150 files changed, 1274 insertions, 634 deletions

diff --git a/.gitignore b/.gitignore
index 3b8b9b33be38..7e9932e55475 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,6 +29,7 @@ modules.builtin
 *.bz2
 *.lzma
 *.xz
+*.lz4
 *.lzo
 *.patch
 *.gcno
diff --git a/Documentation/DocBook/device-drivers.tmpl b/Documentation/DocBook/device-drivers.tmpl
index cbfdf5486639..fe397f90a34f 100644
--- a/Documentation/DocBook/device-drivers.tmpl
+++ b/Documentation/DocBook/device-drivers.tmpl
@@ -84,7 +84,7 @@ X!Iinclude/linux/kobject.h
 
      <sect1><title>Kernel utility functions</title>
 !Iinclude/linux/kernel.h
-!Ekernel/printk.c
+!Ekernel/printk/printk.c
 !Ekernel/panic.c
 !Ekernel/sys.c
 !Ekernel/rcupdate.c
diff --git a/MAINTAINERS b/MAINTAINERS
index a26b10e52aea..d83f70ffdbed 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2871,7 +2871,7 @@ F:	drivers/media/usb/dvb-usb-v2/dvb_usb*
 F:      drivers/media/usb/dvb-usb-v2/usb_urb.c
 
 DYNAMIC DEBUG
-M:      Jason Baron <jbaron@redhat.com>
+M:      Jason Baron <jbaron@akamai.com>
 S:      Maintained
 F:      lib/dynamic_debug.c
 F:      include/linux/dynamic_debug.h
diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h
index 8943c028d4bb..df57611652e5 100644
--- a/arch/arc/include/asm/entry.h
+++ b/arch/arc/include/asm/entry.h
@@ -38,6 +38,7 @@
 #include <asm/ptrace.h>
 #include <asm/processor.h>      /* For VMALLOC_START */
 #include <asm/thread_info.h>    /* For THREAD_SIZE */
+#include <asm/mmu.h>
 
 /* Note on the LD/ST addr modes with addr reg wback
  *
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index f71c37edca26..c9770ba5c7df 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -172,7 +172,7 @@ static void __init xen_percpu_init(void *unused)
         enable_percpu_irq(xen_events_irq, 0);
 }
 
-static void xen_restart(char str, const char *cmd)
+static void xen_restart(enum reboot_mode reboot_mode, const char *cmd)
 {
         struct sched_shutdown r = { .reason = SHUTDOWN_reboot };
         int rc;
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index c3abed332301..e12764c2a9d0 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -114,6 +114,7 @@ config BCM47XX
         select FW_CFE
         select HW_HAS_PCI
         select IRQ_CPU
+        select SYS_HAS_CPU_MIPS32_R1
         select NO_EXCEPT_FILL
         select SYS_SUPPORTS_32BIT_KERNEL
         select SYS_SUPPORTS_LITTLE_ENDIAN
diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
index ba611927749b..2b8b118398c4 100644
--- a/arch/mips/bcm47xx/Kconfig
+++ b/arch/mips/bcm47xx/Kconfig
@@ -2,7 +2,6 @@ if BCM47XX
 
 config BCM47XX_SSB
         bool "SSB Support for Broadcom BCM47XX"
-        select SYS_HAS_CPU_MIPS32_R1
         select SSB
         select SSB_DRIVER_MIPS
         select SSB_DRIVER_EXTIF
diff --git a/arch/mips/include/asm/mach-generic/spaces.h b/arch/mips/include/asm/mach-generic/spaces.h
index 5b2f2e68e57f..9488fa5f8866 100644
--- a/arch/mips/include/asm/mach-generic/spaces.h
+++ b/arch/mips/include/asm/mach-generic/spaces.h
@@ -25,8 +25,12 @@
 #else
 #define CAC_BASE                _AC(0x80000000, UL)
 #endif
+#ifndef IO_BASE
 #define IO_BASE                 _AC(0xa0000000, UL)
+#endif
+#ifndef UNCAC_BASE
 #define UNCAC_BASE              _AC(0xa0000000, UL)
+#endif
 
 #ifndef MAP_BASE
 #ifdef CONFIG_KVM_GUEST
diff --git a/arch/mips/include/uapi/asm/siginfo.h b/arch/mips/include/uapi/asm/siginfo.h
index b7a23064841f..88e292b7719e 100644
--- a/arch/mips/include/uapi/asm/siginfo.h
+++ b/arch/mips/include/uapi/asm/siginfo.h
@@ -25,11 +25,12 @@ struct siginfo;
 /*
  * Careful to keep union _sifields from shifting ...
  */
-#if __SIZEOF_LONG__ == 4
+#if _MIPS_SZLONG == 32
 #define __ARCH_SI_PREAMBLE_SIZE (3 * sizeof(int))
-#endif
-#if __SIZEOF_LONG__ == 8
+#elif _MIPS_SZLONG == 64
 #define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int))
+#else
+#error _MIPS_SZLONG neither 32 nor 64
 #endif
 
 #include <asm-generic/siginfo.h>
diff --git a/arch/mips/kernel/bmips_vec.S b/arch/mips/kernel/bmips_vec.S
index f739aedcb509..bd79c4f9bff4 100644
--- a/arch/mips/kernel/bmips_vec.S
+++ b/arch/mips/kernel/bmips_vec.S
@@ -54,7 +54,11 @@ LEAF(bmips_smp_movevec)
         /* set up CPU1 CBR; move BASE to 0xa000_0000 */
         li      k0, 0xff400000
         mtc0    k0, $22, 6
-        li      k1, CKSEG1 | BMIPS_RELO_VECTOR_CONTROL_1
+        /* set up relocation vector address based on thread ID */
+        mfc0    k1, $22, 3
+        srl     k1, 16
+        andi    k1, 0x8000
+        or      k1, CKSEG1 | BMIPS_RELO_VECTOR_CONTROL_0
         or      k0, k1
         li      k1, 0xa0080000
         sw      k1, 0(k0)
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index c0bb4d59076a..159abc8842d2 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -79,15 +79,9 @@ static void __init bmips_smp_setup(void)
          * MIPS interrupts 0,1 (SW INT 0,1) cross over to the other thread
          * MIPS interrupt 2 (HW INT 0) is the CPU0 L1 controller output
          * MIPS interrupt 3 (HW INT 1) is the CPU1 L1 controller output
-         *
-         * If booting from TP1, leave the existing CMT interrupt routing
-         * such that TP0 responds to SW1 and TP1 responds to SW0.
          */
-        if (boot_cpu == 0)
-                change_c0_brcm_cmt_intr(0xf8018000,
+        change_c0_brcm_cmt_intr(0xf8018000,
                                         (0x02 << 27) | (0x03 << 15));
-        else
-                change_c0_brcm_cmt_intr(0xf8018000, (0x1d << 27));
 
         /* single core, 2 threads (2 pipelines) */
         max_cpus = 2;
@@ -202,9 +196,15 @@ static void bmips_init_secondary(void)
 #if defined(CONFIG_CPU_BMIPS4350) || defined(CONFIG_CPU_BMIPS4380)
         void __iomem *cbr = BMIPS_GET_CBR();
         unsigned long old_vec;
+        unsigned long relo_vector;
+        int boot_cpu;
+
+        boot_cpu = !!(read_c0_brcm_cmt_local() & (1 << 31));
+        relo_vector = boot_cpu ? BMIPS_RELO_VECTOR_CONTROL_0 :
+                          BMIPS_RELO_VECTOR_CONTROL_1;
 
-        old_vec = __raw_readl(cbr + BMIPS_RELO_VECTOR_CONTROL_1);
-        __raw_writel(old_vec & ~0x20000000, cbr + BMIPS_RELO_VECTOR_CONTROL_1);
+        old_vec = __raw_readl(cbr + relo_vector);
+        __raw_writel(old_vec & ~0x20000000, cbr + relo_vector);
 
         clear_c0_cause(smp_processor_id() ? C_SW1 : C_SW0);
 #elif defined(CONFIG_CPU_BMIPS5000)
diff --git a/arch/mips/powertv/asic/asic_devices.c b/arch/mips/powertv/asic/asic_devices.c
index 9f64c2387808..0238af1ba503 100644
--- a/arch/mips/powertv/asic/asic_devices.c
+++ b/arch/mips/powertv/asic/asic_devices.c
@@ -529,8 +529,7 @@ EXPORT_SYMBOL(asic_resource_get);
  */
 void platform_release_memory(void *ptr, int size)
 {
-        free_reserved_area((unsigned long)ptr, (unsigned long)(ptr + size),
-                           -1, NULL);
+        free_reserved_area(ptr, ptr + size, -1, NULL);
 }
 EXPORT_SYMBOL(platform_release_memory);
 
diff --git a/arch/x86/platform/ce4100/ce4100.c b/arch/x86/platform/ce4100/ce4100.c
index 643b8b5eee86..8244f5ec2f4c 100644
--- a/arch/x86/platform/ce4100/ce4100.c
+++ b/arch/x86/platform/ce4100/ce4100.c
@@ -12,6 +12,7 @@
 #include <linux/kernel.h>
 #include <linux/irq.h>
 #include <linux/module.h>
+#include <linux/reboot.h>
 #include <linux/serial_reg.h>
 #include <linux/serial_8250.h>
 #include <linux/reboot.h>
diff --git a/drivers/accessibility/braille/braille_console.c b/drivers/accessibility/braille/braille_console.c
index d21167bfc865..dc34a5b8bcee 100644
--- a/drivers/accessibility/braille/braille_console.c
+++ b/drivers/accessibility/braille/braille_console.c
@@ -359,6 +359,9 @@ int braille_register_console(struct console *console, int index,
                 char *console_options, char *braille_options)
 {
         int ret;
+
+        if (!(console->flags & CON_BRL))
+                return 0;
         if (!console_options)
                 /* Only support VisioBraille for now */
                 console_options = "57600o8";
@@ -374,15 +377,17 @@ int braille_register_console(struct console *console, int index,
         braille_co = console;
         register_keyboard_notifier(&keyboard_notifier_block);
         register_vt_notifier(&vt_notifier_block);
-        return 0;
+        return 1;
 }
 
 int braille_unregister_console(struct console *console)
 {
         if (braille_co != console)
                 return -EINVAL;
+        if (!(console->flags & CON_BRL))
+                return 0;
         unregister_keyboard_notifier(&keyboard_notifier_block);
         unregister_vt_notifier(&vt_notifier_block);
         braille_co = NULL;
-        return 0;
+        return 1;
 }
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 7ef316fdc4d9..ac1b43a04285 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -54,6 +54,7 @@
 #define FW_CDEV_KERNEL_VERSION                  5
 #define FW_CDEV_VERSION_EVENT_REQUEST2          4
 #define FW_CDEV_VERSION_ALLOCATE_REGION_END     4
+#define FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW 5
 
 struct client {
         u32 version;
@@ -1005,6 +1006,8 @@ static int ioctl_create_iso_context(struct client *client, union ioctl_arg *arg)
                         a->channel, a->speed, a->header_size, cb, client);
         if (IS_ERR(context))
                 return PTR_ERR(context);
+        if (client->version < FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW)
+                context->drop_overflow_headers = true;
 
         /* We only support one context at this time. */
         spin_lock_irq(&client->lock);
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 9e1db6490b9a..afb701ec90ca 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2749,8 +2749,11 @@ static void copy_iso_headers(struct iso_context *ctx, const u32 *dma_hdr)
 {
         u32 *ctx_hdr;
 
-        if (ctx->header_length + ctx->base.header_size > PAGE_SIZE)
+        if (ctx->header_length + ctx->base.header_size > PAGE_SIZE) {
+                if (ctx->base.drop_overflow_headers)
+                        return;
                 flush_iso_completions(ctx);
+        }
 
         ctx_hdr = ctx->header + ctx->header_length;
         ctx->last_timestamp = (u16)le32_to_cpu((__force __le32)dma_hdr[0]);
@@ -2910,8 +2913,11 @@ static int handle_it_packet(struct context *context,
 
         sync_it_packet_for_cpu(context, d);
 
-        if (ctx->header_length + 4 > PAGE_SIZE)
+        if (ctx->header_length + 4 > PAGE_SIZE) {
+                if (ctx->base.drop_overflow_headers)
+                        return 1;
                 flush_iso_completions(ctx);
+        }
 
         ctx_hdr = ctx->header + ctx->header_length;
         ctx->last_timestamp = le16_to_cpu(last->res_count);
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index eb760a218da4..232fa8fce26a 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -419,6 +419,13 @@ static void __init dmi_format_ids(char *buf, size_t len)
                             dmi_get_system_info(DMI_BIOS_DATE));
 }
 
+/*
+ * Check for DMI/SMBIOS headers in the system firmware image.  Any
+ * SMBIOS header must start 16 bytes before the DMI header, so take a
+ * 32 byte buffer and check for DMI at offset 16 and SMBIOS at offset
+ * 0.  If the DMI header is present, set dmi_ver accordingly (SMBIOS
+ * takes precedence) and return 0.  Otherwise return 1.
+ */
 static int __init dmi_present(const u8 *buf)
 {
         int smbios_ver;
@@ -506,6 +513,13 @@ void __init dmi_scan_machine(void)
                 if (p == NULL)
                         goto error;
 
+                /*
+                 * Iterate over all possible DMI header addresses q.
+                 * Maintain the 32 bytes around q in buf.  On the
+                 * first iteration, substitute zero for the
+                 * out-of-range bytes so there is no chance of falsely
+                 * detecting an SMBIOS header.
+                 */
                 memset(buf, 0, 16);
                 for (q = p; q < p + 0x10000; q += 16) {
                         memcpy_fromio(buf + 16, q, 16);
diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
index a746ba272f04..a956053608f9 100644
--- a/drivers/net/arcnet/arcnet.c
+++ b/drivers/net/arcnet/arcnet.c
@@ -1007,7 +1007,7 @@ static void arcnet_rx(struct net_device *dev, int bufnum)
 
         soft = &pkt.soft.rfc1201;
 
-        lp->hw.copy_from_card(dev, bufnum, 0, &pkt, sizeof(ARC_HDR_SIZE));
+        lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE);
         if (pkt.hard.offset[0]) {
                 ofs = pkt.hard.offset[0];
                 length = 256 - ofs;
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 6aa7b3266c80..ac6177d3befc 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -412,10 +412,20 @@ static void esd_usb2_read_bulk_callback(struct urb *urb)
 
                 switch (msg->msg.hdr.cmd) {
                 case CMD_CAN_RX:
+                        if (msg->msg.rx.net >= dev->net_count) {
+                                dev_err(dev->udev->dev.parent, "format error\n");
+                                break;
+                        }
+
                         esd_usb2_rx_can_msg(dev->nets[msg->msg.rx.net], msg);
                         break;
 
                 case CMD_CAN_TX:
+                        if (msg->msg.txdone.net >= dev->net_count) {
+                                dev_err(dev->udev->dev.parent, "format error\n");
+                                break;
+                        }
+
                         esd_usb2_tx_done_msg(dev->nets[msg->msg.txdone.net],
                                              msg);
                         break;
diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index cbd388eea682..8becd3d838b5 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -779,6 +779,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
                         usb_unanchor_urb(urb);
                         usb_free_coherent(priv->udev, RX_BUFFER_SIZE, buf,
                                           urb->transfer_dma);
+                        usb_free_urb(urb);
                         break;
                 }
 
diff --git a/drivers/net/ethernet/allwinner/Kconfig b/drivers/net/ethernet/allwinner/Kconfig
index 53ad213e865b..d8d95d4cd45a 100644
--- a/drivers/net/ethernet/allwinner/Kconfig
+++ b/drivers/net/ethernet/allwinner/Kconfig
@@ -3,19 +3,20 @@
 #
 
 config NET_VENDOR_ALLWINNER
-       bool "Allwinner devices"
-       default y
-       depends on ARCH_SUNXI
-       ---help---
-         If you have a network (Ethernet) card belonging to this
-         class, say Y and read the Ethernet-HOWTO, available from
-         <http://www.tldp.org/docs.html#howto>.
+        bool "Allwinner devices"
+        default y
 
-         Note that the answer to this question doesn't directly
-         affect the kernel: saying N will just cause the configurator
-         to skip all the questions about Allwinner cards. If you say Y,
-         you will be asked for your specific card in the following
-         questions.
+        depends on ARCH_SUNXI
+        ---help---
+          If you have a network (Ethernet) card belonging to this
+          class, say Y and read the Ethernet-HOWTO, available from
+          <http://www.tldp.org/docs.html#howto>.
+
+          Note that the answer to this question doesn't directly
+          affect the kernel: saying N will just cause the configurator
+          to skip all the questions about Allwinner cards. If you say Y,
+          you will be asked for your specific card in the following
+          questions.
 
 if NET_VENDOR_ALLWINNER
 
@@ -26,6 +27,7 @@ config SUN4I_EMAC
         select CRC32
         select MII
         select PHYLIB
+        select MDIO_SUN4I
         ---help---
           Support for Allwinner A10 EMAC ethernet driver.
 
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c.h b/drivers/net/ethernet/atheros/atl1c/atl1c.h
index b2bf324631dc..0f0556526ba9 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c.h
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c.h
@@ -520,6 +520,9 @@ struct atl1c_adapter {
         struct net_device   *netdev;
         struct pci_dev      *pdev;
         struct napi_struct  napi;
+        struct page         *rx_page;
+        unsigned int        rx_page_offset;
+        unsigned int        rx_frag_size;
         struct atl1c_hw        hw;
         struct atl1c_hw_stats  hw_stats;
         struct mii_if_info  mii;    /* MII interface info */
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 786a87483298..a36a760ada28 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -481,10 +481,15 @@ static int atl1c_set_mac_addr(struct net_device *netdev, void *p)
 static void atl1c_set_rxbufsize(struct atl1c_adapter *adapter,
                                 struct net_device *dev)
 {
+        unsigned int head_size;
         int mtu = dev->mtu;
 
         adapter->rx_buffer_len = mtu > AT_RX_BUF_SIZE ?
                 roundup(mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN, 8) : AT_RX_BUF_SIZE;
+
+        head_size = SKB_DATA_ALIGN(adapter->rx_buffer_len + NET_SKB_PAD) +
+                    SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+        adapter->rx_frag_size = roundup_pow_of_two(head_size);
 }
 
 static netdev_features_t atl1c_fix_features(struct net_device *netdev,
@@ -952,6 +957,10 @@ static void atl1c_free_ring_resources(struct atl1c_adapter *adapter)
                 kfree(adapter->tpd_ring[0].buffer_info);
                 adapter->tpd_ring[0].buffer_info = NULL;
         }
+        if (adapter->rx_page) {
+                put_page(adapter->rx_page);
+                adapter->rx_page = NULL;
+        }
 }
 
 /**
@@ -1639,6 +1648,35 @@ static inline void atl1c_rx_checksum(struct atl1c_adapter *adapter,
         skb_checksum_none_assert(skb);
 }
 
+static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter)
+{
+        struct sk_buff *skb;
+        struct page *page;
+
+        if (adapter->rx_frag_size > PAGE_SIZE)
+                return netdev_alloc_skb(adapter->netdev,
+                                        adapter->rx_buffer_len);
+
+        page = adapter->rx_page;
+        if (!page) {
+                adapter->rx_page = page = alloc_page(GFP_ATOMIC);
+                if (unlikely(!page))
+                        return NULL;
+                adapter->rx_page_offset = 0;
+        }
+
+        skb = build_skb(page_address(page) + adapter->rx_page_offset,
+                        adapter->rx_frag_size);
+        if (likely(skb)) {
+                adapter->rx_page_offset += adapter->rx_frag_size;
+                if (adapter->rx_page_offset >= PAGE_SIZE)
+                        adapter->rx_page = NULL;
+                else
+                        get_page(page);
+        }
+        return skb;
+}
+
 static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
 {
         struct atl1c_rfd_ring *rfd_ring = &adapter->rfd_ring;
@@ -1660,7 +1698,7 @@ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
         while (next_info->flags & ATL1C_BUFFER_FREE) {
                 rfd_desc = ATL1C_RFD_DESC(rfd_ring, rfd_next_to_use);
 
-                skb = netdev_alloc_skb(adapter->netdev, adapter->rx_buffer_len);
+                skb = atl1c_alloc_skb(adapter);
                 if (unlikely(!skb)) {
                         if (netif_msg_rx_err(adapter))
                                 dev_warn(&pdev->dev, "alloc rx buffer failed\n");
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index d964f302ac94..ddebc7a5dda0 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -17625,7 +17625,8 @@ err_out_free_res:
         pci_release_regions(pdev);
 
 err_out_disable_pdev:
-        pci_disable_device(pdev);
+        if (pci_is_enabled(pdev))
+                pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
         return err;
 }
@@ -17773,7 +17774,8 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
 
         rtnl_lock();
 
-        if (!netif_running(netdev))
+        /* We probably don't have netdev yet */
+        if (!netdev || !netif_running(netdev))
                 goto done;
 
         tg3_phy_stop(tp);
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index 2b0a0ea4f8e7..ae236009f1a8 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -259,6 +259,7 @@ struct bufdesc_ex {
 struct fec_enet_delayed_work {
         struct delayed_work delay_work;
         bool timeout;
+        bool trig_tx;
 };
 
 /* The FEC buffer descriptors track the ring buffers.  The rx_bd_base and
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index d3ad5ea711d3..77ea0db0bbfc 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -93,6 +93,20 @@ static void set_multicast_list(struct net_device *ndev);
 #define FEC_QUIRK_HAS_CSUM              (1 << 5)
 /* Controller has hardware vlan support */
 #define FEC_QUIRK_HAS_VLAN              (1 << 6)
+/* ENET IP errata ERR006358
+ *
+ * If the ready bit in the transmit buffer descriptor (TxBD[R]) is previously
+ * detected as not set during a prior frame transmission, then the
+ * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
+ * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
+ * If the ready bit in the transmit buffer descriptor (TxBD[R]) is previously
+ * detected as not set during a prior frame transmission, then the
+ * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
+ * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
+ * frames not being transmitted until there is a 0-to-1 transition on
+ * ENET_TDAR[TDAR].
+ */
+#define FEC_QUIRK_ERR006358            (1 << 7)
 
 static struct platform_device_id fec_devtype[] = {
         {
@@ -112,7 +126,7 @@ static struct platform_device_id fec_devtype[] = {
                 .name = "imx6q-fec",
                 .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
                                 FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
-                                FEC_QUIRK_HAS_VLAN,
+                                FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR006358,
         }, {
                 .name = "mvf600-fec",
                 .driver_data = FEC_QUIRK_ENET_MAC,
@@ -275,16 +289,11 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         struct fec_enet_private *fep = netdev_priv(ndev);
         const struct platform_device_id *id_entry =
                                 platform_get_device_id(fep->pdev);
-        struct bufdesc *bdp;
+        struct bufdesc *bdp, *bdp_pre;
         void *bufaddr;
         unsigned short  status;
         unsigned int index;
 
-        if (!fep->link) {
-                /* Link is down or auto-negotiation is in progress. */
-                return NETDEV_TX_BUSY;
-        }
-
         /* Fill in a Tx ring entry */
         bdp = fep->cur_tx;
 
@@ -370,6 +379,15 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                                 ebdp->cbd_esc |= BD_ENET_TX_PINS;
                 }
         }
+
+        bdp_pre = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
+        if ((id_entry->driver_data & FEC_QUIRK_ERR006358) &&
+            !(bdp_pre->cbd_sc & BD_ENET_TX_READY)) {
+                fep->delay_work.trig_tx = true;
+                schedule_delayed_work(&(fep->delay_work.delay_work),
+                                        msecs_to_jiffies(1));
+        }
+
         /* If this was the last BD in the ring, start at the beginning again. */
         if (status & BD_ENET_TX_WRAP)
                 bdp = fep->tx_bd_base;
@@ -689,6 +707,11 @@ static void fec_enet_work(struct work_struct *work)
                 fec_restart(fep->netdev, fep->full_duplex);
                 netif_wake_queue(fep->netdev);
         }
+
+        if (fep->delay_work.trig_tx) {
+                fep->delay_work.trig_tx = false;
+                writel(0, fep->hwp + FEC_X_DES_ACTIVE);
+        }
 }
 
 static void
@@ -2279,4 +2302,5 @@ static struct platform_driver fec_driver = {
 
 module_platform_driver(fec_driver);
 
