103 files changed, 1610 insertions, 1149 deletions
diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index 00d2efd674df..4f4e741d34b2 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -28,6 +28,8 @@
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/types.h>
+#include <linux/dmi.h>
+#include <linux/delay.h>
 #ifdef CONFIG_ACPI_PROCFS_POWER
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -74,6 +76,8 @@ static int acpi_ac_resume(struct device *dev);
 #endif
 static SIMPLE_DEV_PM_OPS(acpi_ac_pm, NULL, acpi_ac_resume);
+static int ac_sleep_before_get_state_ms;
 static struct acpi_driver acpi_ac_driver = {
        .name = "ac",
        .class = ACPI_AC_CLASS,
@@ -252,6 +256,16 @@ static void acpi_ac_notify(struct acpi_device *device, u32 event)
        case ACPI_AC_NOTIFY_STATUS:
        case ACPI_NOTIFY_BUS_CHECK:
        case ACPI_NOTIFY_DEVICE_CHECK:
+                /*
+                 * A buggy BIOS may notify AC first and then sleep for
+                 * a specific time before doing actual operations in the
+                 * EC event handler (_Qxx). This will cause the AC state
+                 * reported by the ACPI event to be incorrect, so wait for a
+                 * specific time for the EC event handler to make progress.
+                 */
+                if (ac_sleep_before_get_state_ms > 0)
+                        msleep(ac_sleep_before_get_state_ms);
                acpi_ac_get_state(ac);
                acpi_bus_generate_proc_event(device, event, (u32) ac->state);
                acpi_bus_generate_netlink_event(device->pnp.device_class,
@@ -264,6 +278,24 @@ static void acpi_ac_notify(struct acpi_device *device, u32 event)
        return;
 }
+static int thinkpad_e530_quirk(const struct dmi_system_id *d)
+{
+        ac_sleep_before_get_state_ms = 1000;
+        return 0;
+}
+static struct dmi_system_id ac_dmi_table[] = {
+        {
+        .callback = thinkpad_e530_quirk,
+        .ident = "thinkpad e530",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "32597CG"),
+                },
+        },
+        {},
+};
 static int acpi_ac_add(struct acpi_device *device)
 {
        int result = 0;
@@ -312,6 +344,7 @@ static int acpi_ac_add(struct acpi_device *device)
                kfree(ac);
        }
+        dmi_check_system(ac_dmi_table);
        return result;
 }
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index d45b2871d33b..edc00818c803 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -223,7 +223,7 @@ static int ec_check_sci_sync(struct acpi_ec *ec, u8 state)
 static int ec_poll(struct acpi_ec *ec)
 {
        unsigned long flags;
-        int repeat = 2; /* number of command restarts */
+        int repeat = 5; /* number of command restarts */
        while (repeat--) {
                unsigned long delay = jiffies +
                        msecs_to_jiffies(ec_delay);
@@ -241,8 +241,6 @@ static int ec_poll(struct acpi_ec *ec)
                        }
                        advance_transaction(ec, acpi_ec_read_status(ec));
                } while (time_before(jiffies, delay));
-                if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF)
-                        break;
                pr_debug(PREFIX "controller reset, restart transaction\n");
                spin_lock_irqsave(&ec->lock, flags);
                start_transaction(ec);
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index bec717ffd25f..c266cdc11784 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -95,9 +95,6 @@ static const struct acpi_device_id processor_device_ids[] = {
 };
 MODULE_DEVICE_TABLE(acpi, processor_device_ids);
-static SIMPLE_DEV_PM_OPS(acpi_processor_pm,
-                         acpi_processor_suspend, acpi_processor_resume);
 static struct acpi_driver acpi_processor_driver = {
        .name = "processor",
        .class = ACPI_PROCESSOR_CLASS,
@@ -107,7 +104,6 @@ static struct acpi_driver acpi_processor_driver = {
                .remove = acpi_processor_remove,
                .notify = acpi_processor_notify,
                },
-        .drv.pm = &acpi_processor_pm,
 };
 #define INSTALL_NOTIFY_HANDLER          1
@@ -934,6 +930,8 @@ static int __init acpi_processor_init(void)
        if (result < 0)
                return result;
+        acpi_processor_syscore_init();
        acpi_processor_install_hotplug_notify();
        acpi_thermal_cpufreq_init();
@@ -956,6 +954,8 @@ static void __exit acpi_processor_exit(void)
        acpi_processor_uninstall_hotplug_notify();
+        acpi_processor_syscore_exit();
        acpi_bus_unregister_driver(&acpi_processor_driver);
        return;
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index f0df2c9434d2..eb133c77aadb 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -34,6 +34,7 @@
 #include <linux/sched.h>       /* need_resched() */
 #include <linux/clockchips.h>
 #include <linux/cpuidle.h>
+#include <linux/syscore_ops.h>
 /*
 * Include the apic definitions for x86 to have the APIC timer related defines
@@ -210,33 +211,41 @@ static void lapic_timer_state_broadcast(struct acpi_processor *pr,
 #endif
+#ifdef CONFIG_PM_SLEEP
 static u32 saved_bm_rld;
-static void acpi_idle_bm_rld_save(void)
+int acpi_processor_suspend(void)
 {
        acpi_read_bit_register(ACPI_BITREG_BUS_MASTER_RLD, &saved_bm_rld);
+        return 0;
 }
-static void acpi_idle_bm_rld_restore(void)
+void acpi_processor_resume(void)
 {
        u32 resumed_bm_rld;
        acpi_read_bit_register(ACPI_BITREG_BUS_MASTER_RLD, &resumed_bm_rld);
+        if (resumed_bm_rld == saved_bm_rld)
+                return;
-        if (resumed_bm_rld != saved_bm_rld)
+        acpi_write_bit_register(ACPI_BITREG_BUS_MASTER_RLD, saved_bm_rld);
-                acpi_write_bit_register(ACPI_BITREG_BUS_MASTER_RLD, saved_bm_rld);
 }
-int acpi_processor_suspend(struct device *dev)
+static struct syscore_ops acpi_processor_syscore_ops = {
+        .suspend = acpi_processor_suspend,
+        .resume = acpi_processor_resume,
+};
+void acpi_processor_syscore_init(void)
 {
-        acpi_idle_bm_rld_save();
+        register_syscore_ops(&acpi_processor_syscore_ops);
-        return 0;
 }
-int acpi_processor_resume(struct device *dev)
+void acpi_processor_syscore_exit(void)
 {
-        acpi_idle_bm_rld_restore();
+        unregister_syscore_ops(&acpi_processor_syscore_ops);
-        return 0;
 }
+#endif /* CONFIG_PM_SLEEP */
 #if defined(CONFIG_X86)
 static void tsc_check_state(int state)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index fe158fd4f1df..c1bc608339a6 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1785,7 +1785,7 @@ static void acpi_scan_init_hotplug(acpi_handle handle, int type)
        acpi_set_pnp_ids(handle, &pnp, type);
        if (!pnp.type.hardware_id)
-                return;
+                goto out;
        /*
         * This relies on the fact that acpi_install_notify_handler() will not
@@ -1800,6 +1800,7 @@ static void acpi_scan_init_hotplug(acpi_handle handle, int type)
                }
        }
+out:
        acpi_free_pnp_ids(&pnp);
 }
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index c3932d0876e0..5b32e15a65ce 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -456,6 +456,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
                DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dm4 Notebook PC"),
                },
        },
+        {
+         .callback = video_ignore_initial_backlight,
+         .ident = "HP 1000 Notebook PC",
+         .matches = {
+                DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "HP 1000 Notebook PC"),
+                },
+        },
        {}
 };
diff --git a/drivers/base/power/common.c b/drivers/base/power/common.c
index 39c32529b833..5da914041305 100644
--- a/drivers/base/power/common.c
+++ b/drivers/base/power/common.c
@@ -61,24 +61,24 @@ EXPORT_SYMBOL_GPL(dev_pm_get_subsys_data);
 int dev_pm_put_subsys_data(struct device *dev)
 {
        struct pm_subsys_data *psd;
-        int ret = 0;
+        int ret = 1;
        spin_lock_irq(&dev->power.lock);
        psd = dev_to_psd(dev);
-        if (!psd) {
+        if (!psd)
-                ret = -EINVAL;
                goto out;
-        }
        if (--psd->refcount == 0) {
                dev->power.subsys_data = NULL;
-                kfree(psd);
+        } else {
-                ret = 1;
+                psd = NULL;
+                ret = 0;
        }
 out:
        spin_unlock_irq(&dev->power.lock);
+        kfree(psd);
        return ret;
 }
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index ca63104136e0..d6d314027b5d 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -55,6 +55,39 @@
 #define SECTOR_SHIFT    9
 #define SECTOR_SIZE     (1ULL << SECTOR_SHIFT)
+/*
+ * Increment the given counter and return its updated value.
+ * If the counter is already 0 it will not be incremented.
+ * If the counter is already at its maximum value returns
+ * -EINVAL without updating it.
+ */
+static int atomic_inc_return_safe(atomic_t *v)
+{
+        unsigned int counter;
+        counter = (unsigned int)__atomic_add_unless(v, 1, 0);
+        if (counter <= (unsigned int)INT_MAX)
+                return (int)counter;
+        atomic_dec(v);
+        return -EINVAL;
+}
+/* Decrement the counter.  Return the resulting value, or -EINVAL */
+static int atomic_dec_return_safe(atomic_t *v)
+{
+        int counter;
+        counter = atomic_dec_return(v);
+        if (counter >= 0)
+                return counter;
+        atomic_inc(v);
+        return -EINVAL;
+}
 #define RBD_DRV_NAME "rbd"
 #define RBD_DRV_NAME_LONG "rbd (rados block device)"
@@ -100,21 +133,20 @@
 * block device image metadata (in-memory version)
 */
 struct rbd_image_header {
-        /* These four fields never change for a given rbd image */
+        /* These six fields never change for a given rbd image */
        char *object_prefix;
-        u64 features;
        __u8 obj_order;
        __u8 crypt_type;
        __u8 comp_type;
+        u64 stripe_unit;
+        u64 stripe_count;
+        u64 features;           /* Might be changeable someday? */
        /* The remaining fields need to be updated occasionally */
        u64 image_size;
        struct ceph_snap_context *snapc;
-        char *snap_names;
+        char *snap_names;       /* format 1 only */
-        u64 *snap_sizes;
+        u64 *snap_sizes;        /* format 1 only */
-        u64 stripe_unit;
-        u64 stripe_count;
 };
 /*
@@ -225,6 +257,7 @@ struct rbd_obj_request {
                };
        };
        struct page             **copyup_pages;
+        u32                     copyup_page_count;
        struct ceph_osd_request *osd_req;
@@ -257,6 +290,7 @@ struct rbd_img_request {
                struct rbd_obj_request  *obj_request;   /* obj req initiator */
        };
        struct page             **copyup_pages;
+        u32                     copyup_page_count;
        spinlock_t              completion_lock;/* protects next_completion */
        u32                     next_completion;
        rbd_img_callback_t      callback;
@@ -311,6 +345,7 @@ struct rbd_device {
        struct rbd_spec         *parent_spec;
        u64                     parent_overlap;
+        atomic_t                parent_ref;
        struct rbd_device       *parent;
        /* protects updating the header */
@@ -359,7 +394,8 @@ static ssize_t rbd_add(struct bus_type *bus, const char *buf,
                       size_t count);
 static ssize_t rbd_remove(struct bus_type *bus, const char *buf,
                          size_t count);
-static int rbd_dev_image_probe(struct rbd_device *rbd_dev);
+static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping);
+static void rbd_spec_put(struct rbd_spec *spec);
 static struct bus_attribute rbd_bus_attrs[] = {
        __ATTR(add, S_IWUSR, NULL, rbd_add),
@@ -426,7 +462,8 @@ static void rbd_img_parent_read(struct rbd_obj_request *obj_request);
 static void rbd_dev_remove_parent(struct rbd_device *rbd_dev);
 static int rbd_dev_refresh(struct rbd_device *rbd_dev);
-static int rbd_dev_v2_refresh(struct rbd_device *rbd_dev);
+static int rbd_dev_v2_header_onetime(struct rbd_device *rbd_dev);
+static int rbd_dev_v2_header_info(struct rbd_device *rbd_dev);
 static const char *rbd_dev_v2_snap_name(struct rbd_device *rbd_dev,
                                        u64 snap_id);
 static int _rbd_dev_v2_snap_size(struct rbd_device *rbd_dev, u64 snap_id,
@@ -726,88 +763,123 @@ static bool rbd_dev_ondisk_valid(struct rbd_image_header_ondisk *ondisk)
 }
 /*
- * Create a new header structure, translate header format from the on-disk
+ * Fill an rbd image header with information from the given format 1
- * header.
+ * on-disk header.
 */
-static int rbd_header_from_disk(struct rbd_image_header *header,
+static int rbd_header_from_disk(struct rbd_device *rbd_dev,
                                 struct rbd_image_header_ondisk *ondisk)
 {
+        struct rbd_image_header *header = &rbd_dev->header;
+        bool first_time = header->object_prefix == NULL;
+        struct ceph_snap_context *snapc;
+        char *object_prefix = NULL;
+        char *snap_names = NULL;
+        u64 *snap_sizes = NULL;
        u32 snap_count;
-        size_t len;
        size_t size;
+        int ret = -ENOMEM;
        u32 i;
-        memset(header, 0, sizeof (*header));
+        /* Allocate this now to avoid having to handle failure below */
-        snap_count = le32_to_cpu(ondisk->snap_count);
+        if (first_time) {
+                size_t len;
-        len = strnlen(ondisk->object_prefix, sizeof (ondisk->object_prefix));
+                len = strnlen(ondisk->object_prefix,
-        header->object_prefix = kmalloc(len + 1, GFP_KERNEL);
+                                sizeof (ondisk->object_prefix));
-        if (!header->object_prefix)
+                object_prefix = kmalloc(len + 1, GFP_KERNEL);
-                return -ENOMEM;
+                if (!object_prefix)
-        memcpy(header->object_prefix, ondisk->object_prefix, len);
+                        return -ENOMEM;
-        header->object_prefix[len] = '\0';
+                memcpy(object_prefix, ondisk->object_prefix, len);
+                object_prefix[len] = '\0';
+        }
+        /* Allocate the snapshot context and fill it in */
+        snap_count = le32_to_cpu(ondisk->snap_count);
+        snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);
+        if (!snapc)
+                goto out_err;
+        snapc->seq = le64_to_cpu(ondisk->snap_seq);
        if (snap_count) {
+                struct rbd_image_snap_ondisk *snaps;
                u64 snap_names_len = le64_to_cpu(ondisk->snap_names_len);
-                /* Save a copy of the snapshot names */
+                /* We'll keep a copy of the snapshot names... */
-                if (snap_names_len > (u64) SIZE_MAX)
+                if (snap_names_len > (u64)SIZE_MAX)
-                        return -EIO;
+                        goto out_2big;
-                header->snap_names = kmalloc(snap_names_len, GFP_KERNEL);
+                snap_names = kmalloc(snap_names_len, GFP_KERNEL);
-                if (!header->snap_names)
+                if (!snap_names)
                        goto out_err;
+                /* ...as well as the array of their sizes. */
+                size = snap_count * sizeof (*header->snap_sizes);
+                snap_sizes = kmalloc(size, GFP_KERNEL);
+                if (!snap_sizes)
+                        goto out_err;
                /*
-                 * Note that rbd_dev_v1_header_read() guarantees
+                 * Copy the names, and fill in each snapshot's id
-                 * the ondisk buffer we're working with has
+                 * and size.
+                 *
+                 * Note that rbd_dev_v1_header_info() guarantees the
+                 * ondisk buffer we're working with has
                 * snap_names_len bytes beyond the end of the
                 * snapshot id array, this memcpy() is safe.
                 */
-                memcpy(header->snap_names, &ondisk->snaps[snap_count],
+                memcpy(snap_names, &ondisk->snaps[snap_count], snap_names_len);
-                        snap_names_len);
+                snaps = ondisk->snaps;
+                for (i = 0; i < snap_count; i++) {
+                        snapc->snaps[i] = le64_to_cpu(snaps[i].id);
+                        snap_sizes[i] = le64_to_cpu(snaps[i].image_size);
+                }
+        }
-                /* Record each snapshot's size */
+        /* We won't fail any more, fill in the header */
-                size = snap_count * sizeof (*header->snap_sizes);
+        down_write(&rbd_dev->header_rwsem);
-                header->snap_sizes = kmalloc(size, GFP_KERNEL);
+        if (first_time) {
-                if (!header->snap_sizes)
+                header->object_prefix = object_prefix;
-                        goto out_err;
+                header->obj_order = ondisk->options.order;
-                for (i = 0; i < snap_count; i++)
+                header->crypt_type = ondisk->options.crypt_type;
-                        header->snap_sizes[i] =
+                header->comp_type = ondisk->options.comp_type;
-                                le64_to_cpu(ondisk->snaps[i].image_size);
+                /* The rest aren't used for format 1 images */
+                header->stripe_unit = 0;
+                header->stripe_count = 0;
+                header->features = 0;
        } else {
-                header->snap_names = NULL;
+                ceph_put_snap_context(header->snapc);
-                header->snap_sizes = NULL;
+                kfree(header->snap_names);
+                kfree(header->snap_sizes);
        }
-        header->features = 0;   /* No features support in v1 images */
+        /* The remaining fields always get updated (when we refresh) */
-        header->obj_order = ondisk->options.order;
-        header->crypt_type = ondisk->options.crypt_type;
-        header->comp_type = ondisk->options.comp_type;
-        /* Allocate and fill in the snapshot context */
        header->image_size = le64_to_cpu(ondisk->image_size);
+        header->snapc = snapc;
+        header->snap_names = snap_names;
+        header->snap_sizes = snap_sizes;
-        header->snapc = ceph_create_snap_context(snap_count, GFP_KERNEL);
+        /* Make sure mapping size is consistent with header info */
-        if (!header->snapc)
-                goto out_err;
-        header->snapc->seq = le64_to_cpu(ondisk->snap_seq);
-        for (i = 0; i < snap_count; i++)
-                header->snapc->snaps[i] = le64_to_cpu(ondisk->snaps[i].id);
-        return 0;
+        if (rbd_dev->spec->snap_id == CEPH_NOSNAP || first_time)
+                if (rbd_dev->mapping.size != header->image_size)
+                        rbd_dev->mapping.size = header->image_size;
+        up_write(&rbd_dev->header_rwsem);
+        return 0;
+out_2big:
+        ret = -EIO;
 out_err:
-        kfree(header->snap_sizes);
+        kfree(snap_sizes);
-        header->snap_sizes = NULL;
+        kfree(snap_names);
-        kfree(header->snap_names);
+        ceph_put_snap_context(snapc);
-        header->snap_names = NULL;
+        kfree(object_prefix);
-        kfree(header->object_prefix);
-        header->object_prefix = NULL;
-        return -ENOMEM;
+        return ret;
 }
 static const char *_rbd_dev_v1_snap_name(struct rbd_device *rbd_dev, u32 which)
@@ -934,20 +1006,11 @@ static int rbd_snap_features(struct rbd_device *rbd_dev, u64 snap_id,
 static int rbd_dev_mapping_set(struct rbd_device *rbd_dev)
 {
-        const char *snap_name = rbd_dev->spec->snap_name;
+        u64 snap_id = rbd_dev->spec->snap_id;
-        u64 snap_id;
        u64 size = 0;
        u64 features = 0;
        int ret;
-        if (strcmp(snap_name, RBD_SNAP_HEAD_NAME)) {
-                snap_id = rbd_snap_id_by_name(rbd_dev, snap_name);
-                if (snap_id == CEPH_NOSNAP)
-                        return -ENOENT;
-        } else {
-                snap_id = CEPH_NOSNAP;
-        }
        ret = rbd_snap_size(rbd_dev, snap_id, &size);
        if (ret)
                return ret;
@@ -958,11 +1021,6 @@ static int rbd_dev_mapping_set(struct rbd_device *rbd_dev)
        rbd_dev->mapping.size = size;
        rbd_dev->mapping.features = features;
-        /* If we are mapping a snapshot it must be marked read-only */
-        if (snap_id != CEPH_NOSNAP)
-                rbd_dev->mapping.read_only = true;
        return 0;
 }
@@ -970,14 +1028,6 @@ static void rbd_dev_mapping_clear(struct rbd_device *rbd_dev)
 {
        rbd_dev->mapping.size = 0;
        rbd_dev->mapping.features = 0;
-        rbd_dev->mapping.read_only = true;
-}
-static void rbd_dev_clear_mapping(struct rbd_device *rbd_dev)
-{
-        rbd_dev->mapping.size = 0;
-        rbd_dev->mapping.features = 0;
-        rbd_dev->mapping.read_only = true;
 }
 static const char *rbd_segment_name(struct rbd_device *rbd_dev, u64 offset)
@@ -1342,20 +1392,18 @@ static void rbd_obj_request_put(struct rbd_obj_request *obj_request)
        kref_put(&obj_request->kref, rbd_obj_request_destroy);
 }
-static void rbd_img_request_get(struct rbd_img_request *img_request)
+static bool img_request_child_test(struct rbd_img_request *img_request);
-{
+static void rbd_parent_request_destroy(struct kref *kref);
-        dout("%s: img %p (was %d)\n", __func__, img_request,
-                atomic_read(&img_request->kref.refcount));
-        kref_get(&img_request->kref);
-}
 static void rbd_img_request_destroy(struct kref *kref);
 static void rbd_img_request_put(struct rbd_img_request *img_request)
 {
        rbd_assert(img_request != NULL);
        dout("%s: img %p (was %d)\n", __func__, img_request,
                atomic_read(&img_request->kref.refcount));
-        kref_put(&img_request->kref, rbd_img_request_destroy);
+        if (img_request_child_test(img_request))
+                kref_put(&img_request->kref, rbd_parent_request_destroy);
+        else
+                kref_put(&img_request->kref, rbd_img_request_destroy);
 }
 static inline void rbd_img_obj_request_add(struct rbd_img_request *img_request,
@@ -1472,6 +1520,12 @@ static void img_request_child_set(struct rbd_img_request *img_request)
        smp_mb();
 }
+static void img_request_child_clear(struct rbd_img_request *img_request)
+{
+        clear_bit(IMG_REQ_CHILD, &img_request->flags);
+        smp_mb();
+}
 static bool img_request_child_test(struct rbd_img_request *img_request)
 {
        smp_mb();
@@ -1484,6 +1538,12 @@ static void img_request_layered_set(struct rbd_img_request *img_request)
        smp_mb();
 }
+static void img_request_layered_clear(struct rbd_img_request *img_request)
+{
+        clear_bit(IMG_REQ_LAYERED, &img_request->flags);
+        smp_mb();
+}
 static bool img_request_layered_test(struct rbd_img_request *img_request)
 {
        smp_mb();
@@ -1827,6 +1887,74 @@ static void rbd_obj_request_destroy(struct kref *kref)
        kmem_cache_free(rbd_obj_request_cache, obj_request);
 }
+/* It's OK to call this for a device with no parent */
+static void rbd_spec_put(struct rbd_spec *spec);
+static void rbd_dev_unparent(struct rbd_device *rbd_dev)
+{
+        rbd_dev_remove_parent(rbd_dev);
+        rbd_spec_put(rbd_dev->parent_spec);
+        rbd_dev->parent_spec = NULL;
+        rbd_dev->parent_overlap = 0;
+}
+/*
+ * Parent image reference counting is used to determine when an
+ * image's parent fields can be safely torn down--after there are no
+ * more in-flight requests to the parent image.  When the last
+ * reference is dropped, cleaning them up is safe.
+ */
+static void rbd_dev_parent_put(struct rbd_device *rbd_dev)
+{
+        int counter;
+        if (!rbd_dev->parent_spec)
+                return;
+        counter = atomic_dec_return_safe(&rbd_dev->parent_ref);
+        if (counter > 0)
+                return;
+        /* Last reference; clean up parent data structures */
+        if (!counter)
+                rbd_dev_unparent(rbd_dev);
+        else
+                rbd_warn(rbd_dev, "parent reference underflow\n");
+}
+/*
+ * If an image has a non-zero parent overlap, get a reference to its
+ * parent.
+ *
+ * We must get the reference before checking for the overlap to
+ * coordinate properly with zeroing the parent overlap in
+ * rbd_dev_v2_parent_info() when an image gets flattened.  We
+ * drop it again if there is no overlap.
+ *
+ * Returns true if the rbd device has a parent with a non-zero
+ * overlap and a reference for it was successfully taken, or
+ * false otherwise.
+ */
+static bool rbd_dev_parent_get(struct rbd_device *rbd_dev)
+{
+        int counter;
+        if (!rbd_dev->parent_spec)
+                return false;
+        counter = atomic_inc_return_safe(&rbd_dev->parent_ref);
+        if (counter > 0 && rbd_dev->parent_overlap)
+                return true;
+        /* Image was flattened, but parent is not yet torn down */
+        if (counter < 0)
+                rbd_warn(rbd_dev, "parent reference overflow\n");
+        return false;
+}
 /*
 * Caller is responsible for filling in the list of object requests
 * that comprises the image request, and the Linux request pointer
@@ -1835,8 +1963,7 @@ static void rbd_obj_request_destroy(struct kref *kref)
 static struct rbd_img_request *rbd_img_request_create(
                                        struct rbd_device *rbd_dev,
                                        u64 offset, u64 length,
-                                        bool write_request,
+                                        bool write_request)
-                                        bool child_request)
 {
        struct rbd_img_request *img_request;
@@ -1861,9 +1988,7 @@ static struct rbd_img_request *rbd_img_request_create(
        } else {
                img_request->snap_id = rbd_dev->spec->snap_id;
        }
-        if (child_request)
+        if (rbd_dev_parent_get(rbd_dev))
-                img_request_child_set(img_request);
-        if (rbd_dev->parent_spec)
                img_request_layered_set(img_request);
        spin_lock_init(&img_request->completion_lock);
        img_request->next_completion = 0;
@@ -1873,9 +1998,6 @@ static struct rbd_img_request *rbd_img_request_create(
        INIT_LIST_HEAD(&img_request->obj_requests);
        kref_init(&img_request->kref);
-        rbd_img_request_get(img_request);       /* Avoid a warning */
-        rbd_img_request_put(img_request);       /* TEMPORARY */
        dout("%s: rbd_dev %p %s %llu/%llu -> img %p\n", __func__, rbd_dev,
                write_request ? "write" : "read", offset, length,
                img_request);
@@ -1897,15 +2019,54 @@ static void rbd_img_request_destroy(struct kref *kref)
                rbd_img_obj_request_del(img_request, obj_request);
        rbd_assert(img_request->obj_request_count == 0);
+        if (img_request_layered_test(img_request)) {
+                img_request_layered_clear(img_request);
+                rbd_dev_parent_put(img_request->rbd_dev);
+        }
        if (img_request_write_test(img_request))
                ceph_put_snap_context(img_request->snapc);
-        if (img_request_child_test(img_request))
-                rbd_obj_request_put(img_request->obj_request);
        kmem_cache_free(rbd_img_request_cache, img_request);
 }
+static struct rbd_img_request *rbd_parent_request_create(
+                                        struct rbd_obj_request *obj_request,
+                                        u64 img_offset, u64 length)
+{
+        struct rbd_img_request *parent_request;
+        struct rbd_device *rbd_dev;
+        rbd_assert(obj_request->img_request);
+        rbd_dev = obj_request->img_request->rbd_dev;
+        parent_request = rbd_img_request_create(rbd_dev->parent,
+                                                img_offset, length, false);
+        if (!parent_request)
+                return NULL;
+        img_request_child_set(parent_request);
+        rbd_obj_request_get(obj_request);
+        parent_request->obj_request = obj_request;
+        return parent_request;
+}
+static void rbd_parent_request_destroy(struct kref *kref)
+{
+        struct rbd_img_request *parent_request;
+        struct rbd_obj_request *orig_request;
+        parent_request = container_of(kref, struct rbd_img_request, kref);
+        orig_request = parent_request->obj_request;
+        parent_request->obj_request = NULL;
+        rbd_obj_request_put(orig_request);
+        img_request_child_clear(parent_request);
+        rbd_img_request_destroy(kref);
+}
 static bool rbd_img_obj_end_request(struct rbd_obj_request *obj_request)
 {
        struct rbd_img_request *img_request;
@@ -2114,7 +2275,7 @@ rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request)
 {
        struct rbd_img_request *img_request;
        struct rbd_device *rbd_dev;
-        u64 length;
+        struct page **pages;
        u32 page_count;
        rbd_assert(obj_request->type == OBJ_REQUEST_BIO);
@@ -2124,12 +2285,14 @@ rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request)
        rbd_dev = img_request->rbd_dev;
        rbd_assert(rbd_dev);
-        length = (u64)1 << rbd_dev->header.obj_order;
-        page_count = (u32)calc_pages_for(0, length);
-        rbd_assert(obj_request->copyup_pages);
+        pages = obj_request->copyup_pages;
-        ceph_release_page_vector(obj_request->copyup_pages, page_count);
+        rbd_assert(pages != NULL);
        obj_request->copyup_pages = NULL;
+        page_count = obj_request->copyup_page_count;
+        rbd_assert(page_count);
+        obj_request->copyup_page_count = 0;
+        ceph_release_page_vector(pages, page_count);
        /*
         * We want the transfer count to reflect the size of the
@@ -2153,9 +2316,11 @@ rbd_img_obj_parent_read_full_callback(struct rbd_img_request *img_request)
        struct ceph_osd_client *osdc;
        struct rbd_device *rbd_dev;
        struct page **pages;
-        int result;
+        u32 page_count;
-        u64 obj_size;
+        int img_result;
-        u64 xferred;
+        u64 parent_length;
+        u64 offset;
+        u64 length;
        rbd_assert(img_request_child_test(img_request));
@@ -2164,46 +2329,74 @@ rbd_img_obj_parent_read_full_callback(struct rbd_img_request *img_request)
        pages = img_request->copyup_pages;
        rbd_assert(pages != NULL);
        img_request->copyup_pages = NULL;
+        page_count = img_request->copyup_page_count;
+        rbd_assert(page_count);
+        img_request->copyup_page_count = 0;
        orig_request = img_request->obj_request;
        rbd_assert(orig_request != NULL);
-        rbd_assert(orig_request->type == OBJ_REQUEST_BIO);
+        rbd_assert(obj_request_type_valid(orig_request->type));
-        result = img_request->result;
+        img_result = img_request->result;
-        obj_size = img_request->length;
+        parent_length = img_request->length;
-        xferred = img_request->xferred;
+        rbd_assert(parent_length == img_request->xferred);
+        rbd_img_request_put(img_request);
-        rbd_dev = img_request->rbd_dev;
+        rbd_assert(orig_request->img_request);
+        rbd_dev = orig_request->img_request->rbd_dev;
        rbd_assert(rbd_dev);
-        rbd_assert(obj_size == (u64)1 << rbd_dev->header.obj_order);
-        rbd_img_request_put(img_request);
+        /*
+         * If the overlap has become 0 (most likely because the
+         * image has been flattened) we need to free the pages
+         * and re-submit the original write request.
+         */
+        if (!rbd_dev->parent_overlap) {
+                struct ceph_osd_client *osdc;
-        if (result)
+                ceph_release_page_vector(pages, page_count);
-                goto out_err;
+                osdc = &rbd_dev->rbd_client->client->osdc;
+                img_result = rbd_obj_request_submit(osdc, orig_request);
+                if (!img_result)
+                        return;
+        }
-        /* Allocate the new copyup osd request for the original request */
+        if (img_result)
+                goto out_err;
-        result = -ENOMEM;
+        /*
-        rbd_assert(!orig_request->osd_req);
+         * The original osd request is of no use to use any more.
