68 files changed, 696 insertions, 338 deletions

diff --git a/drivers/block/drbd/drbd_bitmap.c b/drivers/block/drbd/drbd_bitmap.c
index b5c5ff53cb5..fcb956bb4b4 100644
--- a/drivers/block/drbd/drbd_bitmap.c
+++ b/drivers/block/drbd/drbd_bitmap.c
@@ -1475,10 +1475,17 @@ void _drbd_bm_set_bits(struct drbd_conf *mdev, const unsigned long s, const unsi
                 first_word = 0;
                 spin_lock_irq(&b->bm_lock);
         }
-
         /* last page (respectively only page, for first page == last page) */
         last_word = MLPP(el >> LN2_BPL);
-        bm_set_full_words_within_one_page(mdev->bitmap, last_page, first_word, last_word);
+
+        /* consider bitmap->bm_bits = 32768, bitmap->bm_number_of_pages = 1. (or multiples).
+         * ==> e = 32767, el = 32768, last_page = 2,
+         * and now last_word = 0.
+         * We do not want to touch last_page in this case,
+         * as we did not allocate it, it is not present in bitmap->bm_pages.
+         */
+        if (last_word)
+                bm_set_full_words_within_one_page(mdev->bitmap, last_page, first_word, last_word);
 
         /* possibly trailing bits.
          * example: (e & 63) == 63, el will be e+1.
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index 9c5c84946b0..8e93a6ac9bb 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -472,12 +472,17 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
                 req->rq_state |= RQ_LOCAL_COMPLETED;
                 req->rq_state &= ~RQ_LOCAL_PENDING;
 
-                D_ASSERT(!(req->rq_state & RQ_NET_MASK));
+                if (req->rq_state & RQ_LOCAL_ABORTED) {
+                        _req_may_be_done(req, m);
+                        break;
+                }
 
                 __drbd_chk_io_error(mdev, false);
 
         goto_queue_for_net_read:
 
+                D_ASSERT(!(req->rq_state & RQ_NET_MASK));
+
                 /* no point in retrying if there is no good remote data,
                  * or we have no connection. */
                 if (mdev->state.pdsk != D_UP_TO_DATE) {
@@ -765,6 +770,40 @@ static int drbd_may_do_local_read(struct drbd_conf *mdev, sector_t sector, int s
         return 0 == drbd_bm_count_bits(mdev, sbnr, ebnr);
 }
 
+static void maybe_pull_ahead(struct drbd_conf *mdev)
+{
+        int congested = 0;
+
+        /* If I don't even have good local storage, we can not reasonably try
+         * to pull ahead of the peer. We also need the local reference to make
+         * sure mdev->act_log is there.
+         * Note: caller has to make sure that net_conf is there.
+         */
+        if (!get_ldev_if_state(mdev, D_UP_TO_DATE))
+                return;
+
+        if (mdev->net_conf->cong_fill &&
+            atomic_read(&mdev->ap_in_flight) >= mdev->net_conf->cong_fill) {
+                dev_info(DEV, "Congestion-fill threshold reached\n");
+                congested = 1;
+        }
+
+        if (mdev->act_log->used >= mdev->net_conf->cong_extents) {
+                dev_info(DEV, "Congestion-extents threshold reached\n");
+                congested = 1;
+        }
+
+        if (congested) {
+                queue_barrier(mdev); /* last barrier, after mirrored writes */
+
+                if (mdev->net_conf->on_congestion == OC_PULL_AHEAD)
+                        _drbd_set_state(_NS(mdev, conn, C_AHEAD), 0, NULL);
+                else  /*mdev->net_conf->on_congestion == OC_DISCONNECT */
+                        _drbd_set_state(_NS(mdev, conn, C_DISCONNECTING), 0, NULL);
+        }
+        put_ldev(mdev);
+}
+
 static int drbd_make_request_common(struct drbd_conf *mdev, struct bio *bio, unsigned long start_time)
 {
         const int rw = bio_rw(bio);
@@ -972,29 +1011,8 @@ allocate_barrier:
                 _req_mod(req, queue_for_send_oos);
 