+MODULE_ALIAS("platform:"DRIVER_NAME);
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 6a0c1b66ce54..c1d72c03cb59 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -3739,9 +3739,8 @@ static void igb_set_rx_mode(struct net_device *netdev)
         rctl &= ~(E1000_RCTL_UPE | E1000_RCTL_MPE | E1000_RCTL_VFE);
 
         if (netdev->flags & IFF_PROMISC) {
-                u32 mrqc = rd32(E1000_MRQC);
                 /* retain VLAN HW filtering if in VT mode */
-                if (mrqc & E1000_MRQC_ENABLE_VMDQ)
+                if (adapter->vfs_allocated_count)
                         rctl |= E1000_RCTL_VFE;
                 rctl |= (E1000_RCTL_UPE | E1000_RCTL_MPE);
                 vmolr |= (E1000_VMOLR_ROPE | E1000_VMOLR_MPME);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
index ac780770863d..7a77f37a7cbc 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
@@ -108,9 +108,8 @@ s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *hw,
 
         /* Enable arbiter */
         reg &= ~IXGBE_DPMCS_ARBDIS;
-        /* Enable DFP and Recycle mode */
-        reg |= (IXGBE_DPMCS_TDPAC | IXGBE_DPMCS_TRM);
         reg |= IXGBE_DPMCS_TSOEF;
+
         /* Configure Max TSO packet size 34KB including payload and headers */
         reg |= (0x4 << IXGBE_DPMCS_MTSOS_SHIFT);
 
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 712779fb12b7..b017818bccae 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -88,6 +88,8 @@
 #define      MVNETA_TX_IN_PRGRS                  BIT(1)
 #define      MVNETA_TX_FIFO_EMPTY                BIT(8)
 #define MVNETA_RX_MIN_FRAME_SIZE                 0x247c
+#define MVNETA_SGMII_SERDES_CFG                  0x24A0
+#define      MVNETA_SGMII_SERDES_PROTO           0x0cc7
 #define MVNETA_TYPE_PRIO                         0x24bc
 #define      MVNETA_FORCE_UNI                    BIT(21)
 #define MVNETA_TXQ_CMD_1                         0x24e4
@@ -655,6 +657,8 @@ static void mvneta_port_sgmii_config(struct mvneta_port *pp)
         val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
         val |= MVNETA_GMAC2_PSC_ENABLE;
         mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
+
+        mvreg_write(pp, MVNETA_SGMII_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO);
 }
 
 /* Start the Ethernet port RX and TX activity */
@@ -2728,28 +2732,24 @@ static int mvneta_probe(struct platform_device *pdev)
 
         pp = netdev_priv(dev);
 
-        pp->tx_done_timer.function = mvneta_tx_done_timer_callback;
-        init_timer(&pp->tx_done_timer);
-        clear_bit(MVNETA_F_TX_DONE_TIMER_BIT, &pp->flags);
-
         pp->weight = MVNETA_RX_POLL_WEIGHT;
         pp->phy_node = phy_node;
         pp->phy_interface = phy_mode;
 
-        pp->base = of_iomap(dn, 0);
-        if (pp->base == NULL) {
-                err = -ENOMEM;
-                goto err_free_irq;
-        }
-
         pp->clk = devm_clk_get(&pdev->dev, NULL);
         if (IS_ERR(pp->clk)) {
                 err = PTR_ERR(pp->clk);
-                goto err_unmap;
+                goto err_free_irq;
         }
 
         clk_prepare_enable(pp->clk);
 
+        pp->base = of_iomap(dn, 0);
+        if (pp->base == NULL) {
+                err = -ENOMEM;
+                goto err_clk;
+        }
+
         dt_mac_addr = of_get_mac_address(dn);
         if (dt_mac_addr && is_valid_ether_addr(dt_mac_addr)) {
                 mac_from = "device tree";
@@ -2766,6 +2766,9 @@ static int mvneta_probe(struct platform_device *pdev)
         }
 
         pp->tx_done_timer.data = (unsigned long)dev;
+        pp->tx_done_timer.function = mvneta_tx_done_timer_callback;
+        init_timer(&pp->tx_done_timer);
+        clear_bit(MVNETA_F_TX_DONE_TIMER_BIT, &pp->flags);
 
         pp->tx_ring_size = MVNETA_MAX_TXD;
         pp->rx_ring_size = MVNETA_MAX_RXD;
@@ -2776,7 +2779,7 @@ static int mvneta_probe(struct platform_device *pdev)
         err = mvneta_init(pp, phy_addr);
         if (err < 0) {
                 dev_err(&pdev->dev, "can't init eth hal\n");
-                goto err_clk;
+                goto err_unmap;
         }
         mvneta_port_power_up(pp, phy_mode);
 
@@ -2806,10 +2809,10 @@ static int mvneta_probe(struct platform_device *pdev)
 
 err_deinit:
         mvneta_deinit(pp);
-err_clk:
-        clk_disable_unprepare(pp->clk);
 err_unmap:
         iounmap(pp->base);
+err_clk:
+        clk_disable_unprepare(pp->clk);
 err_free_irq:
         irq_dispose_mapping(dev->irq);
 err_free_netdev:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 205753a04cfc..40374063c01e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -1113,7 +1113,13 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, unsigned long vector)
 
         for (i = 0; i < (1 << cmd->log_sz); i++) {
                 if (test_bit(i, &vector)) {
+                        struct semaphore *sem;
+
                         ent = cmd->ent_arr[i];
+                        if (ent->page_queue)
+                                sem = &cmd->pages_sem;
+                        else
+                                sem = &cmd->sem;
                         ktime_get_ts(&ent->ts2);
                         memcpy(ent->out->first.data, ent->lay->out, sizeof(ent->lay->out));
                         dump_command(dev, ent, 0);
@@ -1136,10 +1142,7 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, unsigned long vector)
                         } else {
                                 complete(&ent->done);
                         }
-                        if (ent->page_queue)
-                                up(&cmd->pages_sem);
-                        else
-                                up(&cmd->sem);
+                        up(sem);
                 }
         }
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/uar.c b/drivers/net/ethernet/mellanox/mlx5/core/uar.c
index 71d4a3937200..68f5d9c77c7b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/uar.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/uar.c
@@ -164,6 +164,7 @@ int mlx5_alloc_uuars(struct mlx5_core_dev *dev, struct mlx5_uuar_info *uuari)
                 uuari->uars[i].map = ioremap(addr, PAGE_SIZE);
                 if (!uuari->uars[i].map) {
                         mlx5_cmd_free_uar(dev, uuari->uars[i].index);
+                        err = -ENOMEM;
                         goto out_count;
                 }
                 mlx5_core_dbg(dev, "allocated uar index 0x%x, mmaped at %p\n",
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig b/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig
index cb22341a14a8..a588ffde9700 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig
@@ -4,7 +4,7 @@
 
 config PCH_GBE
         tristate "OKI SEMICONDUCTOR IOH(ML7223/ML7831) GbE"
-        depends on PCI
+        depends on PCI && (X86 || COMPILE_TEST)
         select MII
         select PTP_1588_CLOCK_PCH
         ---help---
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index b00cf5665eab..f4bb8f5d7453 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -1869,7 +1869,8 @@ static inline void qlcnic_free_mac_list(struct qlcnic_adapter *adapter)
 
 static inline void qlcnic_set_mac_filter_count(struct qlcnic_adapter *adapter)
 {
-        adapter->ahw->hw_ops->set_mac_filter_count(adapter);
+        if (adapter->ahw->hw_ops->set_mac_filter_count)
+                adapter->ahw->hw_ops->set_mac_filter_count(adapter);
 }
 
 static inline void qlcnic_dev_request_reset(struct qlcnic_adapter *adapter,
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 0913c623a67e..bc483e1881a3 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -3014,8 +3014,8 @@ int qlcnic_83xx_get_settings(struct qlcnic_adapter *adapter,
         }
 
         if (ahw->port_type == QLCNIC_XGBE) {
-                ecmd->supported = SUPPORTED_1000baseT_Full;
-                ecmd->advertising = ADVERTISED_1000baseT_Full;
+                ecmd->supported = SUPPORTED_10000baseT_Full;
+                ecmd->advertising = ADVERTISED_10000baseT_Full;
         } else {
                 ecmd->supported = (SUPPORTED_10baseT_Half |
                                    SUPPORTED_10baseT_Full |
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index f41dfab1e9a3..51ab4b56fc91 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -2123,6 +2123,8 @@ int qlcnic_83xx_init(struct qlcnic_adapter *adapter, int pci_using_dac)
         set_bit(QLC_83XX_MBX_READY, &adapter->ahw->idc.status);
         qlcnic_83xx_clear_function_resources(adapter);
 
+        INIT_DELAYED_WORK(&adapter->idc_aen_work, qlcnic_83xx_idc_aen_work);
+
         /* register for NIC IDC AEN Events */
         qlcnic_83xx_register_nic_idc_func(adapter, 1);
 
@@ -2140,8 +2142,6 @@ int qlcnic_83xx_init(struct qlcnic_adapter *adapter, int pci_using_dac)
         if (adapter->nic_ops->init_driver(adapter))
                 return -EIO;
 
-        INIT_DELAYED_WORK(&adapter->idc_aen_work, qlcnic_83xx_idc_aen_work);
-
         /* Periodically monitor device status */
         qlcnic_83xx_idc_poll_dev_state(&adapter->fw_work.work);
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 700a46324d09..05a847e599c6 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -1540,7 +1540,7 @@ qlcnic_set_dump(struct net_device *netdev, struct ethtool_dump *val)
                 return 0;
         case QLCNIC_SET_QUIESCENT:
         case QLCNIC_RESET_QUIESCENT:
-                state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
+                state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
                 if (state == QLCNIC_DEV_FAILED || (state == QLCNIC_DEV_BADBAD))
                         netdev_info(netdev, "Device in FAILED state\n");
                 return 0;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
index 5b5d2edf125d..4ed7e73d88d3 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
@@ -516,20 +516,18 @@ void __qlcnic_set_multi(struct net_device *netdev, u16 vlan)
         if (netdev->flags & IFF_PROMISC) {
                 if (!(adapter->flags & QLCNIC_PROMISC_DISABLED))
                         mode = VPORT_MISS_MODE_ACCEPT_ALL;
-        } else if (netdev->flags & IFF_ALLMULTI) {
-                if (netdev_mc_count(netdev) > ahw->max_mc_count) {
-                        mode = VPORT_MISS_MODE_ACCEPT_MULTI;
-                } else if (!netdev_mc_empty(netdev) &&
-                           !qlcnic_sriov_vf_check(adapter)) {
-                                netdev_for_each_mc_addr(ha, netdev)
-                                        qlcnic_nic_add_mac(adapter, ha->addr,
-                                                           vlan);
-                }
-                if (mode != VPORT_MISS_MODE_ACCEPT_MULTI &&
-                    qlcnic_sriov_vf_check(adapter))
-                        qlcnic_vf_add_mc_list(netdev, vlan);
+        } else if ((netdev->flags & IFF_ALLMULTI) ||
+                   (netdev_mc_count(netdev) > ahw->max_mc_count)) {
+                mode = VPORT_MISS_MODE_ACCEPT_MULTI;
+        } else if (!netdev_mc_empty(netdev) &&
+                   !qlcnic_sriov_vf_check(adapter)) {
+                netdev_for_each_mc_addr(ha, netdev)
+                        qlcnic_nic_add_mac(adapter, ha->addr, vlan);
         }
 
+        if (qlcnic_sriov_vf_check(adapter))
+                qlcnic_vf_add_mc_list(netdev, vlan);
+
         /* configure unicast MAC address, if there is not sufficient space
          * to store all the unicast addresses then enable promiscuous mode
          */
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
index d28336fc65ab..a2023090e866 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
@@ -142,7 +142,7 @@ void qlcnic_release_tx_buffers(struct qlcnic_adapter *adapter)
                                          buffrag->length, PCI_DMA_TODEVICE);
                         buffrag->dma = 0ULL;
                 }
-                for (j = 0; j < cmd_buf->frag_count; j++) {
+                for (j = 1; j < cmd_buf->frag_count; j++) {
                         buffrag++;
                         if (buffrag->dma) {
                                 pci_unmap_page(adapter->pdev, buffrag->dma,
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 4528f8ec333b..cc78d3924c6a 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -1383,6 +1383,8 @@ qlcnic_request_irq(struct qlcnic_adapter *adapter)
         if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
                 if (qlcnic_82xx_check(adapter))
                         handler = qlcnic_tmp_intr;
+                else
+                        handler = qlcnic_83xx_tmp_intr;
                 if (!QLCNIC_IS_MSI_FAMILY(adapter))
                         flags |= IRQF_SHARED;
 
@@ -1531,12 +1533,12 @@ int __qlcnic_up(struct qlcnic_adapter *adapter, struct net_device *netdev)
         if (netdev->features & NETIF_F_LRO)
                 qlcnic_config_hw_lro(adapter, QLCNIC_LRO_ENABLED);
 
+        set_bit(__QLCNIC_DEV_UP, &adapter->state);
         qlcnic_napi_enable(adapter);
 
         qlcnic_linkevent_request(adapter, 1);
 
         adapter->ahw->reset_context = 0;
-        set_bit(__QLCNIC_DEV_UP, &adapter->state);
         return 0;
 }
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
index ab8a6744d402..79e54efe07b9 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
@@ -1084,7 +1084,7 @@ flash_temp:
         tmpl_hdr = ahw->fw_dump.tmpl_hdr;
         tmpl_hdr->drv_cap_mask = QLCNIC_DUMP_MASK_DEF;
 
-        if ((tmpl_hdr->version & 0xffffff) >= 0x20001)
+        if ((tmpl_hdr->version & 0xfffff) >= 0x20001)
                 ahw->fw_dump.use_pex_dma = true;
         else
                 ahw->fw_dump.use_pex_dma = false;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 62380ce89905..56e85f98117f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -762,6 +762,7 @@ static int qlcnic_sriov_alloc_bc_mbx_args(struct qlcnic_cmd_args *mbx, u32 type)
                         memset(mbx->rsp.arg, 0, sizeof(u32) * mbx->rsp.num);
                         mbx->req.arg[0] = (type | (mbx->req.num << 16) |
                                            (3 << 29));
+                        mbx->rsp.arg[0] = (type & 0xffff) | mbx->rsp.num << 16;
                         return 0;
                 }
         }
@@ -813,6 +814,7 @@ static int qlcnic_sriov_prepare_bc_hdr(struct qlcnic_bc_trans *trans,
                 cmd->req.num = trans->req_pay_size / 4;
                 cmd->rsp.num = trans->rsp_pay_size / 4;
                 hdr = trans->rsp_hdr;
+                cmd->op_type = trans->req_hdr->op_type;
         }
 
         trans->trans_id = seq;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index ee0c1d307966..eb49cd65378c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -635,12 +635,12 @@ static int qlcnic_sriov_pf_channel_cfg_cmd(struct qlcnic_bc_trans *trans,
                                            struct qlcnic_cmd_args *cmd)
 {
         struct qlcnic_vf_info *vf = trans->vf;
-        struct qlcnic_adapter *adapter = vf->adapter;
-        int err;
+        struct qlcnic_vport *vp = vf->vp;
+        struct qlcnic_adapter *adapter;
         u16 func = vf->pci_func;
+        int err;
 
-        cmd->rsp.arg[0] = trans->req_hdr->cmd_op;
-        cmd->rsp.arg[0] |= (1 << 16);
+        adapter = vf->adapter;
 
         if (trans->req_hdr->cmd_op == QLCNIC_BC_CMD_CHANNEL_INIT) {
                 err = qlcnic_sriov_pf_config_vport(adapter, 1, func);
@@ -650,6 +650,8 @@ static int qlcnic_sriov_pf_channel_cfg_cmd(struct qlcnic_bc_trans *trans,
                                 qlcnic_sriov_pf_config_vport(adapter, 0, func);
                 }
         } else {
+                if (vp->vlan_mode == QLC_GUEST_VLAN_MODE)
+                        vp->vlan = 0;
                 err = qlcnic_sriov_pf_config_vport(adapter, 0, func);
         }
 
@@ -1183,7 +1185,7 @@ static int qlcnic_sriov_pf_get_acl_cmd(struct qlcnic_bc_trans *trans,
         u8 cmd_op, mode = vp->vlan_mode;
 
         cmd_op = trans->req_hdr->cmd_op;
-        cmd->rsp.arg[0] = (cmd_op & 0xffff) | 14 << 16 | 1 << 25;
+        cmd->rsp.arg[0] |= 1 << 25;
 
         switch (mode) {
         case QLC_GUEST_VLAN_MODE:
@@ -1561,6 +1563,7 @@ void qlcnic_sriov_pf_handle_flr(struct qlcnic_sriov *sriov,
                                 struct qlcnic_vf_info *vf)
 {
         struct net_device *dev = vf->adapter->netdev;
+        struct qlcnic_vport *vp = vf->vp;
 
         if (!test_and_clear_bit(QLC_BC_VF_STATE, &vf->state)) {
                 clear_bit(QLC_BC_VF_FLR, &vf->state);
@@ -1573,6 +1576,9 @@ void qlcnic_sriov_pf_handle_flr(struct qlcnic_sriov *sriov,
                 return;
         }
 
+        if (vp->vlan_mode == QLC_GUEST_VLAN_MODE)
+                vp->vlan = 0;
+
         qlcnic_sriov_schedule_flr(sriov, vf, qlcnic_sriov_pf_process_flr);
         netdev_info(dev, "FLR received for PCI func %d\n", vf->pci_func);
 }
@@ -1621,13 +1627,15 @@ int qlcnic_sriov_set_vf_mac(struct net_device *netdev, int vf, u8 *mac)
 {
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         struct qlcnic_sriov *sriov = adapter->ahw->sriov;
-        int i, num_vfs = sriov->num_vfs;
+        int i, num_vfs;
         struct qlcnic_vf_info *vf_info;
         u8 *curr_mac;
 
         if (!qlcnic_sriov_pf_check(adapter))
                 return -EOPNOTSUPP;
 
+        num_vfs = sriov->num_vfs;
+
         if (!is_valid_ether_addr(mac) || vf >= num_vfs)
                 return -EINVAL;
 
@@ -1741,6 +1749,7 @@ int qlcnic_sriov_set_vf_vlan(struct net_device *netdev, int vf,
 
         switch (vlan) {
         case 4095:
+                vp->vlan = 0;
                 vp->vlan_mode = QLC_GUEST_VLAN_MODE;
                 break;
         case 0:
@@ -1759,6 +1768,29 @@ int qlcnic_sriov_set_vf_vlan(struct net_device *netdev, int vf,
         return 0;
 }
 
+static inline __u32 qlcnic_sriov_get_vf_vlan(struct qlcnic_adapter *adapter,
+                                             struct qlcnic_vport *vp, int vf)
+{
+        __u32 vlan = 0;
+
+        switch (vp->vlan_mode) {
+        case QLC_PVID_MODE:
+                vlan = vp->vlan;
+                break;
+        case QLC_GUEST_VLAN_MODE:
+                vlan = MAX_VLAN_ID;
+                break;
+        case QLC_NO_VLAN_MODE:
+                vlan = 0;
+                break;
+        default:
+                netdev_info(adapter->netdev, "Invalid VLAN mode = %d for VF %d\n",
+                            vp->vlan_mode, vf);
+        }
+
+        return vlan;
+}
+
 int qlcnic_sriov_get_vf_config(struct net_device *netdev,
                                int vf, struct ifla_vf_info *ivi)
 {
@@ -1774,7 +1806,7 @@ int qlcnic_sriov_get_vf_config(struct net_device *netdev,
 
         vp = sriov->vf_info[vf].vp;
         memcpy(&ivi->mac, vp->mac, ETH_ALEN);
-        ivi->vlan = vp->vlan;
+        ivi->vlan = qlcnic_sriov_get_vf_vlan(adapter, vp, vf);
         ivi->qos = vp->qos;
         ivi->spoofchk = vp->spoofchk;
         if (vp->max_tx_bw == MAX_BW)
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 4106a743ca74..880015cae6a3 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -6468,6 +6468,8 @@ static int rtl8169_close(struct net_device *dev)
         rtl8169_down(dev);
         rtl_unlock_work(tp);
 
+        cancel_work_sync(&tp->wk.work);
+
         free_irq(pdev->irq, dev);
 
         dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
@@ -6793,8 +6795,6 @@ static void rtl_remove_one(struct pci_dev *pdev)
                 rtl8168_driver_stop(tp);
         }
 
-        cancel_work_sync(&tp->wk.work);
-
         netif_napi_del(&tp->napi);
 
         unregister_netdev(dev);
diff --git a/drivers/net/ethernet/sfc/filter.c b/drivers/net/ethernet/sfc/filter.c
index b74a60ab9ac7..2a469b27a506 100644
--- a/drivers/net/ethernet/sfc/filter.c
+++ b/drivers/net/ethernet/sfc/filter.c
@@ -1209,7 +1209,9 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
         EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + 4 * ip->ihl + 4);
         ports = (const __be16 *)(skb->data + nhoff + 4 * ip->ihl);
 
-        efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT, 0, rxq_index);
+        efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT,
+                           efx->rx_scatter ? EFX_FILTER_FLAG_RX_SCATTER : 0,
+                           rxq_index);
         rc = efx_filter_set_ipv4_full(&spec, ip->protocol,
                                       ip->daddr, ports[1], ip->saddr, ports[0]);
         if (rc)
diff --git a/drivers/net/phy/mdio-sun4i.c b/drivers/net/phy/mdio-sun4i.c
index 61d3f4ebf52e..7f25e49ae37f 100644
--- a/drivers/net/phy/mdio-sun4i.c
+++ b/drivers/net/phy/mdio-sun4i.c
@@ -40,7 +40,7 @@ struct sun4i_mdio_data {
 static int sun4i_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
 {
         struct sun4i_mdio_data *data = bus->priv;
-        unsigned long start_jiffies;
+        unsigned long timeout_jiffies;
         int value;
 
         /* issue the phy address and reg */
@@ -49,10 +49,9 @@ static int sun4i_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
         writel(0x1, data->membase + EMAC_MAC_MCMD_REG);
 
         /* Wait read complete */
-        start_jiffies = jiffies;
+        timeout_jiffies = jiffies + MDIO_TIMEOUT;
         while (readl(data->membase + EMAC_MAC_MIND_REG) & 0x1) {
-                if (time_after(start_jiffies,
-                               start_jiffies + MDIO_TIMEOUT))
+                if (time_is_before_jiffies(timeout_jiffies))
                         return -ETIMEDOUT;
                 msleep(1);
         }
@@ -69,7 +68,7 @@ static int sun4i_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
                             u16 value)
 {
         struct sun4i_mdio_data *data = bus->priv;
-        unsigned long start_jiffies;
+        unsigned long timeout_jiffies;
 
         /* issue the phy address and reg */
         writel((mii_id << 8) | regnum, data->membase + EMAC_MAC_MADR_REG);
@@ -77,10 +76,9 @@ static int sun4i_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
         writel(0x1, data->membase + EMAC_MAC_MCMD_REG);
 