+         * We need a new one that can hold the two ops in a copyup
+         * request.  Allocate the new copyup osd request for the
+         * original request, and release the old one.
+         */
+        img_result = -ENOMEM;
        osd_req = rbd_osd_req_create_copyup(orig_request);
        if (!osd_req)
                goto out_err;
+        rbd_osd_req_destroy(orig_request->osd_req);
        orig_request->osd_req = osd_req;
        orig_request->copyup_pages = pages;
+        orig_request->copyup_page_count = page_count;
        /* Initialize the copyup op */
        osd_req_op_cls_init(osd_req, 0, CEPH_OSD_OP_CALL, "rbd", "copyup");
-        osd_req_op_cls_request_data_pages(osd_req, 0, pages, obj_size, 0,
+        osd_req_op_cls_request_data_pages(osd_req, 0, pages, parent_length, 0,
                                                false, false);
        /* Then the original write request op */
+        offset = orig_request->offset;
+        length = orig_request->length;
        osd_req_op_extent_init(osd_req, 1, CEPH_OSD_OP_WRITE,
-                                        orig_request->offset,
+                                        offset, length, 0, 0);
-                                        orig_request->length, 0, 0);
+        if (orig_request->type == OBJ_REQUEST_BIO)
-        osd_req_op_extent_osd_data_bio(osd_req, 1, orig_request->bio_list,
+                osd_req_op_extent_osd_data_bio(osd_req, 1,
-                                        orig_request->length);
+                                        orig_request->bio_list, length);
+        else
+                osd_req_op_extent_osd_data_pages(osd_req, 1,
+                                        orig_request->pages, length,
+                                        offset & ~PAGE_MASK, false, false);
        rbd_osd_req_format_write(orig_request);
@@ -2211,13 +2404,13 @@ rbd_img_obj_parent_read_full_callback(struct rbd_img_request *img_request)
        orig_request->callback = rbd_img_obj_copyup_callback;
        osdc = &rbd_dev->rbd_client->client->osdc;
-        result = rbd_obj_request_submit(osdc, orig_request);
+        img_result = rbd_obj_request_submit(osdc, orig_request);
-        if (!result)
+        if (!img_result)
                return;
 out_err:
        /* Record the error code and complete the request */
-        orig_request->result = result;
+        orig_request->result = img_result;
        orig_request->xferred = 0;
        obj_request_done_set(orig_request);
        rbd_obj_request_complete(orig_request);
@@ -2249,7 +2442,7 @@ static int rbd_img_obj_parent_read_full(struct rbd_obj_request *obj_request)
        int result;
        rbd_assert(obj_request_img_data_test(obj_request));
-        rbd_assert(obj_request->type == OBJ_REQUEST_BIO);
+        rbd_assert(obj_request_type_valid(obj_request->type));
        img_request = obj_request->img_request;
        rbd_assert(img_request != NULL);
@@ -2257,15 +2450,6 @@ static int rbd_img_obj_parent_read_full(struct rbd_obj_request *obj_request)
        rbd_assert(rbd_dev->parent != NULL);
        /*
-         * First things first.  The original osd request is of no
-         * use to use any more, we'll need a new one that can hold
-         * the two ops in a copyup request.  We'll get that later,
-         * but for now we can release the old one.
-         */
-        rbd_osd_req_destroy(obj_request->osd_req);
-        obj_request->osd_req = NULL;
-        /*
         * Determine the byte range covered by the object in the
         * child image to which the original request was to be sent.
         */
@@ -2295,18 +2479,16 @@ static int rbd_img_obj_parent_read_full(struct rbd_obj_request *obj_request)
        }
        result = -ENOMEM;
-        parent_request = rbd_img_request_create(rbd_dev->parent,
+        parent_request = rbd_parent_request_create(obj_request,
-                                                img_offset, length,
+                                                img_offset, length);
-                                                false, true);
        if (!parent_request)
                goto out_err;
-        rbd_obj_request_get(obj_request);
-        parent_request->obj_request = obj_request;
        result = rbd_img_request_fill(parent_request, OBJ_REQUEST_PAGES, pages);
        if (result)
                goto out_err;
        parent_request->copyup_pages = pages;
+        parent_request->copyup_page_count = page_count;
        parent_request->callback = rbd_img_obj_parent_read_full_callback;
        result = rbd_img_request_submit(parent_request);
@@ -2314,6 +2496,7 @@ static int rbd_img_obj_parent_read_full(struct rbd_obj_request *obj_request)
                return 0;
        parent_request->copyup_pages = NULL;
+        parent_request->copyup_page_count = 0;
        parent_request->obj_request = NULL;
        rbd_obj_request_put(obj_request);
 out_err:
@@ -2331,6 +2514,7 @@ out_err:
 static void rbd_img_obj_exists_callback(struct rbd_obj_request *obj_request)
 {
        struct rbd_obj_request *orig_request;
+        struct rbd_device *rbd_dev;
        int result;
        rbd_assert(!obj_request_img_data_test(obj_request));
@@ -2353,8 +2537,21 @@ static void rbd_img_obj_exists_callback(struct rbd_obj_request *obj_request)
                obj_request->xferred, obj_request->length);
        rbd_obj_request_put(obj_request);
-        rbd_assert(orig_request);
+        /*
-        rbd_assert(orig_request->img_request);
+         * If the overlap has become 0 (most likely because the
+         * image has been flattened) we need to free the pages
+         * and re-submit the original write request.
+         */
+        rbd_dev = orig_request->img_request->rbd_dev;
+        if (!rbd_dev->parent_overlap) {
+                struct ceph_osd_client *osdc;
+                rbd_obj_request_put(orig_request);
+                osdc = &rbd_dev->rbd_client->client->osdc;
+                result = rbd_obj_request_submit(osdc, orig_request);
+                if (!result)
+                        return;
+        }
        /*
         * Our only purpose here is to determine whether the object
@@ -2512,14 +2709,36 @@ static void rbd_img_parent_read_callback(struct rbd_img_request *img_request)
        struct rbd_obj_request *obj_request;
        struct rbd_device *rbd_dev;
        u64 obj_end;
+        u64 img_xferred;
+        int img_result;
        rbd_assert(img_request_child_test(img_request));
+        /* First get what we need from the image request and release it */
        obj_request = img_request->obj_request;
+        img_xferred = img_request->xferred;
+        img_result = img_request->result;
+        rbd_img_request_put(img_request);
+        /*
+         * If the overlap has become 0 (most likely because the
+         * image has been flattened) we need to re-submit the
+         * original request.
+         */
        rbd_assert(obj_request);
        rbd_assert(obj_request->img_request);
+        rbd_dev = obj_request->img_request->rbd_dev;
+        if (!rbd_dev->parent_overlap) {
+                struct ceph_osd_client *osdc;
+                osdc = &rbd_dev->rbd_client->client->osdc;
+                img_result = rbd_obj_request_submit(osdc, obj_request);
+                if (!img_result)
+                        return;
+        }
-        obj_request->result = img_request->result;
+        obj_request->result = img_result;
        if (obj_request->result)
                goto out;
@@ -2532,7 +2751,6 @@ static void rbd_img_parent_read_callback(struct rbd_img_request *img_request)
         */
        rbd_assert(obj_request->img_offset < U64_MAX - obj_request->length);
        obj_end = obj_request->img_offset + obj_request->length;
-        rbd_dev = obj_request->img_request->rbd_dev;
        if (obj_end > rbd_dev->parent_overlap) {
                u64 xferred = 0;
@@ -2540,43 +2758,39 @@ static void rbd_img_parent_read_callback(struct rbd_img_request *img_request)
                        xferred = rbd_dev->parent_overlap -
                                        obj_request->img_offset;
-                obj_request->xferred = min(img_request->xferred, xferred);
+                obj_request->xferred = min(img_xferred, xferred);
        } else {
-                obj_request->xferred = img_request->xferred;
+                obj_request->xferred = img_xferred;
        }
 out:
-        rbd_img_request_put(img_request);
        rbd_img_obj_request_read_callback(obj_request);
        rbd_obj_request_complete(obj_request);
 }
 static void rbd_img_parent_read(struct rbd_obj_request *obj_request)
 {
-        struct rbd_device *rbd_dev;
        struct rbd_img_request *img_request;
        int result;
        rbd_assert(obj_request_img_data_test(obj_request));
        rbd_assert(obj_request->img_request != NULL);
        rbd_assert(obj_request->result == (s32) -ENOENT);
-        rbd_assert(obj_request->type == OBJ_REQUEST_BIO);
+        rbd_assert(obj_request_type_valid(obj_request->type));
-        rbd_dev = obj_request->img_request->rbd_dev;
-        rbd_assert(rbd_dev->parent != NULL);
        /* rbd_read_finish(obj_request, obj_request->length); */
-        img_request = rbd_img_request_create(rbd_dev->parent,
+        img_request = rbd_parent_request_create(obj_request,
                                                obj_request->img_offset,
-                                                obj_request->length,
+                                                obj_request->length);
-                                                false, true);
        result = -ENOMEM;
        if (!img_request)
                goto out_err;
-        rbd_obj_request_get(obj_request);
+        if (obj_request->type == OBJ_REQUEST_BIO)
-        img_request->obj_request = obj_request;
+                result = rbd_img_request_fill(img_request, OBJ_REQUEST_BIO,
+                                                obj_request->bio_list);
-        result = rbd_img_request_fill(img_request, OBJ_REQUEST_BIO,
+        else
-                                        obj_request->bio_list);
+                result = rbd_img_request_fill(img_request, OBJ_REQUEST_PAGES,
+                                                obj_request->pages);
        if (result)
                goto out_err;
@@ -2626,6 +2840,7 @@ out:
 static void rbd_watch_cb(u64 ver, u64 notify_id, u8 opcode, void *data)
 {
        struct rbd_device *rbd_dev = (struct rbd_device *)data;
+        int ret;
        if (!rbd_dev)
                return;
@@ -2633,7 +2848,9 @@ static void rbd_watch_cb(u64 ver, u64 notify_id, u8 opcode, void *data)
        dout("%s: \"%s\" notify_id %llu opcode %u\n", __func__,
                rbd_dev->header_name, (unsigned long long)notify_id,
                (unsigned int)opcode);
-        (void)rbd_dev_refresh(rbd_dev);
+        ret = rbd_dev_refresh(rbd_dev);
+        if (ret)
+                rbd_warn(rbd_dev, ": header refresh error (%d)\n", ret);
        rbd_obj_notify_ack(rbd_dev, notify_id);
 }
@@ -2642,7 +2859,7 @@ static void rbd_watch_cb(u64 ver, u64 notify_id, u8 opcode, void *data)
 * Request sync osd watch/unwatch.  The value of "start" determines
 * whether a watch request is being initiated or torn down.
 */
-static int rbd_dev_header_watch_sync(struct rbd_device *rbd_dev, int start)
+static int rbd_dev_header_watch_sync(struct rbd_device *rbd_dev, bool start)
 {
        struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
        struct rbd_obj_request *obj_request;
@@ -2676,7 +2893,7 @@ static int rbd_dev_header_watch_sync(struct rbd_device *rbd_dev, int start)
                                        rbd_dev->watch_request->osd_req);
        osd_req_op_watch_init(obj_request->osd_req, 0, CEPH_OSD_OP_WATCH,
-                                rbd_dev->watch_event->cookie, 0, start);
+                                rbd_dev->watch_event->cookie, 0, start ? 1 : 0);
        rbd_osd_req_format_write(obj_request);
        ret = rbd_obj_request_submit(osdc, obj_request);
@@ -2869,9 +3086,16 @@ static void rbd_request_fn(struct request_queue *q)
                        goto end_request;       /* Shouldn't happen */
                }
+                result = -EIO;
+                if (offset + length > rbd_dev->mapping.size) {
+                        rbd_warn(rbd_dev, "beyond EOD (%llu~%llu > %llu)\n",
+                                offset, length, rbd_dev->mapping.size);
+                        goto end_request;
+                }
                result = -ENOMEM;
                img_request = rbd_img_request_create(rbd_dev, offset, length,
-                                                        write_request, false);
+                                                        write_request);
                if (!img_request)
                        goto end_request;
@@ -3022,17 +3246,11 @@ out:
 }
 /*
- * Read the complete header for the given rbd device.
+ * Read the complete header for the given rbd device.  On successful
- *
+ * return, the rbd_dev->header field will contain up-to-date
- * Returns a pointer to a dynamically-allocated buffer containing
+ * information about the image.
- * the complete and validated header.  Caller can pass the address
- * of a variable that will be filled in with the version of the
- * header object at the time it was read.
- *
- * Returns a pointer-coded errno if a failure occurs.
 */
-static struct rbd_image_header_ondisk *
+static int rbd_dev_v1_header_info(struct rbd_device *rbd_dev)
-rbd_dev_v1_header_read(struct rbd_device *rbd_dev)
 {
        struct rbd_image_header_ondisk *ondisk = NULL;
        u32 snap_count = 0;
@@ -3057,22 +3275,22 @@ rbd_dev_v1_header_read(struct rbd_device *rbd_dev)
                size += names_size;
                ondisk = kmalloc(size, GFP_KERNEL);
                if (!ondisk)
-                        return ERR_PTR(-ENOMEM);
+                        return -ENOMEM;
                ret = rbd_obj_read_sync(rbd_dev, rbd_dev->header_name,
                                       0, size, ondisk);
                if (ret < 0)
-                        goto out_err;
+                        goto out;
                if ((size_t)ret < size) {
                        ret = -ENXIO;
                        rbd_warn(rbd_dev, "short header read (want %zd got %d)",
                                size, ret);
-                        goto out_err;
+                        goto out;
                }
                if (!rbd_dev_ondisk_valid(ondisk)) {
                        ret = -ENXIO;
                        rbd_warn(rbd_dev, "invalid header");
-                        goto out_err;
+                        goto out;
                }
                names_size = le64_to_cpu(ondisk->snap_names_len);
@@ -3080,85 +3298,13 @@ rbd_dev_v1_header_read(struct rbd_device *rbd_dev)
                snap_count = le32_to_cpu(ondisk->snap_count);
        } while (snap_count != want_count);
-        return ondisk;
+        ret = rbd_header_from_disk(rbd_dev, ondisk);
+out:
-out_err:
-        kfree(ondisk);
-        return ERR_PTR(ret);
-}
-/*
- * reload the ondisk the header
- */
-static int rbd_read_header(struct rbd_device *rbd_dev,
-                           struct rbd_image_header *header)
-{
-        struct rbd_image_header_ondisk *ondisk;
-        int ret;
-        ondisk = rbd_dev_v1_header_read(rbd_dev);
-        if (IS_ERR(ondisk))
-                return PTR_ERR(ondisk);
-        ret = rbd_header_from_disk(header, ondisk);
        kfree(ondisk);
        return ret;
 }
-static void rbd_update_mapping_size(struct rbd_device *rbd_dev)
-{
-        if (rbd_dev->spec->snap_id != CEPH_NOSNAP)
-                return;
-        if (rbd_dev->mapping.size != rbd_dev->header.image_size) {
-                sector_t size;
-                rbd_dev->mapping.size = rbd_dev->header.image_size;
-                size = (sector_t)rbd_dev->mapping.size / SECTOR_SIZE;
-                dout("setting size to %llu sectors", (unsigned long long)size);
-                set_capacity(rbd_dev->disk, size);
-        }
-}
-/*
- * only read the first part of the ondisk header, without the snaps info
- */
-static int rbd_dev_v1_refresh(struct rbd_device *rbd_dev)
-{
-        int ret;
-        struct rbd_image_header h;
-        ret = rbd_read_header(rbd_dev, &h);
-        if (ret < 0)
-                return ret;
-        down_write(&rbd_dev->header_rwsem);
-        /* Update image size, and check for resize of mapped image */
-        rbd_dev->header.image_size = h.image_size;
-        rbd_update_mapping_size(rbd_dev);
-        /* rbd_dev->header.object_prefix shouldn't change */
-        kfree(rbd_dev->header.snap_sizes);
-        kfree(rbd_dev->header.snap_names);
-        /* osd requests may still refer to snapc */
-        ceph_put_snap_context(rbd_dev->header.snapc);
-        rbd_dev->header.image_size = h.image_size;
-        rbd_dev->header.snapc = h.snapc;
-        rbd_dev->header.snap_names = h.snap_names;
-        rbd_dev->header.snap_sizes = h.snap_sizes;
-        /* Free the extra copy of the object prefix */
-        if (strcmp(rbd_dev->header.object_prefix, h.object_prefix))
-                rbd_warn(rbd_dev, "object prefix changed (ignoring)");
-        kfree(h.object_prefix);
-        up_write(&rbd_dev->header_rwsem);
-        return ret;
-}
 /*
 * Clear the rbd device's EXISTS flag if the snapshot it's mapped to
 * has disappeared from the (just updated) snapshot context.
@@ -3180,26 +3326,29 @@ static void rbd_exists_validate(struct rbd_device *rbd_dev)
 static int rbd_dev_refresh(struct rbd_device *rbd_dev)
 {
-        u64 image_size;
+        u64 mapping_size;
        int ret;
        rbd_assert(rbd_image_format_valid(rbd_dev->image_format));
-        image_size = rbd_dev->header.image_size;
+        mapping_size = rbd_dev->mapping.size;
        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
        if (rbd_dev->image_format == 1)
-                ret = rbd_dev_v1_refresh(rbd_dev);
+                ret = rbd_dev_v1_header_info(rbd_dev);
        else
-                ret = rbd_dev_v2_refresh(rbd_dev);
+                ret = rbd_dev_v2_header_info(rbd_dev);
        /* If it's a mapped snapshot, validate its EXISTS flag */
        rbd_exists_validate(rbd_dev);
        mutex_unlock(&ctl_mutex);
-        if (ret)
+        if (mapping_size != rbd_dev->mapping.size) {
-                rbd_warn(rbd_dev, "got notification but failed to "
+                sector_t size;
-                           " update snaps: %d\n", ret);
-        if (image_size != rbd_dev->header.image_size)
+                size = (sector_t)rbd_dev->mapping.size / SECTOR_SIZE;
+                dout("setting size to %llu sectors", (unsigned long long)size);
+                set_capacity(rbd_dev->disk, size);
                revalidate_disk(rbd_dev->disk);
+        }
        return ret;
 }
@@ -3403,6 +3552,8 @@ static ssize_t rbd_image_refresh(struct device *dev,
        int ret;
        ret = rbd_dev_refresh(rbd_dev);
+        if (ret)
+                rbd_warn(rbd_dev, ": manual header refresh error (%d)\n", ret);
        return ret < 0 ? ret : size;
 }
@@ -3501,6 +3652,7 @@ static struct rbd_device *rbd_dev_create(struct rbd_client *rbdc,
        spin_lock_init(&rbd_dev->lock);
        rbd_dev->flags = 0;
+        atomic_set(&rbd_dev->parent_ref, 0);
        INIT_LIST_HEAD(&rbd_dev->node);
        init_rwsem(&rbd_dev->header_rwsem);
@@ -3650,6 +3802,7 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
        __le64 snapid;
        void *p;
        void *end;
+        u64 pool_id;
        char *image_id;
        u64 overlap;
        int ret;
@@ -3680,18 +3833,37 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
        p = reply_buf;
        end = reply_buf + ret;
        ret = -ERANGE;
-        ceph_decode_64_safe(&p, end, parent_spec->pool_id, out_err);
+        ceph_decode_64_safe(&p, end, pool_id, out_err);
-        if (parent_spec->pool_id == CEPH_NOPOOL)
+        if (pool_id == CEPH_NOPOOL) {
+                /*
+                 * Either the parent never existed, or we have
+                 * record of it but the image got flattened so it no
+                 * longer has a parent.  When the parent of a
+                 * layered image disappears we immediately set the
+                 * overlap to 0.  The effect of this is that all new
+                 * requests will be treated as if the image had no
+                 * parent.
+                 */
+                if (rbd_dev->parent_overlap) {
+                        rbd_dev->parent_overlap = 0;
+                        smp_mb();
+                        rbd_dev_parent_put(rbd_dev);
+                        pr_info("%s: clone image has been flattened\n",
+                                rbd_dev->disk->disk_name);
+                }
                goto out;       /* No parent?  No problem. */
+        }
        /* The ceph file layout needs to fit pool id in 32 bits */
        ret = -EIO;
-        if (parent_spec->pool_id > (u64)U32_MAX) {
+        if (pool_id > (u64)U32_MAX) {
                rbd_warn(NULL, "parent pool id too large (%llu > %u)\n",
-                        (unsigned long long)parent_spec->pool_id, U32_MAX);
+                        (unsigned long long)pool_id, U32_MAX);
                goto out_err;
        }
+        parent_spec->pool_id = pool_id;
        image_id = ceph_extract_encoded_string(&p, end, NULL, GFP_KERNEL);
        if (IS_ERR(image_id)) {
@@ -3702,9 +3874,14 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
        ceph_decode_64_safe(&p, end, parent_spec->snap_id, out_err);
        ceph_decode_64_safe(&p, end, overlap, out_err);
-        rbd_dev->parent_overlap = overlap;
+        if (overlap) {
-        rbd_dev->parent_spec = parent_spec;
+                rbd_spec_put(rbd_dev->parent_spec);
-        parent_spec = NULL;     /* rbd_dev now owns this */
+                rbd_dev->parent_spec = parent_spec;
+                parent_spec = NULL;     /* rbd_dev now owns this */
+                rbd_dev->parent_overlap = overlap;
+        } else {
+                rbd_warn(rbd_dev, "ignoring parent of clone with overlap 0\n");
+        }
 out:
        ret = 0;
 out_err:
@@ -4002,6 +4179,7 @@ static int rbd_dev_v2_snap_context(struct rbd_device *rbd_dev)
        for (i = 0; i < snap_count; i++)
                snapc->snaps[i] = ceph_decode_64(&p);
+        ceph_put_snap_context(rbd_dev->header.snapc);
        rbd_dev->header.snapc = snapc;
        dout("  snap context seq = %llu, snap_count = %u\n",
@@ -4053,21 +4231,56 @@ out:
        return snap_name;
 }
-static int rbd_dev_v2_refresh(struct rbd_device *rbd_dev)
+static int rbd_dev_v2_header_info(struct rbd_device *rbd_dev)
 {
+        bool first_time = rbd_dev->header.object_prefix == NULL;
        int ret;
        down_write(&rbd_dev->header_rwsem);
+        if (first_time) {
+                ret = rbd_dev_v2_header_onetime(rbd_dev);
+                if (ret)
+                        goto out;
+        }
+        /*
+         * If the image supports layering, get the parent info.  We
+         * need to probe the first time regardless.  Thereafter we
+         * only need to if there's a parent, to see if it has
+         * disappeared due to the mapped image getting flattened.
+         */
+        if (rbd_dev->header.features & RBD_FEATURE_LAYERING &&
+                        (first_time || rbd_dev->parent_spec)) {
+                bool warn;
+                ret = rbd_dev_v2_parent_info(rbd_dev);
+                if (ret)
+                        goto out;
+                /*
+                 * Print a warning if this is the initial probe and
+                 * the image has a parent.  Don't print it if the
+                 * image now being probed is itself a parent.  We
+                 * can tell at this point because we won't know its
+                 * pool name yet (just its pool id).
+                 */
+                warn = rbd_dev->parent_spec && rbd_dev->spec->pool_name;
+                if (first_time && warn)
+                        rbd_warn(rbd_dev, "WARNING: kernel layering "
+                                        "is EXPERIMENTAL!");
+        }
        ret = rbd_dev_v2_image_size(rbd_dev);
        if (ret)
                goto out;
-        rbd_update_mapping_size(rbd_dev);
+        if (rbd_dev->spec->snap_id == CEPH_NOSNAP)
+                if (rbd_dev->mapping.size != rbd_dev->header.image_size)
+                        rbd_dev->mapping.size = rbd_dev->header.image_size;
        ret = rbd_dev_v2_snap_context(rbd_dev);
        dout("rbd_dev_v2_snap_context returned %d\n", ret);
-        if (ret)
-                goto out;
 out:
        up_write(&rbd_dev->header_rwsem);
@@ -4490,10 +4703,10 @@ static void rbd_dev_unprobe(struct rbd_device *rbd_dev)
 {
        struct rbd_image_header *header;
-        rbd_dev_remove_parent(rbd_dev);
+        /* Drop parent reference unless it's already been done (or none) */
-        rbd_spec_put(rbd_dev->parent_spec);
-        rbd_dev->parent_spec = NULL;
+        if (rbd_dev->parent_overlap)
-        rbd_dev->parent_overlap = 0;
+                rbd_dev_parent_put(rbd_dev);
        /* Free dynamic fields from the header, then zero it out */
@@ -4505,72 +4718,22 @@ static void rbd_dev_unprobe(struct rbd_device *rbd_dev)
        memset(header, 0, sizeof (*header));
 }
-static int rbd_dev_v1_probe(struct rbd_device *rbd_dev)
+static int rbd_dev_v2_header_onetime(struct rbd_device *rbd_dev)
 {
        int ret;
-        /* Populate rbd image metadata */
-        ret = rbd_read_header(rbd_dev, &rbd_dev->header);
-        if (ret < 0)
-                goto out_err;
-        /* Version 1 images have no parent (no layering) */
-        rbd_dev->parent_spec = NULL;
-        rbd_dev->parent_overlap = 0;
-        dout("discovered version 1 image, header name is %s\n",
-                rbd_dev->header_name);
-        return 0;
-out_err:
-        kfree(rbd_dev->header_name);
-        rbd_dev->header_name = NULL;
-        kfree(rbd_dev->spec->image_id);
-        rbd_dev->spec->image_id = NULL;
-        return ret;
-}
-static int rbd_dev_v2_probe(struct rbd_device *rbd_dev)
-{
-        int ret;
-        ret = rbd_dev_v2_image_size(rbd_dev);
-        if (ret)
-                goto out_err;
-        /* Get the object prefix (a.k.a. block_name) for the image */
        ret = rbd_dev_v2_object_prefix(rbd_dev);
        if (ret)
                goto out_err;
-        /* Get the and check features for the image */
+        /*
+         * Get the and check features for the image.  Currently the
+         * features are assumed to never change.
+         */
        ret = rbd_dev_v2_features(rbd_dev);
        if (ret)
                goto out_err;
-        /* If the image supports layering, get the parent info */
-        if (rbd_dev->header.features & RBD_FEATURE_LAYERING) {
-                ret = rbd_dev_v2_parent_info(rbd_dev);
-                if (ret)
-                        goto out_err;
-                /*
-                 * Don't print a warning for parent images.  We can
-                 * tell this point because we won't know its pool
-                 * name yet (just its pool id).
-                 */
-                if (rbd_dev->spec->pool_name)
-                        rbd_warn(rbd_dev, "WARNING: kernel layering "
-                                        "is EXPERIMENTAL!");
-        }
        /* If the image supports fancy striping, get its parameters */
        if (rbd_dev->header.features & RBD_FEATURE_STRIPINGV2) {
@@ -4578,28 +4741,11 @@ static int rbd_dev_v2_probe(struct rbd_device *rbd_dev)
                if (ret < 0)
                        goto out_err;
        }
+        /* No support for crypto and compression type format 2 images */
-        /* crypto and compression type aren't (yet) supported for v2 images */
-        rbd_dev->header.crypt_type = 0;
-        rbd_dev->header.comp_type = 0;
-        /* Get the snapshot context, plus the header version */
-        ret = rbd_dev_v2_snap_context(rbd_dev);
-        if (ret)
-                goto out_err;
-        dout("discovered version 2 image, header name is %s\n",
-                rbd_dev->header_name);
        return 0;
 out_err:
-        rbd_dev->parent_overlap = 0;
+        rbd_dev->header.features = 0;
-        rbd_spec_put(rbd_dev->parent_spec);
-        rbd_dev->parent_spec = NULL;
-        kfree(rbd_dev->header_name);
-        rbd_dev->header_name = NULL;
        kfree(rbd_dev->header.object_prefix);
        rbd_dev->header.object_prefix = NULL;
@@ -4628,15 +4774,16 @@ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev)
        if (!parent)
                goto out_err;
-        ret = rbd_dev_image_probe(parent);
+        ret = rbd_dev_image_probe(parent, false);
        if (ret < 0)
                goto out_err;
        rbd_dev->parent = parent;
+        atomic_set(&rbd_dev->parent_ref, 1);
        return 0;
 out_err:
        if (parent) {
-                rbd_spec_put(rbd_dev->parent_spec);
+                rbd_dev_unparent(rbd_dev);
                kfree(rbd_dev->header_name);
                rbd_dev_destroy(parent);
        } else {
@@ -4651,10 +4798,6 @@ static int rbd_dev_device_setup(struct rbd_device *rbd_dev)
 {
        int ret;
-        ret = rbd_dev_mapping_set(rbd_dev);
-        if (ret)
-                return ret;
        /* generate unique id: find highest unique id, add one */
        rbd_dev_id_get(rbd_dev);
@@ -4676,13 +4819,17 @@ static int rbd_dev_device_setup(struct rbd_device *rbd_dev)
        if (ret)
                goto err_out_blkdev;
-        ret = rbd_bus_add_dev(rbd_dev);
+        ret = rbd_dev_mapping_set(rbd_dev);
        if (ret)
                goto err_out_disk;
+        set_capacity(rbd_dev->disk, rbd_dev->mapping.size / SECTOR_SIZE);
+        ret = rbd_bus_add_dev(rbd_dev);
+        if (ret)
+                goto err_out_mapping;
        /* Everything's ready.  Announce the disk to the world. */
-        set_capacity(rbd_dev->disk, rbd_dev->mapping.size / SECTOR_SIZE);
        set_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);
        add_disk(rbd_dev->disk);
@@ -4691,6 +4838,8 @@ static int rbd_dev_device_setup(struct rbd_device *rbd_dev)
        return ret;
+err_out_mapping:
+        rbd_dev_mapping_clear(rbd_dev);
 err_out_disk:
        rbd_free_disk(rbd_dev);
 err_out_blkdev:
@@ -4731,12 +4880,7 @@ static int rbd_dev_header_name(struct rbd_device *rbd_dev)
 static void rbd_dev_image_release(struct rbd_device *rbd_dev)
 {
-        int ret;
        rbd_dev_unprobe(rbd_dev);
-        ret = rbd_dev_header_watch_sync(rbd_dev, 0);
-        if (ret)
-                rbd_warn(rbd_dev, "failed to cancel watch event (%d)\n", ret);
        kfree(rbd_dev->header_name);
        rbd_dev->header_name = NULL;
        rbd_dev->image_format = 0;
@@ -4748,10 +4892,11 @@ static void rbd_dev_image_release(struct rbd_device *rbd_dev)
 /*
 * Probe for the existence of the header object for the given rbd
- * device.  For format 2 images this includes determining the image
+ * device.  If this image is the one being mapped (i.e., not a
- * id.
+ * parent), initiate a watch on its header object before using that
+ * object to get detailed information about the rbd image.
