 @@ static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buf
 {
        struct rtable *rt;
        struct flowi4 fl4;
+        const struct iphdr *iph = (const struct iphdr *) skb->data;
+        int oif = skb->dev->ifindex;
+        u8 tos = RT_TOS(iph->tos);
+        u8 prot = iph->protocol;
+        u32 mark = skb->mark;
        rt = (struct rtable *) dst;
-        ip_rt_build_flow_key(&fl4, sk, skb);
+        __build_flow_key(&fl4, sk, iph, oif, tos, prot, mark, 0);
        __ip_do_redirect(rt, skb, &fl4, true);
 }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index d1ab6ab29a55..1bbf744c2cc3 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1487,7 +1487,7 @@ static int ipv6_count_addresses(struct inet6_dev *idev)
 }
 int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
-                  struct net_device *dev, int strict)
+                  const struct net_device *dev, int strict)
 {
        struct inet6_ifaddr *ifp;
        unsigned int hash = inet6_addr_hash(addr);
@@ -2658,8 +2658,10 @@ static void init_loopback(struct net_device *dev)
                        sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
                        /* Failure cases are ignored */
-                        if (!IS_ERR(sp_rt))
+                        if (!IS_ERR(sp_rt)) {
+                                sp_ifa->rt = sp_rt;
                                ip6_ins_rt(sp_rt);
+                        }
                }
                read_unlock_bh(&idev->lock);
        }
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 72836f40b730..95f3f1da0d7f 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -10,6 +10,7 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/export.h>
+#include <net/addrconf.h>
 #include <net/dst.h>
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
@@ -186,6 +187,10 @@ static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook,
        return csum;
 };
+static const struct nf_ipv6_ops ipv6ops = {
+        .chk_addr       = ipv6_chk_addr,
+};
 static const struct nf_afinfo nf_ip6_afinfo = {
        .family                 = AF_INET6,
        .checksum               = nf_ip6_checksum,
@@ -198,6 +203,7 @@ static const struct nf_afinfo nf_ip6_afinfo = {
 int __init ipv6_netfilter_init(void)
 {
+        RCU_INIT_POINTER(nf_ipv6_ops, &ipv6ops);
        return nf_register_afinfo(&nf_ip6_afinfo);
 }
@@ -206,5 +212,6 @@ int __init ipv6_netfilter_init(void)
 */
 void ipv6_netfilter_fini(void)
 {
+        RCU_INIT_POINTER(nf_ipv6_ops, NULL);
        nf_unregister_afinfo(&nf_ip6_afinfo);
 }
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index f3c1ff4357ff..51c3285b5d9b 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -90,7 +90,7 @@ static const struct snmp_mib snmp6_ipstats_list[] = {
        SNMP_MIB_ITEM("Ip6OutMcastOctets", IPSTATS_MIB_OUTMCASTOCTETS),
        SNMP_MIB_ITEM("Ip6InBcastOctets", IPSTATS_MIB_INBCASTOCTETS),
        SNMP_MIB_ITEM("Ip6OutBcastOctets", IPSTATS_MIB_OUTBCASTOCTETS),
-        SNMP_MIB_ITEM("InCsumErrors", IPSTATS_MIB_CSUMERRORS),
+        /* IPSTATS_MIB_CSUMERRORS is not relevant in IPv6 (no checksum) */
        SNMP_MIB_SENTINEL
 };
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index 3bb3a891a424..d3cfaf9c7a08 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -46,11 +46,12 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
        unsigned int mss;
        unsigned int unfrag_ip6hlen, unfrag_len;
        struct frag_hdr *fptr;
-        u8 *mac_start, *prevhdr;
+        u8 *packet_start, *prevhdr;
        u8 nexthdr;
        u8 frag_hdr_sz = sizeof(struct frag_hdr);
        int offset;
        __wsum csum;
+        int tnl_hlen;
        mss = skb_shinfo(skb)->gso_size;
        if (unlikely(skb->len <= mss))
@@ -83,9 +84,11 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
        skb->ip_summed = CHECKSUM_NONE;
        /* Check if there is enough headroom to insert fragment header. */
-        if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
+        tnl_hlen = skb_tnl_header_len(skb);
-            pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
+        if (skb_headroom(skb) < (tnl_hlen + frag_hdr_sz)) {
-                goto out;
+                if (gso_pskb_expand_head(skb, tnl_hlen + frag_hdr_sz))
+                        goto out;
+        }
        /* Find the unfragmentable header and shift it left by frag_hdr_sz
         * bytes to insert fragment header.