         /* Wait read complete */
-        start_jiffies = jiffies;
+        timeout_jiffies = jiffies + MDIO_TIMEOUT;
         while (readl(data->membase + EMAC_MAC_MIND_REG) & 0x1) {
-                if (time_after(start_jiffies,
-                               start_jiffies + MDIO_TIMEOUT))
+                if (time_is_before_jiffies(timeout_jiffies))
                         return -ETIMEDOUT;
                 msleep(1);
         }
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 1e3c302d94fe..2bc87e3a8141 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1029,10 +1029,10 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->mii.supports_gmii = 1;
 
         dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                              NETIF_F_RXCSUM;
 
         dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                                 NETIF_F_RXCSUM;
 
         /* Enable checksum offload */
         *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
@@ -1173,7 +1173,6 @@ ax88179_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
         if (((skb->len + 8) % frame_size) == 0)
                 tx_hdr2 |= 0x80008000;  /* Enable padding */
 
-        skb_linearize(skb);
         headroom = skb_headroom(skb);
         tailroom = skb_tailroom(skb);
 
@@ -1317,10 +1316,10 @@ static int ax88179_reset(struct usbnet *dev)
                           1, 1, tmp);
 
         dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                              NETIF_F_RXCSUM;
 
         dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                                 NETIF_F_RXCSUM;
 
         /* Enable checksum offload */
         *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 75409748c774..66ebbacf066f 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -45,7 +45,6 @@
 #define EEPROM_MAC_OFFSET               (0x01)
 #define DEFAULT_TX_CSUM_ENABLE          (true)
 #define DEFAULT_RX_CSUM_ENABLE          (true)
-#define DEFAULT_TSO_ENABLE              (true)
 #define SMSC75XX_INTERNAL_PHY_ID        (1)
 #define SMSC75XX_TX_OVERHEAD            (8)
 #define MAX_RX_FIFO_SIZE                (20 * 1024)
@@ -1410,17 +1409,14 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
 
         INIT_WORK(&pdata->set_multicast, smsc75xx_deferred_multicast_write);
 
-        if (DEFAULT_TX_CSUM_ENABLE) {
+        if (DEFAULT_TX_CSUM_ENABLE)
                 dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
-                if (DEFAULT_TSO_ENABLE)
-                        dev->net->features |= NETIF_F_SG |
-                                NETIF_F_TSO | NETIF_F_TSO6;
-        }
+
         if (DEFAULT_RX_CSUM_ENABLE)
                 dev->net->features |= NETIF_F_RXCSUM;
 
         dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_RXCSUM;
+                                NETIF_F_RXCSUM;
 
         ret = smsc75xx_wait_ready(dev, 0);
         if (ret < 0) {
@@ -2200,8 +2196,6 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
 {
         u32 tx_cmd_a, tx_cmd_b;
 
-        skb_linearize(skb);
-
         if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
                 struct sk_buff *skb2 =
                         skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index da866523cf20..eee1f19ef1e9 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -269,6 +269,7 @@ static void veth_setup(struct net_device *dev)
         dev->ethtool_ops = &veth_ethtool_ops;
         dev->features |= NETIF_F_LLTX;
         dev->features |= VETH_FEATURES;
+        dev->vlan_features = dev->features;
         dev->destructor = veth_dev_free;
 
         dev->hw_features = VETH_FEATURES;
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index a5ba8dd7e6be..f4c6db419ddb 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -136,7 +136,8 @@ struct vxlan_dev {
         u32               flags;        /* VXLAN_F_* below */
 
         struct work_struct sock_work;
-        struct work_struct igmp_work;
+        struct work_struct igmp_join;
+        struct work_struct igmp_leave;
 
         unsigned long     age_interval;
         struct timer_list age_timer;
@@ -736,7 +737,6 @@ static bool vxlan_snoop(struct net_device *dev,
         return false;
 }
 
-
 /* See if multicast group is already in use by other ID */
 static bool vxlan_group_used(struct vxlan_net *vn, __be32 remote_ip)
 {
@@ -770,12 +770,13 @@ static void vxlan_sock_release(struct vxlan_net *vn, struct vxlan_sock *vs)
         queue_work(vxlan_wq, &vs->del_work);
 }
 
-/* Callback to update multicast group membership.
- * Scheduled when vxlan goes up/down.
+/* Callback to update multicast group membership when first VNI on
+ * multicast asddress is brought up
+ * Done as workqueue because ip_mc_join_group acquires RTNL.
  */
-static void vxlan_igmp_work(struct work_struct *work)
+static void vxlan_igmp_join(struct work_struct *work)
 {
-        struct vxlan_dev *vxlan = container_of(work, struct vxlan_dev, igmp_work);
+        struct vxlan_dev *vxlan = container_of(work, struct vxlan_dev, igmp_join);
         struct vxlan_net *vn = net_generic(dev_net(vxlan->dev), vxlan_net_id);
         struct vxlan_sock *vs = vxlan->vn_sock;
         struct sock *sk = vs->sock->sk;
@@ -785,10 +786,27 @@ static void vxlan_igmp_work(struct work_struct *work)
         };
 
         lock_sock(sk);
-        if (vxlan_group_used(vn, vxlan->default_dst.remote_ip))
-                ip_mc_join_group(sk, &mreq);
-        else
-                ip_mc_leave_group(sk, &mreq);
+        ip_mc_join_group(sk, &mreq);
+        release_sock(sk);
+
+        vxlan_sock_release(vn, vs);
+        dev_put(vxlan->dev);
+}
+
+/* Inverse of vxlan_igmp_join when last VNI is brought down */
+static void vxlan_igmp_leave(struct work_struct *work)
+{
+        struct vxlan_dev *vxlan = container_of(work, struct vxlan_dev, igmp_leave);
+        struct vxlan_net *vn = net_generic(dev_net(vxlan->dev), vxlan_net_id);
+        struct vxlan_sock *vs = vxlan->vn_sock;
+        struct sock *sk = vs->sock->sk;
+        struct ip_mreqn mreq = {
+                .imr_multiaddr.s_addr   = vxlan->default_dst.remote_ip,
+                .imr_ifindex            = vxlan->default_dst.remote_ifindex,
+        };
+
+        lock_sock(sk);
+        ip_mc_leave_group(sk, &mreq);
         release_sock(sk);
 
         vxlan_sock_release(vn, vs);
@@ -1359,6 +1377,7 @@ static void vxlan_uninit(struct net_device *dev)
 /* Start ageing timer and join group when device is brought up */
 static int vxlan_open(struct net_device *dev)
 {
+        struct vxlan_net *vn = net_generic(dev_net(dev), vxlan_net_id);
         struct vxlan_dev *vxlan = netdev_priv(dev);
         struct vxlan_sock *vs = vxlan->vn_sock;
 
@@ -1366,10 +1385,11 @@ static int vxlan_open(struct net_device *dev)
         if (!vs)
                 return -ENOTCONN;
 
-        if (IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip))) {
+        if (IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip)) &&
+            ! vxlan_group_used(vn, vxlan->default_dst.remote_ip)) {
                 vxlan_sock_hold(vs);
                 dev_hold(dev);
-                queue_work(vxlan_wq, &vxlan->igmp_work);
+                queue_work(vxlan_wq, &vxlan->igmp_join);
         }
 
         if (vxlan->age_interval)
@@ -1400,13 +1420,15 @@ static void vxlan_flush(struct vxlan_dev *vxlan)
 /* Cleanup timer and forwarding table on shutdown */
 static int vxlan_stop(struct net_device *dev)
 {
+        struct vxlan_net *vn = net_generic(dev_net(dev), vxlan_net_id);
         struct vxlan_dev *vxlan = netdev_priv(dev);
         struct vxlan_sock *vs = vxlan->vn_sock;
 
-        if (vs && IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip))) {
+        if (vs && IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip)) &&
+            ! vxlan_group_used(vn, vxlan->default_dst.remote_ip)) {
                 vxlan_sock_hold(vs);
                 dev_hold(dev);
-                queue_work(vxlan_wq, &vxlan->igmp_work);
+                queue_work(vxlan_wq, &vxlan->igmp_leave);
         }
 
         del_timer_sync(&vxlan->age_timer);
@@ -1471,7 +1493,8 @@ static void vxlan_setup(struct net_device *dev)
 
         INIT_LIST_HEAD(&vxlan->next);
         spin_lock_init(&vxlan->hash_lock);
-        INIT_WORK(&vxlan->igmp_work, vxlan_igmp_work);
+        INIT_WORK(&vxlan->igmp_join, vxlan_igmp_join);
+        INIT_WORK(&vxlan->igmp_leave, vxlan_igmp_leave);
         INIT_WORK(&vxlan->sock_work, vxlan_sock_work);
 
         init_timer_deferrable(&vxlan->age_timer);
@@ -1878,10 +1901,12 @@ static __net_exit void vxlan_exit_net(struct net *net)
 {
         struct vxlan_net *vn = net_generic(net, vxlan_net_id);
         struct vxlan_dev *vxlan;
+        LIST_HEAD(list);
 
         rtnl_lock();
         list_for_each_entry(vxlan, &vn->vxlan_list, next)
-                dev_close(vxlan->dev);
+                unregister_netdevice_queue(vxlan->dev, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
 }
 
diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
index 81b686c6a376..40825d43322e 100644
--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
@@ -325,7 +325,7 @@ ath5k_prepare_multicast(struct ieee80211_hw *hw,
         struct netdev_hw_addr *ha;
 
         mfilt[0] = 0;
-        mfilt[1] = 1;
+        mfilt[1] = 0;
 
         netdev_hw_addr_list_for_each(ha, mc_list) {
                 /* calculate XOR of eight 6-bit values */
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index d1acfe98918a..1576d58291d4 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -610,7 +610,15 @@ static void ar5008_hw_override_ini(struct ath_hw *ah,
         REG_SET_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
 
         if (AR_SREV_9280_20_OR_LATER(ah)) {
-                val = REG_READ(ah, AR_PCU_MISC_MODE2);
+                /*
+                 * For AR9280 and above, there is a new feature that allows
+                 * Multicast search based on both MAC Address and Key ID.
+                 * By default, this feature is enabled. But since the driver
+                 * is not using this feature, we switch it off; otherwise
+                 * multicast search based on MAC addr only will fail.
+                 */
+                val = REG_READ(ah, AR_PCU_MISC_MODE2) &
+                        (~AR_ADHOC_MCAST_KEYID_ENABLE);
 
                 if (!AR_SREV_9271(ah))
                         val &= ~AR_PCU_MISC_MODE2_HWWAR1;
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 9e582e14da74..5205a3625e84 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1082,7 +1082,7 @@ static void ath9k_hif_usb_firmware_fail(struct hif_device_usb *hif_dev)
         struct device *dev = &hif_dev->udev->dev;
         struct device *parent = dev->parent;
 
-        complete(&hif_dev->fw_done);
+        complete_all(&hif_dev->fw_done);
 
         if (parent)
                 device_lock(parent);
@@ -1131,7 +1131,7 @@ static void ath9k_hif_usb_firmware_cb(const struct firmware *fw, void *context)
 
         release_firmware(fw);
         hif_dev->flags |= HIF_USB_READY;
-        complete(&hif_dev->fw_done);
+        complete_all(&hif_dev->fw_done);
 
         return;
 
@@ -1295,7 +1295,9 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
 
         usb_set_intfdata(interface, NULL);
 
-        if (!unplugged && (hif_dev->flags & HIF_USB_START))
+        /* If firmware was loaded we should drop it
+         * go back to first stage bootloader. */
+        if (!unplugged && (hif_dev->flags & HIF_USB_READY))
                 ath9k_hif_usb_reboot(udev);
 
         kfree(hif_dev);
@@ -1316,7 +1318,10 @@ static int ath9k_hif_usb_suspend(struct usb_interface *interface,
         if (!(hif_dev->flags & HIF_USB_START))
                 ath9k_htc_suspend(hif_dev->htc_handle);
 
-        ath9k_hif_usb_dealloc_urbs(hif_dev);
+        wait_for_completion(&hif_dev->fw_done);
+
+        if (hif_dev->flags & HIF_USB_READY)
+                ath9k_hif_usb_dealloc_urbs(hif_dev);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 71a183ffc77f..c3676bf1d6c4 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -861,6 +861,7 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv,
         if (error != 0)
                 goto err_rx;
 
+        ath9k_hw_disable(priv->ah);
 #ifdef CONFIG_MAC80211_LEDS
         /* must be initialized before ieee80211_register_hw */
         priv->led_cdev.default_trigger = ieee80211_create_tpt_led_trigger(priv->hw,
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index c59ae43b9b35..927992732620 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -146,6 +146,28 @@ static void ath_set_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
                                ARRAY_SIZE(bf->rates));
 }
 
+static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
+                             struct sk_buff *skb)
+{
+        int q;
+
+        q = skb_get_queue_mapping(skb);
+        if (txq == sc->tx.uapsdq)
+                txq = sc->tx.txq_map[q];
+
+        if (txq != sc->tx.txq_map[q])
+                return;
+
+        if (WARN_ON(--txq->pending_frames < 0))
+                txq->pending_frames = 0;
+
+        if (txq->stopped &&
+            txq->pending_frames < sc->tx.txq_max_pending[q]) {
+                ieee80211_wake_queue(sc->hw, q);
+                txq->stopped = false;
+        }
+}
+
 static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
 {
         struct ath_txq *txq = tid->ac->txq;
@@ -167,6 +189,7 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
                 if (!bf) {
                         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
                         if (!bf) {
+                                ath_txq_skb_done(sc, txq, skb);
                                 ieee80211_free_txskb(sc->hw, skb);
                                 continue;
                         }
@@ -811,6 +834,7 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
 
                 if (!bf) {
                         __skb_unlink(skb, &tid->buf_q);
+                        ath_txq_skb_done(sc, txq, skb);
                         ieee80211_free_txskb(sc->hw, skb);
                         continue;
                 }
@@ -1824,6 +1848,7 @@ static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_txq *txq,
 
         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
         if (!bf) {
+                ath_txq_skb_done(sc, txq, skb);
                 ieee80211_free_txskb(sc->hw, skb);
                 return;
         }
@@ -2090,6 +2115,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
 
         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
         if (!bf) {
+                ath_txq_skb_done(sc, txq, skb);
                 if (txctl->paprd)
                         dev_kfree_skb_any(skb);
                 else
@@ -2189,7 +2215,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
-        int q, padpos, padsize;
+        int padpos, padsize;
         unsigned long flags;
 
         ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
@@ -2225,21 +2251,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
 
         __skb_queue_tail(&txq->complete_q, skb);
-
-        q = skb_get_queue_mapping(skb);
-        if (txq == sc->tx.uapsdq)
-                txq = sc->tx.txq_map[q];
-
-        if (txq == sc->tx.txq_map[q]) {
-                if (WARN_ON(--txq->pending_frames < 0))
-                        txq->pending_frames = 0;
-
-                if (txq->stopped &&
-                    txq->pending_frames < sc->tx.txq_max_pending[q]) {
-                        ieee80211_wake_queue(sc->hw, q);
-                        txq->stopped = false;
-                }
-        }
+        ath_txq_skb_done(sc, txq, skb);
 }
 
 static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index e8308ec30970..ab636767fbde 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -145,7 +145,7 @@ static void wil_print_ring(struct seq_file *s, const char *prefix,
                                    le16_to_cpu(hdr.type), hdr.flags);
                         if (len <= MAX_MBOXITEM_SIZE) {
                                 int n = 0;
-                                unsigned char printbuf[16 * 3 + 2];
+                                char printbuf[16 * 3 + 2];
                                 unsigned char databuf[MAX_MBOXITEM_SIZE];
                                 void __iomem *src = wmi_buffer(wil, d.addr) +
                                         sizeof(struct wil6210_mbox_hdr);
@@ -416,7 +416,7 @@ static int wil_txdesc_debugfs_show(struct seq_file *s, void *data)
                 seq_printf(s, "  SKB = %p\n", skb);
 
                 if (skb) {
-                        unsigned char printbuf[16 * 3 + 2];
+                        char printbuf[16 * 3 + 2];
                         int i = 0;
                         int len = le16_to_cpu(d->dma.length);
                         void *p = skb->data;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 8e8975562ec3..80099016d21f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -242,7 +242,7 @@ void brcmf_txflowblock_if(struct brcmf_if *ifp,
 {
         unsigned long flags;
 
-        if (!ifp)
+        if (!ifp || !ifp->ndev)
                 return;
 
         brcmf_dbg(TRACE, "enter: idx=%d stop=0x%X reason=%d state=%d\n",
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index f0d9f7f6c83d..29b1f24c2d0f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -1744,13 +1744,14 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
         ulong flags;
         int fifo = BRCMF_FWS_FIFO_BCMC;
         bool multicast = is_multicast_ether_addr(eh->h_dest);
+        bool pae = eh->h_proto == htons(ETH_P_PAE);
 
         /* determine the priority */
         if (!skb->priority)
                 skb->priority = cfg80211_classify8021d(skb);
 
         drvr->tx_multicast += !!multicast;
-        if (ntohs(eh->h_proto) == ETH_P_PAE)
+        if (pae)
                 atomic_inc(&ifp->pend_8021x_cnt);
 
         if (!brcmf_fws_fc_active(fws)) {
@@ -1781,6 +1782,11 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
                 brcmf_fws_schedule_deq(fws);
         } else {
                 brcmf_err("drop skb: no hanger slot\n");
+                if (pae) {
+                        atomic_dec(&ifp->pend_8021x_cnt);
+                        if (waitqueue_active(&ifp->pend_8021x_wait))
+                                wake_up(&ifp->pend_8021x_wait);
+                }
                 brcmu_pkt_buf_free_skb(skb);
         }
         brcmf_fws_unlock(drvr, flags);
diff --git a/drivers/net/wireless/cw1200/txrx.c b/drivers/net/wireless/cw1200/txrx.c
index 5862c373d714..e824d4d4a18d 100644
--- a/drivers/net/wireless/cw1200/txrx.c
+++ b/drivers/net/wireless/cw1200/txrx.c
@@ -1165,7 +1165,7 @@ void cw1200_rx_cb(struct cw1200_common *priv,
                 if (cw1200_handle_action_rx(priv, skb))
                         return;
         } else if (ieee80211_is_beacon(frame->frame_control) &&
-                   !arg->status &&
+                   !arg->status && priv->vif &&
                    !memcmp(ieee80211_get_SA(frame), priv->vif->bss_conf.bssid,
                            ETH_ALEN)) {
                 const u8 *tim_ie;
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 3952ddf2ddb2..1531a4fc0960 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -758,7 +758,7 @@ int iwl_alive_start(struct iwl_priv *priv)
                                          BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
                 if (ret)
                         return ret;
-        } else {
+        } else if (priv->lib->bt_params) {
                 /*
                  * default is 2-wire BT coexexistence support
                  */
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index e56ed2a84888..c24a744910ac 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -988,7 +988,11 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         char buf[100];
 
-        if (!dbgfs_dir)
+        /*
+         * Check if debugfs directory already exist before creating it.
+         * This may happen when, for example, resetting hw or suspend-resume
+         */
+        if (!dbgfs_dir || mvmvif->dbgfs_dir)
                 return;
 
         mvmvif->dbgfs_dir = debugfs_create_dir("iwlmvm", dbgfs_dir);
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index e08683b20531..1eedc424051c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -257,7 +257,11 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         if (ret)
                 return ret;
 
-        return ieee80211_register_hw(mvm->hw);
+        ret = ieee80211_register_hw(mvm->hw);
+        if (ret)
+                iwl_mvm_leds_exit(mvm);
+
+        return ret;
 }
 
 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
@@ -385,6 +389,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
         ieee80211_wake_queues(mvm->hw);
 
         mvm->vif_count = 0;
+        mvm->rx_ba_sessions = 0;
 }
 
 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
@@ -1006,6 +1011,21 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
         mutex_lock(&mvm->mutex);
         if (old_state == IEEE80211_STA_NOTEXIST &&
             new_state == IEEE80211_STA_NONE) {
+                /*
+                 * Firmware bug - it'll crash if the beacon interval is less
+                 * than 16. We can't avoid connecting at all, so refuse the
+                 * station state change, this will cause mac80211 to abandon
+                 * attempts to connect to this AP, and eventually wpa_s will
+                 * blacklist the AP...
+                 */
+                if (vif->type == NL80211_IFTYPE_STATION &&
+                    vif->bss_conf.beacon_int < 16) {
+                        IWL_ERR(mvm,
+                                "AP %pM beacon interval is %d, refusing due to firmware bug!\n",
+                                sta->addr, vif->bss_conf.beacon_int);
+                        ret = -EINVAL;
+                        goto out_unlock;
+                }
                 ret = iwl_mvm_add_sta(mvm, vif, sta);
         } else if (old_state == IEEE80211_STA_NONE &&
                    new_state == IEEE80211_STA_AUTH) {
@@ -1038,6 +1058,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
         } else {
                 ret = -EIO;
         }
+ out_unlock:
         mutex_unlock(&mvm->mutex);
 
         return ret;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index d40d7db185d6..420e82d379d9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -419,6 +419,7 @@ struct iwl_mvm {
         struct work_struct sta_drained_wk;
         unsigned long sta_drained[BITS_TO_LONGS(IWL_MVM_STATION_COUNT)];
         atomic_t pending_frames[IWL_MVM_STATION_COUNT];
+        u8 rx_ba_sessions;
 
         /* configured by mac80211 */
         u32 rts_threshold;
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 2157b0f8ced5..268f027b45b0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -137,8 +137,8 @@ static void iwl_mvm_scan_fill_ssids(struct iwl_scan_cmd *cmd,
 {
         int fw_idx, req_idx;
 
-        fw_idx = 0;
-        for (req_idx = req->n_ssids - 1; req_idx > 0; req_idx--) {
+        for (req_idx = req->n_ssids - 1, fw_idx = 0; req_idx > 0;
+             req_idx--, fw_idx++) {
                 cmd->direct_scan[fw_idx].id = WLAN_EID_SSID;
                 cmd->direct_scan[fw_idx].len = req->ssids[req_idx].ssid_len;
                 memcpy(cmd->direct_scan[fw_idx].ssid,
@@ -153,7 +153,9 @@ static void iwl_mvm_scan_fill_ssids(struct iwl_scan_cmd *cmd,
  * just to notify that this scan is active and not passive.
  * In order to notify the FW of the number of SSIDs we wish to scan (including
  * the zero-length one), we need to set the corresponding bits in chan->type,
- * one for each SSID, and set the active bit (first).
+ * one for each SSID, and set the active bit (first). The first SSID is already
+ * included in the probe template, so we need to set only req->n_ssids - 1 bits
+ * in addition to the first bit.
  */
 static u16 iwl_mvm_get_active_dwell(enum ieee80211_band band, int n_ssids)
 {
@@ -179,7 +181,7 @@ static void iwl_mvm_scan_fill_channels(struct iwl_scan_cmd *cmd,
         __le32 chan_type_value;
 
         if (req->n_ssids > 0)
-                chan_type_value = cpu_to_le32(BIT(req->n_ssids + 1) - 1);
+                chan_type_value = cpu_to_le32(BIT(req->n_ssids) - 1);
         else
                 chan_type_value = SCAN_CHANNEL_TYPE_PASSIVE;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 62fe5209093b..85d4bbe52157 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -608,6 +608,8 @@ int iwl_mvm_rm_bcast_sta(struct iwl_mvm *mvm, struct iwl_mvm_int_sta *bsta)
         return ret;
 }
 
+#define IWL_MAX_RX_BA_SESSIONS 16
+
 int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                        int tid, u16 ssn, bool start)
 {
@@ -618,11 +620,20 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
         lockdep_assert_held(&mvm->mutex);
 
+        if (start && mvm->rx_ba_sessions >= IWL_MAX_RX_BA_SESSIONS) {
+                IWL_WARN(mvm, "Not enough RX BA SESSIONS\n");
+                return -ENOSPC;
+        }
+
         cmd.mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color);
         cmd.sta_id = mvm_sta->sta_id;
         cmd.add_modify = STA_MODE_MODIFY;
-        cmd.add_immediate_ba_tid = (u8) tid;
-        cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
+        if (start) {
+                cmd.add_immediate_ba_tid = (u8) tid;
+                cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
+        } else {
+                cmd.remove_immediate_ba_tid = (u8) tid;
+        }
         cmd.modify_mask = start ? STA_MODIFY_ADD_BA_TID :
                                   STA_MODIFY_REMOVE_BA_TID;
 