 */
-static int rbd_dev_image_probe(struct rbd_device *rbd_dev)
+static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)
 {
        int ret;
        int tmp;
@@ -4771,14 +4916,16 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev)
        if (ret)
                goto err_out_format;
-        ret = rbd_dev_header_watch_sync(rbd_dev, 1);
+        if (mapping) {
-        if (ret)
+                ret = rbd_dev_header_watch_sync(rbd_dev, true);
-                goto out_header_name;
+                if (ret)
+                        goto out_header_name;
+        }
        if (rbd_dev->image_format == 1)
-                ret = rbd_dev_v1_probe(rbd_dev);
+                ret = rbd_dev_v1_header_info(rbd_dev);
        else
-                ret = rbd_dev_v2_probe(rbd_dev);
+                ret = rbd_dev_v2_header_info(rbd_dev);
        if (ret)
                goto err_out_watch;
@@ -4787,15 +4934,22 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev)
                goto err_out_probe;
        ret = rbd_dev_probe_parent(rbd_dev);
-        if (!ret)
+        if (ret)
-                return 0;
+                goto err_out_probe;
+        dout("discovered format %u image, header name is %s\n",
+                rbd_dev->image_format, rbd_dev->header_name);
+        return 0;
 err_out_probe:
        rbd_dev_unprobe(rbd_dev);
 err_out_watch:
-        tmp = rbd_dev_header_watch_sync(rbd_dev, 0);
+        if (mapping) {
-        if (tmp)
+                tmp = rbd_dev_header_watch_sync(rbd_dev, false);
-                rbd_warn(rbd_dev, "unable to tear down watch request\n");
+                if (tmp)
+                        rbd_warn(rbd_dev, "unable to tear down "
+                                        "watch request (%d)\n", tmp);
+        }
 out_header_name:
        kfree(rbd_dev->header_name);
        rbd_dev->header_name = NULL;
@@ -4819,6 +4973,7 @@ static ssize_t rbd_add(struct bus_type *bus,
        struct rbd_spec *spec = NULL;
        struct rbd_client *rbdc;
        struct ceph_osd_client *osdc;
+        bool read_only;
        int rc = -ENOMEM;
        if (!try_module_get(THIS_MODULE))
@@ -4828,6 +4983,9 @@ static ssize_t rbd_add(struct bus_type *bus,
        rc = rbd_add_parse_args(buf, &ceph_opts, &rbd_opts, &spec);
        if (rc < 0)
                goto err_out_module;
+        read_only = rbd_opts->read_only;
+        kfree(rbd_opts);
+        rbd_opts = NULL;        /* done with this */
        rbdc = rbd_get_client(ceph_opts);
        if (IS_ERR(rbdc)) {
@@ -4858,14 +5016,16 @@ static ssize_t rbd_add(struct bus_type *bus,
        rbdc = NULL;            /* rbd_dev now owns this */
        spec = NULL;            /* rbd_dev now owns this */
-        rbd_dev->mapping.read_only = rbd_opts->read_only;
+        rc = rbd_dev_image_probe(rbd_dev, true);
-        kfree(rbd_opts);
-        rbd_opts = NULL;        /* done with this */
-        rc = rbd_dev_image_probe(rbd_dev);
        if (rc < 0)
                goto err_out_rbd_dev;
+        /* If we are mapping a snapshot it must be marked read-only */
+        if (rbd_dev->spec->snap_id != CEPH_NOSNAP)
+                read_only = true;
+        rbd_dev->mapping.read_only = read_only;
        rc = rbd_dev_device_setup(rbd_dev);
        if (!rc)
                return count;
@@ -4911,7 +5071,7 @@ static void rbd_dev_device_release(struct device *dev)
        rbd_free_disk(rbd_dev);
        clear_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);
-        rbd_dev_clear_mapping(rbd_dev);
+        rbd_dev_mapping_clear(rbd_dev);
        unregister_blkdev(rbd_dev->major, rbd_dev->name);
        rbd_dev->major = 0;
        rbd_dev_id_put(rbd_dev);
@@ -4978,10 +5138,13 @@ static ssize_t rbd_remove(struct bus_type *bus,
        spin_unlock_irq(&rbd_dev->lock);
        if (ret < 0)
                goto done;
-        ret = count;
        rbd_bus_del_dev(rbd_dev);
+        ret = rbd_dev_header_watch_sync(rbd_dev, false);
+        if (ret)
+                rbd_warn(rbd_dev, "failed to cancel watch event (%d)\n", ret);
        rbd_dev_image_release(rbd_dev);
        module_put(THIS_MODULE);
+        ret = count;
 done:
        mutex_unlock(&ctl_mutex);
diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
index cdd4c09fda96..a22a7a502740 100644
--- a/drivers/char/ipmi/ipmi_bt_sm.c
+++ b/drivers/char/ipmi/ipmi_bt_sm.c
@@ -95,9 +95,9 @@ struct si_sm_data {
        enum bt_states  state;
        unsigned char   seq;            /* BT sequence number */
        struct si_sm_io *io;
-        unsigned char   write_data[IPMI_MAX_MSG_LENGTH];
+        unsigned char   write_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
        int             write_count;
-        unsigned char   read_data[IPMI_MAX_MSG_LENGTH];
+        unsigned char   read_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
        int             read_count;
        int             truncated;
        long            timeout;        /* microseconds countdown */
diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
index 9eb360ff8cab..d5a5f020810a 100644
--- a/drivers/char/ipmi/ipmi_devintf.c
+++ b/drivers/char/ipmi/ipmi_devintf.c
@@ -837,13 +837,25 @@ static long compat_ipmi_ioctl(struct file *filep, unsigned int cmd,
                return ipmi_ioctl(filep, cmd, arg);
        }
 }
+static long unlocked_compat_ipmi_ioctl(struct file *filep, unsigned int cmd,
+                                       unsigned long arg)
+{
+        int ret;
+        mutex_lock(&ipmi_mutex);
+        ret = compat_ipmi_ioctl(filep, cmd, arg);
+        mutex_unlock(&ipmi_mutex);
+        return ret;
+}
 #endif
 static const struct file_operations ipmi_fops = {
        .owner          = THIS_MODULE,
        .unlocked_ioctl = ipmi_unlocked_ioctl,
 #ifdef CONFIG_COMPAT
-        .compat_ioctl   = compat_ipmi_ioctl,
+        .compat_ioctl   = unlocked_compat_ipmi_ioctl,
 #endif
        .open           = ipmi_open,
        .release        = ipmi_release,
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 4d439d2fcfd6..4445fa164a2d 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -2037,12 +2037,11 @@ int ipmi_smi_add_proc_entry(ipmi_smi_t smi, char *name,
        entry = kmalloc(sizeof(*entry), GFP_KERNEL);
        if (!entry)
                return -ENOMEM;
-        entry->name = kmalloc(strlen(name)+1, GFP_KERNEL);
+        entry->name = kstrdup(name, GFP_KERNEL);
        if (!entry->name) {
                kfree(entry);
                return -ENOMEM;
        }
-        strcpy(entry->name, name);
        file = proc_create_data(name, 0, smi->proc_dir, proc_ops, data);
        if (!file) {
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 313538abe63c..af4b23ffc5a6 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -663,8 +663,10 @@ static void handle_transaction_done(struct smi_info *smi_info)
                /* We got the flags from the SMI, now handle them. */
                smi_info->handlers->get_result(smi_info->si_sm, msg, 4);
                if (msg[2] != 0) {
-                        dev_warn(smi_info->dev, "Could not enable interrupts"
+                        dev_warn(smi_info->dev,
-                                 ", failed get, using polled mode.\n");
+                                 "Couldn't get irq info: %x.\n", msg[2]);
+                        dev_warn(smi_info->dev,
+                                 "Maybe ok, but ipmi might run very slowly.\n");
                        smi_info->si_state = SI_NORMAL;
                } else {
                        msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
@@ -685,10 +687,12 @@ static void handle_transaction_done(struct smi_info *smi_info)
                /* We got the flags from the SMI, now handle them. */
                smi_info->handlers->get_result(smi_info->si_sm, msg, 4);
-                if (msg[2] != 0)
+                if (msg[2] != 0) {
-                        dev_warn(smi_info->dev, "Could not enable interrupts"
+                        dev_warn(smi_info->dev,
-                                 ", failed set, using polled mode.\n");
+                                 "Couldn't set irq info: %x.\n", msg[2]);
-                else
+                        dev_warn(smi_info->dev,
+                                 "Maybe ok, but ipmi might run very slowly.\n");
+                } else
                        smi_info->interrupt_disabled = 0;
                smi_info->si_state = SI_NORMAL;
                break;
diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index a1488f58f6ca..534fcb825153 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -47,7 +47,7 @@ config CPU_FREQ_STAT_DETAILS
 choice
        prompt "Default CPUFreq governor"
-        default CPU_FREQ_DEFAULT_GOV_USERSPACE if CPU_FREQ_SA1100 || CPU_FREQ_SA1110
+        default CPU_FREQ_DEFAULT_GOV_USERSPACE if ARM_SA1100_CPUFREQ || ARM_SA1110_CPUFREQ
        default CPU_FREQ_DEFAULT_GOV_PERFORMANCE
        help
          This option sets which CPUFreq governor shall be loaded at
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index f3af18b9acc5..6e57543fe0b9 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -3,16 +3,17 @@
 #
 config ARM_BIG_LITTLE_CPUFREQ
-        tristate
+        tristate "Generic ARM big LITTLE CPUfreq driver"
-        depends on ARM_CPU_TOPOLOGY
+        depends on ARM_CPU_TOPOLOGY && PM_OPP && HAVE_CLK
+        help
+          This enables the Generic CPUfreq driver for ARM big.LITTLE platforms.
 config ARM_DT_BL_CPUFREQ
-        tristate "Generic ARM big LITTLE CPUfreq driver probed via DT"
+        tristate "Generic probing via DT for ARM big LITTLE CPUfreq driver"
-        select ARM_BIG_LITTLE_CPUFREQ
+        depends on ARM_BIG_LITTLE_CPUFREQ && OF
-        depends on OF && HAVE_CLK
        help
-          This enables the Generic CPUfreq driver for ARM big.LITTLE platform.
+          This enables probing via DT for Generic CPUfreq driver for ARM
-          This gets frequency tables from DT.
+          big.LITTLE platform. This gets frequency tables from DT.
 config ARM_EXYNOS_CPUFREQ
        bool "SAMSUNG EXYNOS SoCs"
diff --git a/drivers/cpufreq/arm_big_little.c b/drivers/cpufreq/arm_big_little.c
index dbdf677d2f36..5d7f53fcd6f5 100644
--- a/drivers/cpufreq/arm_big_little.c
+++ b/drivers/cpufreq/arm_big_little.c
@@ -40,11 +40,6 @@ static struct clk *clk[MAX_CLUSTERS];
 static struct cpufreq_frequency_table *freq_table[MAX_CLUSTERS];
 static atomic_t cluster_usage[MAX_CLUSTERS] = {ATOMIC_INIT(0), ATOMIC_INIT(0)};
-static int cpu_to_cluster(int cpu)
-{
-        return topology_physical_package_id(cpu);
-}
 static unsigned int bL_cpufreq_get(unsigned int cpu)
 {
        u32 cur_cluster = cpu_to_cluster(cpu);
@@ -192,7 +187,7 @@ static int bL_cpufreq_init(struct cpufreq_policy *policy)
        cpumask_copy(policy->cpus, topology_core_cpumask(policy->cpu));
-        dev_info(cpu_dev, "CPU %d initialized\n", policy->cpu);
+        dev_info(cpu_dev, "%s: CPU %d initialized\n", __func__, policy->cpu);
        return 0;
 }
diff --git a/drivers/cpufreq/arm_big_little.h b/drivers/cpufreq/arm_big_little.h
index 70f18fc12d4a..79b2ce17884d 100644
--- a/drivers/cpufreq/arm_big_little.h
+++ b/drivers/cpufreq/arm_big_little.h
@@ -34,6 +34,11 @@ struct cpufreq_arm_bL_ops {
        int (*init_opp_table)(struct device *cpu_dev);
 };
+static inline int cpu_to_cluster(int cpu)
+{
+        return topology_physical_package_id(cpu);
+}
 int bL_cpufreq_register(struct cpufreq_arm_bL_ops *ops);
 void bL_cpufreq_unregister(struct cpufreq_arm_bL_ops *ops);
diff --git a/drivers/cpufreq/arm_big_little_dt.c b/drivers/cpufreq/arm_big_little_dt.c
index 44be3115375c..173ed059d95f 100644
--- a/drivers/cpufreq/arm_big_little_dt.c
+++ b/drivers/cpufreq/arm_big_little_dt.c
@@ -66,8 +66,8 @@ static int dt_get_transition_latency(struct device *cpu_dev)
        parent = of_find_node_by_path("/cpus");
        if (!parent) {
-                pr_err("failed to find OF /cpus\n");
+                pr_info("Failed to find OF /cpus. Use CPUFREQ_ETERNAL transition latency\n");
-                return -ENOENT;
+                return CPUFREQ_ETERNAL;
        }
        for_each_child_of_node(parent, np) {
@@ -78,10 +78,11 @@ static int dt_get_transition_latency(struct device *cpu_dev)
                of_node_put(np);
                of_node_put(parent);
-                return 0;
+                return transition_latency;
        }
-        return -ENODEV;
+        pr_info("clock-latency isn't found, use CPUFREQ_ETERNAL transition latency\n");
+        return CPUFREQ_ETERNAL;
 }
 static struct cpufreq_arm_bL_ops dt_bL_ops = {
diff --git a/drivers/cpufreq/cpufreq-cpu0.c b/drivers/cpufreq/cpufreq-cpu0.c
index 3ab8294eab04..a64eb8b70444 100644
--- a/drivers/cpufreq/cpufreq-cpu0.c
+++ b/drivers/cpufreq/cpufreq-cpu0.c
@@ -189,12 +189,29 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
        if (!np) {
                pr_err("failed to find cpu0 node\n");
-                return -ENOENT;
+                ret = -ENOENT;
+                goto out_put_parent;
        }
        cpu_dev = &pdev->dev;
        cpu_dev->of_node = np;
+        cpu_reg = devm_regulator_get(cpu_dev, "cpu0");
+        if (IS_ERR(cpu_reg)) {
+                /*
+                 * If cpu0 regulator supply node is present, but regulator is
+                 * not yet registered, we should try defering probe.
+                 */
+                if (PTR_ERR(cpu_reg) == -EPROBE_DEFER) {
+                        dev_err(cpu_dev, "cpu0 regulator not ready, retry\n");
+                        ret = -EPROBE_DEFER;
+                        goto out_put_node;
+                }
+                pr_warn("failed to get cpu0 regulator: %ld\n",
+                        PTR_ERR(cpu_reg));
+                cpu_reg = NULL;
+        }
        cpu_clk = devm_clk_get(cpu_dev, NULL);
        if (IS_ERR(cpu_clk)) {
                ret = PTR_ERR(cpu_clk);
@@ -202,12 +219,6 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
                goto out_put_node;
        }
-        cpu_reg = devm_regulator_get(cpu_dev, "cpu0");
-        if (IS_ERR(cpu_reg)) {
-                pr_warn("failed to get cpu0 regulator\n");
-                cpu_reg = NULL;
-        }
        ret = of_init_opp_table(cpu_dev);
        if (ret) {
                pr_err("failed to init OPP table: %d\n", ret);
@@ -264,6 +275,8 @@ out_free_table:
        opp_free_cpufreq_table(cpu_dev, &freq_table);
 out_put_node:
        of_node_put(np);
+out_put_parent:
+        of_node_put(parent);
        return ret;
 }
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 1b8a48eaf90f..4b8c7f297d74 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1075,14 +1075,14 @@ static int __cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif
                                __func__, cpu_dev->id, cpu);
        }
+        if ((cpus == 1) && (cpufreq_driver->target))
+                __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
        pr_debug("%s: removing link, cpu: %d\n", __func__, cpu);
        cpufreq_cpu_put(data);
        /* If cpu is last user of policy, free policy */
        if (cpus == 1) {
-                if (cpufreq_driver->target)
-                        __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
                lock_policy_rwsem_read(cpu);
                kobj = &data->kobj;
                cmp = &data->kobj_unregister;
@@ -1832,15 +1832,13 @@ static int __cpuinit cpufreq_cpu_callback(struct notifier_block *nfb,
        if (dev) {
                switch (action) {
                case CPU_ONLINE:
-                case CPU_ONLINE_FROZEN:
                        cpufreq_add_dev(dev, NULL);
                        break;
                case CPU_DOWN_PREPARE:
-                case CPU_DOWN_PREPARE_FROZEN:
+                case CPU_UP_CANCELED_FROZEN:
                        __cpufreq_remove_dev(dev, NULL);
                        break;
                case CPU_DOWN_FAILED:
-                case CPU_DOWN_FAILED_FROZEN:
                        cpufreq_add_dev(dev, NULL);
                        break;
                }
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index 443442df113b..5af40ad82d23 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -255,6 +255,7 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                if (have_governor_per_policy()) {
                        WARN_ON(dbs_data);
                } else if (dbs_data) {
+                        dbs_data->usage_count++;
                        policy->governor_data = dbs_data;
                        return 0;
                }
@@ -266,6 +267,7 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                }
                dbs_data->cdata = cdata;
+                dbs_data->usage_count = 1;
                rc = cdata->init(dbs_data);
                if (rc) {
                        pr_err("%s: POLICY_INIT: init() failed\n", __func__);
@@ -294,7 +296,8 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                set_sampling_rate(dbs_data, max(dbs_data->min_sampling_rate,
                                        latency * LATENCY_MULTIPLIER));
-                if (dbs_data->cdata->governor == GOV_CONSERVATIVE) {
+                if ((cdata->governor == GOV_CONSERVATIVE) &&
+                                (!policy->governor->initialized)) {
                        struct cs_ops *cs_ops = dbs_data->cdata->gov_ops;
                        cpufreq_register_notifier(cs_ops->notifier_block,
@@ -306,12 +309,12 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                return 0;
        case CPUFREQ_GOV_POLICY_EXIT:
-                if ((policy->governor->initialized == 1) ||
+                if (!--dbs_data->usage_count) {
-                                have_governor_per_policy()) {
                        sysfs_remove_group(get_governor_parent_kobj(policy),
                                        get_sysfs_attr(dbs_data));
-                        if (dbs_data->cdata->governor == GOV_CONSERVATIVE) {
+                        if ((dbs_data->cdata->governor == GOV_CONSERVATIVE) &&
+                                (policy->governor->initialized == 1)) {
                                struct cs_ops *cs_ops = dbs_data->cdata->gov_ops;
                                cpufreq_unregister_notifier(cs_ops->notifier_block,
diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h
index 8ac33538d0bd..e16a96130cb3 100644
--- a/drivers/cpufreq/cpufreq_governor.h
+++ b/drivers/cpufreq/cpufreq_governor.h
@@ -211,6 +211,7 @@ struct common_dbs_data {
 struct dbs_data {
        struct common_dbs_data *cdata;
        unsigned int min_sampling_rate;
+        int usage_count;
        void *tuners;
        /* dbs_mutex protects dbs_enable in governor start/stop */
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index b0ffef96bf77..4b9bb5def6f1 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -547,7 +547,6 @@ static int od_init(struct dbs_data *dbs_data)
        tuners->io_is_busy = should_io_be_busy();
        dbs_data->tuners = tuners;
-        pr_info("%s: tuners %p\n", __func__, tuners);
        mutex_init(&dbs_data->mutex);
        return 0;
 }
diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index bfd6273fd873..fb65decffa28 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -349,15 +349,16 @@ static int __cpuinit cpufreq_stat_cpu_callback(struct notifier_block *nfb,
        switch (action) {
        case CPU_ONLINE:
-        case CPU_ONLINE_FROZEN:
                cpufreq_update_policy(cpu);
                break;
        case CPU_DOWN_PREPARE:
-        case CPU_DOWN_PREPARE_FROZEN:
                cpufreq_stats_free_sysfs(cpu);
                break;
        case CPU_DEAD:
-        case CPU_DEAD_FROZEN:
+                cpufreq_stats_free_table(cpu);
+                break;
+        case CPU_UP_CANCELED_FROZEN:
+                cpufreq_stats_free_sysfs(cpu);
                cpufreq_stats_free_table(cpu);
                break;
        }
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index cc3a8e6c92be..9c36ace92a39 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -48,12 +48,7 @@ static inline int32_t div_fp(int32_t x, int32_t y)
 }
 struct sample {
-        ktime_t start_time;
-        ktime_t end_time;
        int core_pct_busy;
-        int pstate_pct_busy;
-        u64 duration_us;
-        u64 idletime_us;
        u64 aperf;
        u64 mperf;
        int freq;
@@ -86,13 +81,9 @@ struct cpudata {
        struct pstate_adjust_policy *pstate_policy;
        struct pstate_data pstate;
        struct _pid pid;
-        struct _pid idle_pid;
        int min_pstate_count;
-        int idle_mode;
-        ktime_t prev_sample;
-        u64     prev_idle_time_us;
        u64     prev_aperf;
        u64     prev_mperf;
        int     sample_ptr;
@@ -124,6 +115,8 @@ struct perf_limits {
        int min_perf_pct;
        int32_t max_perf;
        int32_t min_perf;
+        int max_policy_pct;
+        int max_sysfs_pct;
 };
 static struct perf_limits limits = {
@@ -132,6 +125,8 @@ static struct perf_limits limits = {
        .max_perf = int_tofp(1),
        .min_perf_pct = 0,
        .min_perf = 0,
+        .max_policy_pct = 100,
+        .max_sysfs_pct = 100,
 };
 static inline void pid_reset(struct _pid *pid, int setpoint, int busy,
@@ -202,19 +197,6 @@ static inline void intel_pstate_busy_pid_reset(struct cpudata *cpu)
                0);
 }
-static inline void intel_pstate_idle_pid_reset(struct cpudata *cpu)
-{
-        pid_p_gain_set(&cpu->idle_pid, cpu->pstate_policy->p_gain_pct);
-        pid_d_gain_set(&cpu->idle_pid, cpu->pstate_policy->d_gain_pct);
-        pid_i_gain_set(&cpu->idle_pid, cpu->pstate_policy->i_gain_pct);
-        pid_reset(&cpu->idle_pid,
-                75,
-                50,
-                cpu->pstate_policy->deadband,
-                0);
-}
 static inline void intel_pstate_reset_all_pid(void)
 {
        unsigned int cpu;
@@ -302,7 +284,8 @@ static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b,
        if (ret != 1)
                return -EINVAL;
-        limits.max_perf_pct = clamp_t(int, input, 0 , 100);
+        limits.max_sysfs_pct = clamp_t(int, input, 0 , 100);
+        limits.max_perf_pct = min(limits.max_policy_pct, limits.max_sysfs_pct);
        limits.max_perf = div_fp(int_tofp(limits.max_perf_pct), int_tofp(100));
        return count;
 }
@@ -408,9 +391,8 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
        if (pstate == cpu->pstate.current_pstate)
                return;
-#ifndef MODULE
        trace_cpu_frequency(pstate * 100000, cpu->cpu);
-#endif
        cpu->pstate.current_pstate = pstate;
        wrmsrl(MSR_IA32_PERF_CTL, pstate << 8);
@@ -450,48 +432,26 @@ static inline void intel_pstate_calc_busy(struct cpudata *cpu,
                                        struct sample *sample)
 {
        u64 core_pct;
-        sample->pstate_pct_busy = 100 - div64_u64(
-                                        sample->idletime_us * 100,
-                                        sample->duration_us);
        core_pct = div64_u64(sample->aperf * 100, sample->mperf);
        sample->freq = cpu->pstate.max_pstate * core_pct * 1000;
-        sample->core_pct_busy = div_s64((sample->pstate_pct_busy * core_pct),
+        sample->core_pct_busy = core_pct;
-                                        100);
 }
 static inline void intel_pstate_sample(struct cpudata *cpu)
 {
-        ktime_t now;
-        u64 idle_time_us;
        u64 aperf, mperf;
-        now = ktime_get();
-        idle_time_us = get_cpu_idle_time_us(cpu->cpu, NULL);
        rdmsrl(MSR_IA32_APERF, aperf);
        rdmsrl(MSR_IA32_MPERF, mperf);
-        /* for the first sample, don't actually record a sample, just
+        cpu->sample_ptr = (cpu->sample_ptr + 1) % SAMPLE_COUNT;
-         * set the baseline */
+        cpu->samples[cpu->sample_ptr].aperf = aperf;
-        if (cpu->prev_idle_time_us > 0) {
+        cpu->samples[cpu->sample_ptr].mperf = mperf;
-                cpu->sample_ptr = (cpu->sample_ptr + 1) % SAMPLE_COUNT;
+        cpu->samples[cpu->sample_ptr].aperf -= cpu->prev_aperf;
-                cpu->samples[cpu->sample_ptr].start_time = cpu->prev_sample;
+        cpu->samples[cpu->sample_ptr].mperf -= cpu->prev_mperf;
-                cpu->samples[cpu->sample_ptr].end_time = now;
-                cpu->samples[cpu->sample_ptr].duration_us =
+        intel_pstate_calc_busy(cpu, &cpu->samples[cpu->sample_ptr]);
-                        ktime_us_delta(now, cpu->prev_sample);
-                cpu->samples[cpu->sample_ptr].idletime_us =
-                        idle_time_us - cpu->prev_idle_time_us;
-                cpu->samples[cpu->sample_ptr].aperf = aperf;
-                cpu->samples[cpu->sample_ptr].mperf = mperf;
-                cpu->samples[cpu->sample_ptr].aperf -= cpu->prev_aperf;
-                cpu->samples[cpu->sample_ptr].mperf -= cpu->prev_mperf;
-                intel_pstate_calc_busy(cpu, &cpu->samples[cpu->sample_ptr]);
-        }
-        cpu->prev_sample = now;
-        cpu->prev_idle_time_us = idle_time_us;
        cpu->prev_aperf = aperf;
        cpu->prev_mperf = mperf;
 }
@@ -505,16 +465,6 @@ static inline void intel_pstate_set_sample_time(struct cpudata *cpu)
        mod_timer_pinned(&cpu->timer, jiffies + delay);
 }
-static inline void intel_pstate_idle_mode(struct cpudata *cpu)
-{
-        cpu->idle_mode = 1;
-}
-static inline void intel_pstate_normal_mode(struct cpudata *cpu)
-{
-        cpu->idle_mode = 0;
-}
 static inline int intel_pstate_get_scaled_busy(struct cpudata *cpu)
 {
        int32_t busy_scaled;
@@ -547,50 +497,21 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
                intel_pstate_pstate_decrease(cpu, steps);
 }
-static inline void intel_pstate_adjust_idle_pstate(struct cpudata *cpu)
-{
-        int busy_scaled;
-        struct _pid *pid;
-        int ctl = 0;
-        int steps;
-        pid = &cpu->idle_pid;
-        busy_scaled = intel_pstate_get_scaled_busy(cpu);
-        ctl = pid_calc(pid, 100 - busy_scaled);
-        steps = abs(ctl);
-        if (ctl < 0)
-                intel_pstate_pstate_decrease(cpu, steps);
-        else
-                intel_pstate_pstate_increase(cpu, steps);
-        if (cpu->pstate.current_pstate == cpu->pstate.min_pstate)
-                intel_pstate_normal_mode(cpu);
-}
 static void intel_pstate_timer_func(unsigned long __data)
 {
        struct cpudata *cpu = (struct cpudata *) __data;
        intel_pstate_sample(cpu);
+        intel_pstate_adjust_busy_pstate(cpu);
-        if (!cpu->idle_mode)
-                intel_pstate_adjust_busy_pstate(cpu);
-        else
-                intel_pstate_adjust_idle_pstate(cpu);
-#if defined(XPERF_FIX)
        if (cpu->pstate.current_pstate == cpu->pstate.min_pstate) {
                cpu->min_pstate_count++;
                if (!(cpu->min_pstate_count % 5)) {
                        intel_pstate_set_pstate(cpu, cpu->pstate.max_pstate);
-                        intel_pstate_idle_mode(cpu);
                }
        } else
                cpu->min_pstate_count = 0;
-#endif
        intel_pstate_set_sample_time(cpu);
 }
@@ -631,7 +552,6 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
                (unsigned long)cpu;
        cpu->timer.expires = jiffies + HZ/100;
        intel_pstate_busy_pid_reset(cpu);
-        intel_pstate_idle_pid_reset(cpu);
        intel_pstate_sample(cpu);
        intel_pstate_set_pstate(cpu, cpu->pstate.max_pstate);
@@ -675,8 +595,9 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
        limits.min_perf_pct = clamp_t(int, limits.min_perf_pct, 0 , 100);
        limits.min_perf = div_fp(int_tofp(limits.min_perf_pct), int_tofp(100));
-        limits.max_perf_pct = policy->max * 100 / policy->cpuinfo.max_freq;
+        limits.max_policy_pct = policy->max * 100 / policy->cpuinfo.max_freq;
-        limits.max_perf_pct = clamp_t(int, limits.max_perf_pct, 0 , 100);
+        limits.max_policy_pct = clamp_t(int, limits.max_policy_pct, 0 , 100);
+        limits.max_perf_pct = min(limits.max_policy_pct, limits.max_sysfs_pct);
        limits.max_perf = div_fp(int_tofp(limits.max_perf_pct), int_tofp(100));
        return 0;
@@ -788,10 +709,9 @@ static int __init intel_pstate_init(void)
        pr_info("Intel P-state driver initializing.\n");
-        all_cpu_data = vmalloc(sizeof(void *) * num_possible_cpus());
+        all_cpu_data = vzalloc(sizeof(void *) * num_possible_cpus());
        if (!all_cpu_data)
                return -ENOMEM;
-        memset(all_cpu_data, 0, sizeof(void *) * num_possible_cpus());
        rc = cpufreq_register_driver(&intel_pstate_driver);
        if (rc)
diff --git a/drivers/cpufreq/kirkwood-cpufreq.c b/drivers/cpufreq/kirkwood-cpufreq.c
index d36ea8dc96eb..b2644af985ec 100644
--- a/drivers/cpufreq/kirkwood-cpufreq.c
+++ b/drivers/cpufreq/kirkwood-cpufreq.c
@@ -171,10 +171,6 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
        priv.dev = &pdev->dev;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                dev_err(&pdev->dev, "Cannot get memory resource\n");
-                return -ENODEV;
-        }
        priv.base = devm_ioremap_resource(&pdev->dev, res);
        if (IS_ERR(priv.base))
                return PTR_ERR(priv.base);
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 3a8f7e6db295..e7e92429d10f 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -78,6 +78,10 @@ void drm_warn_on_modeset_not_all_locked(struct drm_device *dev)
 {
        struct drm_crtc *crtc;
+        /* Locking is currently fubar in the panic handler. */
+        if (oops_in_progress)
+                return;
        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
                WARN_ON(!mutex_is_locked(&crtc->mutex));
@@ -246,6 +250,7 @@ char *drm_get_connector_status_name(enum drm_connector_status status)
        else
                return "unknown";
 }
+EXPORT_SYMBOL(drm_get_connector_status_name);
 /**
 * drm_mode_object_get - allocate a new modeset identifier
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index e974f9309b72..ed1334e27c33 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -121,6 +121,7 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
                connector->helper_private;
        int count = 0;
        int mode_flags = 0;
+        bool verbose_prune = true;
        DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", connector->base.id,
                        drm_get_connector_name(connector));
@@ -149,6 +150,7 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
                DRM_DEBUG_KMS("[CONNECTOR:%d:%s] disconnected\n",
                        connector->base.id, drm_get_connector_name(connector));
                drm_mode_connector_update_edid_property(connector, NULL);
+                verbose_prune = false;
                goto prune;
        }
@@ -182,7 +184,7 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
        }
 prune:
-        drm_mode_prune_invalid(dev, &connector->modes, true);
+        drm_mode_prune_invalid(dev, &connector->modes, verbose_prune);
        if (list_empty(&connector->modes))
                return 0;
@@ -1005,12 +1007,20 @@ static void output_poll_execute(struct work_struct *work)
                        continue;
                connector->status = connector->funcs->detect(connector, false);
-                DRM_DEBUG_KMS("[CONNECTOR:%d:%s] status updated from %d to %d\n",
+                if (old_status != connector->status) {
-                              connector->base.id,
+                        const char *old, *new;
-                              drm_get_connector_name(connector),
-                              old_status, connector->status);
+                        old = drm_get_connector_status_name(old_status);
-                if (old_status != connector->status)
+                        new = drm_get_connector_status_name(connector->status);
+                        DRM_DEBUG_KMS("[CONNECTOR:%d:%s] "
+                                      "status updated from %s to %s\n",
+                                      connector->base.id,
+                                      drm_get_connector_name(connector),
+                                      old, new);
                        changed = true;
+                }
        }
        mutex_unlock(&dev->mode_config.mutex);
@@ -1083,10 +1093,11 @@ void drm_helper_hpd_irq_event(struct drm_device *dev)
                old_status = connector->status;
                connector->status = connector->funcs->detect(connector, false);
-                DRM_DEBUG_KMS("[CONNECTOR:%d:%s] status updated from %d to %d\n",
+                DRM_DEBUG_KMS("[CONNECTOR:%d:%s] status updated from %s to %s\n",
                              connector->base.id,
                              drm_get_connector_name(connector),
-                              old_status, connector->status);
+                              drm_get_connector_status_name(old_status),
+                              drm_get_connector_status_name(connector->status));
                if (old_status != connector->status)
                        changed = true;