@@ -93,11 +96,12 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
        nexthdr = *prevhdr;
        *prevhdr = NEXTHDR_FRAGMENT;
-        unfrag_len = skb_network_header(skb) - skb_mac_header(skb) +
+        unfrag_len = (skb_network_header(skb) - skb_mac_header(skb)) +
-                     unfrag_ip6hlen;
+                     unfrag_ip6hlen + tnl_hlen;
-        mac_start = skb_mac_header(skb);
+        packet_start = (u8 *) skb->head + SKB_GSO_CB(skb)->mac_offset;
-        memmove(mac_start-frag_hdr_sz, mac_start, unfrag_len);
+        memmove(packet_start-frag_hdr_sz, packet_start, unfrag_len);
+        SKB_GSO_CB(skb)->mac_offset -= frag_hdr_sz;
        skb->mac_header -= frag_hdr_sz;
        skb->network_header -= frag_hdr_sz;
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 5b1e5af25713..c5fbd7589681 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2366,6 +2366,8 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa
 out:
        xfrm_pol_put(xp);
+        if (err == 0)
+                xfrm_garbage_collect(net);
        return err;
 }
@@ -2615,6 +2617,8 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, const struct sadb_
 out:
        xfrm_pol_put(xp);
+        if (delete && err == 0)
+                xfrm_garbage_collect(net);
        return err;
 }
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 60f1ce5e5e52..98d20c0f6fed 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -159,9 +159,10 @@ static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
        return 0;
 }
-static int ieee80211_verify_mac(struct ieee80211_local *local, u8 *addr)
+static int ieee80211_verify_mac(struct ieee80211_sub_if_data *sdata, u8 *addr)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_sub_if_data *iter;
        u64 new, mask, tmp;
        u8 *m;
        int ret = 0;
@@ -181,11 +182,14 @@ static int ieee80211_verify_mac(struct ieee80211_local *local, u8 *addr)
        mutex_lock(&local->iflist_mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
+        list_for_each_entry(iter, &local->interfaces, list) {
-                if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
+                if (iter == sdata)
+                        continue;
+                if (iter->vif.type == NL80211_IFTYPE_MONITOR)
                        continue;
-                m = sdata->vif.addr;
+                m = iter->vif.addr;
                tmp =   ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
                        ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
                        ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
@@ -209,7 +213,7 @@ static int ieee80211_change_mac(struct net_device *dev, void *addr)
        if (ieee80211_sdata_running(sdata))
                return -EBUSY;
-        ret = ieee80211_verify_mac(sdata->local, sa->sa_data);
+        ret = ieee80211_verify_mac(sdata, sa->sa_data);
        if (ret)
                return ret;
@@ -474,6 +478,9 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                        master->control_port_protocol;
                sdata->control_port_no_encrypt =
                        master->control_port_no_encrypt;
+                sdata->vif.cab_queue = master->vif.cab_queue;
+                memcpy(sdata->vif.hw_queue, master->vif.hw_queue,
+                       sizeof(sdata->vif.hw_queue));
                break;
                }
        case NL80211_IFTYPE_AP:
@@ -653,7 +660,11 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
        ieee80211_recalc_ps(local, -1);
-        if (dev) {
+        if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+                /* XXX: for AP_VLAN, actually track AP queues */
+                netif_tx_start_all_queues(dev);
+        } else if (dev) {
                unsigned long flags;
                int n_acs = IEEE80211_NUM_ACS;
                int ac;
@@ -1479,7 +1490,17 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
                        break;
                }
+                /*
+                 * Pick address of existing interface in case user changed
+                 * MAC address manually, default to perm_addr.