@@ -648,6 +659,14 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 break;
         }
 
+        if (!ret) {
+                if (start)
+                        mvm->rx_ba_sessions++;
+                else if (mvm->rx_ba_sessions > 0)
+                        /* check that restart flow didn't zero the counter */
+                        mvm->rx_ba_sessions--;
+        }
+
         return ret;
 }
 
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index caaf4bd56b30..2cf8b964e966 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -693,7 +693,7 @@ int mwifiex_dnld_fw(struct mwifiex_adapter *adapter,
                 if (!ret) {
                         dev_notice(adapter->dev,
                                    "WLAN FW already running! Skip FW dnld\n");
-                        goto done;
+                        return 0;
                 }
 
                 poll_num = MAX_FIRMWARE_POLL_TRIES;
@@ -719,14 +719,8 @@ int mwifiex_dnld_fw(struct mwifiex_adapter *adapter,
 poll_fw:
         /* Check if the firmware is downloaded successfully or not */
         ret = adapter->if_ops.check_fw_status(adapter, poll_num);
-        if (ret) {
+        if (ret)
                 dev_err(adapter->dev, "FW failed to be active in time\n");
-                return -1;
-        }
-done:
-        /* re-enable host interrupt for mwifiex after fw dnld is successful */
-        if (adapter->if_ops.enable_int)
-                adapter->if_ops.enable_int(adapter);
 
         return ret;
 }
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index e15ab72fb03d..1753431de361 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -427,6 +427,10 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
                                 "Cal data request_firmware() failed\n");
         }
 
+        /* enable host interrupt after fw dnld is successful */
+        if (adapter->if_ops.enable_int)
+                adapter->if_ops.enable_int(adapter);
+
         adapter->init_wait_q_woken = false;
         ret = mwifiex_init_fw(adapter);
         if (ret == -1) {
@@ -478,6 +482,8 @@ err_add_intf:
         mwifiex_del_virtual_intf(adapter->wiphy, priv->wdev);
         rtnl_unlock();
 err_init_fw:
+        if (adapter->if_ops.disable_int)
+                adapter->if_ops.disable_int(adapter);
         pr_debug("info: %s: unregister device\n", __func__);
         adapter->if_ops.unregister_dev(adapter);
 done:
@@ -855,7 +861,7 @@ mwifiex_add_card(void *card, struct semaphore *sem,
         INIT_WORK(&adapter->main_work, mwifiex_main_work_queue);
 
         /* Register the device. Fill up the private data structure with relevant
-           information from the card and request for the required IRQ. */
+           information from the card. */
         if (adapter->if_ops.register_dev(adapter)) {
                 pr_err("%s: failed to register mwifiex device\n", __func__);
                 goto err_registerdev;
@@ -919,6 +925,11 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
         if (!adapter)
                 goto exit_remove;
 
+        /* We can no longer handle interrupts once we start doing the teardown
+         * below. */
+        if (adapter->if_ops.disable_int)
+                adapter->if_ops.disable_int(adapter);
+
         adapter->surprise_removed = true;
 
         /* Stop data */
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 3da73d36acdf..253e0bd38e25 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -601,6 +601,7 @@ struct mwifiex_if_ops {
         int (*register_dev) (struct mwifiex_adapter *);
         void (*unregister_dev) (struct mwifiex_adapter *);
         int (*enable_int) (struct mwifiex_adapter *);
+        void (*disable_int) (struct mwifiex_adapter *);
         int (*process_int_status) (struct mwifiex_adapter *);
         int (*host_to_card) (struct mwifiex_adapter *, u8, struct sk_buff *,
                              struct mwifiex_tx_param *);
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 5ee5ed02eccd..5ef49f2e375a 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -51,6 +51,7 @@ static struct mwifiex_if_ops sdio_ops;
 static struct semaphore add_remove_card_sem;
 
 static int mwifiex_sdio_resume(struct device *dev);
+static void mwifiex_sdio_interrupt(struct sdio_func *func);
 
 /*
  * SDIO probe.
@@ -296,6 +297,15 @@ static struct sdio_driver mwifiex_sdio = {
         }
 };
 
+/* Write data into SDIO card register. Caller claims SDIO device. */
+static int
+mwifiex_write_reg_locked(struct sdio_func *func, u32 reg, u8 data)
+{
+        int ret = -1;
+        sdio_writeb(func, data, reg, &ret);
+        return ret;
+}
+
 /*
  * This function writes data into SDIO card register.
  */
@@ -303,10 +313,10 @@ static int
 mwifiex_write_reg(struct mwifiex_adapter *adapter, u32 reg, u8 data)
 {
         struct sdio_mmc_card *card = adapter->card;
-        int ret = -1;
+        int ret;
 
         sdio_claim_host(card->func);
-        sdio_writeb(card->func, data, reg, &ret);
+        ret = mwifiex_write_reg_locked(card->func, reg, data);
         sdio_release_host(card->func);
 
         return ret;
@@ -685,23 +695,15 @@ mwifiex_sdio_read_fw_status(struct mwifiex_adapter *adapter, u16 *dat)
  * The host interrupt mask is read, the disable bit is reset and
  * written back to the card host interrupt mask register.
  */
-static int mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
+static void mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
 {
-        u8 host_int_mask, host_int_disable = HOST_INT_DISABLE;
-
-        /* Read back the host_int_mask register */
-        if (mwifiex_read_reg(adapter, HOST_INT_MASK_REG, &host_int_mask))
-                return -1;
-
-        /* Update with the mask and write back to the register */
-        host_int_mask &= ~host_int_disable;
-
-        if (mwifiex_write_reg(adapter, HOST_INT_MASK_REG, host_int_mask)) {
-                dev_err(adapter->dev, "disable host interrupt failed\n");
-                return -1;
-        }
+        struct sdio_mmc_card *card = adapter->card;
+        struct sdio_func *func = card->func;
 
-        return 0;
+        sdio_claim_host(func);
+        mwifiex_write_reg_locked(func, HOST_INT_MASK_REG, 0);
+        sdio_release_irq(func);
+        sdio_release_host(func);
 }
 
 /*
@@ -713,14 +715,29 @@ static int mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
 static int mwifiex_sdio_enable_host_int(struct mwifiex_adapter *adapter)
 {
         struct sdio_mmc_card *card = adapter->card;
+        struct sdio_func *func = card->func;
+        int ret;
+
+        sdio_claim_host(func);
+
+        /* Request the SDIO IRQ */
+        ret = sdio_claim_irq(func, mwifiex_sdio_interrupt);
+        if (ret) {
+                dev_err(adapter->dev, "claim irq failed: ret=%d\n", ret);
+                goto out;
+        }
 
         /* Simply write the mask to the register */
-        if (mwifiex_write_reg(adapter, HOST_INT_MASK_REG,
-                              card->reg->host_int_enable)) {
+        ret = mwifiex_write_reg_locked(func, HOST_INT_MASK_REG,
+                                       card->reg->host_int_enable);
+        if (ret) {
                 dev_err(adapter->dev, "enable host interrupt failed\n");
-                return -1;
+                sdio_release_irq(func);
         }
-        return 0;
+
+out:
+        sdio_release_host(func);
+        return ret;
 }
 
 /*
@@ -997,9 +1014,6 @@ mwifiex_sdio_interrupt(struct sdio_func *func)
         }
         adapter = card->adapter;
 
-        if (adapter->surprise_removed)
-                return;
-
         if (!adapter->pps_uapsd_mode && adapter->ps_state == PS_STATE_SLEEP)
                 adapter->ps_state = PS_STATE_AWAKE;
 
@@ -1728,9 +1742,7 @@ mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
         struct sdio_mmc_card *card = adapter->card;
 
         if (adapter->card) {
-                /* Release the SDIO IRQ */
                 sdio_claim_host(card->func);
-                sdio_release_irq(card->func);
                 sdio_disable_func(card->func);
                 sdio_release_host(card->func);
                 sdio_set_drvdata(card->func, NULL);
@@ -1744,7 +1756,7 @@ mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
  */
 static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
 {
-        int ret = 0;
+        int ret;
         struct sdio_mmc_card *card = adapter->card;
         struct sdio_func *func = card->func;
 
@@ -1753,22 +1765,14 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
 
         sdio_claim_host(func);
 
-        /* Request the SDIO IRQ */
-        ret = sdio_claim_irq(func, mwifiex_sdio_interrupt);
-        if (ret) {
-                pr_err("claim irq failed: ret=%d\n", ret);
-                goto disable_func;
-        }
-
         /* Set block size */
         ret = sdio_set_block_size(card->func, MWIFIEX_SDIO_BLOCK_SIZE);
+        sdio_release_host(func);
         if (ret) {
                 pr_err("cannot set SDIO block size\n");
-                ret = -1;
-                goto release_irq;
+                return ret;
         }
 
-        sdio_release_host(func);
         sdio_set_drvdata(func, card);
 
         adapter->dev = &func->dev;
@@ -1776,15 +1780,6 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
         strcpy(adapter->fw_name, card->firmware);
 
         return 0;
-
-release_irq:
-        sdio_release_irq(func);
-disable_func:
-        sdio_disable_func(func);
-        sdio_release_host(func);
-        adapter->card = NULL;
-
-        return -1;
 }
 
 /*
@@ -1813,9 +1808,6 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
          */
         mwifiex_read_reg(adapter, HOST_INTSTATUS_REG, &sdio_ireg);
 
-        /* Disable host interrupt mask register for SDIO */
-        mwifiex_sdio_disable_host_int(adapter);
-
         /* Get SDIO ioport */
         mwifiex_init_sdio_ioport(adapter);
 
@@ -1957,6 +1949,7 @@ static struct mwifiex_if_ops sdio_ops = {
         .register_dev = mwifiex_register_dev,
         .unregister_dev = mwifiex_unregister_dev,
         .enable_int = mwifiex_sdio_enable_host_int,
+        .disable_int = mwifiex_sdio_disable_host_int,
         .process_int_status = mwifiex_process_int_status,
         .host_to_card = mwifiex_sdio_host_to_card,
         .wakeup = mwifiex_pm_wakeup_card,
diff --git a/drivers/net/wireless/mwifiex/sdio.h b/drivers/net/wireless/mwifiex/sdio.h
index 6d51dfdd8251..532ae0ac4dfb 100644
--- a/drivers/net/wireless/mwifiex/sdio.h
+++ b/drivers/net/wireless/mwifiex/sdio.h
@@ -92,9 +92,6 @@
 /* Host Control Registers : Download host interrupt mask */
 #define DN_LD_HOST_INT_MASK             (0x2U)
 
-/* Disable Host interrupt mask */
-#define HOST_INT_DISABLE                0xff
-
 /* Host Control Registers : Host interrupt status */
 #define HOST_INTSTATUS_REG              0x03
 /* Host Control Registers : Upload host interrupt status */
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 9b915d3a44be..3e60a31582f8 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -1,6 +1,6 @@
 menuconfig RT2X00
         tristate "Ralink driver support"
-        depends on MAC80211
+        depends on MAC80211 && HAS_DMA
         ---help---
           This will enable the support for the Ralink drivers,
           developed in the rt2x00 project <http://rt2x00.serialmonkey.com>.
diff --git a/drivers/net/wireless/rtlwifi/Kconfig b/drivers/net/wireless/rtlwifi/Kconfig
index 7253de3d8c66..c2ffce7a907c 100644
--- a/drivers/net/wireless/rtlwifi/Kconfig
+++ b/drivers/net/wireless/rtlwifi/Kconfig
@@ -1,27 +1,20 @@
-config RTLWIFI
-        tristate "Realtek wireless card support"
-        depends on MAC80211
-        select FW_LOADER
-        ---help---
-          This is common code for RTL8192CE/RTL8192CU/RTL8192SE/RTL8723AE
-          drivers.  This module does nothing by itself - the various front-end
-          drivers need to be enabled to support any desired devices.
-
-          If you choose to build as a module, it'll be called rtlwifi.
-
-config RTLWIFI_DEBUG
-        bool "Debugging output for rtlwifi driver family"
-        depends on RTLWIFI
+menuconfig RTL_CARDS
+        tristate "Realtek rtlwifi family of devices"
+        depends on MAC80211 && (PCI || USB)
         default y
         ---help---
-        To use the module option that sets the dynamic-debugging level for,
-        the front-end driver, this parameter must be "Y". For memory-limited
-        systems, choose "N". If in doubt, choose "Y".
+          This option will enable support for the Realtek mac80211-based
+          wireless drivers. Drivers rtl8192ce, rtl8192cu, rtl8192se, rtl8192de,
+          rtl8723eu, and rtl8188eu share some common code.
+
+if RTL_CARDS
 
 config RTL8192CE
         tristate "Realtek RTL8192CE/RTL8188CE Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
         select RTL8192C_COMMON
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8192CE/RTL8188CE 802.11n PCIe
         wireless network adapters.
@@ -30,7 +23,9 @@ config RTL8192CE
 
 config RTL8192SE
         tristate "Realtek RTL8192SE/RTL8191SE PCIe Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8192SE/RTL8191SE 802.11n PCIe
         wireless network adapters.
@@ -39,7 +34,9 @@ config RTL8192SE
 
 config RTL8192DE
         tristate "Realtek RTL8192DE/RTL8188DE PCIe Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8192DE/RTL8188DE 802.11n PCIe
         wireless network adapters.
@@ -48,7 +45,9 @@ config RTL8192DE
 
 config RTL8723AE
         tristate "Realtek RTL8723AE PCIe Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8723AE 802.11n PCIe
         wireless network adapters.
@@ -57,7 +56,9 @@ config RTL8723AE
 
 config RTL8188EE
         tristate "Realtek RTL8188EE Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8188EE 802.11n PCIe
         wireless network adapters.
@@ -66,7 +67,9 @@ config RTL8188EE
 
 config RTL8192CU
         tristate "Realtek RTL8192CU/RTL8188CU USB Wireless Network Adapter"
-        depends on RTLWIFI && USB
+        depends on USB
+        select RTLWIFI
+        select RTLWIFI_USB
         select RTL8192C_COMMON
         ---help---
         This is the driver for Realtek RTL8192CU/RTL8188CU 802.11n USB
@@ -74,7 +77,28 @@ config RTL8192CU
 
         If you choose to build it as a module, it will be called rtl8192cu
 
+config RTLWIFI
+        tristate
+        select FW_LOADER
+
+config RTLWIFI_PCI
+        tristate
+
+config RTLWIFI_USB
+        tristate
+
+config RTLWIFI_DEBUG
+        bool "Debugging output for rtlwifi driver family"
+        depends on RTLWIFI
+        default y
+        ---help---
+        To use the module option that sets the dynamic-debugging level for,
+        the front-end driver, this parameter must be "Y". For memory-limited
+        systems, choose "N". If in doubt, choose "Y".
+
 config RTL8192C_COMMON
         tristate
         depends on RTL8192CE || RTL8192CU
-        default m
+        default y
+
+endif
diff --git a/drivers/net/wireless/rtlwifi/Makefile b/drivers/net/wireless/rtlwifi/Makefile
index ff02b874f8d8..d56f023a4b90 100644
--- a/drivers/net/wireless/rtlwifi/Makefile
+++ b/drivers/net/wireless/rtlwifi/Makefile
@@ -12,13 +12,11 @@ rtlwifi-objs	:=		\
 
 rtl8192c_common-objs +=         \
 
-ifneq ($(CONFIG_PCI),)
-rtlwifi-objs    += pci.o
-endif
+obj-$(CONFIG_RTLWIFI_PCI)       += rtl_pci.o
+rtl_pci-objs    :=              pci.o
 
-ifneq ($(CONFIG_USB),)
-rtlwifi-objs    += usb.o
-endif
+obj-$(CONFIG_RTLWIFI_USB)       += rtl_usb.o
+rtl_usb-objs    :=              usb.o
 
 obj-$(CONFIG_RTL8192C_COMMON)   += rtl8192c/
 obj-$(CONFIG_RTL8192CE)         += rtl8192ce/
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 9d558ac77b0c..7651f5acc14b 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -172,6 +172,7 @@ u8 rtl_tid_to_ac(u8 tid)
 {
         return tid_to_ac[tid];
 }
+EXPORT_SYMBOL_GPL(rtl_tid_to_ac);
 
 static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
                                   struct ieee80211_sta_ht_cap *ht_cap)
@@ -406,6 +407,7 @@ void rtl_deinit_deferred_work(struct ieee80211_hw *hw)
         cancel_delayed_work(&rtlpriv->works.ps_rfon_wq);
         cancel_delayed_work(&rtlpriv->works.fwevt_wq);
 }
+EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);
 
 void rtl_init_rfkill(struct ieee80211_hw *hw)
 {
@@ -439,6 +441,7 @@ void rtl_deinit_rfkill(struct ieee80211_hw *hw)
 {
         wiphy_rfkill_stop_polling(hw->wiphy);
 }
+EXPORT_SYMBOL_GPL(rtl_deinit_rfkill);
 
 int rtl_init_core(struct ieee80211_hw *hw)
 {
@@ -489,10 +492,12 @@ int rtl_init_core(struct ieee80211_hw *hw)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(rtl_init_core);
 
 void rtl_deinit_core(struct ieee80211_hw *hw)
 {
 }
+EXPORT_SYMBOL_GPL(rtl_deinit_core);
 
 void rtl_init_rx_config(struct ieee80211_hw *hw)
 {
@@ -501,6 +506,7 @@ void rtl_init_rx_config(struct ieee80211_hw *hw)
 
         rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_RCR, (u8 *) (&mac->rx_conf));
 }
+EXPORT_SYMBOL_GPL(rtl_init_rx_config);
 
 /*********************************************************
  *
@@ -879,6 +885,7 @@ bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         return true;
 }
+EXPORT_SYMBOL_GPL(rtl_tx_mgmt_proc);
 
 void rtl_get_tcb_desc(struct ieee80211_hw *hw,
                       struct ieee80211_tx_info *info,
@@ -1052,6 +1059,7 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
 
         return true;
 }
+EXPORT_SYMBOL_GPL(rtl_action_proc);
 
 /*should call before software enc*/
 u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
@@ -1125,6 +1133,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
 
         return false;
 }
+EXPORT_SYMBOL_GPL(rtl_is_special_data);
 
 /*********************************************************
  *
@@ -1300,6 +1309,7 @@ void rtl_beacon_statistic(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         rtlpriv->link_info.bcn_rx_inperiod++;
 }
+EXPORT_SYMBOL_GPL(rtl_beacon_statistic);
 
 void rtl_watchdog_wq_callback(void *data)
 {
@@ -1793,6 +1803,7 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len)
 
         mac->vendor = vendor;
 }
+EXPORT_SYMBOL_GPL(rtl_recognize_peer);
 
 /*********************************************************
  *
@@ -1849,6 +1860,7 @@ struct attribute_group rtl_attribute_group = {
         .name = "rtlsysfs",
         .attrs = rtl_sysfs_entries,
 };
+EXPORT_SYMBOL_GPL(rtl_attribute_group);
 
 MODULE_AUTHOR("lizhaoming       <chaoming_li@realsil.com.cn>");
 MODULE_AUTHOR("Realtek WlanFAE  <wlanfae@realtek.com>");
@@ -1856,7 +1868,8 @@ MODULE_AUTHOR("Larry Finger	<Larry.FInger@lwfinger.net>");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core");
 
-struct rtl_global_var global_var = {};
+struct rtl_global_var rtl_global_var = {};
+EXPORT_SYMBOL_GPL(rtl_global_var);
 
 static int __init rtl_core_module_init(void)
 {
@@ -1864,8 +1877,8 @@ static int __init rtl_core_module_init(void)
                 pr_err("Unable to register rtl_rc, use default RC !!\n");
 
         /* init some global vars */
-        INIT_LIST_HEAD(&global_var.glb_priv_list);
-        spin_lock_init(&global_var.glb_list_lock);
+        INIT_LIST_HEAD(&rtl_global_var.glb_priv_list);
+        spin_lock_init(&rtl_global_var.glb_list_lock);
 
         return 0;
 }
diff --git a/drivers/net/wireless/rtlwifi/base.h b/drivers/net/wireless/rtlwifi/base.h
index 8576bc34b032..0e5fe0902daf 100644
--- a/drivers/net/wireless/rtlwifi/base.h
+++ b/drivers/net/wireless/rtlwifi/base.h
@@ -147,7 +147,7 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len);
 u8 rtl_tid_to_ac(u8 tid);
 extern struct attribute_group rtl_attribute_group;
 void rtl_easy_concurrent_retrytimer_callback(unsigned long data);
-extern struct rtl_global_var global_var;
+extern struct rtl_global_var rtl_global_var;
 int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
                          bool isht, u8 desc_rate, bool first_ampdu);
 bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb);
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index ee84844be008..733b7ce7f0e2 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -1330,3 +1330,4 @@ const struct ieee80211_ops rtl_ops = {
         .rfkill_poll = rtl_op_rfkill_poll,
         .flush = rtl_op_flush,
 };
+EXPORT_SYMBOL_GPL(rtl_ops);
diff --git a/drivers/net/wireless/rtlwifi/debug.c b/drivers/net/wireless/rtlwifi/debug.c
index 7d52d3d7769f..76e2086e137e 100644
--- a/drivers/net/wireless/rtlwifi/debug.c
+++ b/drivers/net/wireless/rtlwifi/debug.c
@@ -51,3 +51,4 @@ void rtl_dbgp_flag_init(struct ieee80211_hw *hw)
 
         /*Init Debug flag enable condition */
 }
+EXPORT_SYMBOL_GPL(rtl_dbgp_flag_init);
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index 9e3894178e77..838a1ed3f194 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -229,6 +229,7 @@ void read_efuse_byte(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf)
 
         *pbuf = (u8) (value32 & 0xff);
 }
+EXPORT_SYMBOL_GPL(read_efuse_byte);
 
 void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
 {
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index c97e9d327331..703f839af6ca 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -35,6 +35,13 @@
 #include "efuse.h"
 #include <linux/export.h>
 #include <linux/kmemleak.h>
+#include <linux/module.h>
+
+MODULE_AUTHOR("lizhaoming       <chaoming_li@realsil.com.cn>");
+MODULE_AUTHOR("Realtek WlanFAE  <wlanfae@realtek.com>");
+MODULE_AUTHOR("Larry Finger     <Larry.FInger@lwfinger.net>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("PCI basic driver for rtlwifi");
 
 static const u16 pcibridge_vendors[PCI_BRIDGE_VENDOR_MAX] = {
         PCI_VENDOR_ID_INTEL,
@@ -1008,19 +1015,6 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
         return;
 }
 
-static void rtl_lps_change_work_callback(struct work_struct *work)
-{
-        struct rtl_works *rtlworks =
-            container_of(work, struct rtl_works, lps_change_work);
-        struct ieee80211_hw *hw = rtlworks->hw;
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-
-        if (rtlpriv->enter_ps)
-                rtl_lps_enter(hw);
-        else
-                rtl_lps_leave(hw);
-}
-
 static void _rtl_pci_init_trx_var(struct ieee80211_hw *hw)
 {
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
@@ -1899,7 +1893,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
         rtlpriv->rtlhal.interface = INTF_PCI;
         rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data);
         rtlpriv->intf_ops = &rtl_pci_ops;
-        rtlpriv->glb_var = &global_var;
+        rtlpriv->glb_var = &rtl_global_var;
 