        }
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 8d4f29075af5..9cc247f55502 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -57,7 +57,7 @@ static int drm_version(struct drm_device *dev, void *data,
                       struct drm_file *file_priv);
 #define DRM_IOCTL_DEF(ioctl, _func, _flags) \
-        [DRM_IOCTL_NR(ioctl)] = {.cmd = ioctl, .func = _func, .flags = _flags, .cmd_drv = 0}
+        [DRM_IOCTL_NR(ioctl)] = {.cmd = ioctl, .func = _func, .flags = _flags, .cmd_drv = 0, .name = #ioctl}
 /** Ioctl table */
 static const struct drm_ioctl_desc drm_ioctls[] = {
@@ -375,7 +375,7 @@ long drm_ioctl(struct file *filp,
 {
        struct drm_file *file_priv = filp->private_data;
        struct drm_device *dev;
-        const struct drm_ioctl_desc *ioctl;
+        const struct drm_ioctl_desc *ioctl = NULL;
        drm_ioctl_t *func;
        unsigned int nr = DRM_IOCTL_NR(cmd);
        int retcode = -EINVAL;
@@ -392,11 +392,6 @@ long drm_ioctl(struct file *filp,
        atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
        ++file_priv->ioctl_count;
-        DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
-                  task_pid_nr(current), cmd, nr,
-                  (long)old_encode_dev(file_priv->minor->device),
-                  file_priv->authenticated);
        if ((nr >= DRM_CORE_IOCTL_COUNT) &&
            ((nr < DRM_COMMAND_BASE) || (nr >= DRM_COMMAND_END)))
                goto err_i1;
@@ -417,6 +412,11 @@ long drm_ioctl(struct file *filp,
        } else
                goto err_i1;
+        DRM_DEBUG("pid=%d, dev=0x%lx, auth=%d, %s\n",
+                  task_pid_nr(current),
+                  (long)old_encode_dev(file_priv->minor->device),
+                  file_priv->authenticated, ioctl->name);
        /* Do not trust userspace, use our own definition */
        func = ioctl->func;
        /* is there a local override? */
@@ -471,6 +471,12 @@ long drm_ioctl(struct file *filp,
        }
      err_i1:
+        if (!ioctl)
+                DRM_DEBUG("invalid iotcl: pid=%d, dev=0x%lx, auth=%d, cmd=0x%02x, nr=0x%02x\n",
+                          task_pid_nr(current),
+                          (long)old_encode_dev(file_priv->minor->device),
+                          file_priv->authenticated, cmd, nr);
        if (kdata != stack_kdata)
                kfree(kdata);
        atomic_dec(&dev->ioctl_count);
diff --git a/drivers/gpu/drm/drm_encoder_slave.c b/drivers/gpu/drm/drm_encoder_slave.c
index 48c52f7df4e6..0cfb60f54766 100644
--- a/drivers/gpu/drm/drm_encoder_slave.c
+++ b/drivers/gpu/drm/drm_encoder_slave.c
@@ -54,16 +54,12 @@ int drm_i2c_encoder_init(struct drm_device *dev,
                         struct i2c_adapter *adap,
                         const struct i2c_board_info *info)
 {
-        char modalias[sizeof(I2C_MODULE_PREFIX)
-                      + I2C_NAME_SIZE];
        struct module *module = NULL;
        struct i2c_client *client;
        struct drm_i2c_encoder_driver *encoder_drv;
        int err = 0;
-        snprintf(modalias, sizeof(modalias),
+        request_module("%s%s", I2C_MODULE_PREFIX, info->type);
-                 "%s%s", I2C_MODULE_PREFIX, info->type);
-        request_module(modalias);
        client = i2c_new_device(adap, info);
        if (!client) {
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index db1e2d6f90d7..07cf99cc8862 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -755,33 +755,35 @@ void drm_mm_debug_table(struct drm_mm *mm, const char *prefix)
 EXPORT_SYMBOL(drm_mm_debug_table);
 #if defined(CONFIG_DEBUG_FS)
-int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
+static unsigned long drm_mm_dump_hole(struct seq_file *m, struct drm_mm_node *entry)
 {
-        struct drm_mm_node *entry;
-        unsigned long total_used = 0, total_free = 0, total = 0;
        unsigned long hole_start, hole_end, hole_size;
-        hole_start = drm_mm_hole_node_start(&mm->head_node);
+        if (entry->hole_follows) {
-        hole_end = drm_mm_hole_node_end(&mm->head_node);
+                hole_start = drm_mm_hole_node_start(entry);
-        hole_size = hole_end - hole_start;
+                hole_end = drm_mm_hole_node_end(entry);
-        if (hole_size)
+                hole_size = hole_end - hole_start;
                seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: free\n",
                                hole_start, hole_end, hole_size);
-        total_free += hole_size;
+                return hole_size;
+        }
+        return 0;
+}
+int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
+{
+        struct drm_mm_node *entry;
+        unsigned long total_used = 0, total_free = 0, total = 0;
+        total_free += drm_mm_dump_hole(m, &mm->head_node);
        drm_mm_for_each_node(entry, mm) {
                seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: used\n",
                                entry->start, entry->start + entry->size,
                                entry->size);
                total_used += entry->size;
-                if (entry->hole_follows) {
+                total_free += drm_mm_dump_hole(m, entry);
-                        hole_start = drm_mm_hole_node_start(entry);
-                        hole_end = drm_mm_hole_node_end(entry);
-                        hole_size = hole_end - hole_start;
-                        seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: free\n",
-                                        hole_start, hole_end, hole_size);
-                        total_free += hole_size;
-                }
        }
        total = total_free + total_used;
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index faa79df02648..a371ff865a88 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1143,6 +1143,7 @@ bool drm_mode_parse_command_line_for_connector(const char *mode_option,
                                was_digit = false;
                        } else
                                goto done;
+                        break;
                case '0' ... '9':
                        was_digit = true;
                        break;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 6be940effefd..6165535d15f0 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1045,6 +1045,8 @@ static int __wait_seqno(struct intel_ring_buffer *ring, u32 seqno,
        if (timeout) {
                struct timespec sleep_time = timespec_sub(now, before);
                *timeout = timespec_sub(*timeout, sleep_time);
+                if (!timespec_valid(timeout)) /* i.e. negative time remains */
+                        set_normalized_timespec(timeout, 0, 0);
        }
        switch (end) {
@@ -1053,8 +1055,6 @@ static int __wait_seqno(struct intel_ring_buffer *ring, u32 seqno,
        case -ERESTARTSYS: /* Signal */
                return (int)end;
        case 0: /* Timeout */
-                if (timeout)
-                        set_normalized_timespec(timeout, 0, 0);
                return -ETIME;
        default: /* Completed */
                WARN_ON(end < 0); /* We're not aware of other errors */
@@ -2377,10 +2377,8 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
        mutex_unlock(&dev->struct_mutex);
        ret = __wait_seqno(ring, seqno, reset_counter, true, timeout);
-        if (timeout) {
+        if (timeout)
-                WARN_ON(!timespec_valid(timeout));
                args->timeout_ns = timespec_to_ns(timeout);
-        }
        return ret;
 out:
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index dca614de71b6..bdb0d7717bc7 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -709,15 +709,6 @@ static inline size_t gen6_get_stolen_size(u16 snb_gmch_ctl)
        return snb_gmch_ctl << 25; /* 32 MB units */
 }
-static inline size_t gen7_get_stolen_size(u16 snb_gmch_ctl)
-{
-        static const int stolen_decoder[] = {
-                0, 0, 0, 0, 0, 32, 48, 64, 128, 256, 96, 160, 224, 352};
-        snb_gmch_ctl >>= IVB_GMCH_GMS_SHIFT;
-        snb_gmch_ctl &= IVB_GMCH_GMS_MASK;
-        return stolen_decoder[snb_gmch_ctl] << 20;
-}
 static int gen6_gmch_probe(struct drm_device *dev,
                           size_t *gtt_total,
                           size_t *stolen,
@@ -747,11 +738,7 @@ static int gen6_gmch_probe(struct drm_device *dev,
        pci_read_config_word(dev->pdev, SNB_GMCH_CTRL, &snb_gmch_ctl);
        gtt_size = gen6_get_total_gtt_size(snb_gmch_ctl);
-        if (IS_GEN7(dev) && !IS_VALLEYVIEW(dev))
+        *stolen = gen6_get_stolen_size(snb_gmch_ctl);
-                *stolen = gen7_get_stolen_size(snb_gmch_ctl);
-        else
-                *stolen = gen6_get_stolen_size(snb_gmch_ctl);
        *gtt_total = (gtt_size / sizeof(gen6_gtt_pte_t)) << PAGE_SHIFT;
        /* For Modern GENs the PTEs and register space are split in the BAR */
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 83f9c26e1adb..2d6b62e42daf 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -46,8 +46,6 @@
 #define    SNB_GMCH_GGMS_MASK   0x3
 #define    SNB_GMCH_GMS_SHIFT   3 /* Graphics Mode Select */
 #define    SNB_GMCH_GMS_MASK    0x1f
-#define    IVB_GMCH_GMS_SHIFT   4
-#define    IVB_GMCH_GMS_MASK    0xf
 /* PCI config space */
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 26a0a570f92e..fb961bb81903 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1265,6 +1265,8 @@ static void intel_ddi_pre_enable(struct intel_encoder *intel_encoder)
                intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
                intel_dp_start_link_train(intel_dp);
                intel_dp_complete_link_train(intel_dp);
+                if (port != PORT_A)
+                        intel_dp_stop_link_train(intel_dp);
        }
 }
@@ -1326,6 +1328,9 @@ static void intel_enable_ddi(struct intel_encoder *intel_encoder)
        } else if (type == INTEL_OUTPUT_EDP) {
                struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
+                if (port == PORT_A)
+                        intel_dp_stop_link_train(intel_dp);
                ironlake_edp_backlight_on(intel_dp);
        }
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index fb2fbc1e08b9..3d704b706a8d 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -702,6 +702,9 @@ intel_dp_compute_config(struct intel_encoder *encoder,
        /* Walk through all bpp values. Luckily they're all nicely spaced with 2
         * bpc in between. */
        bpp = min_t(int, 8*3, pipe_config->pipe_bpp);
+        if (is_edp(intel_dp) && dev_priv->edp.bpp)
+                bpp = min_t(int, bpp, dev_priv->edp.bpp);
        for (; bpp >= 6*3; bpp -= 2*3) {
                mode_rate = intel_dp_link_required(target_clock, bpp);
@@ -739,6 +742,7 @@ found:
        intel_dp->link_bw = bws[clock];
        intel_dp->lane_count = lane_count;
        adjusted_mode->clock = drm_dp_bw_code_to_link_rate(intel_dp->link_bw);
+        pipe_config->pipe_bpp = bpp;
        pipe_config->pixel_target_clock = target_clock;
        DRM_DEBUG_KMS("DP link bw %02x lane count %d clock %d bpp %d\n",
@@ -751,20 +755,6 @@ found:
                               target_clock, adjusted_mode->clock,
                               &pipe_config->dp_m_n);
-        /*
-         * XXX: We have a strange regression where using the vbt edp bpp value
-         * for the link bw computation results in black screens, the panel only
-         * works when we do the computation at the usual 24bpp (but still
-         * requires us to use 18bpp). Until that's fully debugged, stay
-         * bug-for-bug compatible with the old code.
-         */
-        if (is_edp(intel_dp) && dev_priv->edp.bpp) {
-                DRM_DEBUG_KMS("clamping display bpc (was %d) to eDP (%d)\n",
-                              bpp, dev_priv->edp.bpp);
-                bpp = min_t(int, bpp, dev_priv->edp.bpp);
-        }
-        pipe_config->pipe_bpp = bpp;
        return true;
 }
@@ -1389,6 +1379,7 @@ static void intel_enable_dp(struct intel_encoder *encoder)
        ironlake_edp_panel_on(intel_dp);
        ironlake_edp_panel_vdd_off(intel_dp, true);
        intel_dp_complete_link_train(intel_dp);
+        intel_dp_stop_link_train(intel_dp);
        ironlake_edp_backlight_on(intel_dp);
 }
@@ -1711,10 +1702,9 @@ intel_dp_set_link_train(struct intel_dp *intel_dp,
        struct drm_i915_private *dev_priv = dev->dev_private;
        enum port port = intel_dig_port->port;
        int ret;
-        uint32_t temp;
        if (HAS_DDI(dev)) {
-                temp = I915_READ(DP_TP_CTL(port));
+                uint32_t temp = I915_READ(DP_TP_CTL(port));
                if (dp_train_pat & DP_LINK_SCRAMBLING_DISABLE)
                        temp |= DP_TP_CTL_SCRAMBLE_DISABLE;
@@ -1724,18 +1714,6 @@ intel_dp_set_link_train(struct intel_dp *intel_dp,
                temp &= ~DP_TP_CTL_LINK_TRAIN_MASK;
                switch (dp_train_pat & DP_TRAINING_PATTERN_MASK) {
                case DP_TRAINING_PATTERN_DISABLE:
-                        if (port != PORT_A) {
-                                temp |= DP_TP_CTL_LINK_TRAIN_IDLE;
-                                I915_WRITE(DP_TP_CTL(port), temp);
-                                if (wait_for((I915_READ(DP_TP_STATUS(port)) &
-                                              DP_TP_STATUS_IDLE_DONE), 1))
-                                        DRM_ERROR("Timed out waiting for DP idle patterns\n");
-                                temp &= ~DP_TP_CTL_LINK_TRAIN_MASK;
-                        }
                        temp |= DP_TP_CTL_LINK_TRAIN_NORMAL;
                        break;
@@ -1811,6 +1789,37 @@ intel_dp_set_link_train(struct intel_dp *intel_dp,
        return true;
 }
+static void intel_dp_set_idle_link_train(struct intel_dp *intel_dp)
+{
+        struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
+        struct drm_device *dev = intel_dig_port->base.base.dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        enum port port = intel_dig_port->port;
+        uint32_t val;
+        if (!HAS_DDI(dev))
+                return;
+        val = I915_READ(DP_TP_CTL(port));
+        val &= ~DP_TP_CTL_LINK_TRAIN_MASK;
+        val |= DP_TP_CTL_LINK_TRAIN_IDLE;
+        I915_WRITE(DP_TP_CTL(port), val);
+        /*
+         * On PORT_A we can have only eDP in SST mode. There the only reason
+         * we need to set idle transmission mode is to work around a HW issue
+         * where we enable the pipe while not in idle link-training mode.
+         * In this case there is requirement to wait for a minimum number of
+         * idle patterns to be sent.
+         */
+        if (port == PORT_A)
+                return;
+        if (wait_for((I915_READ(DP_TP_STATUS(port)) & DP_TP_STATUS_IDLE_DONE),
+                     1))
+                DRM_ERROR("Timed out waiting for DP idle patterns\n");
+}
 /* Enable corresponding port and start training pattern 1 */
 void
 intel_dp_start_link_train(struct intel_dp *intel_dp)
@@ -1953,10 +1962,19 @@ intel_dp_complete_link_train(struct intel_dp *intel_dp)
                ++tries;
        }
+        intel_dp_set_idle_link_train(intel_dp);
+        intel_dp->DP = DP;
        if (channel_eq)
                DRM_DEBUG_KMS("Channel EQ done. DP Training successful\n");
-        intel_dp_set_link_train(intel_dp, DP, DP_TRAINING_PATTERN_DISABLE);
+}
+void intel_dp_stop_link_train(struct intel_dp *intel_dp)
+{
+        intel_dp_set_link_train(intel_dp, intel_dp->DP,
+                                DP_TRAINING_PATTERN_DISABLE);
 }
 static void
@@ -2164,6 +2182,7 @@ intel_dp_check_link_status(struct intel_dp *intel_dp)
                              drm_get_encoder_name(&intel_encoder->base));
                intel_dp_start_link_train(intel_dp);
                intel_dp_complete_link_train(intel_dp);
+                intel_dp_stop_link_train(intel_dp);
        }
 }
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index b5b6d19e6dd3..624a9e6b8d71 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -499,6 +499,7 @@ extern void intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
 extern void intel_dp_init_link_config(struct intel_dp *intel_dp);
 extern void intel_dp_start_link_train(struct intel_dp *intel_dp);
 extern void intel_dp_complete_link_train(struct intel_dp *intel_dp);
+extern void intel_dp_stop_link_train(struct intel_dp *intel_dp);
 extern void intel_dp_sink_dpms(struct intel_dp *intel_dp, int mode);
 extern void intel_dp_encoder_destroy(struct drm_encoder *encoder);
 extern void intel_dp_check_link_status(struct intel_dp *intel_dp);
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 0e19e575a1b4..6b7c3ca2c035 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -262,10 +262,22 @@ void intel_fbdev_fini(struct drm_device *dev)
 void intel_fbdev_set_suspend(struct drm_device *dev, int state)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
-        if (!dev_priv->fbdev)
+        struct intel_fbdev *ifbdev = dev_priv->fbdev;
+        struct fb_info *info;
+        if (!ifbdev)
                return;
-        fb_set_suspend(dev_priv->fbdev->helper.fbdev, state);
+        info = ifbdev->helper.fbdev;
+        /* On resume from hibernation: If the object is shmemfs backed, it has
+         * been restored from swap. If the object is stolen however, it will be
+         * full of whatever garbage was left in there.
+         */
+        if (!state && ifbdev->ifb.obj->stolen)
+                memset_io(info->screen_base, 0, info->screen_size);
+        fb_set_suspend(info, state);
 }
 MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index de3b0dc5658b..aa01128ff192 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -1301,17 +1301,17 @@ static void valleyview_update_wm(struct drm_device *dev)
        vlv_update_drain_latency(dev);
-        if (g4x_compute_wm0(dev, 0,
+        if (g4x_compute_wm0(dev, PIPE_A,
                            &valleyview_wm_info, latency_ns,
                            &valleyview_cursor_wm_info, latency_ns,
                            &planea_wm, &cursora_wm))
-                enabled |= 1;
+                enabled |= 1 << PIPE_A;
-        if (g4x_compute_wm0(dev, 1,
+        if (g4x_compute_wm0(dev, PIPE_B,
                            &valleyview_wm_info, latency_ns,
                            &valleyview_cursor_wm_info, latency_ns,
                            &planeb_wm, &cursorb_wm))
-                enabled |= 2;
+                enabled |= 1 << PIPE_B;
        if (single_plane_enabled(enabled) &&
            g4x_compute_srwm(dev, ffs(enabled) - 1,
@@ -1357,17 +1357,17 @@ static void g4x_update_wm(struct drm_device *dev)
        int plane_sr, cursor_sr;
        unsigned int enabled = 0;
-        if (g4x_compute_wm0(dev, 0,
+        if (g4x_compute_wm0(dev, PIPE_A,
                            &g4x_wm_info, latency_ns,
                            &g4x_cursor_wm_info, latency_ns,
                            &planea_wm, &cursora_wm))
-                enabled |= 1;
+                enabled |= 1 << PIPE_A;
-        if (g4x_compute_wm0(dev, 1,
+        if (g4x_compute_wm0(dev, PIPE_B,
                            &g4x_wm_info, latency_ns,
                            &g4x_cursor_wm_info, latency_ns,
                            &planeb_wm, &cursorb_wm))
-                enabled |= 2;
+                enabled |= 1 << PIPE_B;
        if (single_plane_enabled(enabled) &&
            g4x_compute_srwm(dev, ffs(enabled) - 1,
@@ -1716,7 +1716,7 @@ static void ironlake_update_wm(struct drm_device *dev)
        unsigned int enabled;
        enabled = 0;
-        if (g4x_compute_wm0(dev, 0,
+        if (g4x_compute_wm0(dev, PIPE_A,
                            &ironlake_display_wm_info,
                            ILK_LP0_PLANE_LATENCY,
                            &ironlake_cursor_wm_info,
@@ -1727,10 +1727,10 @@ static void ironlake_update_wm(struct drm_device *dev)
                DRM_DEBUG_KMS("FIFO watermarks For pipe A -"
                              " plane %d, " "cursor: %d\n",
                              plane_wm, cursor_wm);
-                enabled |= 1;
+                enabled |= 1 << PIPE_A;
        }
-        if (g4x_compute_wm0(dev, 1,
+        if (g4x_compute_wm0(dev, PIPE_B,
                            &ironlake_display_wm_info,
                            ILK_LP0_PLANE_LATENCY,
                            &ironlake_cursor_wm_info,
@@ -1741,7 +1741,7 @@ static void ironlake_update_wm(struct drm_device *dev)
                DRM_DEBUG_KMS("FIFO watermarks For pipe B -"
                              " plane %d, cursor: %d\n",
                              plane_wm, cursor_wm);
-                enabled |= 2;
+                enabled |= 1 << PIPE_B;
        }
        /*
@@ -1801,7 +1801,7 @@ static void sandybridge_update_wm(struct drm_device *dev)
        unsigned int enabled;
        enabled = 0;
-        if (g4x_compute_wm0(dev, 0,
+        if (g4x_compute_wm0(dev, PIPE_A,
                            &sandybridge_display_wm_info, latency,
                            &sandybridge_cursor_wm_info, latency,
                            &plane_wm, &cursor_wm)) {
@@ -1812,10 +1812,10 @@ static void sandybridge_update_wm(struct drm_device *dev)
                DRM_DEBUG_KMS("FIFO watermarks For pipe A -"
                              " plane %d, " "cursor: %d\n",
                              plane_wm, cursor_wm);
-                enabled |= 1;
+                enabled |= 1 << PIPE_A;
        }
-        if (g4x_compute_wm0(dev, 1,
+        if (g4x_compute_wm0(dev, PIPE_B,
                            &sandybridge_display_wm_info, latency,
                            &sandybridge_cursor_wm_info, latency,
                            &plane_wm, &cursor_wm)) {
@@ -1826,7 +1826,7 @@ static void sandybridge_update_wm(struct drm_device *dev)
                DRM_DEBUG_KMS("FIFO watermarks For pipe B -"
                              " plane %d, cursor: %d\n",
                              plane_wm, cursor_wm);
-                enabled |= 2;
+                enabled |= 1 << PIPE_B;
        }
        /*
@@ -1904,7 +1904,7 @@ static void ivybridge_update_wm(struct drm_device *dev)
        unsigned int enabled;
        enabled = 0;
-        if (g4x_compute_wm0(dev, 0,
+        if (g4x_compute_wm0(dev, PIPE_A,
                            &sandybridge_display_wm_info, latency,
                            &sandybridge_cursor_wm_info, latency,
                            &plane_wm, &cursor_wm)) {
@@ -1915,10 +1915,10 @@ static void ivybridge_update_wm(struct drm_device *dev)
                DRM_DEBUG_KMS("FIFO watermarks For pipe A -"
                              " plane %d, " "cursor: %d\n",
                              plane_wm, cursor_wm);
-                enabled |= 1;
+                enabled |= 1 << PIPE_A;
        }
-        if (g4x_compute_wm0(dev, 1,
+        if (g4x_compute_wm0(dev, PIPE_B,
                            &sandybridge_display_wm_info, latency,
                            &sandybridge_cursor_wm_info, latency,
                            &plane_wm, &cursor_wm)) {
@@ -1929,10 +1929,10 @@ static void ivybridge_update_wm(struct drm_device *dev)
                DRM_DEBUG_KMS("FIFO watermarks For pipe B -"
                              " plane %d, cursor: %d\n",
                              plane_wm, cursor_wm);
-                enabled |= 2;
+                enabled |= 1 << PIPE_B;
        }
-        if (g4x_compute_wm0(dev, 2,
+        if (g4x_compute_wm0(dev, PIPE_C,
                            &sandybridge_display_wm_info, latency,
                            &sandybridge_cursor_wm_info, latency,
                            &plane_wm, &cursor_wm)) {
@@ -1943,7 +1943,7 @@ static void ivybridge_update_wm(struct drm_device *dev)
                DRM_DEBUG_KMS("FIFO watermarks For pipe C -"
                              " plane %d, cursor: %d\n",
                              plane_wm, cursor_wm);
-                enabled |= 3;
+                enabled |= 1 << PIPE_C;
        }
        /*
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index f9889658329b..77b8a45fb10a 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -46,29 +46,26 @@ static void mga_crtc_load_lut(struct drm_crtc *crtc)
 static inline void mga_wait_vsync(struct mga_device *mdev)
 {
-        unsigned int count = 0;
+        unsigned long timeout = jiffies + HZ/10;
        unsigned int status = 0;
        do {
                status = RREG32(MGAREG_Status);
-                count++;
+        } while ((status & 0x08) && time_before(jiffies, timeout));
-        } while ((status & 0x08) && (count < 250000));
+        timeout = jiffies + HZ/10;
-        count = 0;
        status = 0;
        do {
                status = RREG32(MGAREG_Status);
-                count++;
+        } while (!(status & 0x08) && time_before(jiffies, timeout));
-        } while (!(status & 0x08) && (count < 250000));
 }
 static inline void mga_wait_busy(struct mga_device *mdev)
 {
-        unsigned int count = 0;
+        unsigned long timeout = jiffies + HZ;
        unsigned int status = 0;
        do {
                status = RREG8(MGAREG_Status + 2);
-                count++;
+        } while ((status & 0x01) && time_before(jiffies, timeout));
-        } while ((status & 0x01) && (count < 500000));
 }
 /*
@@ -189,12 +186,12 @@ static int mga_g200wb_set_plls(struct mga_device *mdev, long clock)
                WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
                tmp = RREG8(DAC_DATA);
                tmp |= MGA1064_PIX_CLK_CTL_CLK_DIS;
-                WREG_DAC(MGA1064_PIX_CLK_CTL_CLK_DIS, tmp);
+                WREG8(DAC_DATA, tmp);
                WREG8(DAC_INDEX, MGA1064_REMHEADCTL);
                tmp = RREG8(DAC_DATA);
                tmp |= MGA1064_REMHEADCTL_CLKDIS;
-                WREG_DAC(MGA1064_REMHEADCTL, tmp);
+                WREG8(DAC_DATA, tmp);
                /* select PLL Set C */
                tmp = RREG8(MGAREG_MEM_MISC_READ);
@@ -204,7 +201,7 @@ static int mga_g200wb_set_plls(struct mga_device *mdev, long clock)
                WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
                tmp = RREG8(DAC_DATA);
                tmp |= MGA1064_PIX_CLK_CTL_CLK_POW_DOWN | 0x80;
-                WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
+                WREG8(DAC_DATA, tmp);
                udelay(500);
@@ -212,7 +209,7 @@ static int mga_g200wb_set_plls(struct mga_device *mdev, long clock)
                WREG8(DAC_INDEX, MGA1064_VREF_CTL);
                tmp = RREG8(DAC_DATA);
                tmp &= ~0x04;
-                WREG_DAC(MGA1064_VREF_CTL, tmp);
+                WREG8(DAC_DATA, tmp);
                udelay(50);
@@ -236,13 +233,13 @@ static int mga_g200wb_set_plls(struct mga_device *mdev, long clock)
                tmp = RREG8(DAC_DATA);
                tmp &= ~MGA1064_PIX_CLK_CTL_SEL_MSK;
                tmp |= MGA1064_PIX_CLK_CTL_SEL_PLL;
-                WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
+                WREG8(DAC_DATA, tmp);
                WREG8(DAC_INDEX, MGA1064_REMHEADCTL);
                tmp = RREG8(DAC_DATA);
                tmp &= ~MGA1064_REMHEADCTL_CLKSL_MSK;
                tmp |= MGA1064_REMHEADCTL_CLKSL_PLL;
-                WREG_DAC(MGA1064_REMHEADCTL, tmp);
+                WREG8(DAC_DATA, tmp);
                /* reset dotclock rate bit */
                WREG8(MGAREG_SEQ_INDEX, 1);
@@ -253,7 +250,7 @@ static int mga_g200wb_set_plls(struct mga_device *mdev, long clock)
                WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
                tmp = RREG8(DAC_DATA);
                tmp &= ~MGA1064_PIX_CLK_CTL_CLK_DIS;
-                WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
+                WREG8(DAC_DATA, tmp);
                vcount = RREG8(MGAREG_VCOUNT);
@@ -318,7 +315,7 @@ static int mga_g200ev_set_plls(struct mga_device *mdev, long clock)
        WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
        tmp = RREG8(DAC_DATA);
        tmp |= MGA1064_PIX_CLK_CTL_CLK_DIS;
-        WREG_DAC(MGA1064_PIX_CLK_CTL_CLK_DIS, tmp);
+        WREG8(DAC_DATA, tmp);
        tmp = RREG8(MGAREG_MEM_MISC_READ);
        tmp |= 0x3 << 2;
@@ -326,12 +323,12 @@ static int mga_g200ev_set_plls(struct mga_device *mdev, long clock)
        WREG8(DAC_INDEX, MGA1064_PIX_PLL_STAT);
        tmp = RREG8(DAC_DATA);
-        WREG_DAC(MGA1064_PIX_PLL_STAT, tmp & ~0x40);
+        WREG8(DAC_DATA, tmp & ~0x40);
        WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
        tmp = RREG8(DAC_DATA);
        tmp |= MGA1064_PIX_CLK_CTL_CLK_POW_DOWN;
-        WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
+        WREG8(DAC_DATA, tmp);
        WREG_DAC(MGA1064_EV_PIX_PLLC_M, m);
        WREG_DAC(MGA1064_EV_PIX_PLLC_N, n);
@@ -342,7 +339,7 @@ static int mga_g200ev_set_plls(struct mga_device *mdev, long clock)
        WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
        tmp = RREG8(DAC_DATA);
        tmp &= ~MGA1064_PIX_CLK_CTL_CLK_POW_DOWN;
-        WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
+        WREG8(DAC_DATA, tmp);
        udelay(500);
@@ -350,11 +347,11 @@ static int mga_g200ev_set_plls(struct mga_device *mdev, long clock)
        tmp = RREG8(DAC_DATA);
        tmp &= ~MGA1064_PIX_CLK_CTL_SEL_MSK;
        tmp |= MGA1064_PIX_CLK_CTL_SEL_PLL;
-        WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
+        WREG8(DAC_DATA, tmp);
        WREG8(DAC_INDEX, MGA1064_PIX_PLL_STAT);
        tmp = RREG8(DAC_DATA);
-        WREG_DAC(MGA1064_PIX_PLL_STAT, tmp | 0x40);
+        WREG8(DAC_DATA, tmp | 0x40);
        tmp = RREG8(MGAREG_MEM_MISC_READ);
        tmp |= (0x3 << 2);
@@ -363,7 +360,7 @@ static int mga_g200ev_set_plls(struct mga_device *mdev, long clock)
        WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
        tmp = RREG8(DAC_DATA);
        tmp &= ~MGA1064_PIX_CLK_CTL_CLK_DIS;
-        WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
+        WREG8(DAC_DATA, tmp);
        return 0;
 }
@@ -416,7 +413,7 @@ static int mga_g200eh_set_plls(struct mga_device *mdev, long clock)
                WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
                tmp = RREG8(DAC_DATA);
                tmp |= MGA1064_PIX_CLK_CTL_CLK_DIS;
-                WREG_DAC(MGA1064_PIX_CLK_CTL_CLK_DIS, tmp);
+                WREG8(DAC_DATA, tmp);
                tmp = RREG8(MGAREG_MEM_MISC_READ);
                tmp |= 0x3 << 2;
@@ -425,7 +422,7 @@ static int mga_g200eh_set_plls(struct mga_device *mdev, long clock)
                WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
                tmp = RREG8(DAC_DATA);
                tmp |= MGA1064_PIX_CLK_CTL_CLK_POW_DOWN;
-                WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
+                WREG8(DAC_DATA, tmp);
                udelay(500);
@@ -439,13 +436,13 @@ static int mga_g200eh_set_plls(struct mga_device *mdev, long clock)
                tmp = RREG8(DAC_DATA);
                tmp &= ~MGA1064_PIX_CLK_CTL_SEL_MSK;
                tmp |= MGA1064_PIX_CLK_CTL_SEL_PLL;
-                WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
+                WREG8(DAC_DATA, tmp);
                WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
                tmp = RREG8(DAC_DATA);
                tmp &= ~MGA1064_PIX_CLK_CTL_CLK_DIS;
                tmp &= ~MGA1064_PIX_CLK_CTL_CLK_POW_DOWN;
-                WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
+                WREG8(DAC_DATA, tmp);
                vcount = RREG8(MGAREG_VCOUNT);
@@ -515,12 +512,12 @@ static int mga_g200er_set_plls(struct mga_device *mdev, long clock)
        WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
        tmp = RREG8(DAC_DATA);
        tmp |= MGA1064_PIX_CLK_CTL_CLK_DIS;
-        WREG_DAC(MGA1064_PIX_CLK_CTL_CLK_DIS, tmp);
+        WREG8(DAC_DATA, tmp);
        WREG8(DAC_INDEX, MGA1064_REMHEADCTL);
        tmp = RREG8(DAC_DATA);
        tmp |= MGA1064_REMHEADCTL_CLKDIS;
-        WREG_DAC(MGA1064_REMHEADCTL, tmp);
+        WREG8(DAC_DATA, tmp);
        tmp = RREG8(MGAREG_MEM_MISC_READ);
        tmp |= (0x3<<2) | 0xc0;
@@ -530,7 +527,7 @@ static int mga_g200er_set_plls(struct mga_device *mdev, long clock)
        tmp = RREG8(DAC_DATA);
        tmp &= ~MGA1064_PIX_CLK_CTL_CLK_DIS;
        tmp |= MGA1064_PIX_CLK_CTL_CLK_POW_DOWN;
-        WREG_DAC(MGA1064_PIX_CLK_CTL, tmp);
+        WREG8(DAC_DATA, tmp);
        udelay(500);
@@ -657,12 +654,26 @@ static void mga_g200wb_commit(struct drm_crtc *crtc)
        WREG_DAC(MGA1064_GEN_IO_DATA, tmp);
 }
+/*
+   This is how the framebuffer base address is stored in g200 cards:
+   * Assume @offset is the gpu_addr variable of the framebuffer object
+   * Then addr is the number of _pixels_ (not bytes) from the start of
+     VRAM to the first pixel we want to display. (divided by 2 for 32bit
+     framebuffers)
+   * addr is stored in the CRTCEXT0, CRTCC and CRTCD registers
+   addr<20> -> CRTCEXT0<6>
+   addr<19-16> -> CRTCEXT0<3-0>
+   addr<15-8> -> CRTCC<7-0>
+   addr<7-0> -> CRTCD<7-0>
+   CRTCEXT0 has to be programmed last to trigger an update and make the
+   new addr variable take effect.