+                 */
                m = local->hw.wiphy->perm_addr;
+                list_for_each_entry(sdata, &local->interfaces, list) {
+                        if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
+                                continue;
+                        m = sdata->vif.addr;
+                        break;
+                }
                start = ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
                        ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
                        ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
@@ -1696,6 +1717,15 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
        ASSERT_RTNL();
+        /*
+         * Close all AP_VLAN interfaces first, as otherwise they
+         * might be closed while the AP interface they belong to
+         * is closed, causing unregister_netdevice_many() to crash.
+         */
+        list_for_each_entry(sdata, &local->interfaces, list)
+                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        dev_close(sdata->dev);
        mutex_lock(&local->iflist_mtx);
        list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
                list_del(&sdata->list);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index a46e490f20dd..a8c2130c8ba4 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3321,10 +3321,6 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
        if (WARN_ON_ONCE(!auth_data))
                return -EINVAL;
-        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
-                tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
-                           IEEE80211_TX_INTFL_MLME_CONN_TX;
        auth_data->tries++;
        if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
@@ -3358,6 +3354,10 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
                        auth_data->expected_transaction = trans;
                }
+                if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                        tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+                                   IEEE80211_TX_INTFL_MLME_CONN_TX;
                ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
                                    auth_data->data, auth_data->data_len,
                                    auth_data->bss->bssid,
@@ -3381,12 +3381,12 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
                 * will not answer to direct packet in unassociated state.
                 */
                ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
-                                         NULL, 0, (u32) -1, true, tx_flags,
+                                         NULL, 0, (u32) -1, true, 0,
                                         auth_data->bss->channel, false);
                rcu_read_unlock();
        }
-        if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
+        if (tx_flags == 0) {
                auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
                ifmgd->auth_data->timeout_started = true;
                run_again(ifmgd, auth_data->timeout);
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 07c865a31a3d..857ca9f35177 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -30,6 +30,8 @@ static DEFINE_MUTEX(afinfo_mutex);
 const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;
 EXPORT_SYMBOL(nf_afinfo);
+const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly;
+EXPORT_SYMBOL_GPL(nf_ipv6_ops);
 int nf_register_afinfo(const struct nf_afinfo *afinfo)
 {
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 085b5880ab0d..05565d2b3a61 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1001,6 +1001,32 @@ static inline int is_tcp_reset(const struct sk_buff *skb, int nh_len)
        return th->rst;
 }
+static inline bool is_new_conn(const struct sk_buff *skb,
+                               struct ip_vs_iphdr *iph)
+{
+        switch (iph->protocol) {
+        case IPPROTO_TCP: {
+                struct tcphdr _tcph, *th;
+                th = skb_header_pointer(skb, iph->len, sizeof(_tcph), &_tcph);
+                if (th == NULL)
+                        return false;
+                return th->syn;
+        }
+        case IPPROTO_SCTP: {
+                sctp_chunkhdr_t *sch, schunk;
+                sch = skb_header_pointer(skb, iph->len + sizeof(sctp_sctphdr_t),
+                                         sizeof(schunk), &schunk);
+                if (sch == NULL)
+                        return false;
+                return sch->type == SCTP_CID_INIT;
+        }
+        default:
+                return false;
+        }
+}
 /* Handle response packets: rewrite addresses and send away...