         /*
          *init dbgp flags before all
diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
index 884bceae38a9..298b615964e8 100644
--- a/drivers/net/wireless/rtlwifi/ps.c
+++ b/drivers/net/wireless/rtlwifi/ps.c
@@ -269,6 +269,7 @@ void rtl_ips_nic_on(struct ieee80211_hw *hw)
 
         spin_unlock_irqrestore(&rtlpriv->locks.ips_lock, flags);
 }
+EXPORT_SYMBOL_GPL(rtl_ips_nic_on);
 
 /*for FW LPS*/
 
@@ -518,6 +519,7 @@ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
                          "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
         }
 }
+EXPORT_SYMBOL_GPL(rtl_swlps_beacon);
 
 void rtl_swlps_rf_awake(struct ieee80211_hw *hw)
 {
@@ -611,6 +613,19 @@ void rtl_swlps_rf_sleep(struct ieee80211_hw *hw)
                         MSECS(sleep_intv * mac->vif->bss_conf.beacon_int - 40));
 }
 
+void rtl_lps_change_work_callback(struct work_struct *work)
+{
+        struct rtl_works *rtlworks =
+            container_of(work, struct rtl_works, lps_change_work);
+        struct ieee80211_hw *hw = rtlworks->hw;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        if (rtlpriv->enter_ps)
+                rtl_lps_enter(hw);
+        else
+                rtl_lps_leave(hw);
+}
+EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);
 
 void rtl_swlps_wq_callback(void *data)
 {
@@ -922,3 +937,4 @@ void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len)
         else
                 rtl_p2p_noa_ie(hw, data, len - FCS_LEN);
 }
+EXPORT_SYMBOL_GPL(rtl_p2p_info);
diff --git a/drivers/net/wireless/rtlwifi/ps.h b/drivers/net/wireless/rtlwifi/ps.h
index 4d682b753f50..88bd76ea88f7 100644
--- a/drivers/net/wireless/rtlwifi/ps.h
+++ b/drivers/net/wireless/rtlwifi/ps.h
@@ -49,5 +49,6 @@ void rtl_swlps_rf_awake(struct ieee80211_hw *hw);
 void rtl_swlps_rf_sleep(struct ieee80211_hw *hw);
 void rtl_p2p_ps_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
 void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len);
+void rtl_lps_change_work_callback(struct work_struct *work);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index a3532e077871..e56778cac9bf 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -32,6 +32,13 @@
 #include "ps.h"
 #include "rtl8192c/fw_common.h"
 #include <linux/export.h>
+#include <linux/module.h>
+
+MODULE_AUTHOR("lizhaoming       <chaoming_li@realsil.com.cn>");
+MODULE_AUTHOR("Realtek WlanFAE  <wlanfae@realtek.com>");
+MODULE_AUTHOR("Larry Finger     <Larry.FInger@lwfinger.net>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("USB basic driver for rtlwifi");
 
 #define REALTEK_USB_VENQT_READ                  0xC0
 #define REALTEK_USB_VENQT_WRITE                 0x40
@@ -1070,6 +1077,8 @@ int rtl_usb_probe(struct usb_interface *intf,
         spin_lock_init(&rtlpriv->locks.usb_lock);
         INIT_WORK(&rtlpriv->works.fill_h2c_cmd,
                   rtl_fill_h2c_cmd_work_callback);
+        INIT_WORK(&rtlpriv->works.lps_change_work,
+                  rtl_lps_change_work_callback);
 
         rtlpriv->usb_data_index = 0;
         init_completion(&rtlpriv->firmware_loading_complete);
diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c
index f4f30af2df68..2e8a20cac588 100644
--- a/drivers/rapidio/rio.c
+++ b/drivers/rapidio/rio.c
@@ -1715,11 +1715,13 @@ int rio_unregister_scan(int mport_id, struct rio_scan *scan_ops)
                     (mport_id == RIO_MPORT_ANY && port->nscan == scan_ops))
                         port->nscan = NULL;
 
-        list_for_each_entry(scan, &rio_scans, node)
+        list_for_each_entry(scan, &rio_scans, node) {
                 if (scan->mport_id == mport_id) {
                         list_del(&scan->node);
                         kfree(scan);
+                        break;
                 }
+        }
 
         mutex_unlock(&rio_mport_list_lock);
 
diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
index 02faf3c4e0d5..c2e80d7ca5e2 100644
--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -524,6 +524,8 @@ static int twl_rtc_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto out1;
 
+        device_init_wakeup(&pdev->dev, 1);
+
         rtc = rtc_device_register(pdev->name,
                                   &pdev->dev, &twl_rtc_ops, THIS_MODULE);
         if (IS_ERR(rtc)) {
@@ -542,7 +544,6 @@ static int twl_rtc_probe(struct platform_device *pdev)
         }
 
         platform_set_drvdata(pdev, rtc);
-        device_init_wakeup(&pdev->dev, 1);
         return 0;
 
 out2:
diff --git a/drivers/tty/serial/arc_uart.c b/drivers/tty/serial/arc_uart.c
index cbf1d155b7b2..22f280aa4f2c 100644
--- a/drivers/tty/serial/arc_uart.c
+++ b/drivers/tty/serial/arc_uart.c
@@ -773,6 +773,6 @@ module_init(arc_serial_init);
 module_exit(arc_serial_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("plat-arcfpga/uart");
+MODULE_ALIAS("platform:" DRIVER_NAME);
 MODULE_AUTHOR("Vineet Gupta");
 MODULE_DESCRIPTION("ARC(Synopsys) On-Chip(fpga) serial driver");
diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
index 4f5f161896a1..f85b8e6d0346 100644
--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
@@ -678,11 +678,18 @@ static void mxs_auart_settermios(struct uart_port *u,
 
 static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
 {
-        u32 istatus, istat;
+        u32 istat;
         struct mxs_auart_port *s = context;
         u32 stat = readl(s->port.membase + AUART_STAT);
 
-        istatus = istat = readl(s->port.membase + AUART_INTR);
+        istat = readl(s->port.membase + AUART_INTR);
+
+        /* ack irq */
+        writel(istat & (AUART_INTR_RTIS
+                | AUART_INTR_TXIS
+                | AUART_INTR_RXIS
+                | AUART_INTR_CTSMIS),
+                        s->port.membase + AUART_INTR_CLR);
 
         if (istat & AUART_INTR_CTSMIS) {
                 uart_handle_cts_change(&s->port, stat & AUART_STAT_CTS);
@@ -702,12 +709,6 @@ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
                 istat &= ~AUART_INTR_TXIS;
         }
 
-        writel(istatus & (AUART_INTR_RTIS
-                | AUART_INTR_TXIS
-                | AUART_INTR_RXIS
-                | AUART_INTR_CTSMIS),
-                        s->port.membase + AUART_INTR_CLR);
-
         return IRQ_HANDLED;
 }
 
@@ -850,7 +851,7 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
         struct mxs_auart_port *s;
         struct uart_port *port;
         unsigned int old_ctrl0, old_ctrl2;
-        unsigned int to = 1000;
+        unsigned int to = 20000;
 
         if (co->index >= MXS_AUART_PORTS || co->index < 0)
                 return;
@@ -871,18 +872,23 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
 
         uart_console_write(port, str, count, mxs_auart_console_putchar);
 
-        /*
-         * Finally, wait for transmitter to become empty
-         * and restore the TCR
-         */
+        /* Finally, wait for transmitter to become empty ... */
         while (readl(port->membase + AUART_STAT) & AUART_STAT_BUSY) {
+                udelay(1);
                 if (!to--)
                         break;
-                udelay(1);
         }
 
-        writel(old_ctrl0, port->membase + AUART_CTRL0);
-        writel(old_ctrl2, port->membase + AUART_CTRL2);
+        /*
+         * ... and restore the TCR if we waited long enough for the transmitter
+         * to be idle. This might keep the transmitter enabled although it is
+         * unused, but that is better than to disable it while it is still
+         * transmitting.
+         */
+        if (!(readl(port->membase + AUART_STAT) & AUART_STAT_BUSY)) {
+                writel(old_ctrl0, port->membase + AUART_CTRL0);
+                writel(old_ctrl2, port->membase + AUART_CTRL2);
+        }
 
         clk_disable(s->clk);
 }
diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 121aeb9393e1..f597e88a705d 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -256,10 +256,9 @@ void tty_port_tty_hangup(struct tty_port *port, bool check_clocal)
 {
         struct tty_struct *tty = tty_port_tty_get(port);
 
-        if (tty && (!check_clocal || !C_CLOCAL(tty))) {
+        if (tty && (!check_clocal || !C_CLOCAL(tty)))
                 tty_hangup(tty);
-                tty_kref_put(tty);
-        }
+        tty_kref_put(tty);
 }
 EXPORT_SYMBOL_GPL(tty_port_tty_hangup);
 
diff --git a/drivers/usb/chipidea/Kconfig b/drivers/usb/chipidea/Kconfig
index eb2aa2e5a842..d1bd8ef1f9c1 100644
--- a/drivers/usb/chipidea/Kconfig
+++ b/drivers/usb/chipidea/Kconfig
@@ -12,7 +12,7 @@ if USB_CHIPIDEA
 
 config USB_CHIPIDEA_UDC
         bool "ChipIdea device controller"
-        depends on USB_GADGET=y || USB_CHIPIDEA=m
+        depends on USB_GADGET=y || (USB_CHIPIDEA=m && USB_GADGET=m)
         help
           Say Y here to enable device controller functionality of the
           ChipIdea driver.
@@ -20,7 +20,7 @@ config USB_CHIPIDEA_UDC
 config USB_CHIPIDEA_HOST
         bool "ChipIdea host controller"
         depends on USB=y
-        depends on USB_EHCI_HCD=y || USB_CHIPIDEA=m
+        depends on USB_EHCI_HCD=y || (USB_CHIPIDEA=m && USB_EHCI_HCD=m)
         select USB_EHCI_ROOT_HUB_TT
         help
           Say Y here to enable host controller functionality of the
diff --git a/drivers/usb/chipidea/bits.h b/drivers/usb/chipidea/bits.h
index aefa0261220c..1b23e354f9fb 100644
--- a/drivers/usb/chipidea/bits.h
+++ b/drivers/usb/chipidea/bits.h
@@ -50,7 +50,7 @@
 #define PORTSC_PTC            (0x0FUL << 16)
 /* PTS and PTW for non lpm version only */
 #define PORTSC_PTS(d)                                           \
-        ((((d) & 0x3) << 30) | (((d) & 0x4) ? BIT(25) : 0))
+        (u32)((((d) & 0x3) << 30) | (((d) & 0x4) ? BIT(25) : 0))
 #define PORTSC_PTW            BIT(28)
 #define PORTSC_STS            BIT(29)
 
@@ -59,7 +59,7 @@
 #define DEVLC_PSPD_HS         (0x02UL << 25)
 #define DEVLC_PTW             BIT(27)
 #define DEVLC_STS             BIT(28)
-#define DEVLC_PTS(d)          (((d) & 0x7) << 29)
+#define DEVLC_PTS(d)          (u32)(((d) & 0x7) << 29)
 
 /* Encoding for DEVLC_PTS and PORTSC_PTS */
 #define PTS_UTMI              0
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index f48712ffe261..c1c113ef950c 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -449,14 +449,20 @@ fail:
 
 static int __exit eth_unbind(struct usb_composite_dev *cdev)
 {
-        if (has_rndis())
+        if (has_rndis()) {
+                usb_put_function(f_rndis);
                 usb_put_function_instance(fi_rndis);
-        if (use_eem)
+        }
+        if (use_eem) {
+                usb_put_function(f_eem);
                 usb_put_function_instance(fi_eem);
-        else if (can_support_ecm(cdev->gadget))
+        } else if (can_support_ecm(cdev->gadget)) {
+                usb_put_function(f_ecm);
                 usb_put_function_instance(fi_ecm);
-        else
+        } else {
+                usb_put_function(f_geth);
                 usb_put_function_instance(fi_geth);
+        }
         return 0;
 }
 
diff --git a/drivers/usb/gadget/f_phonet.c b/drivers/usb/gadget/f_phonet.c
index 1bf26e9f38cd..eb3aa817a662 100644
--- a/drivers/usb/gadget/f_phonet.c
+++ b/drivers/usb/gadget/f_phonet.c
@@ -488,7 +488,6 @@ static int pn_bind(struct usb_configuration *c, struct usb_function *f)
         struct usb_ep *ep;
         int status, i;
 
-#ifndef USBF_PHONET_INCLUDED
         struct f_phonet_opts *phonet_opts;
 
         phonet_opts = container_of(f->fi, struct f_phonet_opts, func_inst);
@@ -507,7 +506,6 @@ static int pn_bind(struct usb_configuration *c, struct usb_function *f)
                         return status;
                 phonet_opts->bound = true;
         }
-#endif
 
         /* Reserve interface IDs */
         status = usb_interface_id(c, f);
diff --git a/drivers/usb/gadget/multi.c b/drivers/usb/gadget/multi.c
index 032b96a51ce4..2a1ebefd8f9e 100644
--- a/drivers/usb/gadget/multi.c
+++ b/drivers/usb/gadget/multi.c
@@ -160,10 +160,8 @@ static __init int rndis_do_config(struct usb_configuration *c)
                 return ret;
 
         f_acm_rndis = usb_get_function(fi_acm);
-        if (IS_ERR(f_acm_rndis)) {
-                ret = PTR_ERR(f_acm_rndis);
-                goto err_func_acm;
-        }
+        if (IS_ERR(f_acm_rndis))
+                return PTR_ERR(f_acm_rndis);
 
         ret = usb_add_function(c, f_acm_rndis);
         if (ret)
@@ -178,7 +176,6 @@ err_fsg:
         usb_remove_function(c, f_acm_rndis);
 err_conf:
         usb_put_function(f_acm_rndis);
-err_func_acm:
         return ret;
 }
 
@@ -226,7 +223,7 @@ static __init int cdc_do_config(struct usb_configuration *c)
         /* implicit port_num is zero */
         f_acm_multi = usb_get_function(fi_acm);
         if (IS_ERR(f_acm_multi))
-                goto err_func_acm;
+                return PTR_ERR(f_acm_multi);
 
         ret = usb_add_function(c, f_acm_multi);
         if (ret)
@@ -241,7 +238,6 @@ err_fsg:
         usb_remove_function(c, f_acm_multi);
 err_conf:
         usb_put_function(f_acm_multi);
-err_func_acm:
         return ret;
 }
 
diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
index c28ac9872030..13e25f80fc20 100644
--- a/drivers/usb/gadget/udc-core.c
+++ b/drivers/usb/gadget/udc-core.c
@@ -109,7 +109,7 @@ void usb_gadget_set_state(struct usb_gadget *gadget,
                 enum usb_device_state state)
 {
         gadget->state = state;
-        sysfs_notify(&gadget->dev.kobj, NULL, "status");
+        sysfs_notify(&gadget->dev.kobj, NULL, "state");
 }
 EXPORT_SYMBOL_GPL(usb_gadget_set_state);
 
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 6708a3b78ad8..f44e8b5e00c9 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -481,7 +481,7 @@ static u64 omap2430_dmamask = DMA_BIT_MASK(32);
 
 static int omap2430_probe(struct platform_device *pdev)
 {
-        struct resource                 musb_resources[2];
+        struct resource                 musb_resources[3];
         struct musb_hdrc_platform_data  *pdata = pdev->dev.platform_data;
         struct omap_musb_board_data     *data;
         struct platform_device          *musb;
@@ -581,6 +581,11 @@ static int omap2430_probe(struct platform_device *pdev)
         musb_resources[1].end = pdev->resource[1].end;
         musb_resources[1].flags = pdev->resource[1].flags;
 
+        musb_resources[2].name = pdev->resource[2].name;
+        musb_resources[2].start = pdev->resource[2].start;
+        musb_resources[2].end = pdev->resource[2].end;
+        musb_resources[2].flags = pdev->resource[2].flags;
+
         ret = platform_device_add_resources(musb, musb_resources,
                         ARRAY_SIZE(musb_resources));
         if (ret) {
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index 2c06a8969a9f..6f8a9ca96ae7 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -1156,7 +1156,7 @@ static u64 tusb_dmamask = DMA_BIT_MASK(32);
 
 static int tusb_probe(struct platform_device *pdev)
 {
-        struct resource musb_resources[2];
+        struct resource musb_resources[3];
         struct musb_hdrc_platform_data  *pdata = pdev->dev.platform_data;
         struct platform_device          *musb;
         struct tusb6010_glue            *glue;
@@ -1199,6 +1199,11 @@ static int tusb_probe(struct platform_device *pdev)
         musb_resources[1].end = pdev->resource[1].end;
         musb_resources[1].flags = pdev->resource[1].flags;
 
+        musb_resources[2].name = pdev->resource[2].name;
+        musb_resources[2].start = pdev->resource[2].start;
+        musb_resources[2].end = pdev->resource[2].end;
+        musb_resources[2].flags = pdev->resource[2].flags;
+
         ret = platform_device_add_resources(musb, musb_resources,
                         ARRAY_SIZE(musb_resources));
         if (ret) {
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index 8c3a42ea910c..7eef9b33fde6 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -719,6 +719,13 @@ config USB_SERIAL_FLASHLOADER
           To compile this driver as a module, choose M here: the
           module will be called flashloader.
 
+config USB_SERIAL_SUUNTO
+        tristate "USB Suunto ANT+ driver"
+        help
+          Say Y here if you want to use the Suunto ANT+ USB device.
+
+          To compile this driver as a module, choose M here: the
+          module will be called suunto.
 
 config USB_SERIAL_DEBUG
         tristate "USB Debugging Device"
diff --git a/drivers/usb/serial/Makefile b/drivers/usb/serial/Makefile
index f7130114488f..a14a870d993f 100644
--- a/drivers/usb/serial/Makefile
+++ b/drivers/usb/serial/Makefile
@@ -54,6 +54,7 @@ obj-$(CONFIG_USB_SERIAL_SIEMENS_MPI)		+= siemens_mpi.o
 obj-$(CONFIG_USB_SERIAL_SIERRAWIRELESS)         += sierra.o
 obj-$(CONFIG_USB_SERIAL_SPCP8X5)                += spcp8x5.o
 obj-$(CONFIG_USB_SERIAL_SSU100)                 += ssu100.o
+obj-$(CONFIG_USB_SERIAL_SUUNTO)                 += suunto.o
 obj-$(CONFIG_USB_SERIAL_SYMBOL)                 += symbolserial.o
 obj-$(CONFIG_USB_SERIAL_WWAN)                   += usb_wwan.o
 obj-$(CONFIG_USB_SERIAL_TI)                     += ti_usb_3410_5052.o
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 7260ec660347..b65e657c641d 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -735,9 +735,34 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
         { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
-        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
-        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) },
-        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_RTS01_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29A_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29F_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S01_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29C_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_81B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_82B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5D_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K4Y_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5G_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S05_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_60_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_61_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_64_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_65_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92D_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_W5R_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_A5R_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_PW1_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
         { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 6dd79253205d..1b8af461b522 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -815,11 +815,35 @@
 /*
  * RT Systems programming cables for various ham radios
  */
-#define RTSYSTEMS_VID                   0x2100  /* Vendor ID */
-#define RTSYSTEMS_SERIAL_VX7_PID        0x9e52  /* Serial converter for VX-7 Radios using FT232RL */
-#define RTSYSTEMS_CT29B_PID             0x9e54  /* CT29B Radio Cable */
-#define RTSYSTEMS_RTS01_PID             0x9e57  /* USB-RTS01 Radio Cable */
-
+#define RTSYSTEMS_VID           0x2100  /* Vendor ID */
+#define RTSYSTEMS_USB_S03_PID   0x9001  /* RTS-03 USB to Serial Adapter */
+#define RTSYSTEMS_USB_59_PID    0x9e50  /* USB-59 USB to 8 pin plug */
+#define RTSYSTEMS_USB_57A_PID   0x9e51  /* USB-57A USB to 4pin 3.5mm plug */
+#define RTSYSTEMS_USB_57B_PID   0x9e52  /* USB-57B USB to extended 4pin 3.5mm plug */
+#define RTSYSTEMS_USB_29A_PID   0x9e53  /* USB-29A USB to 3.5mm stereo plug */
+#define RTSYSTEMS_USB_29B_PID   0x9e54  /* USB-29B USB to 6 pin mini din */
+#define RTSYSTEMS_USB_29F_PID   0x9e55  /* USB-29F USB to 6 pin modular plug */
+#define RTSYSTEMS_USB_62B_PID   0x9e56  /* USB-62B USB to 8 pin mini din plug*/
+#define RTSYSTEMS_USB_S01_PID   0x9e57  /* USB-RTS01 USB to 3.5 mm stereo plug*/
+#define RTSYSTEMS_USB_63_PID    0x9e58  /* USB-63 USB to 9 pin female*/
+#define RTSYSTEMS_USB_29C_PID   0x9e59  /* USB-29C USB to 4 pin modular plug*/
+#define RTSYSTEMS_USB_81B_PID   0x9e5A  /* USB-81 USB to 8 pin mini din plug*/
+#define RTSYSTEMS_USB_82B_PID   0x9e5B  /* USB-82 USB to 2.5 mm stereo plug*/
+#define RTSYSTEMS_USB_K5D_PID   0x9e5C  /* USB-K5D USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_K4Y_PID   0x9e5D  /* USB-K4Y USB to 2.5/3.5 mm plugs*/
+#define RTSYSTEMS_USB_K5G_PID   0x9e5E  /* USB-K5G USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_S05_PID   0x9e5F  /* USB-RTS05 USB to 2.5 mm stereo plug*/
+#define RTSYSTEMS_USB_60_PID    0x9e60  /* USB-60 USB to 6 pin din*/
+#define RTSYSTEMS_USB_61_PID    0x9e61  /* USB-61 USB to 6 pin mini din*/
+#define RTSYSTEMS_USB_62_PID    0x9e62  /* USB-62 USB to 8 pin mini din*/
+#define RTSYSTEMS_USB_63B_PID   0x9e63  /* USB-63 USB to 9 pin female*/
+#define RTSYSTEMS_USB_64_PID    0x9e64  /* USB-64 USB to 9 pin male*/
+#define RTSYSTEMS_USB_65_PID    0x9e65  /* USB-65 USB to 9 pin female null modem*/
+#define RTSYSTEMS_USB_92_PID    0x9e66  /* USB-92 USB to 12 pin plug*/
+#define RTSYSTEMS_USB_92D_PID   0x9e67  /* USB-92D USB to 12 pin plug data*/
+#define RTSYSTEMS_USB_W5R_PID   0x9e68  /* USB-W5R USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_A5R_PID   0x9e69  /* USB-A5R USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_PW1_PID   0x9e6A  /* USB-PW1 USB to 8 pin modular plug*/
 
 /*
  * Physik Instrumente
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 603fb70dde80..d953d674f222 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -183,7 +183,10 @@
 #define LED_ON_MS       500
 #define LED_OFF_MS      500
 
-static int device_type;
+enum mos7840_flag {
+        MOS7840_FLAG_CTRL_BUSY,
+        MOS7840_FLAG_LED_BUSY,
+};
 
 static const struct usb_device_id id_table[] = {
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
@@ -238,9 +241,12 @@ struct moschip_port {
 
         /* For device(s) with LED indicator */
         bool has_led;
-        bool led_flag;
         struct timer_list led_timer1;   /* Timer for LED on */
         struct timer_list led_timer2;   /* Timer for LED off */
+        struct urb *led_urb;
+        struct usb_ctrlrequest *led_dr;
+
+        unsigned long flags;
 };
 