+ */
 void mga_set_start_address(struct drm_crtc *crtc, unsigned offset)
 {
        struct mga_device *mdev = crtc->dev->dev_private;
        u32 addr;
        int count;
+        u8 crtcext0;
        while (RREG8(0x1fda) & 0x08);
        while (!(RREG8(0x1fda) & 0x08));
@@ -670,10 +681,17 @@ void mga_set_start_address(struct drm_crtc *crtc, unsigned offset)
        count = RREG8(MGAREG_VCOUNT) + 2;
        while (RREG8(MGAREG_VCOUNT) < count);
-        addr = offset >> 2;
+        WREG8(MGAREG_CRTCEXT_INDEX, 0);
+        crtcext0 = RREG8(MGAREG_CRTCEXT_DATA);
+        crtcext0 &= 0xB0;
+        addr = offset / 8;
+        /* Can't store addresses any higher than that...
+           but we also don't have more than 16MB of memory, so it should be fine. */
+        WARN_ON(addr > 0x1fffff);
+        crtcext0 |= (!!(addr & (1<<20)))<<6;
        WREG_CRT(0x0d, (u8)(addr & 0xff));
        WREG_CRT(0x0c, (u8)(addr >> 8) & 0xff);
-        WREG_CRT(0xaf, (u8)(addr >> 16) & 0xf);
+        WREG_ECRT(0x0, ((u8)(addr >> 16) & 0xf) | crtcext0);
 }
@@ -829,11 +847,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
        for (i = 0; i < sizeof(dacvalue); i++) {
-                if ((i <= 0x03) ||
+                if ((i <= 0x17) ||
-                    (i == 0x07) ||
-                    (i == 0x0b) ||
-                    (i == 0x0f) ||
-                    ((i >= 0x13) && (i <= 0x17)) ||
                    (i == 0x1b) ||
                    (i == 0x1c) ||
                    ((i >= 0x1f) && (i <= 0x29)) ||
diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
index 08b0823c93d5..f86771481317 100644
--- a/drivers/gpu/drm/qxl/qxl_cmd.c
+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
@@ -277,7 +277,7 @@ out_unref:
        return 0;
 }
-static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port)
+static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port, bool intr)
 {
        int irq_num;
        long addr = qdev->io_base + port;
@@ -285,20 +285,29 @@ static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port)
        mutex_lock(&qdev->async_io_mutex);
        irq_num = atomic_read(&qdev->irq_received_io_cmd);
        if (qdev->last_sent_io_cmd > irq_num) {
-                ret = wait_event_interruptible(qdev->io_cmd_event,
+                if (intr)
-                                               atomic_read(&qdev->irq_received_io_cmd) > irq_num);
+                        ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
-                if (ret)
+                                                               atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
+                else
+                        ret = wait_event_timeout(qdev->io_cmd_event,
+                                                 atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
+                /* 0 is timeout, just bail the "hw" has gone away */
+                if (ret <= 0)
                        goto out;
                irq_num = atomic_read(&qdev->irq_received_io_cmd);
        }
        outb(val, addr);
        qdev->last_sent_io_cmd = irq_num + 1;
-        ret = wait_event_interruptible(qdev->io_cmd_event,
+        if (intr)
-                                       atomic_read(&qdev->irq_received_io_cmd) > irq_num);
+                ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
+                                                       atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
+        else
+                ret = wait_event_timeout(qdev->io_cmd_event,
+                                         atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
 out:
+        if (ret > 0)
+                ret = 0;
        mutex_unlock(&qdev->async_io_mutex);
        return ret;
 }
@@ -308,7 +317,7 @@ static void wait_for_io_cmd(struct qxl_device *qdev, uint8_t val, long port)
        int ret;
 restart:
-        ret = wait_for_io_cmd_user(qdev, val, port);
+        ret = wait_for_io_cmd_user(qdev, val, port, false);
        if (ret == -ERESTARTSYS)
                goto restart;
 }
@@ -340,7 +349,7 @@ int qxl_io_update_area(struct qxl_device *qdev, struct qxl_bo *surf,
        mutex_lock(&qdev->update_area_mutex);
        qdev->ram_header->update_area = *area;
        qdev->ram_header->update_surface = surface_id;
-        ret = wait_for_io_cmd_user(qdev, 0, QXL_IO_UPDATE_AREA_ASYNC);
+        ret = wait_for_io_cmd_user(qdev, 0, QXL_IO_UPDATE_AREA_ASYNC, true);
        mutex_unlock(&qdev->update_area_mutex);
        return ret;
 }
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index fcfd4436ceed..823d29e926ec 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -428,10 +428,10 @@ static int qxl_framebuffer_surface_dirty(struct drm_framebuffer *fb,
        int inc = 1;
        qobj = gem_to_qxl_bo(qxl_fb->obj);
-        if (qxl_fb != qdev->active_user_framebuffer) {
+        /* if we aren't primary surface ignore this */
-                DRM_INFO("%s: qxl_fb 0x%p != qdev->active_user_framebuffer 0x%p\n",
+        if (!qobj->is_primary)
-                        __func__, qxl_fb, qdev->active_user_framebuffer);
+                return 0;
-        }
        if (!num_clips) {
                num_clips = 1;
                clips = &norect;
@@ -604,7 +604,6 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
                                               mode->hdisplay,
                                               mode->vdisplay);
        }
-        qdev->mode_set = true;
        return 0;
 }
@@ -893,7 +892,6 @@ qxl_user_framebuffer_create(struct drm_device *dev,
 {
        struct drm_gem_object *obj;
        struct qxl_framebuffer *qxl_fb;
-        struct qxl_device *qdev = dev->dev_private;
        int ret;
        obj = drm_gem_object_lookup(dev, file_priv, mode_cmd->handles[0]);
@@ -909,13 +907,6 @@ qxl_user_framebuffer_create(struct drm_device *dev,
                return NULL;
        }
-        if (qdev->active_user_framebuffer) {
-                DRM_INFO("%s: active_user_framebuffer %p -> %p\n",
-                         __func__,
-                         qdev->active_user_framebuffer, qxl_fb);
-        }
-        qdev->active_user_framebuffer = qxl_fb;
        return &qxl_fb->base;
 }
diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
index 52b582c211da..43d06ab28a21 100644
--- a/drivers/gpu/drm/qxl/qxl_drv.h
+++ b/drivers/gpu/drm/qxl/qxl_drv.h
@@ -255,12 +255,6 @@ struct qxl_device {
        struct qxl_gem          gem;
        struct qxl_mode_info mode_info;
-        /*
-         * last created framebuffer with fb_create
-         * only used by debugfs dumbppm
-         */
-        struct qxl_framebuffer *active_user_framebuffer;
        struct fb_info                  *fbdev_info;
        struct qxl_framebuffer  *fbdev_qfb;
        void *ram_physical;
@@ -270,7 +264,6 @@ struct qxl_device {
        struct qxl_ring *cursor_ring;
        struct qxl_ram_header *ram_header;
-        bool mode_set;
        bool primary_created;
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 04b64f9cbfdb..6db7370373ea 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -294,6 +294,7 @@ static int qxl_update_area_ioctl(struct drm_device *dev, void *data,
                goto out;
        if (!qobj->pin_count) {
+                qxl_ttm_placement_from_domain(qobj, qobj->type);
                ret = ttm_bo_validate(&qobj->tbo, &qobj->placement,
                                      true, false);
                if (unlikely(ret))
diff --git a/drivers/gpu/drm/radeon/r300_cmdbuf.c b/drivers/gpu/drm/radeon/r300_cmdbuf.c
index 865e2c9980db..60170ea5e3a2 100644
--- a/drivers/gpu/drm/radeon/r300_cmdbuf.c
+++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c
@@ -75,7 +75,7 @@ static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
                OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));
                for (i = 0; i < nr; ++i) {
-                        if (DRM_COPY_FROM_USER_UNCHECKED
+                        if (DRM_COPY_FROM_USER
                            (&box, &cmdbuf->boxes[n + i], sizeof(box))) {
                                DRM_ERROR("copy cliprect faulted\n");
                                return -EFAULT;
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index d33f484ace48..094e7e5ea39e 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -147,7 +147,7 @@ static inline void radeon_unregister_atpx_handler(void) {}
 #endif
 int radeon_no_wb;
-int radeon_modeset = 1;
+int radeon_modeset = -1;
 int radeon_dynclks = -1;
 int radeon_r4xx_atom = 0;
 int radeon_agpmode = 0;
@@ -456,6 +456,16 @@ static struct pci_driver radeon_kms_pci_driver = {
 static int __init radeon_init(void)
 {
+#ifdef CONFIG_VGA_CONSOLE
+        if (vgacon_text_force() && radeon_modeset == -1) {
+                DRM_INFO("VGACON disable radeon kernel modesetting.\n");
+                radeon_modeset = 0;
+        }
+#endif
+        /* set to modesetting by default if not nomodeset */
+        if (radeon_modeset == -1)
+                radeon_modeset = 1;
        if (radeon_modeset == 1) {
                DRM_INFO("radeon kernel modesetting enabled.\n");
                driver = &kms_driver;
diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
index 699187ab3800..5b9ac32801c7 100644
--- a/drivers/lguest/page_tables.c
+++ b/drivers/lguest/page_tables.c
@@ -1002,6 +1002,7 @@ void guest_set_pgd(struct lguest *lg, unsigned long gpgdir, u32 idx)
                        kill_guest(&lg->cpus[0],
                                   "Cannot populate switcher mapping");
                }
+                lg->pgdirs[pgdir].last_host_cpu = -1;
        }
 }
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 375c109607ff..f4f3038c1df0 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -1130,6 +1130,7 @@ static void mmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
        struct variant_data *variant = host->variant;
        u32 pwr = 0;
        unsigned long flags;
+        int ret;
        pm_runtime_get_sync(mmc_dev(mmc));
@@ -1161,8 +1162,12 @@ static void mmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                break;
        case MMC_POWER_ON:
                if (!IS_ERR(mmc->supply.vqmmc) &&
-                    !regulator_is_enabled(mmc->supply.vqmmc))
+                    !regulator_is_enabled(mmc->supply.vqmmc)) {
-                        regulator_enable(mmc->supply.vqmmc);
+                        ret = regulator_enable(mmc->supply.vqmmc);
+                        if (ret < 0)
+                                dev_err(mmc_dev(mmc),
+                                        "failed to enable vqmmc regulator\n");
+                }
                pwr |= MCI_PWR_ON;
                break;
diff --git a/drivers/net/caif/Kconfig b/drivers/net/caif/Kconfig
index 7ffc756131a2..547098086773 100644
--- a/drivers/net/caif/Kconfig
+++ b/drivers/net/caif/Kconfig
@@ -43,7 +43,7 @@ config CAIF_HSI
 config CAIF_VIRTIO
        tristate "CAIF virtio transport driver"
-        depends on CAIF
+        depends on CAIF && HAS_DMA
        select VHOST_RING
        select VIRTIO
        select GENERIC_ALLOCATOR
diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index de570a8f8967..072c6f14e8fc 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -632,7 +632,6 @@ struct vortex_private {
                pm_state_valid:1,                               /* pci_dev->saved_config_space has sane contents */
                open:1,
                medialock:1,
-                must_free_region:1,                             /* Flag: if zero, Cardbus owns the I/O region */
                large_frames:1,                 /* accept large frames */
                handling_irq:1;                 /* private in_irq indicator */
        /* {get|set}_wol operations are already serialized by rtnl.
@@ -1012,6 +1011,12 @@ static int vortex_init_one(struct pci_dev *pdev,
        if (rc < 0)
                goto out;
+        rc = pci_request_regions(pdev, DRV_NAME);
+        if (rc < 0) {
+                pci_disable_device(pdev);
+                goto out;
+        }
        unit = vortex_cards_found;
        if (global_use_mmio < 0 && (unit >= MAX_UNITS || use_mmio[unit] < 0)) {
@@ -1027,6 +1032,7 @@ static int vortex_init_one(struct pci_dev *pdev,
        if (!ioaddr) /* If mapping fails, fall-back to BAR 0... */
                ioaddr = pci_iomap(pdev, 0, 0);
        if (!ioaddr) {
+                pci_release_regions(pdev);
                pci_disable_device(pdev);
                rc = -ENOMEM;
                goto out;
@@ -1036,6 +1042,7 @@ static int vortex_init_one(struct pci_dev *pdev,
                           ent->driver_data, unit);
        if (rc < 0) {
                pci_iounmap(pdev, ioaddr);
+                pci_release_regions(pdev);
                pci_disable_device(pdev);
                goto out;
        }
@@ -1178,11 +1185,6 @@ static int vortex_probe1(struct device *gendev, void __iomem *ioaddr, int irq,
        /* PCI-only startup logic */
        if (pdev) {
-                /* EISA resources already marked, so only PCI needs to do this here */
-                /* Ignore return value, because Cardbus drivers already allocate for us */
-                if (request_region(dev->base_addr, vci->io_size, print_name) != NULL)
-                        vp->must_free_region = 1;
                /* enable bus-mastering if necessary */
                if (vci->flags & PCI_USES_MASTER)
                        pci_set_master(pdev);
@@ -1220,7 +1222,7 @@ static int vortex_probe1(struct device *gendev, void __iomem *ioaddr, int irq,
                                           &vp->rx_ring_dma);
        retval = -ENOMEM;
        if (!vp->rx_ring)
-                goto free_region;
+                goto free_device;
        vp->tx_ring = (struct boom_tx_desc *)(vp->rx_ring + RX_RING_SIZE);
        vp->tx_ring_dma = vp->rx_ring_dma + sizeof(struct boom_rx_desc) * RX_RING_SIZE;
@@ -1484,9 +1486,7 @@ free_ring:
                                                        + sizeof(struct boom_tx_desc) * TX_RING_SIZE,
                                                vp->rx_ring,
                                                vp->rx_ring_dma);
-free_region:
+free_device:
-        if (vp->must_free_region)
-                release_region(dev->base_addr, vci->io_size);
        free_netdev(dev);
        pr_err(PFX "vortex_probe1 fails.  Returns %d\n", retval);
 out:
@@ -3254,8 +3254,9 @@ static void vortex_remove_one(struct pci_dev *pdev)
                                                        + sizeof(struct boom_tx_desc) * TX_RING_SIZE,
                                                vp->rx_ring,
                                                vp->rx_ring_dma);
-        if (vp->must_free_region)
-                release_region(dev->base_addr, vp->io_size);
+        pci_release_regions(pdev);
        free_netdev(dev);
 }
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index ce4a030d3d0c..07f7ef05c3f2 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -3236,9 +3236,10 @@ bnad_init(struct bnad *bnad,
        sprintf(bnad->wq_name, "%s_wq_%d", BNAD_NAME, bnad->id);
        bnad->work_q = create_singlethread_workqueue(bnad->wq_name);
+        if (!bnad->work_q) {
-        if (!bnad->work_q)
+                iounmap(bnad->bar0);
                return -ENOMEM;
+        }
        return 0;
 }
diff --git a/drivers/net/ethernet/cadence/Kconfig b/drivers/net/ethernet/cadence/Kconfig
index 1194446f859a..768285ec10f4 100644
--- a/drivers/net/ethernet/cadence/Kconfig
+++ b/drivers/net/ethernet/cadence/Kconfig
@@ -22,7 +22,7 @@ if NET_CADENCE
 config ARM_AT91_ETHER
        tristate "AT91RM9200 Ethernet support"
-        depends on GENERIC_HARDIRQS
+        depends on GENERIC_HARDIRQS && HAS_DMA
        select NET_CORE
        select MACB
        ---help---
@@ -31,6 +31,7 @@ config ARM_AT91_ETHER
 config MACB
        tristate "Cadence MACB/GEM support"
+        depends on HAS_DMA
        select PHYLIB
        ---help---
          The Cadence MACB ethernet interface is found on many Atmel AT32 and
diff --git a/drivers/net/ethernet/calxeda/Kconfig b/drivers/net/ethernet/calxeda/Kconfig
index aba435c3d4ae..184a063bed5f 100644
--- a/drivers/net/ethernet/calxeda/Kconfig
+++ b/drivers/net/ethernet/calxeda/Kconfig
@@ -1,6 +1,6 @@
 config NET_CALXEDA_XGMAC
        tristate "Calxeda 1G/10G XGMAC Ethernet driver"
-        depends on HAS_IOMEM
+        depends on HAS_IOMEM && HAS_DMA
        select CRC32
        help
          This is the driver for the XGMAC Ethernet IP block found on Calxeda
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index aff0310a778b..ca9825ca88c9 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -87,6 +87,8 @@
 #define FEC_QUIRK_HAS_GBIT              (1 << 3)
 /* Controller has extend desc buffer */
 #define FEC_QUIRK_HAS_BUFDESC_EX        (1 << 4)
+/* Controller has hardware checksum support */
+#define FEC_QUIRK_HAS_CSUM              (1 << 5)
 static struct platform_device_id fec_devtype[] = {
        {
@@ -105,7 +107,7 @@ static struct platform_device_id fec_devtype[] = {
        }, {
                .name = "imx6q-fec",
                .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
-                                FEC_QUIRK_HAS_BUFDESC_EX,
+                                FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM,
        }, {
                .name = "mvf-fec",
                .driver_data = FEC_QUIRK_ENET_MAC,
@@ -1744,6 +1746,8 @@ static const struct net_device_ops fec_netdev_ops = {
 static int fec_enet_init(struct net_device *ndev)
 {
        struct fec_enet_private *fep = netdev_priv(ndev);
+        const struct platform_device_id *id_entry =
+                                platform_get_device_id(fep->pdev);
        struct bufdesc *cbd_base;
        /* Allocate memory for buffer descriptors. */
@@ -1775,12 +1779,14 @@ static int fec_enet_init(struct net_device *ndev)
        writel(FEC_RX_DISABLED_IMASK, fep->hwp + FEC_IMASK);
        netif_napi_add(ndev, &fep->napi, fec_enet_rx_napi, FEC_NAPI_WEIGHT);
-        /* enable hw accelerator */
+        if (id_entry->driver_data & FEC_QUIRK_HAS_CSUM) {
-        ndev->features |= (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM
+                /* enable hw accelerator */
-                        | NETIF_F_RXCSUM);
+                ndev->features |= (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM
-        ndev->hw_features |= (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM
+                                | NETIF_F_RXCSUM);
-                        | NETIF_F_RXCSUM);
+                ndev->hw_features |= (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM
-        fep->csum_flags |= FLAG_RX_CSUM_ENABLED;
+                                | NETIF_F_RXCSUM);
+                fep->csum_flags |= FLAG_RX_CSUM_ENABLED;
+        }
        fec_restart(ndev, 0);
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 4989481c19f0..d300a0c0eafc 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -359,10 +359,26 @@ static int emac_reset(struct emac_instance *dev)
        }
 #ifdef CONFIG_PPC_DCR_NATIVE
-        /* Enable internal clock source */
+        /*
-        if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX))
+         * PPC460EX/GT Embedded Processor Advanced User's Manual
-                dcri_clrset(SDR0, SDR0_ETH_CFG,
+         * section 28.10.1 Mode Register 0 (EMACx_MR0) states:
-                            0, SDR0_ETH_CFG_ECS << dev->cell_index);
+         * Note: The PHY must provide a TX Clk in order to perform a soft reset
+         * of the EMAC. If none is present, select the internal clock
+         * (SDR0_ETH_CFG[EMACx_PHY_CLK] = 1).
+         * After a soft reset, select the external clock.