 */
 static unsigned int
@@ -1612,6 +1638,15 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
         * Check if the packet belongs to an existing connection entry
         */
        cp = pp->conn_in_get(af, skb, &iph, 0);
+        if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp && cp->dest &&
+            unlikely(!atomic_read(&cp->dest->weight)) && !iph.fragoffs &&
+            is_new_conn(skb, &iph)) {
+                ip_vs_conn_expire_now(cp);
+                __ip_vs_conn_put(cp);
+                cp = NULL;
+        }
        if (unlikely(!cp) && !iph.fragoffs) {
                /* No (second) fragments need to enter here, as nf_defrag_ipv6
                 * replayed fragment zero will already have created the cp
diff --git a/net/netfilter/ipvs/ip_vs_sh.c b/net/netfilter/ipvs/ip_vs_sh.c
index 0df269d7c99f..a65edfe4b16c 100644
--- a/net/netfilter/ipvs/ip_vs_sh.c
+++ b/net/netfilter/ipvs/ip_vs_sh.c
@@ -67,8 +67,8 @@ struct ip_vs_sh_bucket {
 #define IP_VS_SH_TAB_MASK               (IP_VS_SH_TAB_SIZE - 1)
 struct ip_vs_sh_state {
-        struct ip_vs_sh_bucket          buckets[IP_VS_SH_TAB_SIZE];
        struct rcu_head                 rcu_head;
+        struct ip_vs_sh_bucket          buckets[IP_VS_SH_TAB_SIZE];
 };
 /*
diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
index 491c7d821a0b..5ab24843370a 100644
--- a/net/netfilter/xt_LOG.c
+++ b/net/netfilter/xt_LOG.c
@@ -737,7 +737,7 @@ static void dump_ipv6_packet(struct sbuff *m,
                dump_sk_uid_gid(m, skb->sk);
        /* Max length: 16 "MARK=0xFFFFFFFF " */
-        if (!recurse && skb->mark)
+        if (recurse && skb->mark)
                sb_add(m, "MARK=0x%x ", skb->mark);
 }
diff --git a/net/netfilter/xt_addrtype.c b/net/netfilter/xt_addrtype.c
index 49c5ff7f6dd6..68ff29f60867 100644
--- a/net/netfilter/xt_addrtype.c
+++ b/net/netfilter/xt_addrtype.c
@@ -22,6 +22,7 @@
 #include <net/ip6_fib.h>
 #endif
+#include <linux/netfilter_ipv6.h>
 #include <linux/netfilter/xt_addrtype.h>
 #include <linux/netfilter/x_tables.h>
@@ -33,12 +34,12 @@ MODULE_ALIAS("ip6t_addrtype");
 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
 static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
-                            const struct in6_addr *addr)
+                            const struct in6_addr *addr, u16 mask)
 {
        const struct nf_afinfo *afinfo;
        struct flowi6 flow;
        struct rt6_info *rt;
-        u32 ret;
+        u32 ret = 0;
        int route_err;
        memset(&flow, 0, sizeof(flow));
@@ -49,12 +50,19 @@ static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
        rcu_read_lock();
        afinfo = nf_get_afinfo(NFPROTO_IPV6);
-        if (afinfo != NULL)
+        if (afinfo != NULL) {
+                const struct nf_ipv6_ops *v6ops;
+                if (dev && (mask & XT_ADDRTYPE_LOCAL)) {
+                        v6ops = nf_get_ipv6_ops();
+                        if (v6ops && v6ops->chk_addr(net, addr, dev, true))
+                                ret = XT_ADDRTYPE_LOCAL;
+                }
                route_err = afinfo->route(net, (struct dst_entry **)&rt,
-                                        flowi6_to_flowi(&flow), !!dev);
+                                          flowi6_to_flowi(&flow), false);
-        else
+        } else {
                route_err = 1;
+        }
        rcu_read_unlock();
        if (route_err)
@@ -62,15 +70,12 @@ static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
        if (rt->rt6i_flags & RTF_REJECT)
                ret = XT_ADDRTYPE_UNREACHABLE;
-        else
-                ret = 0;
-        if (rt->rt6i_flags & RTF_LOCAL)
+        if (dev == NULL && rt->rt6i_flags & RTF_LOCAL)
                ret |= XT_ADDRTYPE_LOCAL;
        if (rt->rt6i_flags & RTF_ANYCAST)
                ret |= XT_ADDRTYPE_ANYCAST;
        dst_release(&rt->dst);
        return ret;
 }
@@ -90,7 +95,7 @@ static bool match_type6(struct net *net, const struct net_device *dev,
        if ((XT_ADDRTYPE_LOCAL | XT_ADDRTYPE_ANYCAST |
             XT_ADDRTYPE_UNREACHABLE) & mask)
-                return !!(mask & match_lookup_rt6(net, dev, addr));
+                return !!(mask & match_lookup_rt6(net, dev, addr, mask));
        return true;
 }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 12ac6b47a35c..d0b3dd60d386 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -747,7 +747,7 @@ static void netlink_skb_destructor(struct sk_buff *skb)
                atomic_dec(&ring->pending);
                sock_put(sk);
-                skb->data = NULL;
+                skb->head = NULL;
        }
 #endif
        if (skb->sk != NULL)