 /*
@@ -460,10 +466,10 @@ static void mos7840_control_callback(struct urb *urb)
         case -ESHUTDOWN:
                 /* this urb is terminated, clean up */
                 dev_dbg(dev, "%s - urb shutting down with status: %d\n", __func__, status);
-                return;
+                goto out;
         default:
                 dev_dbg(dev, "%s - nonzero urb status received: %d\n", __func__, status);
-                return;
+                goto out;
         }
 
         dev_dbg(dev, "%s urb buffer size is %d\n", __func__, urb->actual_length);
@@ -476,6 +482,8 @@ static void mos7840_control_callback(struct urb *urb)
                 mos7840_handle_new_msr(mos7840_port, regval);
         else if (mos7840_port->MsrLsr == 1)
                 mos7840_handle_new_lsr(mos7840_port, regval);
+out:
+        clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mos7840_port->flags);
 }
 
 static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
@@ -486,6 +494,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
         unsigned char *buffer = mcs->ctrl_buf;
         int ret;
 
+        if (test_and_set_bit_lock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags))
+                return -EBUSY;
+
         dr->bRequestType = MCS_RD_RTYPE;
         dr->bRequest = MCS_RDREQ;
         dr->wValue = cpu_to_le16(Wval); /* 0 */
@@ -497,6 +508,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
                              mos7840_control_callback, mcs);
         mcs->control_urb->transfer_buffer_length = 2;
         ret = usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
+        if (ret)
+                clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags);
+
         return ret;
 }
 
@@ -523,7 +537,7 @@ static void mos7840_set_led_async(struct moschip_port *mcs, __u16 wval,
                                 __u16 reg)
 {
         struct usb_device *dev = mcs->port->serial->dev;
-        struct usb_ctrlrequest *dr = mcs->dr;
+        struct usb_ctrlrequest *dr = mcs->led_dr;
 
         dr->bRequestType = MCS_WR_RTYPE;
         dr->bRequest = MCS_WRREQ;
@@ -531,10 +545,10 @@ static void mos7840_set_led_async(struct moschip_port *mcs, __u16 wval,
         dr->wIndex = cpu_to_le16(reg);
         dr->wLength = cpu_to_le16(0);
 
-        usb_fill_control_urb(mcs->control_urb, dev, usb_sndctrlpipe(dev, 0),
+        usb_fill_control_urb(mcs->led_urb, dev, usb_sndctrlpipe(dev, 0),
                 (unsigned char *)dr, NULL, 0, mos7840_set_led_callback, NULL);
 
-        usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
+        usb_submit_urb(mcs->led_urb, GFP_ATOMIC);
 }
 
 static void mos7840_set_led_sync(struct usb_serial_port *port, __u16 reg,
@@ -560,7 +574,19 @@ static void mos7840_led_flag_off(unsigned long arg)
 {
         struct moschip_port *mcs = (struct moschip_port *) arg;
 
-        mcs->led_flag = false;
+        clear_bit_unlock(MOS7840_FLAG_LED_BUSY, &mcs->flags);
+}
+
+static void mos7840_led_activity(struct usb_serial_port *port)
+{
+        struct moschip_port *mos7840_port = usb_get_serial_port_data(port);
+
+        if (test_and_set_bit_lock(MOS7840_FLAG_LED_BUSY, &mos7840_port->flags))
+                return;
+
+        mos7840_set_led_async(mos7840_port, 0x0301, MODEM_CONTROL_REGISTER);
+        mod_timer(&mos7840_port->led_timer1,
+                                jiffies + msecs_to_jiffies(LED_ON_MS));
 }
 
 /*****************************************************************************
@@ -758,14 +784,8 @@ static void mos7840_bulk_in_callback(struct urb *urb)
                 return;
         }
 
-        /* Turn on LED */
-        if (mos7840_port->has_led && !mos7840_port->led_flag) {
-                mos7840_port->led_flag = true;
-                mos7840_set_led_async(mos7840_port, 0x0301,
-                                        MODEM_CONTROL_REGISTER);
-                mod_timer(&mos7840_port->led_timer1,
-                                jiffies + msecs_to_jiffies(LED_ON_MS));
-        }
+        if (mos7840_port->has_led)
+                mos7840_led_activity(port);
 
         mos7840_port->read_urb_busy = true;
         retval = usb_submit_urb(mos7840_port->read_urb, GFP_ATOMIC);
@@ -816,18 +836,6 @@ static void mos7840_bulk_out_data_callback(struct urb *urb)
 /************************************************************************/
 /*       D R I V E R  T T Y  I N T E R F A C E  F U N C T I O N S       */
 /************************************************************************/
-#ifdef MCSSerialProbe
-static int mos7840_serial_probe(struct usb_serial *serial,
-                                const struct usb_device_id *id)
-{
-
-        /*need to implement the mode_reg reading and updating\
-           structures usb_serial_ device_type\
-           (i.e num_ports, num_bulkin,bulkout etc) */
-        /* Also we can update the changes  attach */
-        return 1;
-}
-#endif
 
 /*****************************************************************************
  * mos7840_open
@@ -1454,13 +1462,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
         data1 = urb->transfer_buffer;
         dev_dbg(&port->dev, "bulkout endpoint is %d\n", port->bulk_out_endpointAddress);
 
-        /* Turn on LED */
-        if (mos7840_port->has_led && !mos7840_port->led_flag) {
-                mos7840_port->led_flag = true;
-                mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0301);
-                mod_timer(&mos7840_port->led_timer1,
-                                jiffies + msecs_to_jiffies(LED_ON_MS));
-        }
+        if (mos7840_port->has_led)
+                mos7840_led_activity(port);
 
         /* send it down the pipe */
         status = usb_submit_urb(urb, GFP_ATOMIC);
@@ -2187,38 +2190,48 @@ static int mos7810_check(struct usb_serial *serial)
         return 0;
 }
 
-static int mos7840_calc_num_ports(struct usb_serial *serial)
+static int mos7840_probe(struct usb_serial *serial,
+                                const struct usb_device_id *id)
 {
-        __u16 data = 0x00;
+        u16 product = serial->dev->descriptor.idProduct;
         u8 *buf;
-        int mos7840_num_ports;
+        int device_type;
+
+        if (product == MOSCHIP_DEVICE_ID_7810 ||
+                product == MOSCHIP_DEVICE_ID_7820) {
+                device_type = product;
+                goto out;
+        }
 
         buf = kzalloc(VENDOR_READ_LENGTH, GFP_KERNEL);
-        if (buf) {
-                usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+        if (!buf)
+                return -ENOMEM;
+
+        usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
                         MCS_RDREQ, MCS_RD_RTYPE, 0, GPIO_REGISTER, buf,
                         VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT);
-                data = *buf;
-                kfree(buf);
-        }
 
-        if (serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7810 ||
-                serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7820) {
-                device_type = serial->dev->descriptor.idProduct;
-        } else {
-                /* For a MCS7840 device GPIO0 must be set to 1 */
-                if ((data & 0x01) == 1)
-                        device_type = MOSCHIP_DEVICE_ID_7840;
-                else if (mos7810_check(serial))
-                        device_type = MOSCHIP_DEVICE_ID_7810;
-                else
-                        device_type = MOSCHIP_DEVICE_ID_7820;
-        }
+        /* For a MCS7840 device GPIO0 must be set to 1 */
+        if (buf[0] & 0x01)
+                device_type = MOSCHIP_DEVICE_ID_7840;
+        else if (mos7810_check(serial))
+                device_type = MOSCHIP_DEVICE_ID_7810;
+        else
+                device_type = MOSCHIP_DEVICE_ID_7820;
+
+        kfree(buf);
+out:
+        usb_set_serial_data(serial, (void *)(unsigned long)device_type);
+
+        return 0;
+}
+
+static int mos7840_calc_num_ports(struct usb_serial *serial)
+{
+        int device_type = (unsigned long)usb_get_serial_data(serial);
+        int mos7840_num_ports;
 
         mos7840_num_ports = (device_type >> 4) & 0x000F;
-        serial->num_bulk_in = mos7840_num_ports;
-        serial->num_bulk_out = mos7840_num_ports;
-        serial->num_ports = mos7840_num_ports;
 
         return mos7840_num_ports;
 }
@@ -2226,6 +2239,7 @@ static int mos7840_calc_num_ports(struct usb_serial *serial)
 static int mos7840_port_probe(struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
+        int device_type = (unsigned long)usb_get_serial_data(serial);
         struct moschip_port *mos7840_port;
         int status;
         int pnum;
@@ -2401,6 +2415,14 @@ static int mos7840_port_probe(struct usb_serial_port *port)
         if (device_type == MOSCHIP_DEVICE_ID_7810) {
                 mos7840_port->has_led = true;
 
+                mos7840_port->led_urb = usb_alloc_urb(0, GFP_KERNEL);
+                mos7840_port->led_dr = kmalloc(sizeof(*mos7840_port->led_dr),
+                                                                GFP_KERNEL);
+                if (!mos7840_port->led_urb || !mos7840_port->led_dr) {
+                        status = -ENOMEM;
+                        goto error;
+                }
+
                 init_timer(&mos7840_port->led_timer1);
                 mos7840_port->led_timer1.function = mos7840_led_off;
                 mos7840_port->led_timer1.expires =
@@ -2413,8 +2435,6 @@ static int mos7840_port_probe(struct usb_serial_port *port)
                         jiffies + msecs_to_jiffies(LED_OFF_MS);
                 mos7840_port->led_timer2.data = (unsigned long)mos7840_port;
 
-                mos7840_port->led_flag = false;
-
                 /* Turn off LED */
                 mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0300);
         }
@@ -2436,6 +2456,8 @@ out:
         }
         return 0;
 error:
+        kfree(mos7840_port->led_dr);
+        usb_free_urb(mos7840_port->led_urb);
         kfree(mos7840_port->dr);
         kfree(mos7840_port->ctrl_buf);
         usb_free_urb(mos7840_port->control_urb);
@@ -2456,6 +2478,10 @@ static int mos7840_port_remove(struct usb_serial_port *port)
 
                 del_timer_sync(&mos7840_port->led_timer1);
                 del_timer_sync(&mos7840_port->led_timer2);
+
+                usb_kill_urb(mos7840_port->led_urb);
+                usb_free_urb(mos7840_port->led_urb);
+                kfree(mos7840_port->led_dr);
         }
         usb_kill_urb(mos7840_port->control_urb);
         usb_free_urb(mos7840_port->control_urb);
@@ -2482,9 +2508,7 @@ static struct usb_serial_driver moschip7840_4port_device = {
         .throttle = mos7840_throttle,
         .unthrottle = mos7840_unthrottle,
         .calc_num_ports = mos7840_calc_num_ports,
-#ifdef MCSSerialProbe
-        .probe = mos7840_serial_probe,
-#endif
+        .probe = mos7840_probe,
         .ioctl = mos7840_ioctl,
         .set_termios = mos7840_set_termios,
         .break_ctl = mos7840_break,
diff --git a/drivers/usb/serial/suunto.c b/drivers/usb/serial/suunto.c
new file mode 100644
index 000000000000..2248e7a7d5ad
--- /dev/null
+++ b/drivers/usb/serial/suunto.c
@@ -0,0 +1,41 @@
+/*
+ * Suunto ANT+ USB Driver
+ *
+ * Copyright (C) 2013 Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+ * Copyright (C) 2013 Linux Foundation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation only.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/tty.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/usb/serial.h>
+#include <linux/uaccess.h>
+
+static const struct usb_device_id id_table[] = {
+        { USB_DEVICE(0x0fcf, 0x1008) },
+        { },
+};
+MODULE_DEVICE_TABLE(usb, id_table);
+
+static struct usb_serial_driver suunto_device = {
+        .driver = {
+                .owner =        THIS_MODULE,
+                .name =         KBUILD_MODNAME,
+        },
+        .id_table =             id_table,
+        .num_ports =            1,
+};
+
+static struct usb_serial_driver * const serial_drivers[] = {
+        &suunto_device,
+        NULL,
+};
+
+module_usb_serial_driver(serial_drivers, id_table);
+MODULE_LICENSE("GPL");
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index c5179e269df6..cef6002acbd4 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -137,8 +137,27 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev)
          */
         pci_write_config_word(pdev, PCI_COMMAND, PCI_COMMAND_INTX_DISABLE);
 
-        if (vdev->reset_works)
-                __pci_reset_function(pdev);
+        /*
+         * Careful, device_lock may already be held.  This is the case if
+         * a driver unbind is blocked.  Try to get the locks ourselves to
+         * prevent a deadlock.
+         */
+        if (vdev->reset_works) {
+                bool reset_done = false;
+
+                if (pci_cfg_access_trylock(pdev)) {
+                        if (device_trylock(&pdev->dev)) {
+                                __pci_reset_function_locked(pdev);
+                                reset_done = true;
+                                device_unlock(&pdev->dev);
+                        }
+                        pci_cfg_access_unlock(pdev);
+                }
+
+                if (!reset_done)
+                        pr_warn("%s: Unable to acquire locks for reset of %s\n",
+                                __func__, dev_name(&pdev->dev));
+        }
 
         pci_restore_state(pdev);
 }
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index c488da5db7c7..842f4507883e 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -494,27 +494,6 @@ static int vfio_group_nb_add_dev(struct vfio_group *group, struct device *dev)
         return 0;
 }
 
-static int vfio_group_nb_del_dev(struct vfio_group *group, struct device *dev)
-{
-        struct vfio_device *device;
-
-        /*
-         * Expect to fall out here.  If a device was in use, it would
-         * have been bound to a vfio sub-driver, which would have blocked
-         * in .remove at vfio_del_group_dev.  Sanity check that we no
-         * longer track the device, so it's safe to remove.
-         */
-        device = vfio_group_get_device(group, dev);
-        if (likely(!device))
-                return 0;
-
-        WARN("Device %s removed from live group %d!\n", dev_name(dev),
-             iommu_group_id(group->iommu_group));
-
-        vfio_device_put(device);
-        return 0;
-}
-
 static int vfio_group_nb_verify(struct vfio_group *group, struct device *dev)
 {
         /* We don't care what happens when the group isn't in use */
@@ -531,13 +510,11 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb,
         struct device *dev = data;
 
         /*
-         * Need to go through a group_lock lookup to get a reference or
-         * we risk racing a group being removed.  Leave a WARN_ON for
-         * debuging, but if the group no longer exists, a spurious notify
-         * is harmless.
+         * Need to go through a group_lock lookup to get a reference or we
+         * risk racing a group being removed.  Ignore spurious notifies.
          */
         group = vfio_group_try_get(group);
-        if (WARN_ON(!group))
+        if (!group)
                 return NOTIFY_OK;
 
         switch (action) {
@@ -545,7 +522,13 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb,
                 vfio_group_nb_add_dev(group, dev);
                 break;
         case IOMMU_GROUP_NOTIFY_DEL_DEVICE:
-                vfio_group_nb_del_dev(group, dev);
+                /*
+                 * Nothing to do here.  If the device is in use, then the
+                 * vfio sub-driver should block the remove callback until
+                 * it is unused.  If the device is unused or attached to a
+                 * stub driver, then it should be released and we don't
+                 * care that it will be going away.
+                 */
                 break;
         case IOMMU_GROUP_NOTIFY_BIND_DRIVER:
                 pr_debug("%s: Device %s, group %d binding to driver\n",
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index a89c15de9f45..9b0f12c5c284 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -435,8 +435,8 @@ static int correct_chipset(struct atyfb_par *par)
         const char *name;
         int i;
 
-        for (i = ARRAY_SIZE(aty_chips); i > 0; i--)
-                if (par->pci_id == aty_chips[i - 1].pci_id)
+        for (i = (int)ARRAY_SIZE(aty_chips) - 1; i >= 0; i--)
+                if (par->pci_id == aty_chips[i].pci_id)
                         break;
 
         if (i < 0)
diff --git a/drivers/video/nuc900fb.c b/drivers/video/nuc900fb.c
index 8c527e5b293c..796e5112ceee 100644
--- a/drivers/video/nuc900fb.c
+++ b/drivers/video/nuc900fb.c
@@ -587,8 +587,7 @@ static int nuc900fb_probe(struct platform_device *pdev)
         fbinfo->flags                   = FBINFO_FLAG_DEFAULT;
         fbinfo->pseudo_palette          = &fbi->pseudo_pal;
 
-        ret = request_irq(irq, nuc900fb_irqhandler, 0,
-                          pdev->name, fbinfo);
+        ret = request_irq(irq, nuc900fb_irqhandler, 0, pdev->name, fbi);
         if (ret) {
                 dev_err(&pdev->dev, "cannot register irq handler %d -err %d\n",
                         irq, ret);
diff --git a/drivers/video/sgivwfb.c b/drivers/video/sgivwfb.c
index b2a8912f6435..a9ac3ce2d0e9 100644
--- a/drivers/video/sgivwfb.c
+++ b/drivers/video/sgivwfb.c
@@ -713,7 +713,7 @@ static int sgivwfb_mmap(struct fb_info *info,
         r = vm_iomap_memory(vma, sgivwfb_mem_phys, sgivwfb_mem_size);
 
         printk(KERN_DEBUG "sgivwfb: mmap framebuffer P(%lx)->V(%lx)\n",
-               offset, vma->vm_start);
+                sgivwfb_mem_phys + (vma->vm_pgoff << PAGE_SHIFT), vma->vm_start);
 
         return r;
 }
diff --git a/drivers/video/sh7760fb.c b/drivers/video/sh7760fb.c
index a8c6c43a4658..1265b25f9f99 100644
--- a/drivers/video/sh7760fb.c
+++ b/drivers/video/sh7760fb.c
@@ -567,7 +567,7 @@ static int sh7760fb_remove(struct platform_device *dev)
         fb_dealloc_cmap(&info->cmap);
         sh7760fb_free_mem(info);
         if (par->irq >= 0)
-                free_irq(par->irq, par);
+                free_irq(par->irq, &par->vsync);
         iounmap(par->base);
         release_mem_region(par->ioarea->start, resource_size(par->ioarea));
         framebuffer_release(info);
diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c
index 830ded45fd47..2827333703d9 100644
--- a/drivers/video/vga16fb.c
+++ b/drivers/video/vga16fb.c
@@ -1265,7 +1265,6 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image
 
 static void vga16fb_destroy(struct fb_info *info)
 {
-        struct platform_device *dev = container_of(info->device, struct platform_device, dev);
         iounmap(info->screen_base);
         fb_dealloc_cmap(&info->cmap);
         /* XXX unshare VGA regions */
diff --git a/drivers/video/xilinxfb.c b/drivers/video/xilinxfb.c
index f3d4a69e1e4e..6629b29a8202 100644
--- a/drivers/video/xilinxfb.c
+++ b/drivers/video/xilinxfb.c
@@ -341,8 +341,8 @@ static int xilinxfb_assign(struct platform_device *pdev,
 
         if (drvdata->flags & BUS_ACCESS_FLAG) {
                 /* Put a banner in the log (for DEBUG) */
-                dev_dbg(dev, "regs: phys=%x, virt=%p\n", drvdata->regs_phys,
-                                        drvdata->regs);
+                dev_dbg(dev, "regs: phys=%pa, virt=%p\n",
+                        &drvdata->regs_phys, drvdata->regs);
         }
         /* Put a banner in the log (for DEBUG) */
         dev_dbg(dev, "fb: phys=%llx, virt=%p, size=%x\n",
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index 9e02d60a364b..23eae5cb69c2 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -145,7 +145,7 @@ config SWIOTLB_XEN
 
 config XEN_TMEM
         tristate
-        depends on !ARM
+        depends on !ARM && !ARM64
         default m if (CLEANCACHE || FRONTSWAP)
         help
           Shim to interface in-kernel Transcendent Memory hooks
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index eabd0ee1c2bc..14fe79d8634a 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -1,9 +1,8 @@
-ifneq ($(CONFIG_ARM),y)
-obj-y   += manage.o
+ifeq ($(filter y, $(CONFIG_ARM) $(CONFIG_ARM64)),)
 obj-$(CONFIG_HOTPLUG_CPU)               += cpu_hotplug.o
 endif
 obj-$(CONFIG_X86)                       += fallback.o
-obj-y   += grant-table.o features.o events.o balloon.o
+obj-y   += grant-table.o features.o events.o balloon.o manage.o
 obj-y   += xenbus/
 
 nostackp := $(call cc-option, -fno-stack-protector)
diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
index 8feecf01d55c..b6165e047f48 100644
--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -379,18 +379,12 @@ static long evtchn_ioctl(struct file *file,
                 if (unbind.port >= NR_EVENT_CHANNELS)
                         break;
 
-                spin_lock_irq(&port_user_lock);
-
                 rc = -ENOTCONN;
-                if (get_port_user(unbind.port) != u) {
-                        spin_unlock_irq(&port_user_lock);
+                if (get_port_user(unbind.port) != u)
                         break;
-                }
 
                 disable_irq(irq_from_evtchn(unbind.port));
 
-                spin_unlock_irq(&port_user_lock);
-
                 evtchn_unbind_from_user(u, unbind.port);
 
                 rc = 0;
@@ -490,26 +484,15 @@ static int evtchn_release(struct inode *inode, struct file *filp)
         int i;
         struct per_user_data *u = filp->private_data;
 
-        spin_lock_irq(&port_user_lock);
-
-        free_page((unsigned long)u->ring);
-
         for (i = 0; i < NR_EVENT_CHANNELS; i++) {
                 if (get_port_user(i) != u)
                         continue;
 
                 disable_irq(irq_from_evtchn(i));
-        }
-
-        spin_unlock_irq(&port_user_lock);
-
-        for (i = 0; i < NR_EVENT_CHANNELS; i++) {
-                if (get_port_user(i) != u)
-                        continue;
-
                 evtchn_unbind_from_user(get_port_user(i), i);
         }
 
+        free_page((unsigned long)u->ring);
         kfree(u->name);
         kfree(u);
 
diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
index 6ed8a9df4472..34b20bfa4e8c 100644
--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
+++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
@@ -115,7 +115,6 @@ static int xenbus_frontend_dev_resume(struct device *dev)
                         return -EFAULT;
                 }
 
-                INIT_WORK(&xdev->work, xenbus_frontend_delayed_resume);
                 queue_work(xenbus_frontend_wq, &xdev->work);
 
                 return 0;
@@ -124,6 +123,16 @@ static int xenbus_frontend_dev_resume(struct device *dev)
         return xenbus_dev_resume(dev);
 }
 
+static int xenbus_frontend_dev_probe(struct device *dev)
+{
+        if (xen_store_domain_type == XS_LOCAL) {
+                struct xenbus_device *xdev = to_xenbus_device(dev);
+                INIT_WORK(&xdev->work, xenbus_frontend_delayed_resume);
+        }
+
+        return xenbus_dev_probe(dev);
+}
+
 static const struct dev_pm_ops xenbus_pm_ops = {
         .suspend        = xenbus_dev_suspend,
         .resume         = xenbus_frontend_dev_resume,
@@ -142,7 +151,7 @@ static struct xen_bus_type xenbus_frontend = {
                 .name           = "xen",
                 .match          = xenbus_match,
                 .uevent         = xenbus_uevent_frontend,
-                .probe          = xenbus_dev_probe,
+                .probe          = xenbus_frontend_dev_probe,
                 .remove         = xenbus_dev_remove,
                 .shutdown       = xenbus_dev_shutdown,
                 .dev_attrs      = xenbus_dev_attrs,
@@ -474,7 +483,11 @@ static int __init xenbus_probe_frontend_init(void)
 
         register_xenstore_notifier(&xenstore_notifier);
 
-        xenbus_frontend_wq = create_workqueue("xenbus_frontend");
+        if (xen_store_domain_type == XS_LOCAL) {
+                xenbus_frontend_wq = create_workqueue("xenbus_frontend");
+                if (!xenbus_frontend_wq)
+                        pr_warn("create xenbus frontend workqueue failed, S3 resume is likely to fail\n");
+        }
 
         return 0;
 }
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 998b17eda09d..9f6b96a09615 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -2965,6 +2965,11 @@ int ocfs2_duplicate_clusters_by_page(handle_t *handle,
                         to = map_end & (PAGE_CACHE_SIZE - 1);
 
                 page = find_or_create_page(mapping, page_index, GFP_NOFS);
+                if (!page) {
+                        ret = -ENOMEM;
+                        mlog_errno(ret);
+                        break;
+                }
 