+         */
+        if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
+                if (dev->phy_address == 0xffffffff &&
+                    dev->phy_map == 0xffffffff) {
+                        /* No PHY: select internal loop clock before reset */
+                        dcri_clrset(SDR0, SDR0_ETH_CFG,
+                                    0, SDR0_ETH_CFG_ECS << dev->cell_index);
+                } else {
+                        /* PHY present: select external clock before reset */
+                        dcri_clrset(SDR0, SDR0_ETH_CFG,
+                                    SDR0_ETH_CFG_ECS << dev->cell_index, 0);
+                }
+        }
 #endif
        out_be32(&p->mr0, EMAC_MR0_SRST);
@@ -370,10 +386,14 @@ static int emac_reset(struct emac_instance *dev)
                --n;
 #ifdef CONFIG_PPC_DCR_NATIVE
-         /* Enable external clock source */
+        if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
-        if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX))
+                if (dev->phy_address == 0xffffffff &&
-                dcri_clrset(SDR0, SDR0_ETH_CFG,
+                    dev->phy_map == 0xffffffff) {
-                            SDR0_ETH_CFG_ECS << dev->cell_index, 0);
+                        /* No PHY: restore external clock source after reset */
+                        dcri_clrset(SDR0, SDR0_ETH_CFG,
+                                    SDR0_ETH_CFG_ECS << dev->cell_index, 0);
+                }
+        }
 #endif
        if (n) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_resources.c b/drivers/net/ethernet/mellanox/mlx4/en_resources.c
index 91f2b2c43c12..d3f508697a3d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_resources.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_resources.c
@@ -60,7 +60,7 @@ void mlx4_en_fill_qp_context(struct mlx4_en_priv *priv, int size, int stride,
        context->pri_path.sched_queue = 0x83 | (priv->port - 1) << 6;
        if (user_prio >= 0) {
                context->pri_path.sched_queue |= user_prio << 3;
-                context->pri_path.feup = 1 << 6;
+                context->pri_path.feup = MLX4_FEUP_FORCE_ETH_UP;
        }
        context->pri_path.counter_index = 0xff;
        context->cqn_send = cpu_to_be32(cqn);
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index b147bdd40768..58a8e535d698 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -131,7 +131,9 @@ static void dump_dev_cap_flags2(struct mlx4_dev *dev, u64 flags)
                [2] = "RSS XOR Hash Function support",
                [3] = "Device manage flow steering support",
                [4] = "Automatic MAC reassignment support",
-                [5] = "Time stamping support"
+                [5] = "Time stamping support",
+                [6] = "VST (control vlan insertion/stripping) support",
+                [7] = "FSM (MAC anti-spoofing) support"
        };
        int i;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index e12e0d2e0ee0..1157f028a90f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -372,24 +372,29 @@ static int update_vport_qp_param(struct mlx4_dev *dev,
                if (MLX4_QP_ST_RC == qp_type)
                        return -EINVAL;
+                /* force strip vlan by clear vsd */
+                qpc->param3 &= ~cpu_to_be32(MLX4_STRIP_VLAN);
+                if (0 != vp_oper->state.default_vlan) {
+                        qpc->pri_path.vlan_control =
+                                MLX4_VLAN_CTRL_ETH_TX_BLOCK_TAGGED |
+                                MLX4_VLAN_CTRL_ETH_RX_BLOCK_PRIO_TAGGED |
+                                MLX4_VLAN_CTRL_ETH_RX_BLOCK_UNTAGGED;
+                } else { /* priority tagged */
+                        qpc->pri_path.vlan_control =
+                                MLX4_VLAN_CTRL_ETH_TX_BLOCK_TAGGED |
+                                MLX4_VLAN_CTRL_ETH_RX_BLOCK_TAGGED;
+                }
+                qpc->pri_path.fvl_rx |= MLX4_FVL_RX_FORCE_ETH_VLAN;
                qpc->pri_path.vlan_index = vp_oper->vlan_idx;
-                qpc->pri_path.fl = (1 << 6) | (1 << 2); /* set cv bit and hide_cqe_vlan bit*/
+                qpc->pri_path.fl |= MLX4_FL_CV | MLX4_FL_ETH_HIDE_CQE_VLAN;
-                qpc->pri_path.feup |= 1 << 3; /* set fvl bit */
+                qpc->pri_path.feup |= MLX4_FEUP_FORCE_ETH_UP | MLX4_FVL_FORCE_ETH_VLAN;
                qpc->pri_path.sched_queue &= 0xC7;
                qpc->pri_path.sched_queue |= (vp_oper->state.default_qos) << 3;
-                mlx4_dbg(dev, "qp %d  port %d Q 0x%x set vlan to %d vidx %d feup %x fl %x\n",
-                         be32_to_cpu(qpc->local_qpn) & 0xffffff, port,
-                         (int)(qpc->pri_path.sched_queue), vp_oper->state.default_vlan,
-                         vp_oper->vlan_idx, (int)(qpc->pri_path.feup),
-                         (int)(qpc->pri_path.fl));
        }
        if (vp_oper->state.spoofchk) {
-                qpc->pri_path.feup |= 1 << 5; /* set fsm bit */;
+                qpc->pri_path.feup |= MLX4_FSM_FORCE_ETH_SRC_MAC;
                qpc->pri_path.grh_mylmc = (0x80 & qpc->pri_path.grh_mylmc) + vp_oper->mac_idx;
-                mlx4_dbg(dev, "spoof qp %d  port %d feup  0x%x, myLmc 0x%x mindx %d\n",
-                         be32_to_cpu(qpc->local_qpn) & 0xffffff, port,
-                         (int)qpc->pri_path.feup, (int)qpc->pri_path.grh_mylmc,
-                         vp_oper->mac_idx);
        }
        return 0;
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 90c253b145ef..019c5f78732e 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -429,6 +429,7 @@ struct qlcnic_hardware_context {
        u16 port_type;
        u16 board_type;
+        u16 supported_type;
        u16 link_speed;
        u16 link_duplex;
@@ -1514,6 +1515,7 @@ void qlcnic_create_diag_entries(struct qlcnic_adapter *adapter);
 void qlcnic_remove_diag_entries(struct qlcnic_adapter *adapter);
 void qlcnic_82xx_add_sysfs(struct qlcnic_adapter *adapter);
 void qlcnic_82xx_remove_sysfs(struct qlcnic_adapter *adapter);
+int qlcnic_82xx_get_settings(struct qlcnic_adapter *, struct ethtool_cmd *);
 int qlcnicvf_config_bridged_mode(struct qlcnic_adapter *, u32);
 int qlcnicvf_config_led(struct qlcnic_adapter *, u32, u32);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index ea790a93ee7c..b4ff1e35a11d 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -696,15 +696,14 @@ u32 qlcnic_83xx_mac_rcode(struct qlcnic_adapter *adapter)
        return 1;
 }
-u32 qlcnic_83xx_mbx_poll(struct qlcnic_adapter *adapter)
+u32 qlcnic_83xx_mbx_poll(struct qlcnic_adapter *adapter, u32 *wait_time)
 {
        u32 data;
-        unsigned long wait_time = 0;
        struct qlcnic_hardware_context *ahw = adapter->ahw;
        /* wait for mailbox completion */
        do {
                data = QLCRDX(ahw, QLCNIC_FW_MBX_CTRL);
-                if (++wait_time > QLCNIC_MBX_TIMEOUT) {
+                if (++(*wait_time) > QLCNIC_MBX_TIMEOUT) {
                        data = QLCNIC_RCODE_TIMEOUT;
                        break;
                }
@@ -720,8 +719,8 @@ int qlcnic_83xx_mbx_op(struct qlcnic_adapter *adapter,
        u16 opcode;
        u8 mbx_err_code;
        unsigned long flags;
-        u32 rsp, mbx_val, fw_data, rsp_num, mbx_cmd;
        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        u32 rsp, mbx_val, fw_data, rsp_num, mbx_cmd, wait_time = 0;
        opcode = LSW(cmd->req.arg[0]);
        if (!test_bit(QLC_83XX_MBX_READY, &adapter->ahw->idc.status)) {
@@ -754,15 +753,13 @@ int qlcnic_83xx_mbx_op(struct qlcnic_adapter *adapter,
        /* Signal FW about the impending command */
        QLCWRX(ahw, QLCNIC_HOST_MBX_CTRL, QLCNIC_SET_OWNER);
 poll:
-        rsp = qlcnic_83xx_mbx_poll(adapter);
+        rsp = qlcnic_83xx_mbx_poll(adapter, &wait_time);
        if (rsp != QLCNIC_RCODE_TIMEOUT) {
                /* Get the FW response data */
                fw_data = readl(QLCNIC_MBX_FW(ahw, 0));
                if (fw_data &  QLCNIC_MBX_ASYNC_EVENT) {
                        __qlcnic_83xx_process_aen(adapter);
-                        mbx_val = QLCRDX(ahw, QLCNIC_HOST_MBX_CTRL);
+                        goto poll;
-                        if (mbx_val)
-                                goto poll;
                }
                mbx_err_code = QLCNIC_MBX_STATUS(fw_data);
                rsp_num = QLCNIC_MBX_NUM_REGS(fw_data);
@@ -1276,11 +1273,13 @@ out:
        return err;
 }
-static int qlcnic_83xx_diag_alloc_res(struct net_device *netdev, int test)
+static int qlcnic_83xx_diag_alloc_res(struct net_device *netdev, int test,
+                                      int num_sds_ring)
 {
        struct qlcnic_adapter *adapter = netdev_priv(netdev);
        struct qlcnic_host_sds_ring *sds_ring;
        struct qlcnic_host_rds_ring *rds_ring;
+        u16 adapter_state = adapter->is_up;
        u8 ring;
        int ret;
@@ -1304,6 +1303,10 @@ static int qlcnic_83xx_diag_alloc_res(struct net_device *netdev, int test)
        ret = qlcnic_fw_create_ctx(adapter);
        if (ret) {
                qlcnic_detach(adapter);
+                if (adapter_state == QLCNIC_ADAPTER_UP_MAGIC) {
+                        adapter->max_sds_rings = num_sds_ring;
+                        qlcnic_attach(adapter);
+                }
                netif_device_attach(netdev);
                return ret;
        }
@@ -1596,7 +1599,8 @@ int qlcnic_83xx_loopback_test(struct net_device *netdev, u8 mode)
        if (test_and_set_bit(__QLCNIC_RESETTING, &adapter->state))
                return -EBUSY;
-        ret = qlcnic_83xx_diag_alloc_res(netdev, QLCNIC_LOOPBACK_TEST);
+        ret = qlcnic_83xx_diag_alloc_res(netdev, QLCNIC_LOOPBACK_TEST,
+                                         max_sds_rings);
        if (ret)
                goto fail_diag_alloc;
@@ -2830,6 +2834,23 @@ int qlcnic_83xx_test_link(struct qlcnic_adapter *adapter)
                        break;
                }
                config = cmd.rsp.arg[3];
+                if (QLC_83XX_SFP_PRESENT(config)) {
+                        switch (ahw->module_type) {
+                        case LINKEVENT_MODULE_OPTICAL_UNKNOWN:
+                        case LINKEVENT_MODULE_OPTICAL_SRLR:
+                        case LINKEVENT_MODULE_OPTICAL_LRM:
+                        case LINKEVENT_MODULE_OPTICAL_SFP_1G:
+                                ahw->supported_type = PORT_FIBRE;
+                                break;
+                        case LINKEVENT_MODULE_TWINAX_UNSUPPORTED_CABLE:
+                        case LINKEVENT_MODULE_TWINAX_UNSUPPORTED_CABLELEN:
+                        case LINKEVENT_MODULE_TWINAX:
+                                ahw->supported_type = PORT_TP;
+                                break;
+                        default:
+                                ahw->supported_type = PORT_OTHER;
+                        }
+                }
                if (config & 1)
                        err = 1;
        }
@@ -2838,7 +2859,8 @@ out:
        return config;
 }
-int qlcnic_83xx_get_settings(struct qlcnic_adapter *adapter)
+int qlcnic_83xx_get_settings(struct qlcnic_adapter *adapter,
+                             struct ethtool_cmd *ecmd)
 {
        u32 config = 0;
        int status = 0;
@@ -2851,6 +2873,54 @@ int qlcnic_83xx_get_settings(struct qlcnic_adapter *adapter)
        ahw->module_type = QLC_83XX_SFP_MODULE_TYPE(config);
        /* hard code until there is a way to get it from flash */
        ahw->board_type = QLCNIC_BRDTYPE_83XX_10G;
+        if (netif_running(adapter->netdev) && ahw->has_link_events) {
+                ethtool_cmd_speed_set(ecmd, ahw->link_speed);
+                ecmd->duplex = ahw->link_duplex;
+                ecmd->autoneg = ahw->link_autoneg;
+        } else {
+                ethtool_cmd_speed_set(ecmd, SPEED_UNKNOWN);
+                ecmd->duplex = DUPLEX_UNKNOWN;
+                ecmd->autoneg = AUTONEG_DISABLE;
+        }
+        if (ahw->port_type == QLCNIC_XGBE) {
+                ecmd->supported = SUPPORTED_1000baseT_Full;
+                ecmd->advertising = ADVERTISED_1000baseT_Full;
+        } else {
+                ecmd->supported = (SUPPORTED_10baseT_Half |
+                                   SUPPORTED_10baseT_Full |
+                                   SUPPORTED_100baseT_Half |
+                                   SUPPORTED_100baseT_Full |
+                                   SUPPORTED_1000baseT_Half |
+                                   SUPPORTED_1000baseT_Full);
+                ecmd->advertising = (ADVERTISED_100baseT_Half |
+                                     ADVERTISED_100baseT_Full |
+                                     ADVERTISED_1000baseT_Half |
+                                     ADVERTISED_1000baseT_Full);
+        }
+        switch (ahw->supported_type) {
+        case PORT_FIBRE:
+                ecmd->supported |= SUPPORTED_FIBRE;
+                ecmd->advertising |= ADVERTISED_FIBRE;
+                ecmd->port = PORT_FIBRE;
+                ecmd->transceiver = XCVR_EXTERNAL;
+                break;
+        case PORT_TP:
+                ecmd->supported |= SUPPORTED_TP;
+                ecmd->advertising |= ADVERTISED_TP;
+                ecmd->port = PORT_TP;
+                ecmd->transceiver = XCVR_INTERNAL;
+                break;
+        default:
+                ecmd->supported |= SUPPORTED_FIBRE;
+                ecmd->advertising |= ADVERTISED_FIBRE;
+                ecmd->port = PORT_OTHER;
+                ecmd->transceiver = XCVR_EXTERNAL;
+                break;
+        }
+        ecmd->phy_address = ahw->physical_port;
        return status;
 }
@@ -3046,7 +3116,8 @@ int qlcnic_83xx_interrupt_test(struct net_device *netdev)
        if (test_and_set_bit(__QLCNIC_RESETTING, &adapter->state))
                return -EIO;
-        ret = qlcnic_83xx_diag_alloc_res(netdev, QLCNIC_INTERRUPT_TEST);
+        ret = qlcnic_83xx_diag_alloc_res(netdev, QLCNIC_INTERRUPT_TEST,
+                                         max_sds_rings);
        if (ret)
                goto fail_diag_irq;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
index 1f1d85e6f2af..f5db67fc9f55 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
@@ -603,7 +603,7 @@ int qlcnic_83xx_get_vnic_pf_info(struct qlcnic_adapter *, struct qlcnic_info *);
 void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *);
 void qlcnic_83xx_get_stats(struct qlcnic_adapter *adapter, u64 *data);
-int qlcnic_83xx_get_settings(struct qlcnic_adapter *);
+int qlcnic_83xx_get_settings(struct qlcnic_adapter *, struct ethtool_cmd *);
 int qlcnic_83xx_set_settings(struct qlcnic_adapter *, struct ethtool_cmd *);
 void qlcnic_83xx_get_pauseparam(struct qlcnic_adapter *,
                                struct ethtool_pauseparam *);
@@ -620,7 +620,7 @@ int qlcnic_83xx_flash_test(struct qlcnic_adapter *);
 int qlcnic_83xx_enable_flash_write(struct qlcnic_adapter *);
 int qlcnic_83xx_disable_flash_write(struct qlcnic_adapter *);
 u32 qlcnic_83xx_mac_rcode(struct qlcnic_adapter *);
-u32 qlcnic_83xx_mbx_poll(struct qlcnic_adapter *);
+u32 qlcnic_83xx_mbx_poll(struct qlcnic_adapter *, u32 *);
 void qlcnic_83xx_enable_mbx_poll(struct qlcnic_adapter *);
 void qlcnic_83xx_disable_mbx_poll(struct qlcnic_adapter *);
 #endif
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index ab1d8d99cbd5..c67d1eb35e8f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -435,10 +435,6 @@ static void qlcnic_83xx_idc_attach_driver(struct qlcnic_adapter *adapter)
        }
 done:
        netif_device_attach(netdev);
-        if (netif_running(netdev)) {
-                netif_carrier_on(netdev);
-                netif_wake_queue(netdev);
-        }
 }
 static int qlcnic_83xx_idc_enter_failed_state(struct qlcnic_adapter *adapter,
@@ -642,15 +638,21 @@ static int qlcnic_83xx_idc_reattach_driver(struct qlcnic_adapter *adapter)
 static void qlcnic_83xx_idc_update_idc_params(struct qlcnic_adapter *adapter)
 {
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
        qlcnic_83xx_idc_update_drv_presence_reg(adapter, 1, 1);
-        clear_bit(__QLCNIC_RESETTING, &adapter->state);
        set_bit(QLC_83XX_MBX_READY, &adapter->ahw->idc.status);
        qlcnic_83xx_idc_update_audit_reg(adapter, 0, 1);
        set_bit(QLC_83XX_MODULE_LOADED, &adapter->ahw->idc.status);
-        adapter->ahw->idc.quiesce_req = 0;
-        adapter->ahw->idc.delay = QLC_83XX_IDC_FW_POLL_DELAY;
+        ahw->idc.quiesce_req = 0;
-        adapter->ahw->idc.err_code = 0;
+        ahw->idc.delay = QLC_83XX_IDC_FW_POLL_DELAY;
-        adapter->ahw->idc.collect_dump = 0;
+        ahw->idc.err_code = 0;
+        ahw->idc.collect_dump = 0;
+        ahw->reset_context = 0;
+        adapter->tx_timeo_cnt = 0;
+        clear_bit(__QLCNIC_RESETTING, &adapter->state);
 }
 /**
@@ -851,6 +853,7 @@ static int qlcnic_83xx_idc_ready_state(struct qlcnic_adapter *adapter)
        /* Check for soft reset request */
        if (ahw->reset_context &&
            !(val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY)) {
+                adapter->ahw->reset_context = 0;
                qlcnic_83xx_idc_tx_soft_reset(adapter);
                return ret;
        }
@@ -914,6 +917,7 @@ static int qlcnic_83xx_idc_need_quiesce_state(struct qlcnic_adapter *adapter)
 static int qlcnic_83xx_idc_failed_state(struct qlcnic_adapter *adapter)
 {
        dev_err(&adapter->pdev->dev, "%s: please restart!!\n", __func__);
+        clear_bit(__QLCNIC_RESETTING, &adapter->state);
        adapter->ahw->idc.err_code = -EIO;
        return 0;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 08efb4635007..f67652de5a63 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -131,12 +131,13 @@ static const char qlcnic_83xx_rx_stats_strings[][ETH_GSTRING_LEN] = {
        "ctx_lro_pkt_cnt",
        "ctx_ip_csum_error",
        "ctx_rx_pkts_wo_ctx",
-        "ctx_rx_pkts_dropped_wo_sts",
+        "ctx_rx_pkts_drop_wo_sds_on_card",
+        "ctx_rx_pkts_drop_wo_sds_on_host",
        "ctx_rx_osized_pkts",
        "ctx_rx_pkts_dropped_wo_rds",
        "ctx_rx_unexpected_mcast_pkts",
        "ctx_invalid_mac_address",
-        "ctx_rx_rds_ring_prim_attemoted",
+        "ctx_rx_rds_ring_prim_attempted",
        "ctx_rx_rds_ring_prim_success",
        "ctx_num_lro_flows_added",
        "ctx_num_lro_flows_removed",
@@ -251,6 +252,18 @@ static int
 qlcnic_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
 {
        struct qlcnic_adapter *adapter = netdev_priv(dev);
+        if (qlcnic_82xx_check(adapter))
+                return qlcnic_82xx_get_settings(adapter, ecmd);
+        else if (qlcnic_83xx_check(adapter))
+                return qlcnic_83xx_get_settings(adapter, ecmd);
+        return -EIO;
+}
+int qlcnic_82xx_get_settings(struct qlcnic_adapter *adapter,
+                             struct ethtool_cmd *ecmd)
+{
        struct qlcnic_hardware_context *ahw = adapter->ahw;
        u32 speed, reg;
        int check_sfp_module = 0;
@@ -276,10 +289,7 @@ qlcnic_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
        } else if (adapter->ahw->port_type == QLCNIC_XGBE) {
                u32 val = 0;
-                if (qlcnic_83xx_check(adapter))
+                val = QLCRD32(adapter, QLCNIC_PORT_MODE_ADDR);
-                        qlcnic_83xx_get_settings(adapter);
-                else
-                        val = QLCRD32(adapter, QLCNIC_PORT_MODE_ADDR);
                if (val == QLCNIC_PORT_MODE_802_3_AP) {
                        ecmd->supported = SUPPORTED_1000baseT_Full;
@@ -289,16 +299,13 @@ qlcnic_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
                        ecmd->advertising = ADVERTISED_10000baseT_Full;
                }
-                if (netif_running(dev) && adapter->ahw->has_link_events) {
+                if (netif_running(adapter->netdev) && ahw->has_link_events) {
-                        if (qlcnic_82xx_check(adapter)) {
+                        reg = QLCRD32(adapter, P3P_LINK_SPEED_REG(pcifn));
-                                reg = QLCRD32(adapter,
+                        speed = P3P_LINK_SPEED_VAL(pcifn, reg);
-                                              P3P_LINK_SPEED_REG(pcifn));
+                        ahw->link_speed = speed * P3P_LINK_SPEED_MHZ;
-                                speed = P3P_LINK_SPEED_VAL(pcifn, reg);
+                        ethtool_cmd_speed_set(ecmd, ahw->link_speed);
-                                ahw->link_speed = speed * P3P_LINK_SPEED_MHZ;
+                        ecmd->autoneg = ahw->link_autoneg;
-                        }
+                        ecmd->duplex = ahw->link_duplex;
-                        ethtool_cmd_speed_set(ecmd, adapter->ahw->link_speed);
-                        ecmd->autoneg = adapter->ahw->link_autoneg;
-                        ecmd->duplex = adapter->ahw->link_duplex;
                        goto skip;
                }
@@ -340,8 +347,8 @@ skip:
        case QLCNIC_BRDTYPE_P3P_10G_SFP_QT:
                ecmd->advertising |= ADVERTISED_TP;
                ecmd->supported |= SUPPORTED_TP;
-                check_sfp_module = netif_running(dev) &&
+                check_sfp_module = netif_running(adapter->netdev) &&
-                                   adapter->ahw->has_link_events;
+                                   ahw->has_link_events;
        case QLCNIC_BRDTYPE_P3P_10G_XFP:
                ecmd->supported |= SUPPORTED_FIBRE;
                ecmd->advertising |= ADVERTISED_FIBRE;
@@ -355,8 +362,8 @@ skip:
                        ecmd->advertising |=
                                (ADVERTISED_FIBRE | ADVERTISED_TP);
                        ecmd->port = PORT_FIBRE;
-                        check_sfp_module = netif_running(dev) &&
+                        check_sfp_module = netif_running(adapter->netdev) &&
-                                           adapter->ahw->has_link_events;
+                                           ahw->has_link_events;
                } else {
                        ecmd->autoneg = AUTONEG_ENABLE;
                        ecmd->supported |= (SUPPORTED_TP | SUPPORTED_Autoneg);
@@ -365,13 +372,6 @@ skip:
                        ecmd->port = PORT_TP;
                }
                break;
-        case QLCNIC_BRDTYPE_83XX_10G:
-                ecmd->autoneg = AUTONEG_DISABLE;
-                ecmd->supported |= (SUPPORTED_FIBRE | SUPPORTED_TP);
-                ecmd->advertising |= (ADVERTISED_FIBRE | ADVERTISED_TP);
-                ecmd->port = PORT_FIBRE;
-                check_sfp_module = netif_running(dev) && ahw->has_link_events;
-                break;
        default:
                dev_err(&adapter->pdev->dev, "Unsupported board model %d\n",
                        adapter->ahw->board_type);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h
index 95b1b5732838..b6818f4356b9 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h
@@ -134,7 +134,7 @@ struct qlcnic_mailbox_metadata {
 #define QLCNIC_SET_OWNER        1
 #define QLCNIC_CLR_OWNER        0
-#define QLCNIC_MBX_TIMEOUT      10000
+#define QLCNIC_MBX_TIMEOUT      5000
 #define QLCNIC_MBX_RSP_OK       1
 #define QLCNIC_MBX_PORT_RSP_OK  0x1a
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 264d5a4f8153..8fb836d4129f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -37,24 +37,24 @@ MODULE_PARM_DESC(qlcnic_mac_learn,
                 "Mac Filter (0=learning is disabled, 1=Driver learning is enabled, 2=FDB learning is enabled)");
 int qlcnic_use_msi = 1;
-MODULE_PARM_DESC(use_msi, "MSI interrupt (0=disabled, 1=enabled");
+MODULE_PARM_DESC(use_msi, "MSI interrupt (0=disabled, 1=enabled)");
 module_param_named(use_msi, qlcnic_use_msi, int, 0444);
 int qlcnic_use_msi_x = 1;
-MODULE_PARM_DESC(use_msi_x, "MSI-X interrupt (0=disabled, 1=enabled");
+MODULE_PARM_DESC(use_msi_x, "MSI-X interrupt (0=disabled, 1=enabled)");
 module_param_named(use_msi_x, qlcnic_use_msi_x, int, 0444);
 int qlcnic_auto_fw_reset = 1;
-MODULE_PARM_DESC(auto_fw_reset, "Auto firmware reset (0=disabled, 1=enabled");
+MODULE_PARM_DESC(auto_fw_reset, "Auto firmware reset (0=disabled, 1=enabled)");
 module_param_named(auto_fw_reset, qlcnic_auto_fw_reset, int, 0644);
 int qlcnic_load_fw_file;
-MODULE_PARM_DESC(load_fw_file, "Load firmware from (0=flash, 1=file");
+MODULE_PARM_DESC(load_fw_file, "Load firmware from (0=flash, 1=file)");
 module_param_named(load_fw_file, qlcnic_load_fw_file, int, 0444);
 int qlcnic_config_npars;
 module_param(qlcnic_config_npars, int, 0444);
-MODULE_PARM_DESC(qlcnic_config_npars, "Configure NPARs (0=disabled, 1=enabled");
+MODULE_PARM_DESC(qlcnic_config_npars, "Configure NPARs (0=disabled, 1=enabled)");
 static int qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent);
 static void qlcnic_remove(struct pci_dev *pdev);
@@ -308,6 +308,23 @@ int qlcnic_read_mac_addr(struct qlcnic_adapter *adapter)
        return 0;
 }
+static void qlcnic_delete_adapter_mac(struct qlcnic_adapter *adapter)
+{
+        struct qlcnic_mac_list_s *cur;
+        struct list_head *head;
+        list_for_each(head, &adapter->mac_list) {
+                cur = list_entry(head, struct qlcnic_mac_list_s, list);
+                if (!memcmp(adapter->mac_addr, cur->mac_addr, ETH_ALEN)) {
+                        qlcnic_sre_macaddr_change(adapter, cur->mac_addr,
+                                                  0, QLCNIC_MAC_DEL);
+                        list_del(&cur->list);
+                        kfree(cur);
+                        return;
+                }
+        }
+}
 static int qlcnic_set_mac(struct net_device *netdev, void *p)
 {
        struct qlcnic_adapter *adapter = netdev_priv(netdev);
@@ -322,11 +339,15 @@ static int qlcnic_set_mac(struct net_device *netdev, void *p)
        if (!is_valid_ether_addr(addr->sa_data))
                return -EINVAL;
+        if (!memcmp(adapter->mac_addr, addr->sa_data, ETH_ALEN))
+                return 0;
        if (test_bit(__QLCNIC_DEV_UP, &adapter->state)) {
                netif_device_detach(netdev);
                qlcnic_napi_disable(adapter);
        }
+        qlcnic_delete_adapter_mac(adapter);
        memcpy(adapter->mac_addr, addr->sa_data, netdev->addr_len);
        memcpy(netdev->dev_addr, addr->sa_data, netdev->addr_len);
        qlcnic_set_multi(adapter->netdev);
@@ -2481,12 +2502,17 @@ static void qlcnic_tx_timeout(struct net_device *netdev)
        if (test_bit(__QLCNIC_RESETTING, &adapter->state))
                return;
-        dev_err(&netdev->dev, "transmit timeout, resetting.\n");
+        if (++adapter->tx_timeo_cnt >= QLCNIC_MAX_TX_TIMEOUTS) {
+                netdev_info(netdev, "Tx timeout, reset the adapter.\n");
-        if (++adapter->tx_timeo_cnt >= QLCNIC_MAX_TX_TIMEOUTS)
+                if (qlcnic_82xx_check(adapter))
-                adapter->need_fw_reset = 1;
+                        adapter->need_fw_reset = 1;
-        else
+                else if (qlcnic_83xx_check(adapter))
+                        qlcnic_83xx_idc_request_reset(adapter,
+                                                      QLCNIC_FORCE_FW_DUMP_KEY);
+        } else {
+                netdev_info(netdev, "Tx timeout, reset adapter context.\n");
                adapter->ahw->reset_context = 1;
+        }
 }
 static struct net_device_stats *qlcnic_get_stats(struct net_device *netdev)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 44d547d78b84..3869c3864deb 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -280,9 +280,9 @@ void qlcnic_sriov_cleanup(struct qlcnic_adapter *adapter)
 static int qlcnic_sriov_post_bc_msg(struct qlcnic_adapter *adapter, u32 *hdr,
                                    u32 *pay, u8 pci_func, u8 size)
 {
+        u32 rsp, mbx_val, fw_data, rsp_num, mbx_cmd, val, wait_time = 0;
        struct qlcnic_hardware_context *ahw = adapter->ahw;
        unsigned long flags;
-        u32 rsp, mbx_val, fw_data, rsp_num, mbx_cmd, val;
        u16 opcode;
        u8 mbx_err_code;
        int i, j;
@@ -330,15 +330,13 @@ static int qlcnic_sriov_post_bc_msg(struct qlcnic_adapter *adapter, u32 *hdr,
         * assume something is wrong.