diff --git a/net/nfc/Makefile b/net/nfc/Makefile
index fb799deaed4f..a76f4533cb6c 100644
--- a/net/nfc/Makefile
+++ b/net/nfc/Makefile
@@ -5,7 +5,6 @@
 obj-$(CONFIG_NFC) += nfc.o
 obj-$(CONFIG_NFC_NCI) += nci/
 obj-$(CONFIG_NFC_HCI) += hci/
-#obj-$(CONFIG_NFC_LLCP) += llcp/
 nfc-objs := core.o netlink.o af_nfc.o rawsock.o llcp_core.o llcp_commands.o \
                llcp_sock.o
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 823463adbd21..189e3c5b3d09 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -231,14 +231,14 @@ override:
        }
        if (R_tab) {
                police->rate_present = true;
-                psched_ratecfg_precompute(&police->rate, R_tab->rate.rate);
+                psched_ratecfg_precompute(&police->rate, &R_tab->rate);
                qdisc_put_rtab(R_tab);
        } else {
                police->rate_present = false;
        }
        if (P_tab) {
                police->peak_present = true;
-                psched_ratecfg_precompute(&police->peak, P_tab->rate.rate);
+                psched_ratecfg_precompute(&police->peak, &P_tab->rate);
                qdisc_put_rtab(P_tab);
        } else {
                police->peak_present = false;
@@ -376,9 +376,9 @@ tcf_act_police_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
        };
        if (police->rate_present)
-                opt.rate.rate = psched_ratecfg_getrate(&police->rate);
+                psched_ratecfg_getrate(&opt.rate, &police->rate);
        if (police->peak_present)
-                opt.peakrate.rate = psched_ratecfg_getrate(&police->peak);
+                psched_ratecfg_getrate(&opt.peakrate, &police->peak);
        if (nla_put(skb, TCA_POLICE_TBF, sizeof(opt), &opt))
                goto nla_put_failure;
        if (police->tcfp_result &&
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index eac7e0ee23c1..20224086cc28 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -898,14 +898,16 @@ void dev_shutdown(struct net_device *dev)
        WARN_ON(timer_pending(&dev->watchdog_timer));
 }
-void psched_ratecfg_precompute(struct psched_ratecfg *r, u32 rate)
+void psched_ratecfg_precompute(struct psched_ratecfg *r,
+                               const struct tc_ratespec *conf)
 {
        u64 factor;
        u64 mult;
        int shift;
-        r->rate_bps = (u64)rate << 3;
+        memset(r, 0, sizeof(*r));
-        r->shift = 0;
+        r->overhead = conf->overhead;
+        r->rate_bps = (u64)conf->rate << 3;
        r->mult = 1;
        /*
         * Calibrate mult, shift so that token counting is accurate
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 79b1876b6cd2..adaedd79389c 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -109,7 +109,7 @@ struct htb_class {
        } un;
        struct rb_node node[TC_HTB_NUMPRIO];    /* node for self or feed tree */
        struct rb_node pq_node; /* node for event queue */
-        psched_time_t pq_key;
+        s64     pq_key;
        int prio_activity;      /* for which prios are we active */
        enum htb_cmode cmode;   /* current mode of the class */
@@ -121,10 +121,10 @@ struct htb_class {
        /* token bucket parameters */
        struct psched_ratecfg rate;
        struct psched_ratecfg ceil;
-        s64 buffer, cbuffer;    /* token bucket depth/rate */
+        s64     buffer, cbuffer;        /* token bucket depth/rate */
-        psched_tdiff_t mbuffer; /* max wait time */
+        s64     mbuffer;                /* max wait time */
-        s64 tokens, ctokens;    /* current number of tokens */
+        s64     tokens, ctokens;        /* current number of tokens */
-        psched_time_t t_c;      /* checkpoint time */
+        s64     t_c;                    /* checkpoint time */
 };
 struct htb_sched {
@@ -141,15 +141,15 @@ struct htb_sched {
        struct rb_root wait_pq[TC_HTB_MAXDEPTH];
        /* time of nearest event per level (row) */
-        psched_time_t near_ev_cache[TC_HTB_MAXDEPTH];
+        s64     near_ev_cache[TC_HTB_MAXDEPTH];
        int defcls;             /* class where unclassified flows go to */
        /* filters for qdisc itself */
        struct tcf_proto *filter_list;
-        int rate2quantum;       /* quant = rate / rate2quantum */
+        int     rate2quantum;   /* quant = rate / rate2quantum */
-        psched_time_t now;      /* cached dequeue time */
+        s64     now;    /* cached dequeue time */
        struct qdisc_watchdog watchdog;
        /* non shaped skbs; let them go directly thru */
@@ -664,8 +664,8 @@ static void htb_charge_class(struct htb_sched *q, struct htb_class *cl,
 * next pending event (0 for no event in pq, q->now for too many events).