                 /*
                  * In case PAGE_CACHE_SIZE <= CLUSTER_SIZE, This page
diff --git a/include/linux/firewire.h b/include/linux/firewire.h
index 3b0e820375ab..5d7782e42b8f 100644
--- a/include/linux/firewire.h
+++ b/include/linux/firewire.h
@@ -436,6 +436,7 @@ struct fw_iso_context {
         int type;
         int channel;
         int speed;
+        bool drop_overflow_headers;
         size_t header_size;
         union {
                 fw_iso_callback_t sc;
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index b62d4af6c667..45e921401b06 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -361,7 +361,8 @@ struct ssb_device_id {
         __u16   vendor;
         __u16   coreid;
         __u8    revision;
-};
+        __u8    __pad;
+} __attribute__((packed, aligned(2)));
 #define SSB_DEVICE(_vendor, _coreid, _revision)  \
         { .vendor = _vendor, .coreid = _coreid, .revision = _revision, }
 #define SSB_DEVTABLE_END  \
@@ -377,7 +378,7 @@ struct bcma_device_id {
         __u16   id;
         __u8    rev;
         __u8    class;
-};
+} __attribute__((packed,aligned(2)));
 #define BCMA_CORE(_manuf, _id, _rev, _class)  \
         { .manuf = _manuf, .id = _id, .rev = _rev, .class = _class, }
 #define BCMA_CORETABLE_END  \
diff --git a/include/linux/vmpressure.h b/include/linux/vmpressure.h
index 76be077340ea..7dc17e2456de 100644
--- a/include/linux/vmpressure.h
+++ b/include/linux/vmpressure.h
@@ -12,7 +12,7 @@ struct vmpressure {
         unsigned long scanned;
         unsigned long reclaimed;
         /* The lock is used to keep the scanned/reclaimed above in sync. */
-        struct mutex sr_lock;
+        struct spinlock sr_lock;
 
         /* The list of vmpressure_event structs. */
         struct list_head events;
@@ -30,6 +30,7 @@ extern void vmpressure(gfp_t gfp, struct mem_cgroup *memcg,
 extern void vmpressure_prio(gfp_t gfp, struct mem_cgroup *memcg, int prio);
 
 extern void vmpressure_init(struct vmpressure *vmpr);
+extern void vmpressure_cleanup(struct vmpressure *vmpr);
 extern struct vmpressure *memcg_to_vmpressure(struct mem_cgroup *memcg);
 extern struct cgroup_subsys_state *vmpressure_to_css(struct vmpressure *vmpr);
 extern struct vmpressure *css_to_vmpressure(struct cgroup_subsys_state *css);
diff --git a/include/uapi/linux/firewire-cdev.h b/include/uapi/linux/firewire-cdev.h
index d50036953497..1db453e4b550 100644
--- a/include/uapi/linux/firewire-cdev.h
+++ b/include/uapi/linux/firewire-cdev.h
@@ -215,8 +215,8 @@ struct fw_cdev_event_request2 {
  * with the %FW_CDEV_ISO_INTERRUPT bit set, when explicitly requested with
  * %FW_CDEV_IOC_FLUSH_ISO, or when there have been so many completed packets
  * without the interrupt bit set that the kernel's internal buffer for @header
- * is about to overflow.  (In the last case, kernels with ABI version < 5 drop
- * header data up to the next interrupt packet.)
+ * is about to overflow.  (In the last case, ABI versions < 5 drop header data
+ * up to the next interrupt packet.)
  *
  * Isochronous transmit events (context type %FW_CDEV_ISO_CONTEXT_TRANSMIT):
  *
diff --git a/kernel/Makefile b/kernel/Makefile
index 470839d1a30e..35ef1185e359 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the linux kernel.
 #
 
-obj-y     = fork.o exec_domain.o panic.o printk.o \
+obj-y     = fork.o exec_domain.o panic.o \
             cpu.o exit.o itimer.o time.o softirq.o resource.o \
             sysctl.o sysctl_binary.o capability.o ptrace.o timer.o user.o \
             signal.o sys.o kmod.o workqueue.o pid.o task_work.o \
@@ -24,6 +24,7 @@ endif
 
 obj-y += sched/
 obj-y += power/
+obj-y += printk/
 obj-y += cpu/
 
 obj-$(CONFIG_CHECKPOINT_RESTORE) += kcmp.o
diff --git a/kernel/printk/Makefile b/kernel/printk/Makefile
new file mode 100644
index 000000000000..85405bdcf2b3
--- /dev/null
+++ b/kernel/printk/Makefile
@@ -0,0 +1,2 @@
+obj-y   = printk.o
+obj-$(CONFIG_A11Y_BRAILLE_CONSOLE)      += braille.o
diff --git a/kernel/printk/braille.c b/kernel/printk/braille.c
new file mode 100644
index 000000000000..b51087fb9ace
--- /dev/null
+++ b/kernel/printk/braille.c
@@ -0,0 +1,48 @@
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/kernel.h>
+#include <linux/console.h>
+#include <linux/string.h>
+
+#include "console_cmdline.h"
+#include "braille.h"
+
+char *_braille_console_setup(char **str, char **brl_options)
+{
+        if (!memcmp(*str, "brl,", 4)) {
+                *brl_options = "";
+                *str += 4;
+        } else if (!memcmp(str, "brl=", 4)) {
+                *brl_options = *str + 4;
+                *str = strchr(*brl_options, ',');
+                if (!*str)
+                        pr_err("need port name after brl=\n");
+                else
+                        *((*str)++) = 0;
+        }
+
+        return *str;
+}
+
+int
+_braille_register_console(struct console *console, struct console_cmdline *c)
+{
+        int rtn = 0;
+
+        if (c->brl_options) {
+                console->flags |= CON_BRL;
+                rtn = braille_register_console(console, c->index, c->options,
+                                               c->brl_options);
+        }
+
+        return rtn;
+}
+
+int
+_braille_unregister_console(struct console *console)
+{
+        if (console->flags & CON_BRL)
+                return braille_unregister_console(console);
+
+        return 0;
+}
diff --git a/kernel/printk/braille.h b/kernel/printk/braille.h
new file mode 100644
index 000000000000..769d771145c8
--- /dev/null
+++ b/kernel/printk/braille.h
@@ -0,0 +1,48 @@
+#ifndef _PRINTK_BRAILLE_H
+#define _PRINTK_BRAILLE_H
+
+#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+
+static inline void
+braille_set_options(struct console_cmdline *c, char *brl_options)
+{
+        c->brl_options = brl_options;
+}
+
+char *
+_braille_console_setup(char **str, char **brl_options);
+
+int
+_braille_register_console(struct console *console, struct console_cmdline *c);
+
+int
+_braille_unregister_console(struct console *console);
+
+#else
+
+static inline void
+braille_set_options(struct console_cmdline *c, char *brl_options)
+{
+}
+
+static inline char *
+_braille_console_setup(char **str, char **brl_options)
+{
+        return NULL;
+}
+
+static inline int
+_braille_register_console(struct console *console, struct console_cmdline *c)
+{
+        return 0;
+}
+
+static inline int
+_braille_unregister_console(struct console *console)
+{
+        return 0;
+}
+
+#endif
+
+#endif
diff --git a/kernel/printk/console_cmdline.h b/kernel/printk/console_cmdline.h
new file mode 100644
index 000000000000..cbd69d842341
--- /dev/null
+++ b/kernel/printk/console_cmdline.h
@@ -0,0 +1,14 @@
+#ifndef _CONSOLE_CMDLINE_H
+#define _CONSOLE_CMDLINE_H
+
+struct console_cmdline
+{
+        char    name[8];                        /* Name of the driver       */
+        int     index;                          /* Minor dev. to use        */
+        char    *options;                       /* Options for the driver   */
+#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+        char    *brl_options;                   /* Options for braille driver */
+#endif
+};
+
+#endif
diff --git a/kernel/printk.c b/kernel/printk/printk.c
index 69b0890ed7e5..5b5a7080e2a5 100644
--- a/kernel/printk.c
+++ b/kernel/printk/printk.c
@@ -51,6 +51,9 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/printk.h>
 
+#include "console_cmdline.h"
+#include "braille.h"
+
 /* printk's without a loglevel use this.. */
 #define DEFAULT_MESSAGE_LOGLEVEL CONFIG_DEFAULT_MESSAGE_LOGLEVEL
 
@@ -105,19 +108,11 @@ static struct console *exclusive_console;
 /*
  *      Array of consoles built from command line options (console=)
  */
-struct console_cmdline
-{
-        char    name[8];                        /* Name of the driver       */
-        int     index;                          /* Minor dev. to use        */
-        char    *options;                       /* Options for the driver   */
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-        char    *brl_options;                   /* Options for braille driver */
-#endif
-};
 
 #define MAX_CMDLINECONSOLES 8
 
 static struct console_cmdline console_cmdline[MAX_CMDLINECONSOLES];
+
 static int selected_console = -1;
 static int preferred_console = -1;
 int console_set_on_cmdline;
@@ -178,7 +173,7 @@ static int console_may_schedule;
  *         67                           "g"
  *   0032     00 00 00                  padding to next message header
  *
- * The 'struct log' buffer header must never be directly exported to
+ * The 'struct printk_log' buffer header must never be directly exported to
  * userspace, it is a kernel-private implementation detail that might
  * need to be changed in the future, when the requirements change.
  *
@@ -200,7 +195,7 @@ enum log_flags {
         LOG_CONT        = 8,    /* text is a fragment of a continuation line */
 };
 
-struct log {
+struct printk_log {
         u64 ts_nsec;            /* timestamp in nanoseconds */
         u16 len;                /* length of entire record */
         u16 text_len;           /* length of text buffer */
@@ -248,7 +243,7 @@ static u32 clear_idx;
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
 #define LOG_ALIGN 4
 #else
-#define LOG_ALIGN __alignof__(struct log)
+#define LOG_ALIGN __alignof__(struct printk_log)
 #endif
 #define __LOG_BUF_LEN (1 << CONFIG_LOG_BUF_SHIFT)
 static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN);
@@ -259,35 +254,35 @@ static u32 log_buf_len = __LOG_BUF_LEN;
 static volatile unsigned int logbuf_cpu = UINT_MAX;
 
 /* human readable text of the record */
-static char *log_text(const struct log *msg)
+static char *log_text(const struct printk_log *msg)
 {
-        return (char *)msg + sizeof(struct log);
+        return (char *)msg + sizeof(struct printk_log);
 }
 
 /* optional key/value pair dictionary attached to the record */
-static char *log_dict(const struct log *msg)
+static char *log_dict(const struct printk_log *msg)
 {
-        return (char *)msg + sizeof(struct log) + msg->text_len;
+        return (char *)msg + sizeof(struct printk_log) + msg->text_len;
 }
 
 /* get record by index; idx must point to valid msg */
-static struct log *log_from_idx(u32 idx)
+static struct printk_log *log_from_idx(u32 idx)
 {
-        struct log *msg = (struct log *)(log_buf + idx);
+        struct printk_log *msg = (struct printk_log *)(log_buf + idx);
 
         /*
          * A length == 0 record is the end of buffer marker. Wrap around and
          * read the message at the start of the buffer.
          */
         if (!msg->len)
-                return (struct log *)log_buf;
+                return (struct printk_log *)log_buf;
         return msg;
 }
 
 /* get next record; idx must point to valid msg */
 static u32 log_next(u32 idx)
 {
-        struct log *msg = (struct log *)(log_buf + idx);
+        struct printk_log *msg = (struct printk_log *)(log_buf + idx);
 
         /* length == 0 indicates the end of the buffer; wrap */
         /*
@@ -296,7 +291,7 @@ static u32 log_next(u32 idx)
          * return the one after that.
          */
         if (!msg->len) {
-                msg = (struct log *)log_buf;
+                msg = (struct printk_log *)log_buf;
                 return msg->len;
         }
         return idx + msg->len;
@@ -308,11 +303,11 @@ static void log_store(int facility, int level,
                       const char *dict, u16 dict_len,
                       const char *text, u16 text_len)
 {
-        struct log *msg;
+        struct printk_log *msg;
         u32 size, pad_len;
 
         /* number of '\0' padding bytes to next message */
-        size = sizeof(struct log) + text_len + dict_len;
+        size = sizeof(struct printk_log) + text_len + dict_len;
         pad_len = (-size) & (LOG_ALIGN - 1);
         size += pad_len;
 
@@ -324,7 +319,7 @@ static void log_store(int facility, int level,
                 else
                         free = log_first_idx - log_next_idx;
 
-                if (free > size + sizeof(struct log))
+                if (free > size + sizeof(struct printk_log))
                         break;
 
                 /* drop old messages until we have enough contiuous space */
@@ -332,18 +327,18 @@ static void log_store(int facility, int level,
                 log_first_seq++;
         }
 
-        if (log_next_idx + size + sizeof(struct log) >= log_buf_len) {
+        if (log_next_idx + size + sizeof(struct printk_log) >= log_buf_len) {
                 /*
                  * This message + an additional empty header does not fit
                  * at the end of the buffer. Add an empty header with len == 0
                  * to signify a wrap around.
                  */
-                memset(log_buf + log_next_idx, 0, sizeof(struct log));
+                memset(log_buf + log_next_idx, 0, sizeof(struct printk_log));
                 log_next_idx = 0;
         }
 
         /* fill message */
-        msg = (struct log *)(log_buf + log_next_idx);
+        msg = (struct printk_log *)(log_buf + log_next_idx);
         memcpy(log_text(msg), text, text_len);
         msg->text_len = text_len;
         memcpy(log_dict(msg), dict, dict_len);
@@ -356,7 +351,7 @@ static void log_store(int facility, int level,
         else
                 msg->ts_nsec = local_clock();
         memset(log_dict(msg) + dict_len, 0, pad_len);
-        msg->len = sizeof(struct log) + text_len + dict_len + pad_len;
+        msg->len = sizeof(struct printk_log) + text_len + dict_len + pad_len;
 
         /* insert message */
         log_next_idx += msg->len;
@@ -479,7 +474,7 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
                             size_t count, loff_t *ppos)
 {
         struct devkmsg_user *user = file->private_data;
-        struct log *msg;
+        struct printk_log *msg;
         u64 ts_usec;
         size_t i;
         char cont = '-';
@@ -724,14 +719,14 @@ void log_buf_kexec_setup(void)
         VMCOREINFO_SYMBOL(log_first_idx);
         VMCOREINFO_SYMBOL(log_next_idx);
         /*
-         * Export struct log size and field offsets. User space tools can
+         * Export struct printk_log size and field offsets. User space tools can
          * parse it and detect any changes to structure down the line.
          */
-        VMCOREINFO_STRUCT_SIZE(log);
-        VMCOREINFO_OFFSET(log, ts_nsec);
-        VMCOREINFO_OFFSET(log, len);
-        VMCOREINFO_OFFSET(log, text_len);
-        VMCOREINFO_OFFSET(log, dict_len);
+        VMCOREINFO_STRUCT_SIZE(printk_log);
+        VMCOREINFO_OFFSET(printk_log, ts_nsec);
+        VMCOREINFO_OFFSET(printk_log, len);
+        VMCOREINFO_OFFSET(printk_log, text_len);
+        VMCOREINFO_OFFSET(printk_log, dict_len);
 }
 #endif
 
@@ -884,7 +879,7 @@ static size_t print_time(u64 ts, char *buf)
                        (unsigned long)ts, rem_nsec / 1000);
 }
 
-static size_t print_prefix(const struct log *msg, bool syslog, char *buf)
+static size_t print_prefix(const struct printk_log *msg, bool syslog, char *buf)
 {
         size_t len = 0;
         unsigned int prefix = (msg->facility << 3) | msg->level;
@@ -907,7 +902,7 @@ static size_t print_prefix(const struct log *msg, bool syslog, char *buf)
         return len;
 }
 
-static size_t msg_print_text(const struct log *msg, enum log_flags prev,
+static size_t msg_print_text(const struct printk_log *msg, enum log_flags prev,
                              bool syslog, char *buf, size_t size)
 {
         const char *text = log_text(msg);
@@ -969,7 +964,7 @@ static size_t msg_print_text(const struct log *msg, enum log_flags prev,
 static int syslog_print(char __user *buf, int size)
 {
         char *text;
-        struct log *msg;
+        struct printk_log *msg;
         int len = 0;
 
         text = kmalloc(LOG_LINE_MAX + PREFIX_MAX, GFP_KERNEL);
@@ -1060,7 +1055,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 idx = clear_idx;
                 prev = 0;
                 while (seq < log_next_seq) {
-                        struct log *msg = log_from_idx(idx);
+                        struct printk_log *msg = log_from_idx(idx);
 
                         len += msg_print_text(msg, prev, true, NULL, 0);
                         prev = msg->flags;
@@ -1073,7 +1068,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 idx = clear_idx;
                 prev = 0;
                 while (len > size && seq < log_next_seq) {
-                        struct log *msg = log_from_idx(idx);
+                        struct printk_log *msg = log_from_idx(idx);
 
                         len -= msg_print_text(msg, prev, true, NULL, 0);
                         prev = msg->flags;
@@ -1087,7 +1082,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 len = 0;
                 prev = 0;
                 while (len >= 0 && seq < next_seq) {
-                        struct log *msg = log_from_idx(idx);
+                        struct printk_log *msg = log_from_idx(idx);
                         int textlen;
 
                         textlen = msg_print_text(msg, prev, true, text,
@@ -1233,7 +1228,7 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
 
                         error = 0;
                         while (seq < log_next_seq) {
-                                struct log *msg = log_from_idx(idx);
+                                struct printk_log *msg = log_from_idx(idx);
 
                                 error += msg_print_text(msg, prev, true, NULL, 0);
                                 idx = log_next(idx);
@@ -1719,10 +1714,10 @@ static struct cont {
         u8 level;
         bool flushed:1;
 } cont;
-static struct log *log_from_idx(u32 idx) { return NULL; }
+static struct printk_log *log_from_idx(u32 idx) { return NULL; }
 static u32 log_next(u32 idx) { return 0; }
 static void call_console_drivers(int level, const char *text, size_t len) {}
-static size_t msg_print_text(const struct log *msg, enum log_flags prev,
+static size_t msg_print_text(const struct printk_log *msg, enum log_flags prev,
                              bool syslog, char *buf, size_t size) { return 0; }
 static size_t cont_print_text(char *text, size_t size) { return 0; }
 
@@ -1761,23 +1756,23 @@ static int __add_preferred_console(char *name, int idx, char *options,
          *      See if this tty is not yet registered, and
          *      if we have a slot free.
          */
-        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; i++)
-                if (strcmp(console_cmdline[i].name, name) == 0 &&
-                          console_cmdline[i].index == idx) {
-                                if (!brl_options)
-                                        selected_console = i;
-                                return 0;
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
+                if (strcmp(c->name, name) == 0 && c->index == idx) {
+                        if (!brl_options)
+                                selected_console = i;
+                        return 0;
                 }
+        }
         if (i == MAX_CMDLINECONSOLES)
                 return -E2BIG;
         if (!brl_options)
                 selected_console = i;
-        c = &console_cmdline[i];
         strlcpy(c->name, name, sizeof(c->name));
         c->options = options;
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-        c->brl_options = brl_options;
-#endif
+        braille_set_options(c, brl_options);
+
         c->index = idx;
         return 0;
 }
@@ -1790,20 +1785,8 @@ static int __init console_setup(char *str)
         char *s, *options, *brl_options = NULL;
         int idx;
 
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-        if (!memcmp(str, "brl,", 4)) {
-                brl_options = "";
-                str += 4;
-        } else if (!memcmp(str, "brl=", 4)) {
-                brl_options = str + 4;
-                str = strchr(brl_options, ',');
-                if (!str) {
-                        printk(KERN_ERR "need port name after brl=\n");
-                        return 1;
-                }
-                *(str++) = 0;
-        }
-#endif
+        if (_braille_console_setup(&str, &brl_options))
+                return 1;
 
         /*
          * Decode str into name, index, options.
@@ -1858,15 +1841,15 @@ int update_console_cmdline(char *name, int idx, char *name_new, int idx_new, cha
         struct console_cmdline *c;
         int i;
 
-        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; i++)
-                if (strcmp(console_cmdline[i].name, name) == 0 &&
-                          console_cmdline[i].index == idx) {
-                                c = &console_cmdline[i];
-                                strlcpy(c->name, name_new, sizeof(c->name));
-                                c->name[sizeof(c->name) - 1] = 0;
-                                c->options = options;
-                                c->index = idx_new;
-                                return i;
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++)
+                if (strcmp(c->name, name) == 0 && c->index == idx) {
+                        strlcpy(c->name, name_new, sizeof(c->name));
+                        c->name[sizeof(c->name) - 1] = 0;
+                        c->options = options;
+                        c->index = idx_new;
+                        return i;
                 }
         /* not found */
         return -1;
@@ -2046,7 +2029,7 @@ void console_unlock(void)
         console_cont_flush(text, sizeof(text));
 again:
         for (;;) {
-                struct log *msg;
+                struct printk_log *msg;
                 size_t len;
                 int level;
 
@@ -2241,6 +2224,7 @@ void register_console(struct console *newcon)
         int i;
         unsigned long flags;
         struct console *bcon = NULL;
+        struct console_cmdline *c;
 
         /*
          * before we register a new CON_BOOT console, make sure we don't
@@ -2288,30 +2272,25 @@ void register_console(struct console *newcon)
          *      See if this console matches one we selected on
          *      the command line.
          */
-        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0];
-                        i++) {
-                if (strcmp(console_cmdline[i].name, newcon->name) != 0)
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
+                if (strcmp(c->name, newcon->name) != 0)
                         continue;
                 if (newcon->index >= 0 &&
-                    newcon->index != console_cmdline[i].index)
+                    newcon->index != c->index)
                         continue;
                 if (newcon->index < 0)
-                        newcon->index = console_cmdline[i].index;
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-                if (console_cmdline[i].brl_options) {
-                        newcon->flags |= CON_BRL;
-                        braille_register_console(newcon,
-                                        console_cmdline[i].index,
-                                        console_cmdline[i].options,
-                                        console_cmdline[i].brl_options);
+                        newcon->index = c->index;
+
+                if (_braille_register_console(newcon, c))
                         return;
-                }
-#endif
+
                 if (newcon->setup &&
                     newcon->setup(newcon, console_cmdline[i].options) != 0)
                         break;
                 newcon->flags |= CON_ENABLED;
-                newcon->index = console_cmdline[i].index;
+                newcon->index = c->index;
                 if (i == selected_console) {
                         newcon->flags |= CON_CONSDEV;
                         preferred_console = selected_console;
@@ -2394,13 +2373,13 @@ EXPORT_SYMBOL(register_console);
 int unregister_console(struct console *console)
 {
         struct console *a, *b;
-        int res = 1;
+        int res;
 
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-        if (console->flags & CON_BRL)
-                return braille_unregister_console(console);
-#endif
+        res = _braille_unregister_console(console);
+        if (res)
+                return res;
 
+        res = 1;
         console_lock();
         if (console_drivers == console) {
                 console_drivers=console->next;
@@ -2666,7 +2645,7 @@ void kmsg_dump(enum kmsg_dump_reason reason)
 bool kmsg_dump_get_line_nolock(struct kmsg_dumper *dumper, bool syslog,
                                char *line, size_t size, size_t *len)
 {
-        struct log *msg;
+        struct printk_log *msg;
         size_t l = 0;
         bool ret = false;
 