         */
 poll:
-        rsp = qlcnic_83xx_mbx_poll(adapter);
+        rsp = qlcnic_83xx_mbx_poll(adapter, &wait_time);
        if (rsp != QLCNIC_RCODE_TIMEOUT) {
                /* Get the FW response data */
                fw_data = readl(QLCNIC_MBX_FW(ahw, 0));
                if (fw_data &  QLCNIC_MBX_ASYNC_EVENT) {
                        __qlcnic_83xx_process_aen(adapter);
-                        mbx_val = QLCRDX(ahw, QLCNIC_HOST_MBX_CTRL);
+                        goto poll;
-                        if (mbx_val)
-                                goto poll;
                }
                mbx_err_code = QLCNIC_MBX_STATUS(fw_data);
                rsp_num = QLCNIC_MBX_NUM_REGS(fw_data);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index c81be2da119b..1a66ccded235 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -1133,9 +1133,6 @@ static int qlcnic_sriov_validate_linkevent(struct qlcnic_vf_info *vf,
        if ((cmd->req.arg[1] >> 16) != vf->rx_ctx_id)
                return -EINVAL;
-        if (!(cmd->req.arg[1] & BIT_8))
-                return -EINVAL;
        return 0;
 }
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 87463bc701a6..50235d201592 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -1106,6 +1106,7 @@ static int ql_get_next_chunk(struct ql_adapter *qdev, struct rx_ring *rx_ring,
                if (pci_dma_mapping_error(qdev->pdev, map)) {
                        __free_pages(rx_ring->pg_chunk.page,
                                        qdev->lbq_buf_order);
+                        rx_ring->pg_chunk.page = NULL;
                        netif_err(qdev, drv, qdev->ndev,
                                  "PCI mapping failed.\n");
                        return -ENOMEM;
@@ -2777,6 +2778,12 @@ static void ql_free_lbq_buffers(struct ql_adapter *qdev, struct rx_ring *rx_ring
                        curr_idx = 0;
        }
+        if (rx_ring->pg_chunk.page) {
+                pci_unmap_page(qdev->pdev, rx_ring->pg_chunk.map,
+                        ql_lbq_block_size(qdev), PCI_DMA_FROMDEVICE);
+                put_page(rx_ring->pg_chunk.page);
+                rx_ring->pg_chunk.page = NULL;
+        }
 }
 static void ql_free_sbq_buffers(struct ql_adapter *qdev, struct rx_ring *rx_ring)
diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index f695a50bac47..43c1f3223322 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -1,6 +1,6 @@
 config STMMAC_ETH
        tristate "STMicroelectronics 10/100/1000 Ethernet driver"
-        depends on HAS_IOMEM
+        depends on HAS_IOMEM && HAS_DMA
        select NET_CORE
        select MII
        select PHYLIB
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index d5a141c7c4e7..1c502bb0c916 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -229,7 +229,8 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
        }
        if (port->passthru)
-                vlan = list_first_entry(&port->vlans, struct macvlan_dev, list);
+                vlan = list_first_or_null_rcu(&port->vlans,
+                                              struct macvlan_dev, list);
        else
                vlan = macvlan_hash_lookup(port, eth->h_dest);
        if (vlan == NULL)
@@ -814,7 +815,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
        if (err < 0)
                goto upper_dev_unlink;
-        list_add_tail(&vlan->list, &port->vlans);
+        list_add_tail_rcu(&vlan->list, &port->vlans);
        netif_stacked_transfer_operstate(lowerdev, dev);
        return 0;
@@ -842,7 +843,7 @@ void macvlan_dellink(struct net_device *dev, struct list_head *head)
 {
        struct macvlan_dev *vlan = netdev_priv(dev);
-        list_del(&vlan->list);
+        list_del_rcu(&vlan->list);
        unregister_netdevice_queue(dev, head);
        netdev_upper_dev_unlink(vlan->lowerdev, dev);
 }
diff --git a/drivers/net/ntb_netdev.c b/drivers/net/ntb_netdev.c
index ed947dd76fbd..f3cdf64997d6 100644
--- a/drivers/net/ntb_netdev.c
+++ b/drivers/net/ntb_netdev.c
@@ -375,6 +375,8 @@ static void ntb_netdev_remove(struct pci_dev *pdev)
        if (dev == NULL)
                return;
+        list_del(&dev->list);
        ndev = dev->ndev;
        unregister_netdev(ndev);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 3c23fdc27bf0..655bb25eed2b 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -28,7 +28,7 @@
 #include <linux/slab.h>
 #include <linux/cpu.h>
-static int napi_weight = 128;
+static int napi_weight = NAPI_POLL_WEIGHT;
 module_param(napi_weight, int, 0444);
 static bool csum = true, gso = true;
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 9b20d9ee2719..7f702fe3ecc2 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -2369,6 +2369,9 @@ ath5k_tx_complete_poll_work(struct work_struct *work)
        int i;
        bool needreset = false;
+        if (!test_bit(ATH_STAT_STARTED, ah->status))
+                return;
        mutex_lock(&ah->lock);
        for (i = 0; i < ARRAY_SIZE(ah->txqs); i++) {
@@ -2676,6 +2679,7 @@ done:
        mmiowb();
        mutex_unlock(&ah->lock);
+        set_bit(ATH_STAT_STARTED, ah->status);
        ieee80211_queue_delayed_work(ah->hw, &ah->tx_complete_work,
                        msecs_to_jiffies(ATH5K_TX_COMPLETE_POLL_INT));
@@ -2737,6 +2741,7 @@ void ath5k_stop(struct ieee80211_hw *hw)
        ath5k_stop_tasklets(ah);
+        clear_bit(ATH_STAT_STARTED, ah->status);
        cancel_delayed_work_sync(&ah->tx_complete_work);
        if (!ath5k_modparam_no_hw_rfkill_switch)
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index 17507dc8a1e7..f3dc124c60c7 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -17,7 +17,7 @@ config ATH9K_BTCOEX_SUPPORT
 config ATH9K
        tristate "Atheros 802.11n wireless cards support"
-        depends on MAC80211
+        depends on MAC80211 && HAS_DMA
        select ATH9K_HW
        select MAC80211_LEDS
        select LEDS_CLASS
diff --git a/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h
index 0c2ac0c6dc89..e85a8b076c22 100644
--- a/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h
@@ -233,9 +233,9 @@ static const u32 ar9565_1p0_baseband_core[][2] = {
        {0x00009d10, 0x01834061},
        {0x00009d14, 0x00c00400},
        {0x00009d18, 0x00000000},
-        {0x00009e08, 0x0078230c},
+        {0x00009e08, 0x0038230c},
-        {0x00009e24, 0x990bb515},
+        {0x00009e24, 0x9907b515},
-        {0x00009e28, 0x126f0000},
+        {0x00009e28, 0x126f0600},
        {0x00009e30, 0x06336f77},
        {0x00009e34, 0x6af6532f},
        {0x00009e38, 0x0cc80c00},
@@ -337,7 +337,7 @@ static const u32 ar9565_1p0_baseband_core[][2] = {
 static const u32 ar9565_1p0_baseband_postamble[][5] = {
        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8005, 0xd00a800d},
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8005, 0xd00a8009},
        {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a01ae},
        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x63c640da},
        {0x00009828, 0x06903081, 0x06903081, 0x06903881, 0x09143c81},
@@ -345,9 +345,9 @@ static const u32 ar9565_1p0_baseband_postamble[][5] = {
        {0x00009830, 0x0000059c, 0x0000059c, 0x0000059c, 0x0000059c},
        {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a0},
-        {0x00009e04, 0x00802020, 0x00802020, 0x00802020, 0x00802020},
+        {0x00009e04, 0x00802020, 0x00802020, 0x00142020, 0x00142020},
-        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000d8},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2},
-        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec86d2e},
+        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec84d2e},
        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3379605e, 0x33795d5e},
        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
@@ -450,6 +450,8 @@ static const u32 ar9565_1p0_soc_postamble[][5] = {
 static const u32 ar9565_1p0_Common_rx_gain_table[][2] = {
        /* Addr      allmodes  */
+        {0x00004050, 0x00300300},
+        {0x0000406c, 0x00100000},
        {0x0000a000, 0x00010000},
        {0x0000a004, 0x00030002},
        {0x0000a008, 0x00050004},
@@ -498,27 +500,27 @@ static const u32 ar9565_1p0_Common_rx_gain_table[][2] = {
        {0x0000a0b4, 0x00000000},
        {0x0000a0b8, 0x00000000},
        {0x0000a0bc, 0x00000000},
-        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c0, 0x00bf00a0},
-        {0x0000a0c4, 0x01000101},
+        {0x0000a0c4, 0x11a011a1},
-        {0x0000a0c8, 0x011e011f},
+        {0x0000a0c8, 0x11be11bf},
-        {0x0000a0cc, 0x011c011d},
+        {0x0000a0cc, 0x11bc11bd},
-        {0x0000a0d0, 0x02030204},
+        {0x0000a0d0, 0x22632264},
-        {0x0000a0d4, 0x02010202},
+        {0x0000a0d4, 0x22612262},
-        {0x0000a0d8, 0x021f0200},
+        {0x0000a0d8, 0x227f2260},
-        {0x0000a0dc, 0x0302021e},
+        {0x0000a0dc, 0x4322227e},
-        {0x0000a0e0, 0x03000301},
+        {0x0000a0e0, 0x43204321},
-        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e4, 0x433e433f},
-        {0x0000a0e8, 0x0402031d},
+        {0x0000a0e8, 0x4462433d},
-        {0x0000a0ec, 0x04000401},
+        {0x0000a0ec, 0x44604461},
-        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f0, 0x447e447f},
-        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f4, 0x5582447d},
-        {0x0000a0f8, 0x05000501},
+        {0x0000a0f8, 0x55805581},
-        {0x0000a0fc, 0x051e051f},
+        {0x0000a0fc, 0x559e559f},
-        {0x0000a100, 0x06010602},
+        {0x0000a100, 0x66816682},
-        {0x0000a104, 0x061f0600},
+        {0x0000a104, 0x669f6680},
-        {0x0000a108, 0x061d061e},
+        {0x0000a108, 0x669d669e},
-        {0x0000a10c, 0x07020703},
+        {0x0000a10c, 0x77627763},
-        {0x0000a110, 0x07000701},
+        {0x0000a110, 0x77607761},
        {0x0000a114, 0x00000000},
        {0x0000a118, 0x00000000},
        {0x0000a11c, 0x00000000},
@@ -530,27 +532,27 @@ static const u32 ar9565_1p0_Common_rx_gain_table[][2] = {
        {0x0000a134, 0x00000000},
        {0x0000a138, 0x00000000},
        {0x0000a13c, 0x00000000},
-        {0x0000a140, 0x001f0000},
+        {0x0000a140, 0x00bf00a0},
-        {0x0000a144, 0x01000101},
+        {0x0000a144, 0x11a011a1},
-        {0x0000a148, 0x011e011f},
+        {0x0000a148, 0x11be11bf},
-        {0x0000a14c, 0x011c011d},
+        {0x0000a14c, 0x11bc11bd},
-        {0x0000a150, 0x02030204},
+        {0x0000a150, 0x22632264},
-        {0x0000a154, 0x02010202},
+        {0x0000a154, 0x22612262},
-        {0x0000a158, 0x021f0200},
+        {0x0000a158, 0x227f2260},
-        {0x0000a15c, 0x0302021e},
+        {0x0000a15c, 0x4322227e},
-        {0x0000a160, 0x03000301},
+        {0x0000a160, 0x43204321},
-        {0x0000a164, 0x031e031f},
+        {0x0000a164, 0x433e433f},
-        {0x0000a168, 0x0402031d},
+        {0x0000a168, 0x4462433d},
-        {0x0000a16c, 0x04000401},
+        {0x0000a16c, 0x44604461},
-        {0x0000a170, 0x041e041f},
+        {0x0000a170, 0x447e447f},
-        {0x0000a174, 0x0502041d},
+        {0x0000a174, 0x5582447d},
-        {0x0000a178, 0x05000501},
+        {0x0000a178, 0x55805581},
-        {0x0000a17c, 0x051e051f},
+        {0x0000a17c, 0x559e559f},
-        {0x0000a180, 0x06010602},
+        {0x0000a180, 0x66816682},
-        {0x0000a184, 0x061f0600},
+        {0x0000a184, 0x669f6680},
-        {0x0000a188, 0x061d061e},
+        {0x0000a188, 0x669d669e},
-        {0x0000a18c, 0x07020703},
+        {0x0000a18c, 0x77e677e7},
-        {0x0000a190, 0x07000701},
+        {0x0000a190, 0x77e477e5},
        {0x0000a194, 0x00000000},
        {0x0000a198, 0x00000000},
        {0x0000a19c, 0x00000000},
@@ -770,7 +772,7 @@ static const u32 ar9565_1p0_Modes_lowest_ob_db_tx_gain_table[][5] = {
 static const u32 ar9565_1p0_pciephy_clkreq_disable_L1[][2] = {
        /* Addr      allmodes  */
-        {0x00018c00, 0x18213ede},
+        {0x00018c00, 0x18212ede},
        {0x00018c04, 0x000801d8},
        {0x00018c08, 0x0003780c},
 };
@@ -889,8 +891,8 @@ static const u32 ar9565_1p0_common_wo_xlna_rx_gain_table[][2] = {
        {0x0000a180, 0x66816682},
        {0x0000a184, 0x669f6680},
        {0x0000a188, 0x669d669e},
-        {0x0000a18c, 0x77627763},
+        {0x0000a18c, 0x77e677e7},
-        {0x0000a190, 0x77607761},
+        {0x0000a190, 0x77e477e5},
        {0x0000a194, 0x00000000},
        {0x0000a198, 0x00000000},
        {0x0000a19c, 0x00000000},
@@ -1114,7 +1116,7 @@ static const u32 ar9565_1p0_modes_high_ob_db_tx_gain_table[][5] = {
        {0x0000a2e0, 0xffecec00, 0xffecec00, 0xfd339c84, 0xfd339c84},
        {0x0000a2e4, 0xfc0f0000, 0xfc0f0000, 0xfec3e000, 0xfec3e000},
        {0x0000a2e8, 0xfc100000, 0xfc100000, 0xfffc0000, 0xfffc0000},
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050df, 0x000050df},
        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
        {0x0000a504, 0x06002223, 0x06002223, 0x04000002, 0x04000002},
        {0x0000a508, 0x0b022220, 0x0b022220, 0x08000004, 0x08000004},
@@ -1140,13 +1142,13 @@ static const u32 ar9565_1p0_modes_high_ob_db_tx_gain_table[][5] = {
        {0x0000a558, 0x69027f56, 0x69027f56, 0x53001ce5, 0x53001ce5},
        {0x0000a55c, 0x6d029f56, 0x6d029f56, 0x57001ce9, 0x57001ce9},
        {0x0000a560, 0x73049f56, 0x73049f56, 0x5b001ceb, 0x5b001ceb},
-        {0x0000a564, 0x7804ff56, 0x7804ff56, 0x5d001eec, 0x5d001eec},
+        {0x0000a564, 0x7804ff56, 0x7804ff56, 0x60001cf0, 0x60001cf0},
-        {0x0000a568, 0x7804ff56, 0x7804ff56, 0x5d001eec, 0x5d001eec},
+        {0x0000a568, 0x7804ff56, 0x7804ff56, 0x61001cf1, 0x61001cf1},
-        {0x0000a56c, 0x7804ff56, 0x7804ff56, 0x5d001eec, 0x5d001eec},
+        {0x0000a56c, 0x7804ff56, 0x7804ff56, 0x62001cf2, 0x62001cf2},
-        {0x0000a570, 0x7804ff56, 0x7804ff56, 0x5d001eec, 0x5d001eec},
+        {0x0000a570, 0x7804ff56, 0x7804ff56, 0x63001cf3, 0x63001cf3},
-        {0x0000a574, 0x7804ff56, 0x7804ff56, 0x5d001eec, 0x5d001eec},
+        {0x0000a574, 0x7804ff56, 0x7804ff56, 0x64001cf4, 0x64001cf4},
-        {0x0000a578, 0x7804ff56, 0x7804ff56, 0x5d001eec, 0x5d001eec},
+        {0x0000a578, 0x7804ff56, 0x7804ff56, 0x66001ff6, 0x66001ff6},
-        {0x0000a57c, 0x7804ff56, 0x7804ff56, 0x5d001eec, 0x5d001eec},
+        {0x0000a57c, 0x7804ff56, 0x7804ff56, 0x66001ff6, 0x66001ff6},
        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
@@ -1174,7 +1176,7 @@ static const u32 ar9565_1p0_modes_high_power_tx_gain_table[][5] = {
        {0x0000a2e0, 0xffecec00, 0xffecec00, 0xfd339c84, 0xfd339c84},
        {0x0000a2e4, 0xfc0f0000, 0xfc0f0000, 0xfec3e000, 0xfec3e000},
        {0x0000a2e8, 0xfc100000, 0xfc100000, 0xfffc0000, 0xfffc0000},
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050df, 0x000050df},
        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
        {0x0000a504, 0x06002223, 0x06002223, 0x04000002, 0x04000002},
        {0x0000a508, 0x0a022220, 0x0a022220, 0x08000004, 0x08000004},
@@ -1200,13 +1202,13 @@ static const u32 ar9565_1p0_modes_high_power_tx_gain_table[][5] = {
        {0x0000a558, 0x66027f56, 0x66027f56, 0x4c001ce5, 0x4c001ce5},
        {0x0000a55c, 0x6a029f56, 0x6a029f56, 0x50001ce9, 0x50001ce9},
        {0x0000a560, 0x70049f56, 0x70049f56, 0x54001ceb, 0x54001ceb},
-        {0x0000a564, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a564, 0x7504ff56, 0x7504ff56, 0x59001cf0, 0x59001cf0},
-        {0x0000a568, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x7504ff56, 0x7504ff56, 0x5a001cf1, 0x5a001cf1},
-        {0x0000a56c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a56c, 0x7504ff56, 0x7504ff56, 0x5b001cf2, 0x5b001cf2},
-        {0x0000a570, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a570, 0x7504ff56, 0x7504ff56, 0x5c001cf3, 0x5c001cf3},
-        {0x0000a574, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a574, 0x7504ff56, 0x7504ff56, 0x5d001cf4, 0x5d001cf4},
-        {0x0000a578, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a578, 0x7504ff56, 0x7504ff56, 0x5f001ff6, 0x5f001ff6},
-        {0x0000a57c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a57c, 0x7504ff56, 0x7504ff56, 0x5f001ff6, 0x5f001ff6},
        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 6963862a1872..a18414b5948b 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -227,13 +227,13 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
                if (!test_bit(SC_OP_BEACONS, &sc->sc_flags))
                        goto work;
-                ath9k_set_beacon(sc);
                if (ah->opmode == NL80211_IFTYPE_STATION &&
                    test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags)) {
                        spin_lock_irqsave(&sc->sc_pm_lock, flags);
                        sc->ps_flags |= PS_BEACON_SYNC | PS_WAIT_FOR_BEACON;
                        spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
+                } else {
+                        ath9k_set_beacon(sc);
                }
        work:
                ath_restart_work(sc);
@@ -1332,6 +1332,7 @@ static int ath9k_sta_add(struct ieee80211_hw *hw,
        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
        struct ath_node *an = (struct ath_node *) sta->drv_priv;
        struct ieee80211_key_conf ps_key = { };
+        int key;
        ath_node_attach(sc, sta, vif);
@@ -1339,7 +1340,9 @@ static int ath9k_sta_add(struct ieee80211_hw *hw,
            vif->type != NL80211_IFTYPE_AP_VLAN)
                return 0;
-        an->ps_key = ath_key_config(common, vif, sta, &ps_key);
+        key = ath_key_config(common, vif, sta, &ps_key);
+        if (key > 0)
+                an->ps_key = key;
        return 0;
 }
@@ -1356,6 +1359,7 @@ static void ath9k_del_ps_key(struct ath_softc *sc,
            return;
        ath_key_delete(common, &ps_key);
+        an->ps_key = 0;
 }
 static int ath9k_sta_remove(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 523355b87659..f7c70b3a6ea9 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1728,6 +1728,25 @@ drop_recycle_buffer:
        sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
 }
+void b43_dma_handle_rx_overflow(struct b43_dmaring *ring)
+{
+        int current_slot, previous_slot;
+        B43_WARN_ON(ring->tx);
+        /* Device has filled all buffers, drop all packets and let TCP
+         * decrease speed.
+         * Decrement RX index by one will let the device to see all slots
+         * as free again
+         */
+        /*
+        *TODO: How to increase rx_drop in mac80211?
+        */
+        current_slot = ring->ops->get_current_rxslot(ring);
+        previous_slot = prev_slot(ring, current_slot);
+        ring->ops->set_current_rxslot(ring, previous_slot);
+}
 void b43_dma_rx(struct b43_dmaring *ring)
 {
        const struct b43_dma_ops *ops = ring->ops;
diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
index 9fdd1983079c..df8c8cdcbdb5 100644
--- a/drivers/net/wireless/b43/dma.h
+++ b/drivers/net/wireless/b43/dma.h
@@ -9,7 +9,7 @@
 /* DMA-Interrupt reasons. */
 #define B43_DMAIRQ_FATALMASK    ((1 << 10) | (1 << 11) | (1 << 12) \
                                         | (1 << 14) | (1 << 15))
-#define B43_DMAIRQ_NONFATALMASK (1 << 13)
+#define B43_DMAIRQ_RDESC_UFLOW          (1 << 13)
 #define B43_DMAIRQ_RX_DONE              (1 << 16)
 /*** 32-bit DMA Engine. ***/
@@ -295,6 +295,8 @@ int b43_dma_tx(struct b43_wldev *dev,
 void b43_dma_handle_txstatus(struct b43_wldev *dev,
                             const struct b43_txstatus *status);
+void b43_dma_handle_rx_overflow(struct b43_dmaring *ring);
 void b43_dma_rx(struct b43_dmaring *ring);
 void b43_dma_direct_fifo_rx(struct b43_wldev *dev,
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index d377f77d30b5..6dd07e2ec595 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1902,30 +1902,18 @@ static void b43_do_interrupt_thread(struct b43_wldev *dev)
                }
        }
-        if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
+        if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
-                                          B43_DMAIRQ_NONFATALMASK))) {
+                b43err(dev->wl,
-                if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
+                        "Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
-                        b43err(dev->wl, "Fatal DMA error: "
+                        dma_reason[0], dma_reason[1],
-                               "0x%08X, 0x%08X, 0x%08X, "
+                        dma_reason[2], dma_reason[3],
-                               "0x%08X, 0x%08X, 0x%08X\n",
+                        dma_reason[4], dma_reason[5]);
-                               dma_reason[0], dma_reason[1],
+                b43err(dev->wl, "This device does not support DMA "
-                               dma_reason[2], dma_reason[3],
-                               dma_reason[4], dma_reason[5]);
-                        b43err(dev->wl, "This device does not support DMA "
                               "on your system. It will now be switched to PIO.\n");
-                        /* Fall back to PIO transfers if we get fatal DMA errors! */
+                /* Fall back to PIO transfers if we get fatal DMA errors! */
-                        dev->use_pio = true;
+                dev->use_pio = true;
-                        b43_controller_restart(dev, "DMA error");
+                b43_controller_restart(dev, "DMA error");
-                        return;
+                return;
-                }
-                if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
-                        b43err(dev->wl, "DMA error: "
-                               "0x%08X, 0x%08X, 0x%08X, "
-                               "0x%08X, 0x%08X, 0x%08X\n",
-                               dma_reason[0], dma_reason[1],
-                               dma_reason[2], dma_reason[3],
-                               dma_reason[4], dma_reason[5]);
-                }
        }
        if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
@@ -1944,6 +1932,11 @@ static void b43_do_interrupt_thread(struct b43_wldev *dev)
                handle_irq_noise(dev);
        /* Check the DMA reason registers for received data. */
+        if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
+                if (B43_DEBUG)
+                        b43warn(dev->wl, "RX descriptor underrun\n");
+                b43_dma_handle_rx_overflow(dev->dma.rx_ring);
+        }
        if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
                if (b43_using_pio_transfers(dev))
                        b43_pio_rx(dev->pio.rx_queue);
@@ -2001,7 +1994,7 @@ static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
                return IRQ_NONE;
        dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
-            & 0x0001DC00;
+            & 0x0001FC00;
        dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
            & 0x0000DC00;
        dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
@@ -3130,7 +3123,7 @@ static int b43_chip_init(struct b43_wldev *dev)
                b43_write32(dev, 0x018C, 0x02000000);
        }
        b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
-        b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
+        b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
        b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
        b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
        b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index b8f82e688c72..9a95045c97b6 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -5741,8 +5741,7 @@ il4965_mac_setup_register(struct il_priv *il, u32 max_probe_length)
        hw->flags =
            IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_AMPDU_AGGREGATION |
            IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC | IEEE80211_HW_SPECTRUM_MGMT |
-            IEEE80211_HW_REPORTS_TX_ACK_STATUS | IEEE80211_HW_SUPPORTS_PS |
+            IEEE80211_HW_SUPPORTS_PS | IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
-            IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
        if (il->cfg->sku & IL_SKU_N)
                hw->flags |=
                    IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index d3c8ece980d8..e42b266a023a 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -2234,9 +2234,6 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
        if (wdev->netdev->reg_state == NETREG_REGISTERED)
                unregister_netdevice(wdev->netdev);
-        if (wdev->netdev->reg_state == NETREG_UNREGISTERED)
-                free_netdev(wdev->netdev);
        /* Clear the priv in adapter */
        priv->netdev = NULL;
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 74db0d24a579..26755d9acb55 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -1191,6 +1191,7 @@ mwifiex_process_hs_config(struct mwifiex_adapter *adapter)
        adapter->if_ops.wakeup(adapter);
        adapter->hs_activated = false;
        adapter->is_hs_configured = false;
+        adapter->is_suspended = false;
        mwifiex_hs_activated_event(mwifiex_get_priv(adapter,
                                                    MWIFIEX_BSS_ROLE_ANY),
                                   false);
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 121443a0f2a1..2eb88ea9acf7 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -655,6 +655,7 @@ void mwifiex_init_priv_params(struct mwifiex_private *priv,
                                                struct net_device *dev)
 {
        dev->netdev_ops = &mwifiex_netdev_ops;
+        dev->destructor = free_netdev;
        /* Initialize private structure */
        priv->current_key_index = 0;
        priv->media_connected = false;
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 311d0b26b81c..1a8a19dbd635 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -96,7 +96,7 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
        } else {
                /* Multicast */
                priv->curr_pkt_filter &= ~HostCmd_ACT_MAC_PROMISCUOUS_ENABLE;
-                if (mcast_list->mode == MWIFIEX_MULTICAST_MODE) {
+                if (mcast_list->mode == MWIFIEX_ALL_MULTI_MODE) {
                        dev_dbg(priv->adapter->dev,
                                "info: Enabling All Multicast!\n");
                        priv->curr_pkt_filter |=
@@ -108,20 +108,11 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
                                dev_dbg(priv->adapter->dev,
                                        "info: Set multicast list=%d\n",
                                       mcast_list->num_multicast_addr);
-                                /* Set multicast addresses to firmware */
+                                /* Send multicast addresses to firmware */
-                                if (old_pkt_filter == priv->curr_pkt_filter) {
+                                ret = mwifiex_send_cmd_async(priv,
-                                        /* Send request to firmware */
+                                        HostCmd_CMD_MAC_MULTICAST_ADR,
-                                        ret = mwifiex_send_cmd_async(priv,
+                                        HostCmd_ACT_GEN_SET, 0,
-                                                HostCmd_CMD_MAC_MULTICAST_ADR,
+                                        mcast_list);
-                                                HostCmd_ACT_GEN_SET, 0,
-                                                mcast_list);
-                                } else {
-                                        /* Send request to firmware */
-                                        ret = mwifiex_send_cmd_async(priv,
-                                                HostCmd_CMD_MAC_MULTICAST_ADR,
-                                                HostCmd_ACT_GEN_SET, 0,
-                                                mcast_list);
-                                }
                        }
                }
        }
diff --git a/drivers/ntb/ntb_hw.c b/drivers/ntb/ntb_hw.c
index f802e7c92356..2dacd19e1b8a 100644
--- a/drivers/ntb/ntb_hw.c
+++ b/drivers/ntb/ntb_hw.c
@@ -345,7 +345,7 @@ int ntb_read_remote_spad(struct ntb_device *ndev, unsigned int idx, u32 *val)
 */
 void __iomem *ntb_get_mw_vbase(struct ntb_device *ndev, unsigned int mw)
 {
-        if (mw > NTB_NUM_MW)
+        if (mw >= NTB_NUM_MW)
                return NULL;
        return ndev->mw[mw].vbase;
@@ -362,7 +362,7 @@ void __iomem *ntb_get_mw_vbase(struct ntb_device *ndev, unsigned int mw)
 */
 resource_size_t ntb_get_mw_size(struct ntb_device *ndev, unsigned int mw)
 {
-        if (mw > NTB_NUM_MW)
+        if (mw >= NTB_NUM_MW)
                return 0;
        return ndev->mw[mw].bar_sz;
@@ -380,7 +380,7 @@ resource_size_t ntb_get_mw_size(struct ntb_device *ndev, unsigned int mw)
 */
 void ntb_set_mw_addr(struct ntb_device *ndev, unsigned int mw, u64 addr)
 {
-        if (mw > NTB_NUM_MW)
+        if (mw >= NTB_NUM_MW)
                return;
        dev_dbg(&ndev->pdev->dev, "Writing addr %Lx to BAR %d\n", addr,
@@ -1027,8 +1027,8 @@ static int ntb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                ndev->mw[i].vbase =
                    ioremap_wc(pci_resource_start(pdev, MW_TO_BAR(i)),
                               ndev->mw[i].bar_sz);
-                dev_info(&pdev->dev, "MW %d size %d\n", i,
+                dev_info(&pdev->dev, "MW %d size %llu\n", i,
-                         (u32) pci_resource_len(pdev, MW_TO_BAR(i)));
+                         pci_resource_len(pdev, MW_TO_BAR(i)));
                if (!ndev->mw[i].vbase) {
                        dev_warn(&pdev->dev, "Cannot remap BAR %d\n",
                                 MW_TO_BAR(i));
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index e0bdfd7f9930..f8d7081ee301 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -58,7 +58,7 @@
 #include <linux/ntb.h>
 #include "ntb_hw.h"
-#define NTB_TRANSPORT_VERSION   2
+#define NTB_TRANSPORT_VERSION   3
 static unsigned int transport_mtu = 0x401E;
 module_param(transport_mtu, uint, 0644);
@@ -173,10 +173,13 @@ struct ntb_payload_header {
 enum {
        VERSION = 0,
-        MW0_SZ,
-        MW1_SZ,
-        NUM_QPS,
        QP_LINKS,
+        NUM_QPS,
+        NUM_MWS,
+        MW0_SZ_HIGH,
+        MW0_SZ_LOW,
+        MW1_SZ_HIGH,
+        MW1_SZ_LOW,
        MAX_SPAD,
 };
@@ -297,7 +300,7 @@ int ntb_register_client_dev(char *device_name)
 {
        struct ntb_transport_client_dev *client_dev;
        struct ntb_transport *nt;
-        int rc;
+        int rc, i = 0;
        if (list_empty(&ntb_transport_list))
                return -ENODEV;
@@ -315,7 +318,7 @@ int ntb_register_client_dev(char *device_name)
                dev = &client_dev->dev;
                /* setup and register client devices */
-                dev_set_name(dev, "%s", device_name);
+                dev_set_name(dev, "%s%d", device_name, i);
                dev->bus = &ntb_bus_type;
                dev->release = ntb_client_release;
                dev->parent = &ntb_query_pdev(nt->ndev)->dev;
@@ -327,6 +330,7 @@ int ntb_register_client_dev(char *device_name)
                }
                list_add_tail(&client_dev->entry, &nt->client_devs);
+                i++;
        }
        return 0;
@@ -486,12 +490,13 @@ static void ntb_transport_setup_qp_mw(struct ntb_transport *nt,
                             (qp_num / NTB_NUM_MW * rx_size);
        rx_size -= sizeof(struct ntb_rx_info);
-        qp->rx_buff = qp->remote_rx_info + sizeof(struct ntb_rx_info);
+        qp->rx_buff = qp->remote_rx_info + 1;
-        qp->rx_max_frame = min(transport_mtu, rx_size);
+        /* Due to housekeeping, there must be atleast 2 buffs */
+        qp->rx_max_frame = min(transport_mtu, rx_size / 2);
        qp->rx_max_entry = rx_size / qp->rx_max_frame;
        qp->rx_index = 0;
-        qp->remote_rx_info->entry = qp->rx_max_entry;
+        qp->remote_rx_info->entry = qp->rx_max_entry - 1;
        /* setup the hdr offsets with 0's */
        for (i = 0; i < qp->rx_max_entry; i++) {
@@ -502,6 +507,19 @@ static void ntb_transport_setup_qp_mw(struct ntb_transport *nt,
        qp->rx_pkts = 0;
        qp->tx_pkts = 0;
+        qp->tx_index = 0;
+}
+static void ntb_free_mw(struct ntb_transport *nt, int num_mw)
+{
+        struct ntb_transport_mw *mw = &nt->mw[num_mw];
+        struct pci_dev *pdev = ntb_query_pdev(nt->ndev);
+        if (!mw->virt_addr)
+                return;
+        dma_free_coherent(&pdev->dev, mw->size, mw->virt_addr, mw->dma_addr);
+        mw->virt_addr = NULL;
 }
 static int ntb_set_mw(struct ntb_transport *nt, int num_mw, unsigned int size)
@@ -509,12 +527,20 @@ static int ntb_set_mw(struct ntb_transport *nt, int num_mw, unsigned int size)
        struct ntb_transport_mw *mw = &nt->mw[num_mw];
        struct pci_dev *pdev = ntb_query_pdev(nt->ndev);
+        /* No need to re-setup */
+        if (mw->size == ALIGN(size, 4096))
+                return 0;
+        if (mw->size != 0)
+                ntb_free_mw(nt, num_mw);
        /* Alloc memory for receiving data.  Must be 4k aligned */
        mw->size = ALIGN(size, 4096);
        mw->virt_addr = dma_alloc_coherent(&pdev->dev, mw->size, &mw->dma_addr,
                                           GFP_KERNEL);
        if (!mw->virt_addr) {
+                mw->size = 0;
                dev_err(&pdev->dev, "Unable to allocate MW buffer of size %d\n",
                       (int) mw->size);
                return -ENOMEM;
@@ -604,25 +630,31 @@ static void ntb_transport_link_work(struct work_struct *work)
        u32 val;
        int rc, i;
-        /* send the local info */
+        /* send the local info, in the opposite order of the way we read it */
-        rc = ntb_write_remote_spad(ndev, VERSION, NTB_TRANSPORT_VERSION);
+        for (i = 0; i < NTB_NUM_MW; i++) {
-        if (rc) {
+                rc = ntb_write_remote_spad(ndev, MW0_SZ_HIGH + (i * 2),
-                dev_err(&pdev->dev, "Error writing %x to remote spad %d\n",
+                                           ntb_get_mw_size(ndev, i) >> 32);
-                        0, VERSION);
+                if (rc) {
-                goto out;
+                        dev_err(&pdev->dev, "Error writing %u to remote spad %d\n",
-        }
+                                (u32)(ntb_get_mw_size(ndev, i) >> 32),
+                                MW0_SZ_HIGH + (i * 2));
+                        goto out;
+                }
-        rc = ntb_write_remote_spad(ndev, MW0_SZ, ntb_get_mw_size(ndev, 0));
+                rc = ntb_write_remote_spad(ndev, MW0_SZ_LOW + (i * 2),
-        if (rc) {
+                                           (u32) ntb_get_mw_size(ndev, i));
-                dev_err(&pdev->dev, "Error writing %x to remote spad %d\n",
+                if (rc) {
-                        (u32) ntb_get_mw_size(ndev, 0), MW0_SZ);
+                        dev_err(&pdev->dev, "Error writing %u to remote spad %d\n",
-                goto out;
+                                (u32) ntb_get_mw_size(ndev, i),
+                                MW0_SZ_LOW + (i * 2));
+                        goto out;
+                }
        }
-        rc = ntb_write_remote_spad(ndev, MW1_SZ, ntb_get_mw_size(ndev, 1));
+        rc = ntb_write_remote_spad(ndev, NUM_MWS, NTB_NUM_MW);
        if (rc) {
                dev_err(&pdev->dev, "Error writing %x to remote spad %d\n",
-                        (u32) ntb_get_mw_size(ndev, 1), MW1_SZ);
+                        NTB_NUM_MW, NUM_MWS);
                goto out;
        }
@@ -633,16 +665,10 @@ static void ntb_transport_link_work(struct work_struct *work)