 * Note: Applied are events whose have cl->pq_key <= q->now.
 */
-static psched_time_t htb_do_events(struct htb_sched *q, int level,
+static s64 htb_do_events(struct htb_sched *q, int level,
-                                   unsigned long start)
+                         unsigned long start)
 {
        /* don't run for longer than 2 jiffies; 2 is used instead of
         * 1 to simplify things when jiffy is going to be incremented
@@ -857,7 +857,7 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
        struct sk_buff *skb;
        struct htb_sched *q = qdisc_priv(sch);
        int level;
-        psched_time_t next_event;
+        s64 next_event;
        unsigned long start_at;
        /* try to dequeue direct packets as high prio (!) to minimize cpu work */
@@ -880,7 +880,7 @@ ok:
        for (level = 0; level < TC_HTB_MAXDEPTH; level++) {
                /* common case optimization - skip event handler quickly */
                int m;
-                psched_time_t event;
+                s64 event;
                if (q->now >= q->near_ev_cache[level]) {
                        event = htb_do_events(q, level, start_at);
@@ -1090,9 +1090,9 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
        memset(&opt, 0, sizeof(opt));
-        opt.rate.rate = psched_ratecfg_getrate(&cl->rate);
+        psched_ratecfg_getrate(&opt.rate, &cl->rate);
        opt.buffer = PSCHED_NS2TICKS(cl->buffer);
-        opt.ceil.rate = psched_ratecfg_getrate(&cl->ceil);
+        psched_ratecfg_getrate(&opt.ceil, &cl->ceil);
        opt.cbuffer = PSCHED_NS2TICKS(cl->cbuffer);
        opt.quantum = cl->quantum;
        opt.prio = cl->prio;
@@ -1117,8 +1117,8 @@ htb_dump_class_stats(struct Qdisc *sch, unsigned long arg, struct gnet_dump *d)
        if (!cl->level && cl->un.leaf.q)
                cl->qstats.qlen = cl->un.leaf.q->q.qlen;
-        cl->xstats.tokens = cl->tokens;
+        cl->xstats.tokens = PSCHED_NS2TICKS(cl->tokens);
-        cl->xstats.ctokens = cl->ctokens;
+        cl->xstats.ctokens = PSCHED_NS2TICKS(cl->ctokens);
        if (gnet_stats_copy_basic(d, &cl->bstats) < 0 ||
            gnet_stats_copy_rate_est(d, NULL, &cl->rate_est) < 0 ||
@@ -1200,7 +1200,7 @@ static void htb_parent_to_leaf(struct htb_sched *q, struct htb_class *cl,
        parent->un.leaf.q = new_q ? new_q : &noop_qdisc;
        parent->tokens = parent->buffer;
        parent->ctokens = parent->cbuffer;
-        parent->t_c = psched_get_time();
+        parent->t_c = ktime_to_ns(ktime_get());
        parent->cmode = HTB_CAN_SEND;
 }
@@ -1417,8 +1417,8 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                /* set class to be in HTB_CAN_SEND state */
                cl->tokens = PSCHED_TICKS2NS(hopt->buffer);
                cl->ctokens = PSCHED_TICKS2NS(hopt->cbuffer);
-                cl->mbuffer = 60 * PSCHED_TICKS_PER_SEC;        /* 1min */
+                cl->mbuffer = 60ULL * NSEC_PER_SEC;     /* 1min */
-                cl->t_c = psched_get_time();
+                cl->t_c = ktime_to_ns(ktime_get());
                cl->cmode = HTB_CAN_SEND;
                /* attach to the hash list and parent's family */
@@ -1459,8 +1459,8 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                        cl->prio = TC_HTB_NUMPRIO - 1;
        }
-        psched_ratecfg_precompute(&cl->rate, hopt->rate.rate);
+        psched_ratecfg_precompute(&cl->rate, &hopt->rate);
-        psched_ratecfg_precompute(&cl->ceil, hopt->ceil.rate);
+        psched_ratecfg_precompute(&cl->ceil, &hopt->ceil);
        cl->buffer = PSCHED_TICKS2NS(hopt->buffer);
        cl->cbuffer = PSCHED_TICKS2NS(hopt->buffer);
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index c8388f3c3426..e478d316602b 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -298,9 +298,9 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
        q->tokens = q->buffer;
        q->ptokens = q->mtu;
-        psched_ratecfg_precompute(&q->rate, rtab->rate.rate);
+        psched_ratecfg_precompute(&q->rate, &rtab->rate);
        if (ptab) {