@@ -2778,7 +2757,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
         idx = dumper->cur_idx;
         prev = 0;
         while (seq < dumper->next_seq) {
-                struct log *msg = log_from_idx(idx);
+                struct printk_log *msg = log_from_idx(idx);
 
                 l += msg_print_text(msg, prev, true, NULL, 0);
                 idx = log_next(idx);
@@ -2791,7 +2770,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
         idx = dumper->cur_idx;
         prev = 0;
         while (l > size && seq < dumper->next_seq) {
-                struct log *msg = log_from_idx(idx);
+                struct printk_log *msg = log_from_idx(idx);
 
                 l -= msg_print_text(msg, prev, true, NULL, 0);
                 idx = log_next(idx);
@@ -2806,7 +2785,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
         l = 0;
         prev = 0;
         while (seq < dumper->next_seq) {
-                struct log *msg = log_from_idx(idx);
+                struct printk_log *msg = log_from_idx(idx);
 
                 l += msg_print_text(msg, prev, syslog, buf + l, size - l);
                 idx = log_next(idx);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index bb456f44b7b1..9565645e3202 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -851,7 +851,7 @@ void task_numa_fault(int node, int pages, bool migrated)
 {
         struct task_struct *p = current;
 
-        if (!sched_feat_numa(NUMA))
+        if (!numabalancing_enabled)
                 return;
 
         /* FIXME: Allocate task-specific structure for placement policy here */
@@ -5786,7 +5786,7 @@ static void task_tick_fair(struct rq *rq, struct task_struct *curr, int queued)
                 entity_tick(cfs_rq, se, queued);
         }
 
-        if (sched_feat_numa(NUMA))
+        if (numabalancing_enabled)
                 task_tick_numa(rq, curr);
 
         update_rq_runnable_avg(rq, 1);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index ac09d98490aa..07f6fc468e17 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2346,7 +2346,11 @@ static int do_proc_dointvec_ms_jiffies_conv(bool *negp, unsigned long *lvalp,
                                             int write, void *data)
 {
         if (write) {
-                *valp = msecs_to_jiffies(*negp ? -*lvalp : *lvalp);
+                unsigned long jif = msecs_to_jiffies(*negp ? -*lvalp : *lvalp);
+
+                if (jif > INT_MAX)
+                        return 1;
+                *valp = (int)jif;
         } else {
                 int val = *valp;
                 unsigned long lval;
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 243e710c6039..a92012a71702 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1620,7 +1620,9 @@ static void __split_huge_page_refcount(struct page *page,
                                      ((1L << PG_referenced) |
                                       (1L << PG_swapbacked) |
                                       (1L << PG_mlocked) |
-                                      (1L << PG_uptodate)));
+                                      (1L << PG_uptodate) |
+                                      (1L << PG_active) |
+                                      (1L << PG_unevictable)));
                 page_tail->flags |= (1L << PG_dirty);
 
                 /* clear PageTail before overwriting first_page */
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 00a7a664b9c1..c290a1cf3862 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -6335,6 +6335,7 @@ static void mem_cgroup_css_offline(struct cgroup *cont)
         mem_cgroup_invalidate_reclaim_iterators(memcg);
         mem_cgroup_reparent_charges(memcg);
         mem_cgroup_destroy_all_caches(memcg);
+        vmpressure_cleanup(&memcg->vmpressure);
 }
 
 static void mem_cgroup_css_free(struct cgroup *cont)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 74310017296e..4baf12e534d1 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -732,7 +732,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
                 if (prev) {
                         vma = prev;
                         next = vma->vm_next;
-                        continue;
+                        if (mpol_equal(vma_policy(vma), new_pol))
+                                continue;
+                        /* vma_merge() joined vma && vma->next, case 8 */
+                        goto replace;
                 }
                 if (vma->vm_start != vmstart) {
                         err = split_vma(vma->vm_mm, vma, vmstart, 1);
@@ -744,6 +747,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
                         if (err)
                                 goto out;
                 }
+ replace:
                 err = vma_replace_policy(vma, new_pol);
                 if (err)
                         goto out;
diff --git a/mm/mmap.c b/mm/mmap.c
index fbad7b091090..1edbaa3136c3 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -865,7 +865,7 @@ again:			remove_next = 1 + (end > next->vm_end);
                 if (next->anon_vma)
                         anon_vma_merge(vma, next);
                 mm->map_count--;
-                vma_set_policy(vma, vma_policy(next));
+                mpol_put(vma_policy(next));
                 kmem_cache_free(vm_area_cachep, next);
                 /*
                  * In mprotect's case 6 (see comments on vma_merge),
diff --git a/mm/swap.c b/mm/swap.c
index 4a1d0d2c52fa..62b78a6e224f 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -512,12 +512,7 @@ EXPORT_SYMBOL(__lru_cache_add);
  */
 void lru_cache_add(struct page *page)
 {
-        if (PageActive(page)) {
-                VM_BUG_ON(PageUnevictable(page));
-        } else if (PageUnevictable(page)) {
-                VM_BUG_ON(PageActive(page));
-        }
-
+        VM_BUG_ON(PageActive(page) && PageUnevictable(page));
         VM_BUG_ON(PageLRU(page));
         __lru_cache_add(page);
 }
@@ -539,6 +534,7 @@ void add_page_to_unevictable_list(struct page *page)
 
         spin_lock_irq(&zone->lru_lock);
         lruvec = mem_cgroup_page_lruvec(page, zone);
+        ClearPageActive(page);
         SetPageUnevictable(page);
         SetPageLRU(page);
         add_page_to_lru_list(page, lruvec, LRU_UNEVICTABLE);
@@ -774,8 +770,6 @@ EXPORT_SYMBOL(__pagevec_release);
 void lru_add_page_tail(struct page *page, struct page *page_tail,
                        struct lruvec *lruvec, struct list_head *list)
 {
-        int uninitialized_var(active);
-        enum lru_list lru;
         const int file = 0;
 
         VM_BUG_ON(!PageHead(page));
@@ -787,20 +781,6 @@ void lru_add_page_tail(struct page *page, struct page *page_tail,
         if (!list)
                 SetPageLRU(page_tail);
 
-        if (page_evictable(page_tail)) {
-                if (PageActive(page)) {
-                        SetPageActive(page_tail);
-                        active = 1;
-                        lru = LRU_ACTIVE_ANON;
-                } else {
-                        active = 0;
-                        lru = LRU_INACTIVE_ANON;
-                }
-        } else {
-                SetPageUnevictable(page_tail);
-                lru = LRU_UNEVICTABLE;
-        }
-
         if (likely(PageLRU(page)))
                 list_add_tail(&page_tail->lru, &page->lru);
         else if (list) {
@@ -816,13 +796,13 @@ void lru_add_page_tail(struct page *page, struct page *page_tail,
                  * Use the standard add function to put page_tail on the list,
                  * but then correct its position so they all end up in order.
                  */
-                add_page_to_lru_list(page_tail, lruvec, lru);
+                add_page_to_lru_list(page_tail, lruvec, page_lru(page_tail));
                 list_head = page_tail->lru.prev;
                 list_move_tail(&page_tail->lru, list_head);
         }
 
         if (!PageUnevictable(page))
-                update_page_reclaim_stat(lruvec, file, active);
+                update_page_reclaim_stat(lruvec, file, PageActive(page_tail));
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
@@ -833,7 +813,6 @@ static void __pagevec_lru_add_fn(struct page *page, struct lruvec *lruvec,
         int active = PageActive(page);
         enum lru_list lru = page_lru(page);
 
-        VM_BUG_ON(PageUnevictable(page));
         VM_BUG_ON(PageLRU(page));
 
         SetPageLRU(page);
diff --git a/mm/vmpressure.c b/mm/vmpressure.c
index 736a6011c2c8..0c1e37d829fa 100644
--- a/mm/vmpressure.c
+++ b/mm/vmpressure.c
@@ -180,12 +180,12 @@ static void vmpressure_work_fn(struct work_struct *work)
         if (!vmpr->scanned)
                 return;
 
-        mutex_lock(&vmpr->sr_lock);
+        spin_lock(&vmpr->sr_lock);
         scanned = vmpr->scanned;
         reclaimed = vmpr->reclaimed;
         vmpr->scanned = 0;
         vmpr->reclaimed = 0;
-        mutex_unlock(&vmpr->sr_lock);
+        spin_unlock(&vmpr->sr_lock);
 
         do {
                 if (vmpressure_event(vmpr, scanned, reclaimed))
@@ -240,13 +240,13 @@ void vmpressure(gfp_t gfp, struct mem_cgroup *memcg,
         if (!scanned)
                 return;
 
-        mutex_lock(&vmpr->sr_lock);
+        spin_lock(&vmpr->sr_lock);
         vmpr->scanned += scanned;
         vmpr->reclaimed += reclaimed;
         scanned = vmpr->scanned;
-        mutex_unlock(&vmpr->sr_lock);
+        spin_unlock(&vmpr->sr_lock);
 
-        if (scanned < vmpressure_win || work_pending(&vmpr->work))
+        if (scanned < vmpressure_win)
                 return;
         schedule_work(&vmpr->work);
 }
@@ -367,8 +367,24 @@ void vmpressure_unregister_event(struct cgroup *cg, struct cftype *cft,
  */
 void vmpressure_init(struct vmpressure *vmpr)
 {
-        mutex_init(&vmpr->sr_lock);
+        spin_lock_init(&vmpr->sr_lock);
         mutex_init(&vmpr->events_lock);
         INIT_LIST_HEAD(&vmpr->events);
         INIT_WORK(&vmpr->work, vmpressure_work_fn);
 }
+
+/**
+ * vmpressure_cleanup() - shuts down vmpressure control structure
+ * @vmpr:       Structure to be cleaned up
+ *
+ * This function should be called before the structure in which it is
+ * embedded is cleaned up.
+ */
+void vmpressure_cleanup(struct vmpressure *vmpr)
+{
+        /*
+         * Make sure there is no pending work before eventfd infrastructure
+         * goes away.
+         */
+        flush_work(&vmpr->work);
+}
diff --git a/mm/zbud.c b/mm/zbud.c
index 9bb4710e3589..ad1e781284fd 100644
--- a/mm/zbud.c
+++ b/mm/zbud.c
@@ -257,7 +257,7 @@ int zbud_alloc(struct zbud_pool *pool, int size, gfp_t gfp,
 
         if (size <= 0 || gfp & __GFP_HIGHMEM)
                 return -EINVAL;
-        if (size > PAGE_SIZE - ZHDR_SIZE_ALIGNED)
+        if (size > PAGE_SIZE - ZHDR_SIZE_ALIGNED - CHUNK_SIZE)
                 return -ENOSPC;
         chunks = size_to_chunks(size);
         spin_lock(&pool->lock);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 69af490cce44..4b99c9a27044 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -619,6 +619,9 @@ rehash:
         mp->br = br;
         mp->addr = *group;
 
+        setup_timer(&mp->timer, br_multicast_group_expired,
+                    (unsigned long)mp);
+
         hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
         mdb->size++;
 
@@ -1126,7 +1129,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
         if (!mp)
                 goto out;
 
-        setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
         mod_timer(&mp->timer, now + br->multicast_membership_interval);
         mp->timer_armed = true;
 
@@ -1204,7 +1206,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         if (!mp)
                 goto out;
 
-        setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
         mod_timer(&mp->timer, now + br->multicast_membership_interval);
         mp->timer_armed = true;
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index b7de821f98df..9232c68941ab 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2767,6 +2767,7 @@ EXPORT_SYMBOL(neigh_app_ns);
 
 #ifdef CONFIG_SYSCTL
 static int zero;
+static int int_max = INT_MAX;
 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
 
 static int proc_unres_qlen(struct ctl_table *ctl, int write,
@@ -2819,19 +2820,25 @@ static struct neigh_sysctl_table {
                         .procname       = "mcast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_UCAST_PROBE] = {
                         .procname       = "ucast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_APP_PROBE] = {
                         .procname       = "app_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_RETRANS_TIME] = {
                         .procname       = "retrans_time",
@@ -2874,7 +2881,9 @@ static struct neigh_sysctl_table {
                         .procname       = "proxy_qlen",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_ANYCAST_DELAY] = {
                         .procname       = "anycast_delay",
@@ -2916,19 +2925,25 @@ static struct neigh_sysctl_table {
                         .procname       = "gc_thresh1",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_GC_THRESH2] = {
                         .procname       = "gc_thresh2",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_GC_THRESH3] = {
                         .procname       = "gc_thresh3",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 {},
         },
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 20e02d2605ec..3df4d4ccf440 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -309,7 +309,8 @@ EXPORT_SYMBOL(__alloc_skb);
  * @frag_size: size of fragment, or 0 if head was kmalloced
  *
  * Allocate a new &sk_buff. Caller provides space holding head and
- * skb_shared_info. @data must have been allocated by kmalloc()
+ * skb_shared_info. @data must have been allocated by kmalloc() only if
+ * @frag_size is 0, otherwise data should come from the page allocator.
  * The return is the new skb buffer.
  * On a failure the return is %NULL, and @data is not freed.
  * Notes :
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 49616fed9340..108a1e9c9eac 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2133,7 +2133,7 @@ static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat)
                 max--;
 
         pointers = 0;
-        for (i = 1; i <= max; i++)
+        for (i = 1; i < max; i++)
                 if (stat->nodesizes[i] != 0) {
                         seq_printf(seq, "  %u: %u",  i, stat->nodesizes[i]);
                         pointers += (1<<i) * stat->nodesizes[i];
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index b2c123c44d69..610e324348d1 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -36,6 +36,8 @@ static int tcp_adv_win_scale_min = -31;
 static int tcp_adv_win_scale_max = 31;
 static int ip_ttl_min = 1;
 static int ip_ttl_max = 255;
+static int tcp_syn_retries_min = 1;
+static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
 static int ip_ping_group_range_min[] = { 0, 0 };
 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
 
@@ -332,7 +334,9 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_syn_retries,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &tcp_syn_retries_min,
+                .extra2         = &tcp_syn_retries_max
         },
         {
                 .procname       = "tcp_synack_retries",
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 583e8d435f9a..03986d31fa41 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -259,10 +259,12 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
 {
         struct mr6_table *mrt, *next;
 
+        rtnl_lock();
         list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
                 list_del(&mrt->list);
                 ip6mr_free_table(mrt);
         }
+        rtnl_unlock();
         fib_rules_unregister(net->ipv6.mr6_rules_ops);
 }
 #else
@@ -289,7 +291,10 @@ static int __net_init ip6mr_rules_init(struct net *net)
 
 static void __net_exit ip6mr_rules_exit(struct net *net)
 {
+        rtnl_lock();
         ip6mr_free_table(net->ipv6.mrt6);
+        net->ipv6.mrt6 = NULL;
+        rtnl_unlock();
 }
 #endif
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9da862070dd8..ab8bd2cabfa0 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2081,6 +2081,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy *
                         pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
         }
         pol->sadb_x_policy_dir = dir+1;
+        pol->sadb_x_policy_reserved = 0;
         pol->sadb_x_policy_id = xp->index;
         pol->sadb_x_policy_priority = xp->priority;
 
@@ -3137,7 +3138,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
         pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
         pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
         pol->sadb_x_policy_dir = XFRM_POLICY_OUT + 1;
+        pol->sadb_x_policy_reserved = 0;
         pol->sadb_x_policy_id = xp->index;
+        pol->sadb_x_policy_priority = xp->priority;
 
         /* Set sadb_comb's. */
         if (x->id.proto == IPPROTO_AH)
@@ -3525,6 +3528,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
         pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
         pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
         pol->sadb_x_policy_dir = dir + 1;
+        pol->sadb_x_policy_reserved = 0;
         pol->sadb_x_policy_id = 0;
         pol->sadb_x_policy_priority = 0;
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 8184d121ff09..43dd7525bfcb 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -666,6 +666,8 @@ static void ieee80211_get_et_stats(struct wiphy *wiphy,
                         if (sta->sdata->dev != dev)
                                 continue;
 
+                        sinfo.filled = 0;
+                        sta_set_sinfo(sta, &sinfo);
                         i = 0;
                         ADD_STA_STATS(sta);
                 }
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index ac7ef5414bde..e6512e2ffd20 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
         struct minstrel_rate *msr, *mr;
         unsigned int ndx;
         bool mrr_capable;
-        bool prev_sample = mi->prev_sample;
+        bool prev_sample;
         int delta;
         int sampling_ratio;
 
@@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
                         (mi->sample_count + mi->sample_deferred / 2);
 
         /* delta < 0: no sampling required */
+        prev_sample = mi->prev_sample;
         mi->prev_sample = false;
         if (delta < 0 || (!mrr_capable && prev_sample))
                 return;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 5b2d3012b983..f5aed963b22e 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -804,10 +804,18 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
 
         sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
         info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+        rate->count = 1;
+
+        if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
+                int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
+                rate->idx = mp->cck_rates[idx];
+                rate->flags = 0;
+                return;
+        }
+
         rate->idx = sample_idx % MCS_GROUP_RATES +
                     (sample_group->streams - 1) * MCS_GROUP_RATES;
         rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
-        rate->count = 1;
 }
 
 static void
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 23dbcfc69b3b..2c5a79bd3777 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -936,8 +936,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
 
-        /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
-        if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
+        /*
+         * Drop duplicate 802.11 retransmissions
+         * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
+         */
+        if (rx->skb->len >= 24 && rx->sta &&
+            !ieee80211_is_ctl(hdr->frame_control) &&
+            !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
+            !is_multicast_ether_addr(hdr->addr1)) {
                 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
                              rx->sta->last_seq_ctrl[rx->seqno_idx] ==
                              hdr->seq_ctrl)) {
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index c63b618cd619..4fd1ca94fd4a 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -293,6 +293,11 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
                        sizeof(exp->tuple.dst.u3) - len);
 
         exp->tuple.dst.u.all = *dst;
+
+#ifdef CONFIG_NF_NAT_NEEDED
+        memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
+        memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
+#endif
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_init);
 
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index f8b71911037a..20b15916f403 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -172,7 +172,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
 
                 /* Ignore non-transparent sockets,
                    if XT_SOCKET_TRANSPARENT is used */
-                if (info && info->flags & XT_SOCKET_TRANSPARENT)
+                if (info->flags & XT_SOCKET_TRANSPARENT)
                         transparent = ((sk->sk_state != TCP_TIME_WAIT &&
                                         inet_sk(sk)->transparent) ||
                                        (sk->sk_state == TCP_TIME_WAIT &&
@@ -196,7 +196,11 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
 static bool
 socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par)
 {
-        return socket_match(skb, par, NULL);
+        static struct xt_socket_mtinfo1 xt_info_v0 = {
+                .flags = 0,
+        };
+
+        return socket_match(skb, par, &xt_info_v0);
 }
 
 static bool
@@ -314,7 +318,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
 
                 /* Ignore non-transparent sockets,
                    if XT_SOCKET_TRANSPARENT is used */
-                if (info && info->flags & XT_SOCKET_TRANSPARENT)
+                if (info->flags & XT_SOCKET_TRANSPARENT)
                         transparent = ((sk->sk_state != TCP_TIME_WAIT &&
                                         inet_sk(sk)->transparent) ||
                                        (sk->sk_state == TCP_TIME_WAIT &&
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 2fd6dbea327a..512718adb0d5 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -571,7 +571,7 @@ static int genl_family_rcv_msg(struct genl_family *family,
             !capable(CAP_NET_ADMIN))
                 return -EPERM;
 
-        if (nlh->nlmsg_flags & NLM_F_DUMP) {
+        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
                 struct netlink_dump_control c = {
                         .dump = ops->dumpit,
                         .done = ops->done,
@@ -877,8 +877,10 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
 #ifdef CONFIG_MODULES
                 if (res == NULL) {
                         genl_unlock();
+                        up_read(&cb_lock);
                         request_module("net-pf-%d-proto-%d-family-%s",
                                        PF_NETLINK, NETLINK_GENERIC, name);
+                        down_read(&cb_lock);
                         genl_lock();
                         res = genl_family_find_byname(name);
                 }
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 71a568862557..7a42c81a19eb 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1465,6 +1465,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
         unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_wrropt opt;
 
+        memset(&opt, 0, sizeof(opt));
         opt.flags = 0;
         opt.allot = cl->allot;
         opt.priority = cl->priority + 1;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 1cc47aca7f05..25d217d90807 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4770,9 +4770,9 @@ do {									    \
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
                                   mask, NL80211_MESHCONF_FORWARDING,
                                   nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
-                                  nla_get_u32);
+                                  nla_get_s32);
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
                                   mask, NL80211_MESHCONF_HT_OPMODE,
                                   nla_get_u16);
@@ -6613,12 +6613,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
 
 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
 {
+        struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
         void *hdr = ((void **)skb->cb)[1];
         struct nlattr *data = ((void **)skb->cb)[2];
 
         nla_nest_end(skb, data);
         genlmsg_end(skb, hdr);
-        genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
+                                nl80211_testmode_mcgrp.id, gfp);
 }
 EXPORT_SYMBOL(cfg80211_testmode_event);
 #endif
@@ -10064,7 +10066,8 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
         return;
 
  nla_put_failure:
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 5a24c986f34b..5a950f36bae4 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2279,7 +2279,9 @@ void wiphy_regulatory_deregister(struct wiphy *wiphy)
 static void reg_timeout_work(struct work_struct *work)
 {
         REG_DBG_PRINT("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
+        rtnl_lock();
         restore_regulatory_settings(true);
+        rtnl_unlock();
 }
 
 int __init regulatory_init(void)
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 1d3cfb1a3f28..81c8a10d743c 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -34,8 +34,10 @@ struct cfg80211_conn {
                 CFG80211_CONN_SCAN_AGAIN,
                 CFG80211_CONN_AUTHENTICATE_NEXT,
                 CFG80211_CONN_AUTHENTICATING,
+                CFG80211_CONN_AUTH_FAILED,
                 CFG80211_CONN_ASSOCIATE_NEXT,
                 CFG80211_CONN_ASSOCIATING,
+                CFG80211_CONN_ASSOC_FAILED,
                 CFG80211_CONN_DEAUTH,
                 CFG80211_CONN_CONNECTED,
         } state;
@@ -164,6 +166,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                           NULL, 0,
                                           params->key, params->key_len,
                                           params->key_idx, NULL, 0);
+        case CFG80211_CONN_AUTH_FAILED:
+                return -ENOTCONN;
         case CFG80211_CONN_ASSOCIATE_NEXT:
                 BUG_ON(!rdev->ops->assoc);
                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
@@ -188,10 +192,17 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                              WLAN_REASON_DEAUTH_LEAVING,
                                              false);
                 return err;
+        case CFG80211_CONN_ASSOC_FAILED:
+                cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+                                     NULL, 0,
+                                     WLAN_REASON_DEAUTH_LEAVING, false);
+                return -ENOTCONN;
         case CFG80211_CONN_DEAUTH:
                 cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
                                      NULL, 0,
                                      WLAN_REASON_DEAUTH_LEAVING, false);
+                /* free directly, disconnected event already sent */
+                cfg80211_sme_free(wdev);
                 return 0;
         default:
                 return 0;
@@ -371,7 +382,7 @@ bool cfg80211_sme_rx_assoc_resp(struct wireless_dev *wdev, u16 status)
                 return true;
         }
 
-        wdev->conn->state = CFG80211_CONN_DEAUTH;
+        wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
         schedule_work(&rdev->conn_work);
         return false;
 }
@@ -383,7 +394,13 @@ void cfg80211_sme_deauth(struct wireless_dev *wdev)
 
 void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
 {
-        cfg80211_sme_free(wdev);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+
+        if (!wdev->conn)
+                return;
+
+        wdev->conn->state = CFG80211_CONN_AUTH_FAILED;
+        schedule_work(&rdev->conn_work);
 }
 
 void cfg80211_sme_disassoc(struct wireless_dev *wdev)
@@ -399,7 +416,13 @@ void cfg80211_sme_disassoc(struct wireless_dev *wdev)
 
 void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
 {
-        cfg80211_sme_disassoc(wdev);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+
+        if (!wdev->conn)
+                return;
+
+        wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
+        schedule_work(&rdev->conn_work);
 }
 
 static int cfg80211_sme_connect(struct wireless_dev *wdev,