                goto out;
        }
-        rc = ntb_read_local_spad(nt->ndev, QP_LINKS, &val);
+        rc = ntb_write_remote_spad(ndev, VERSION, NTB_TRANSPORT_VERSION);
-        if (rc) {
-                dev_err(&pdev->dev, "Error reading spad %d\n", QP_LINKS);
-                goto out;
-        }
-        rc = ntb_write_remote_spad(ndev, QP_LINKS, val);
        if (rc) {
                dev_err(&pdev->dev, "Error writing %x to remote spad %d\n",
-                        val, QP_LINKS);
+                        NTB_TRANSPORT_VERSION, VERSION);
                goto out;
        }
@@ -667,33 +693,43 @@ static void ntb_transport_link_work(struct work_struct *work)
                goto out;
        dev_dbg(&pdev->dev, "Remote max number of qps = %d\n", val);
-        rc = ntb_read_remote_spad(ndev, MW0_SZ, &val);
+        rc = ntb_read_remote_spad(ndev, NUM_MWS, &val);
        if (rc) {
-                dev_err(&pdev->dev, "Error reading remote spad %d\n", MW0_SZ);
+                dev_err(&pdev->dev, "Error reading remote spad %d\n", NUM_MWS);
                goto out;
        }
-        if (!val)
+        if (val != NTB_NUM_MW)
                goto out;
-        dev_dbg(&pdev->dev, "Remote MW0 size = %d\n", val);
+        dev_dbg(&pdev->dev, "Remote number of mws = %d\n", val);
-        rc = ntb_set_mw(nt, 0, val);
+        for (i = 0; i < NTB_NUM_MW; i++) {
-        if (rc)
+                u64 val64;
-                goto out;
-        rc = ntb_read_remote_spad(ndev, MW1_SZ, &val);
+                rc = ntb_read_remote_spad(ndev, MW0_SZ_HIGH + (i * 2), &val);
-        if (rc) {
+                if (rc) {
-                dev_err(&pdev->dev, "Error reading remote spad %d\n", MW1_SZ);
+                        dev_err(&pdev->dev, "Error reading remote spad %d\n",
-                goto out;
+                                MW0_SZ_HIGH + (i * 2));
-        }
+                        goto out1;
+                }
-        if (!val)
+                val64 = (u64) val << 32;
-                goto out;
-        dev_dbg(&pdev->dev, "Remote MW1 size = %d\n", val);
-        rc = ntb_set_mw(nt, 1, val);
+                rc = ntb_read_remote_spad(ndev, MW0_SZ_LOW + (i * 2), &val);
-        if (rc)
+                if (rc) {
-                goto out;
+                        dev_err(&pdev->dev, "Error reading remote spad %d\n",
+                                MW0_SZ_LOW + (i * 2));
+                        goto out1;
+                }
+                val64 |= val;
+                dev_dbg(&pdev->dev, "Remote MW%d size = %llu\n", i, val64);
+                rc = ntb_set_mw(nt, i, val64);
+                if (rc)
+                        goto out1;
+        }
        nt->transport_link = NTB_LINK_UP;
@@ -708,6 +744,9 @@ static void ntb_transport_link_work(struct work_struct *work)
        return;
+out1:
+        for (i = 0; i < NTB_NUM_MW; i++)
+                ntb_free_mw(nt, i);
 out:
        if (ntb_hw_link_status(ndev))
                schedule_delayed_work(&nt->link_work,
@@ -780,10 +819,10 @@ static void ntb_transport_init_queue(struct ntb_transport *nt,
                      (qp_num / NTB_NUM_MW * tx_size);
        tx_size -= sizeof(struct ntb_rx_info);
-        qp->tx_mw = qp->rx_info + sizeof(struct ntb_rx_info);
+        qp->tx_mw = qp->rx_info + 1;
-        qp->tx_max_frame = min(transport_mtu, tx_size);
+        /* Due to housekeeping, there must be atleast 2 buffs */
+        qp->tx_max_frame = min(transport_mtu, tx_size / 2);
        qp->tx_max_entry = tx_size / qp->tx_max_frame;
-        qp->tx_index = 0;
        if (nt->debugfs_dir) {
                char debugfs_name[4];
@@ -897,10 +936,7 @@ void ntb_transport_free(void *transport)
        pdev = ntb_query_pdev(nt->ndev);
        for (i = 0; i < NTB_NUM_MW; i++)
-                if (nt->mw[i].virt_addr)
+                ntb_free_mw(nt, i);
-                        dma_free_coherent(&pdev->dev, nt->mw[i].size,
-                                          nt->mw[i].virt_addr,
-                                          nt->mw[i].dma_addr);
        kfree(nt->qps);
        ntb_unregister_transport(nt->ndev);
@@ -999,11 +1035,16 @@ out:
 static void ntb_transport_rx(unsigned long data)
 {
        struct ntb_transport_qp *qp = (struct ntb_transport_qp *)data;
-        int rc;
+        int rc, i;
-        do {
+        /* Limit the number of packets processed in a single interrupt to
+         * provide fairness to others
+         */
+        for (i = 0; i < qp->rx_max_entry; i++) {
                rc = ntb_process_rxc(qp);
-        } while (!rc);
+                if (rc)
+                        break;
+        }
 }
 static void ntb_transport_rxc_db(void *data, int db_num)
@@ -1210,12 +1251,14 @@ EXPORT_SYMBOL_GPL(ntb_transport_create_queue);
 */
 void ntb_transport_free_queue(struct ntb_transport_qp *qp)
 {
-        struct pci_dev *pdev = ntb_query_pdev(qp->ndev);
+        struct pci_dev *pdev;
        struct ntb_queue_entry *entry;
        if (!qp)
                return;
+        pdev = ntb_query_pdev(qp->ndev);
        cancel_delayed_work_sync(&qp->link_work);
        ntb_unregister_db_callback(qp->ndev, qp->qp_num);
@@ -1371,12 +1414,13 @@ EXPORT_SYMBOL_GPL(ntb_transport_link_up);
 */
 void ntb_transport_link_down(struct ntb_transport_qp *qp)
 {
-        struct pci_dev *pdev = ntb_query_pdev(qp->ndev);
+        struct pci_dev *pdev;
        int rc, val;
        if (!qp)
                return;
+        pdev = ntb_query_pdev(qp->ndev);
        qp->client_ready = NTB_LINK_DOWN;
        rc = ntb_read_local_spad(qp->ndev, QP_LINKS, &val);
@@ -1408,6 +1452,9 @@ EXPORT_SYMBOL_GPL(ntb_transport_link_down);
 */
 bool ntb_transport_link_query(struct ntb_transport_qp *qp)
 {
+        if (!qp)
+                return false;
        return qp->qp_link == NTB_LINK_UP;
 }
 EXPORT_SYMBOL_GPL(ntb_transport_link_query);
@@ -1422,6 +1469,9 @@ EXPORT_SYMBOL_GPL(ntb_transport_link_query);
 */
 unsigned char ntb_transport_qp_num(struct ntb_transport_qp *qp)
 {
+        if (!qp)
+                return 0;
        return qp->qp_num;
 }
 EXPORT_SYMBOL_GPL(ntb_transport_qp_num);
@@ -1436,6 +1486,9 @@ EXPORT_SYMBOL_GPL(ntb_transport_qp_num);
 */
 unsigned int ntb_transport_max_size(struct ntb_transport_qp *qp)
 {
+        if (!qp)
+                return 0;
        return qp->tx_max_frame - sizeof(struct ntb_payload_header);
 }
 EXPORT_SYMBOL_GPL(ntb_transport_max_size);
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 0c81915b1997..b9838130a7b0 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -20,7 +20,6 @@ if RTC_CLASS
 config RTC_HCTOSYS
        bool "Set system time from RTC on startup and resume"
        default y
-        depends on !ALWAYS_USE_PERSISTENT_CLOCK
        help
          If you say yes here, the system time (wall clock) will be set using
          the value read from a specified RTC device. This is useful to avoid
@@ -29,7 +28,6 @@ config RTC_HCTOSYS
 config RTC_SYSTOHC
        bool "Set the RTC time based on NTP synchronization"
        default y
-        depends on !ALWAYS_USE_PERSISTENT_CLOCK
        help
          If you say yes here, the system time (wall clock) will be stored
          in the RTC specified by RTC_HCTOSYS_DEVICE approximately every 11
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index 787bd2c22bca..380387a47b1d 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -526,13 +526,17 @@ static void atmel_spi_next_xfer_pio(struct spi_master *master,
        }
        if (xfer->tx_buf)
-                spi_writel(as, TDR, *(u8 *)(xfer->tx_buf));
+                if (xfer->bits_per_word > 8)
+                        spi_writel(as, TDR, *(u16 *)(xfer->tx_buf));
+                else
+                        spi_writel(as, TDR, *(u8 *)(xfer->tx_buf));
        else
                spi_writel(as, TDR, 0);
        dev_dbg(master->dev.parent,
-                "  start pio xfer %p: len %u tx %p rx %p\n",
+                "  start pio xfer %p: len %u tx %p rx %p bitpw %d\n",
-                xfer, xfer->len, xfer->tx_buf, xfer->rx_buf);
+                xfer, xfer->len, xfer->tx_buf, xfer->rx_buf,
+                xfer->bits_per_word);
        /* Enable relevant interrupts */
        spi_writel(as, IER, SPI_BIT(RDRF) | SPI_BIT(OVRES));
@@ -950,21 +954,39 @@ atmel_spi_pump_pio_data(struct atmel_spi *as, struct spi_transfer *xfer)
 {
        u8              *txp;
        u8              *rxp;
+        u16             *txp16;
+        u16             *rxp16;
        unsigned long   xfer_pos = xfer->len - as->current_remaining_bytes;
        if (xfer->rx_buf) {
-                rxp = ((u8 *)xfer->rx_buf) + xfer_pos;
+                if (xfer->bits_per_word > 8) {
-                *rxp = spi_readl(as, RDR);
+                        rxp16 = (u16 *)(((u8 *)xfer->rx_buf) + xfer_pos);
+                        *rxp16 = spi_readl(as, RDR);
+                } else {
+                        rxp = ((u8 *)xfer->rx_buf) + xfer_pos;
+                        *rxp = spi_readl(as, RDR);
+                }
        } else {
                spi_readl(as, RDR);
        }
+        if (xfer->bits_per_word > 8) {
-        as->current_remaining_bytes--;
+                as->current_remaining_bytes -= 2;
+                if (as->current_remaining_bytes < 0)
+                        as->current_remaining_bytes = 0;
+        } else {
+                as->current_remaining_bytes--;
+        }
        if (as->current_remaining_bytes) {
                if (xfer->tx_buf) {
-                        txp = ((u8 *)xfer->tx_buf) + xfer_pos + 1;
+                        if (xfer->bits_per_word > 8) {
-                        spi_writel(as, TDR, *txp);
+                                txp16 = (u16 *)(((u8 *)xfer->tx_buf)
+                                                        + xfer_pos + 2);
+                                spi_writel(as, TDR, *txp16);
+                        } else {
+                                txp = ((u8 *)xfer->tx_buf) + xfer_pos + 1;
+                                spi_writel(as, TDR, *txp);
+                        }
                } else {
                        spi_writel(as, TDR, 0);
                }
@@ -1378,9 +1400,16 @@ static int atmel_spi_transfer(struct spi_device *spi, struct spi_message *msg)
                        }
                }
+                if (xfer->bits_per_word > 8) {
+                        if (xfer->len % 2) {
+                                dev_dbg(&spi->dev, "buffer len should be 16 bits aligned\n");
+                                return -EINVAL;
+                        }
+                }
                /* FIXME implement these protocol options!! */
-                if (xfer->speed_hz) {
+                if (xfer->speed_hz < spi->max_speed_hz) {
-                        dev_dbg(&spi->dev, "no protocol options yet\n");
+                        dev_dbg(&spi->dev, "can't change speed in transfer\n");
                        return -ENOPROTOOPT;
                }
diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index 2e8f24a1fb95..50b13c9b1ab6 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -784,7 +784,7 @@ static const struct of_device_id davinci_spi_of_match[] = {
        },
        { },
 };
-MODULE_DEVICE_TABLE(of, davini_spi_of_match);
+MODULE_DEVICE_TABLE(of, davinci_spi_of_match);
 /**
 * spi_davinci_get_pdata - Get platform data from DTS binding
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 163fd802b7ac..32b7bb111eb6 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -334,7 +334,7 @@ struct spi_device *spi_alloc_device(struct spi_master *master)
        spi->dev.parent = &master->dev;
        spi->dev.bus = &spi_bus_type;
        spi->dev.release = spidev_release;
-        spi->cs_gpio = -EINVAL;
+        spi->cs_gpio = -ENOENT;
        device_initialize(&spi->dev);
        return spi;
 }
@@ -1067,8 +1067,11 @@ static int of_spi_register_master(struct spi_master *master)
        nb = of_gpio_named_count(np, "cs-gpios");
        master->num_chipselect = max(nb, (int)master->num_chipselect);
-        if (nb < 1)
+        /* Return error only for an incorrectly formed cs-gpios property */
+        if (nb == 0 || nb == -ENOENT)
                return 0;
+        else if (nb < 0)
+                return nb;
        cs = devm_kzalloc(&master->dev,
                          sizeof(int) * master->num_chipselect,
@@ -1079,7 +1082,7 @@ static int of_spi_register_master(struct spi_master *master)
                return -ENOMEM;
        for (i = 0; i < master->num_chipselect; i++)
-                cs[i] = -EINVAL;
+                cs[i] = -ENOENT;
        for (i = 0; i < nb; i++)
                cs[i] = of_get_named_gpio(np, "cs-gpios", i);
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index ffbc6a94be52..262ef1f23b38 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1250,7 +1250,7 @@ static u32 iscsit_do_crypto_hash_sg(
 static void iscsit_do_crypto_hash_buf(
        struct hash_desc *hash,
-        unsigned char *buf,
+        const void *buf,
        u32 payload_length,
        u32 padding,
        u8 *pad_bytes,
@@ -2524,9 +2524,8 @@ static int iscsit_send_conn_drop_async_message(
        if (conn->conn_ops->HeaderDigest) {
                u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
-                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
+                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
-                                (unsigned char *)hdr, ISCSI_HDR_LEN,
+                                ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
-                                0, NULL, (u8 *)header_digest);
                cmd->tx_size += ISCSI_CRC_LEN;
                pr_debug("Attaching CRC32C HeaderDigest to"
@@ -2662,9 +2661,8 @@ static int iscsit_send_datain(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
        if (conn->conn_ops->HeaderDigest) {
                u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
-                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
+                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, cmd->pdu,
-                                (unsigned char *)cmd->pdu, ISCSI_HDR_LEN,
+                                ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
-                                0, NULL, (u8 *)header_digest);
                iov[0].iov_len += ISCSI_CRC_LEN;
                tx_size += ISCSI_CRC_LEN;
@@ -2841,9 +2839,8 @@ iscsit_send_logout(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
        if (conn->conn_ops->HeaderDigest) {
                u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
-                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
+                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, &cmd->pdu[0],
-                                (unsigned char *)&cmd->pdu[0], ISCSI_HDR_LEN,
+                                ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
-                                0, NULL, (u8 *)header_digest);
                iov[0].iov_len += ISCSI_CRC_LEN;
                tx_size += ISCSI_CRC_LEN;
@@ -2900,9 +2897,8 @@ static int iscsit_send_unsolicited_nopin(
        if (conn->conn_ops->HeaderDigest) {
                u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
-                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
+                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
-                                (unsigned char *)hdr, ISCSI_HDR_LEN,
+                                ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
-                                0, NULL, (u8 *)header_digest);
                tx_size += ISCSI_CRC_LEN;
                pr_debug("Attaching CRC32C HeaderDigest to"
@@ -2949,9 +2945,8 @@ iscsit_send_nopin(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
        if (conn->conn_ops->HeaderDigest) {
                u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
-                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
+                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
-                                (unsigned char *)hdr, ISCSI_HDR_LEN,
+                                ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
-                                0, NULL, (u8 *)header_digest);
                iov[0].iov_len += ISCSI_CRC_LEN;
                tx_size += ISCSI_CRC_LEN;
@@ -3040,9 +3035,8 @@ static int iscsit_send_r2t(
        if (conn->conn_ops->HeaderDigest) {
                u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
-                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
+                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
-                                (unsigned char *)hdr, ISCSI_HDR_LEN,
+                                ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
-                                0, NULL, (u8 *)header_digest);
                cmd->iov_misc[0].iov_len += ISCSI_CRC_LEN;
                tx_size += ISCSI_CRC_LEN;
@@ -3256,9 +3250,8 @@ static int iscsit_send_response(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
        if (conn->conn_ops->HeaderDigest) {
                u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
-                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
+                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, cmd->pdu,
-                                (unsigned char *)cmd->pdu, ISCSI_HDR_LEN,
+                                ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
-                                0, NULL, (u8 *)header_digest);
                iov[0].iov_len += ISCSI_CRC_LEN;
                tx_size += ISCSI_CRC_LEN;
@@ -3329,9 +3322,8 @@ iscsit_send_task_mgt_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn)
        if (conn->conn_ops->HeaderDigest) {
                u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
-                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
+                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
-                                (unsigned char *)hdr, ISCSI_HDR_LEN,
+                                ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
-                                0, NULL, (u8 *)header_digest);
                cmd->iov_misc[0].iov_len += ISCSI_CRC_LEN;
                tx_size += ISCSI_CRC_LEN;
@@ -3504,9 +3496,8 @@ static int iscsit_send_text_rsp(
        if (conn->conn_ops->HeaderDigest) {
                u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
-                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
+                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
-                                (unsigned char *)hdr, ISCSI_HDR_LEN,
+                                ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
-                                0, NULL, (u8 *)header_digest);
                iov[0].iov_len += ISCSI_CRC_LEN;
                tx_size += ISCSI_CRC_LEN;
@@ -3557,11 +3548,11 @@ static int iscsit_send_reject(
        struct iscsi_cmd *cmd,
        struct iscsi_conn *conn)
 {
-        u32 iov_count = 0, tx_size = 0;
+        struct iscsi_reject *hdr = (struct iscsi_reject *)&cmd->pdu[0];
-        struct iscsi_reject *hdr;
        struct kvec *iov;
+        u32 iov_count = 0, tx_size;
-        iscsit_build_reject(cmd, conn, (struct iscsi_reject *)&cmd->pdu[0]);
+        iscsit_build_reject(cmd, conn, hdr);
        iov = &cmd->iov_misc[0];
        iov[iov_count].iov_base = cmd->pdu;
@@ -3574,9 +3565,8 @@ static int iscsit_send_reject(
        if (conn->conn_ops->HeaderDigest) {
                u32 *header_digest = (u32 *)&cmd->pdu[ISCSI_HDR_LEN];
-                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
+                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, hdr,
-                                (unsigned char *)hdr, ISCSI_HDR_LEN,
+                                ISCSI_HDR_LEN, 0, NULL, (u8 *)header_digest);
-                                0, NULL, (u8 *)header_digest);
                iov[0].iov_len += ISCSI_CRC_LEN;
                tx_size += ISCSI_CRC_LEN;
@@ -3585,9 +3575,8 @@ static int iscsit_send_reject(
        }
        if (conn->conn_ops->DataDigest) {
-                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash,
+                iscsit_do_crypto_hash_buf(&conn->conn_tx_hash, cmd->buf_ptr,
-                                (unsigned char *)cmd->buf_ptr, ISCSI_HDR_LEN,
+                                ISCSI_HDR_LEN, 0, NULL, (u8 *)&cmd->data_crc);
-                                0, NULL, (u8 *)&cmd->data_crc);
                iov[iov_count].iov_base = &cmd->data_crc;
                iov[iov_count++].iov_len  = ISCSI_CRC_LEN;
diff --git a/drivers/target/iscsi/iscsi_target_erl1.c b/drivers/target/iscsi/iscsi_target_erl1.c
index 7816af6cdd12..40d9dbca987b 100644
--- a/drivers/target/iscsi/iscsi_target_erl1.c
+++ b/drivers/target/iscsi/iscsi_target_erl1.c
@@ -823,7 +823,7 @@ static int iscsit_attach_ooo_cmdsn(
                /*
                 * CmdSN is greater than the tail of the list.
                 */
-                if (ooo_tail->cmdsn < ooo_cmdsn->cmdsn)
+                if (iscsi_sna_lt(ooo_tail->cmdsn, ooo_cmdsn->cmdsn))
                        list_add_tail(&ooo_cmdsn->ooo_list,
                                        &sess->sess_ooo_cmdsn_list);
                else {
@@ -833,11 +833,12 @@ static int iscsit_attach_ooo_cmdsn(
                         */
                        list_for_each_entry(ooo_tmp, &sess->sess_ooo_cmdsn_list,
                                                ooo_list) {
-                                if (ooo_tmp->cmdsn < ooo_cmdsn->cmdsn)
+                                if (iscsi_sna_lt(ooo_tmp->cmdsn, ooo_cmdsn->cmdsn))
                                        continue;
+                                /* Insert before this entry */
                                list_add(&ooo_cmdsn->ooo_list,
-                                        &ooo_tmp->ooo_list);
+                                        ooo_tmp->ooo_list.prev);
                                break;
                        }
                }
diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
index f690be9e5293..c2185fc31136 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -436,7 +436,7 @@ int iscsi_create_default_params(struct iscsi_param_list **param_list_ptr)
        /*
         * Extra parameters for ISER from RFC-5046
         */
-        param = iscsi_set_default_param(pl, RDMAEXTENTIONS, INITIAL_RDMAEXTENTIONS,
+        param = iscsi_set_default_param(pl, RDMAEXTENSIONS, INITIAL_RDMAEXTENSIONS,
                        PHASE_OPERATIONAL, SCOPE_SESSION_WIDE, SENDER_BOTH,
                        TYPERANGE_BOOL_AND, USE_LEADING_ONLY);
        if (!param)
@@ -529,7 +529,7 @@ int iscsi_set_keys_to_negotiate(
                        SET_PSTATE_NEGOTIATE(param);
                } else if (!strcmp(param->name, OFMARKINT)) {
                        SET_PSTATE_NEGOTIATE(param);
-                } else if (!strcmp(param->name, RDMAEXTENTIONS)) {
+                } else if (!strcmp(param->name, RDMAEXTENSIONS)) {
                        if (iser == true)
                                SET_PSTATE_NEGOTIATE(param);
                } else if (!strcmp(param->name, INITIATORRECVDATASEGMENTLENGTH)) {
@@ -580,7 +580,7 @@ int iscsi_set_keys_irrelevant_for_discovery(
                        param->state &= ~PSTATE_NEGOTIATE;
                else if (!strcmp(param->name, OFMARKINT))
                        param->state &= ~PSTATE_NEGOTIATE;
-                else if (!strcmp(param->name, RDMAEXTENTIONS))
+                else if (!strcmp(param->name, RDMAEXTENSIONS))
                        param->state &= ~PSTATE_NEGOTIATE;
                else if (!strcmp(param->name, INITIATORRECVDATASEGMENTLENGTH))
                        param->state &= ~PSTATE_NEGOTIATE;
@@ -1977,7 +1977,7 @@ void iscsi_set_session_parameters(
                        ops->SessionType = !strcmp(param->value, DISCOVERY);
                        pr_debug("SessionType:                  %s\n",
                                param->value);
-                } else if (!strcmp(param->name, RDMAEXTENTIONS)) {
+                } else if (!strcmp(param->name, RDMAEXTENSIONS)) {
                        ops->RDMAExtensions = !strcmp(param->value, YES);
                        pr_debug("RDMAExtensions:               %s\n",
                                param->value);
diff --git a/drivers/target/iscsi/iscsi_target_parameters.h b/drivers/target/iscsi/iscsi_target_parameters.h
index f31b9c4b83f2..915b06798505 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.h
+++ b/drivers/target/iscsi/iscsi_target_parameters.h
@@ -91,7 +91,7 @@ extern void iscsi_set_session_parameters(struct iscsi_sess_ops *,
 /*
 * Parameter names of iSCSI Extentions for RDMA (iSER).  See RFC-5046
 */
-#define RDMAEXTENTIONS                  "RDMAExtensions"
+#define RDMAEXTENSIONS                  "RDMAExtensions"
 #define INITIATORRECVDATASEGMENTLENGTH  "InitiatorRecvDataSegmentLength"
 #define TARGETRECVDATASEGMENTLENGTH     "TargetRecvDataSegmentLength"
@@ -142,7 +142,7 @@ extern void iscsi_set_session_parameters(struct iscsi_sess_ops *,
 /*
 * Initial values for iSER parameters following RFC-5046 Section 6
 */
-#define INITIAL_RDMAEXTENTIONS                  NO
+#define INITIAL_RDMAEXTENSIONS                  NO
 #define INITIAL_INITIATORRECVDATASEGMENTLENGTH  "262144"
 #define INITIAL_TARGETRECVDATASEGMENTLENGTH     "8192"
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 43b7ac6c5b1c..4a8bd36d3958 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -1584,6 +1584,13 @@ static struct target_core_configfs_attribute target_core_attr_dev_udev_path = {
        .store  = target_core_store_dev_udev_path,
 };
+static ssize_t target_core_show_dev_enable(void *p, char *page)
+{
+        struct se_device *dev = p;
+        return snprintf(page, PAGE_SIZE, "%d\n", !!(dev->dev_flags & DF_CONFIGURED));
+}
 static ssize_t target_core_store_dev_enable(
        void *p,
        const char *page,
@@ -1609,8 +1616,8 @@ static ssize_t target_core_store_dev_enable(
 static struct target_core_configfs_attribute target_core_attr_dev_enable = {
        .attr   = { .ca_owner = THIS_MODULE,
                    .ca_name = "enable",
-                    .ca_mode = S_IWUSR },
+                    .ca_mode =  S_IRUGO | S_IWUSR },
-        .show   = NULL,
+        .show   = target_core_show_dev_enable,
        .store  = target_core_store_dev_enable,
 };
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 2e4d655471bc..4630481b6043 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -68,7 +68,6 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u32 unpacked_lun)
                struct se_dev_entry *deve = se_cmd->se_deve;
                deve->total_cmds++;
-                deve->total_bytes += se_cmd->data_length;
                if ((se_cmd->data_direction == DMA_TO_DEVICE) &&
                    (deve->lun_flags & TRANSPORT_LUNFLAGS_READ_ONLY)) {
@@ -85,8 +84,6 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u32 unpacked_lun)
                else if (se_cmd->data_direction == DMA_FROM_DEVICE)
                        deve->read_bytes += se_cmd->data_length;
-                deve->deve_cmds++;
                se_lun = deve->se_lun;
                se_cmd->se_lun = deve->se_lun;
                se_cmd->pr_res_key = deve->pr_res_key;
@@ -275,17 +272,6 @@ int core_free_device_list_for_node(
        return 0;
 }
-void core_dec_lacl_count(struct se_node_acl *se_nacl, struct se_cmd *se_cmd)
-{
-        struct se_dev_entry *deve;
-        unsigned long flags;
-        spin_lock_irqsave(&se_nacl->device_list_lock, flags);
-        deve = se_nacl->device_list[se_cmd->orig_fe_lun];
-        deve->deve_cmds--;
-        spin_unlock_irqrestore(&se_nacl->device_list_lock, flags);
-}
 void core_update_device_list_access(
        u32 mapped_lun,
        u32 lun_access,
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 58ed683e04ae..1b1d544e927a 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -153,10 +153,6 @@ static int fd_configure_device(struct se_device *dev)
                struct request_queue *q = bdev_get_queue(inode->i_bdev);
                unsigned long long dev_size;
-                dev->dev_attrib.hw_block_size =
-                        bdev_logical_block_size(inode->i_bdev);
-                dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q);
                /*
                 * Determine the number of bytes from i_size_read() minus
                 * one (1) logical sector from underlying struct block_device
@@ -203,9 +199,6 @@ static int fd_configure_device(struct se_device *dev)
                        goto fail;
                }
-                dev->dev_attrib.hw_block_size = FD_BLOCKSIZE;
-                dev->dev_attrib.hw_max_sectors = FD_MAX_SECTORS;
                /*
                 * Limit UNMAP emulation to 8k Number of LBAs (NoLB)
                 */
@@ -226,6 +219,8 @@ static int fd_configure_device(struct se_device *dev)
        fd_dev->fd_block_size = dev->dev_attrib.hw_block_size;
+        dev->dev_attrib.hw_block_size = FD_BLOCKSIZE;
+        dev->dev_attrib.hw_max_sectors = FD_MAX_SECTORS;
        dev->dev_attrib.hw_queue_depth = FD_MAX_DEVICE_QUEUE_DEPTH;
        if (fd_dev->fbd_flags & FDBD_HAS_BUFFERED_IO_WCE) {
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 07f5f94634bb..aa1620abec6d 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -615,6 +615,8 @@ iblock_execute_rw(struct se_cmd *cmd)
                                rw = WRITE_FUA;
                        else if (!(q->flush_flags & REQ_FLUSH))
                                rw = WRITE_FUA;
+                        else
+                                rw = WRITE;
                } else {
                        rw = WRITE;
                }
diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
index 853bab60e362..18d49df4d0ac 100644
--- a/drivers/target/target_core_internal.h
+++ b/drivers/target/target_core_internal.h
@@ -8,7 +8,6 @@ extern struct t10_alua_lu_gp *default_lu_gp;
 struct se_dev_entry *core_get_se_deve_from_rtpi(struct se_node_acl *, u16);
 int     core_free_device_list_for_node(struct se_node_acl *,
                struct se_portal_group *);
-void    core_dec_lacl_count(struct se_node_acl *, struct se_cmd *);
 void    core_update_device_list_access(u32, u32, struct se_node_acl *);
 int     core_enable_device_list_for_node(struct se_lun *, struct se_lun_acl *,
                u32, u32, struct se_node_acl *, struct se_portal_group *);
diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c
index e0b3c379aa14..0921a64b5550 100644
--- a/drivers/target/target_core_rd.c
+++ b/drivers/target/target_core_rd.c
@@ -291,6 +291,11 @@ rd_execute_rw(struct se_cmd *cmd)
        u32 src_len;
        u64 tmp;
+        if (dev->rd_flags & RDF_NULLIO) {
+                target_complete_cmd(cmd, SAM_STAT_GOOD);
+                return 0;
+        }
        tmp = cmd->t_task_lba * se_dev->dev_attrib.block_size;
        rd_offset = do_div(tmp, PAGE_SIZE);
        rd_page = tmp;
@@ -373,11 +378,12 @@ rd_execute_rw(struct se_cmd *cmd)
 }
 enum {
-        Opt_rd_pages, Opt_err
+        Opt_rd_pages, Opt_rd_nullio, Opt_err
 };
 static match_table_t tokens = {
        {Opt_rd_pages, "rd_pages=%d"},
+        {Opt_rd_nullio, "rd_nullio=%d"},
        {Opt_err, NULL}
 };
@@ -408,6 +414,14 @@ static ssize_t rd_set_configfs_dev_params(struct se_device *dev,
                                " Count: %u\n", rd_dev->rd_page_count);
                        rd_dev->rd_flags |= RDF_HAS_PAGE_COUNT;
                        break;
+                case Opt_rd_nullio:
+                        match_int(args, &arg);
+                        if (arg != 1)
+                                break;
+                        pr_debug("RAMDISK: Setting NULLIO flag: %d\n", arg);
+                        rd_dev->rd_flags |= RDF_NULLIO;
+                        break;
                default:
                        break;
                }
@@ -424,8 +438,9 @@ static ssize_t rd_show_configfs_dev_params(struct se_device *dev, char *b)
        ssize_t bl = sprintf(b, "TCM RamDisk ID: %u  RamDisk Makeup: rd_mcp\n",
                        rd_dev->rd_dev_id);
        bl += sprintf(b + bl, "        PAGES/PAGE_SIZE: %u*%lu"
-                        "  SG_table_count: %u\n", rd_dev->rd_page_count,
+                        "  SG_table_count: %u  nullio: %d\n", rd_dev->rd_page_count,
-                        PAGE_SIZE, rd_dev->sg_table_count);
+                        PAGE_SIZE, rd_dev->sg_table_count,
+                        !!(rd_dev->rd_flags & RDF_NULLIO));
        return bl;
 }
diff --git a/drivers/target/target_core_rd.h b/drivers/target/target_core_rd.h
index 933b38b6e563..1789d1e14395 100644
--- a/drivers/target/target_core_rd.h
+++ b/drivers/target/target_core_rd.h
@@ -22,6 +22,7 @@ struct rd_dev_sg_table {
 } ____cacheline_aligned;
 #define RDF_HAS_PAGE_COUNT      0x01
+#define RDF_NULLIO              0x02
 struct rd_dev {
        struct se_device dev;
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index f8388b4024aa..4a793362309d 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2163,8 +2163,6 @@ void transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
                if (wait_for_tasks)
                        transport_wait_for_tasks(cmd);
-                core_dec_lacl_count(cmd->se_sess->se_node_acl, cmd);
                if (cmd->se_lun)
                        transport_lun_remove_cmd(cmd);
@@ -2213,21 +2211,19 @@ static void target_release_cmd_kref(struct kref *kref)
 {
        struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref);
        struct se_session *se_sess = se_cmd->se_sess;
-        unsigned long flags;
-        spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
        if (list_empty(&se_cmd->se_cmd_list)) {
-                spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+                spin_unlock(&se_sess->sess_cmd_lock);
                se_cmd->se_tfo->release_cmd(se_cmd);
                return;
        }
        if (se_sess->sess_tearing_down && se_cmd->cmd_wait_set) {
-                spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+                spin_unlock(&se_sess->sess_cmd_lock);
                complete(&se_cmd->cmd_wait_comp);
                return;
        }
        list_del(&se_cmd->se_cmd_list);
-        spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+        spin_unlock(&se_sess->sess_cmd_lock);
        se_cmd->se_tfo->release_cmd(se_cmd);
 }
@@ -2238,7 +2234,8 @@ static void target_release_cmd_kref(struct kref *kref)
 */
 int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd)
 {
-        return kref_put(&se_cmd->cmd_kref, target_release_cmd_kref);
+        return kref_put_spinlock_irqsave(&se_cmd->cmd_kref, target_release_cmd_kref,
+                        &se_sess->sess_cmd_lock);
 }
 EXPORT_SYMBOL(target_put_sess_cmd);
diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index bff0775e258c..5174ebac288d 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -3,6 +3,7 @@
 *
 * Since these may be in userspace, we use (inline) accessors.
 */
+#include <linux/module.h>
 #include <linux/vringh.h>
 #include <linux/virtio_ring.h>
 #include <linux/kernel.h>
@@ -1005,3 +1006,5 @@ int vringh_need_notify_kern(struct vringh *vrh)
        return __vringh_need_notify(vrh, getu16_kern);
 }
 EXPORT_SYMBOL(vringh_need_notify_kern);
+MODULE_LICENSE("GPL");