-                psched_ratecfg_precompute(&q->peak, ptab->rate.rate);
+                psched_ratecfg_precompute(&q->peak, &ptab->rate);
                q->peak_present = true;
        } else {
                q->peak_present = false;
@@ -350,9 +350,9 @@ static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
                goto nla_put_failure;
        opt.limit = q->limit;
-        opt.rate.rate = psched_ratecfg_getrate(&q->rate);
+        psched_ratecfg_getrate(&opt.rate, &q->rate);
        if (q->peak_present)
-                opt.peakrate.rate = psched_ratecfg_getrate(&q->peak);
+                psched_ratecfg_getrate(&opt.peakrate, &q->peak);
        else
                memset(&opt.peakrate, 0, sizeof(opt.peakrate));
        opt.mtu = PSCHED_NS2TICKS(q->mtu);
diff --git a/net/socket.c b/net/socket.c
index 6b94633ca61d..9ff6366fee13 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2075,8 +2075,12 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, fla
 {
        int fput_needed, err;
        struct msghdr msg_sys;
-        struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
+        struct socket *sock;
+        if (flags & MSG_CMSG_COMPAT)
+                return -EINVAL;
+        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                goto out;
@@ -2149,6 +2153,8 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
 SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
                unsigned int, vlen, unsigned int, flags)
 {
+        if (flags & MSG_CMSG_COMPAT)
+                return -EINVAL;
        return __sys_sendmmsg(fd, mmsg, vlen, flags);
 }
@@ -2249,8 +2255,12 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
 {
        int fput_needed, err;
        struct msghdr msg_sys;
-        struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
+        struct socket *sock;
+        if (flags & MSG_CMSG_COMPAT)
+                return -EINVAL;
+        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                goto out;
@@ -2375,6 +2385,9 @@ SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
        int datagrams;
        struct timespec timeout_sys;
+        if (flags & MSG_CMSG_COMPAT)
+                return -EINVAL;
        if (!timeout)
                return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
@@ -2492,15 +2505,31 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
                                   (int __user *)a[4]);
                break;
        case SYS_SENDMSG:
+                if (a[2] & MSG_CMSG_COMPAT) {
+                        err = -EINVAL;
+                        break;
+                }
                err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
                break;
        case SYS_SENDMMSG:
+                if (a[3] & MSG_CMSG_COMPAT) {
+                        err = -EINVAL;
+                        break;
+                }
                err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
                break;
        case SYS_RECVMSG:
+                if (a[2] & MSG_CMSG_COMPAT) {
+                        err = -EINVAL;
+                        break;
+                }
                err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
                break;
        case SYS_RECVMMSG:
+                if (a[3] & MSG_CMSG_COMPAT) {
+                        err = -EINVAL;
+                        break;
+                }
                err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
                                   (struct timespec __user *)a[4]);
                break;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index dfdb5e643211..d5aed3bb3945 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3411,7 +3411,7 @@ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
                        (u32)sinfo->rx_bytes))
                goto nla_put_failure;
        if ((sinfo->filled & (STATION_INFO_TX_BYTES |
-                              NL80211_STA_INFO_TX_BYTES64)) &&
+                              STATION_INFO_TX_BYTES64)) &&
            nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
                        (u32)sinfo->tx_bytes))
                goto nla_put_failure;
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 8b5eddfba1e5..3ed35c345cae 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -231,6 +231,9 @@ void cfg80211_conn_work(struct work_struct *work)
        mutex_lock(&rdev->sched_scan_mtx);
        list_for_each_entry(wdev, &rdev->wdev_list, list) {
+                if (!wdev->netdev)
+                        continue;
                wdev_lock(wdev);
                if (!netif_running(wdev->netdev)) {
                        wdev_unlock(wdev);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 23cea0f74336..ea970b8002a2 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2557,11 +2557,12 @@ static void __xfrm_garbage_collect(struct net *net)
        }
 }
-static void xfrm_garbage_collect(struct net *net)
+void xfrm_garbage_collect(struct net *net)
 {
        flow_cache_flush();
        __xfrm_garbage_collect(net);
 }
+EXPORT_SYMBOL(xfrm_garbage_collect);
 static void xfrm_garbage_collect_deferred(struct net *net)
 {
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index aa778748c565..3f565e495ac6 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1681,6 +1681,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
 out:
        xfrm_pol_put(xp);
+        if (delete && err == 0)
+                xfrm_garbage_collect(net);
        return err;
 }
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 8ab295154517..d03081886214 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -316,6 +316,7 @@ int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
                memcpy(new_ctx, old_ctx, sizeof(*new_ctx));
                memcpy(new_ctx->ctx_str, old_ctx->ctx_str, new_ctx->ctx_len);
+                atomic_inc(&selinux_xfrm_refcount);
                *new_ctxp = new_ctx;
        }
        return 0;
@@ -326,6 +327,7 @@ int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
 */
 void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
 {
+        atomic_dec(&selinux_xfrm_refcount);
        kfree(ctx);
 }
@@ -335,17 +337,13 @@ void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
 int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
 {
        const struct task_security_struct *tsec = current_security();
-        int rc = 0;
-        if (ctx) {
+        if (!ctx)
-                rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
+                return 0;
-                                  SECCLASS_ASSOCIATION,
-                                  ASSOCIATION__SETCONTEXT, NULL);
-                if (rc == 0)
-                        atomic_dec(&selinux_xfrm_refcount);
-        }
-        return rc;
+        return avc_has_perm(tsec->sid, ctx->ctx_sid,
+                            SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT,
+                            NULL);
 }
 /*
@@ -370,8 +368,8 @@ int selinux_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *uct
 */
 void selinux_xfrm_state_free(struct xfrm_state *x)
 {
-        struct xfrm_sec_ctx *ctx = x->security;
+        atomic_dec(&selinux_xfrm_refcount);
-        kfree(ctx);
+        kfree(x->security);
 }
 /*
@@ -381,17 +379,13 @@ int selinux_xfrm_state_delete(struct xfrm_state *x)
 {
        const struct task_security_struct *tsec = current_security();
        struct xfrm_sec_ctx *ctx = x->security;
-        int rc = 0;
-        if (ctx) {
+        if (!ctx)
-                rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
+                return 0;
-                                  SECCLASS_ASSOCIATION,
-                                  ASSOCIATION__SETCONTEXT, NULL);
-                if (rc == 0)
-                        atomic_dec(&selinux_xfrm_refcount);
-        }
-        return rc;
+        return avc_has_perm(tsec->sid, ctx->ctx_sid,
+                            SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT,
+                            NULL);
 }
 /*