         if (remote &&
-            mdev->net_conf->on_congestion != OC_BLOCK && mdev->agreed_pro_version >= 96) {
-                int congested = 0;
-
-                if (mdev->net_conf->cong_fill &&
-                    atomic_read(&mdev->ap_in_flight) >= mdev->net_conf->cong_fill) {
-                        dev_info(DEV, "Congestion-fill threshold reached\n");
-                        congested = 1;
-                }
-
-                if (mdev->act_log->used >= mdev->net_conf->cong_extents) {
-                        dev_info(DEV, "Congestion-extents threshold reached\n");
-                        congested = 1;
-                }
-
-                if (congested) {
-                        queue_barrier(mdev); /* last barrier, after mirrored writes */
-
-                        if (mdev->net_conf->on_congestion == OC_PULL_AHEAD)
-                                _drbd_set_state(_NS(mdev, conn, C_AHEAD), 0, NULL);
-                        else  /*mdev->net_conf->on_congestion == OC_DISCONNECT */
-                                _drbd_set_state(_NS(mdev, conn, C_DISCONNECTING), 0, NULL);
-                }
-        }
+            mdev->net_conf->on_congestion != OC_BLOCK && mdev->agreed_pro_version >= 96)
+                maybe_pull_ahead(mdev);
 
         spin_unlock_irq(&mdev->req_lock);
         kfree(b); /* if someone else has beaten us to it... */
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index cce7df367b7..553f43a9095 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -671,6 +671,7 @@ static void __reschedule_timeout(int drive, const char *message)
 
         if (drive == current_reqD)
                 drive = current_drive;
+        __cancel_delayed_work(&fd_timeout);
 
         if (drive < 0 || drive >= N_DRIVE) {
                 delay = 20UL * HZ;
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 264bc77dcb9..a8fddeb3d63 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -37,6 +37,7 @@
 #include <linux/kthread.h>
 #include <../drivers/ata/ahci.h>
 #include <linux/export.h>
+#include <linux/debugfs.h>
 #include "mtip32xx.h"
 
 #define HW_CMD_SLOT_SZ          (MTIP_MAX_COMMAND_SLOTS * 32)
@@ -85,6 +86,7 @@ static int instance;
  * allocated in mtip_init().
  */
 static int mtip_major;
+static struct dentry *dfs_parent;
 
 static DEFINE_SPINLOCK(rssd_index_lock);
 static DEFINE_IDA(rssd_index_ida);
@@ -2546,7 +2548,7 @@ static struct scatterlist *mtip_hw_get_scatterlist(struct driver_data *dd,
 }
 
 /*
- * Sysfs register/status dump.
+ * Sysfs status dump.
  *
  * @dev  Pointer to the device structure, passed by the kernrel.
  * @attr Pointer to the device_attribute structure passed by the kernel.
@@ -2555,45 +2557,68 @@ static struct scatterlist *mtip_hw_get_scatterlist(struct driver_data *dd,
  * return value
  *      The size, in bytes, of the data copied into buf.
  */
-static ssize_t mtip_hw_show_registers(struct device *dev,
+static ssize_t mtip_hw_show_status(struct device *dev,
                                 struct device_attribute *attr,
                                 char *buf)
 {
-        u32 group_allocated;
         struct driver_data *dd = dev_to_disk(dev)->private_data;
         int size = 0;
+
+        if (test_bit(MTIP_DDF_OVER_TEMP_BIT, &dd->dd_flag))
+                size += sprintf(buf, "%s", "thermal_shutdown\n");
+        else if (test_bit(MTIP_DDF_WRITE_PROTECT_BIT, &dd->dd_flag))
+                size += sprintf(buf, "%s", "write_protect\n");
+        else
+                size += sprintf(buf, "%s", "online\n");
+
+        return size;
+}
+
+static DEVICE_ATTR(status, S_IRUGO, mtip_hw_show_status, NULL);
+
+static ssize_t mtip_hw_read_registers(struct file *f, char __user *ubuf,
+                                  size_t len, loff_t *offset)
+{
+        struct driver_data *dd =  (struct driver_data *)f->private_data;
+        char buf[MTIP_DFS_MAX_BUF_SIZE];
+        u32 group_allocated;
+        int size = *offset;
         int n;
 
-        size += sprintf(&buf[size], "Hardware\n--------\n");
-        size += sprintf(&buf[size], "S ACTive      : [ 0x");
+        if (!len || size)
+                return 0;
+
+        if (size < 0)
+                return -EINVAL;
+
+        size += sprintf(&buf[size], "H/ S ACTive      : [ 0x");
 
         for (n = dd->slot_groups-1; n >= 0; n--)
                 size += sprintf(&buf[size], "%08X ",
                                          readl(dd->port->s_active[n]));
 
         size += sprintf(&buf[size], "]\n");
-        size += sprintf(&buf[size], "Command Issue : [ 0x");
+        size += sprintf(&buf[size], "H/ Command Issue : [ 0x");
 
         for (n = dd->slot_groups-1; n >= 0; n--)
                 size += sprintf(&buf[size], "%08X ",
                                         readl(dd->port->cmd_issue[n]));
 
         size += sprintf(&buf[size], "]\n");
-        size += sprintf(&buf[size], "Completed     : [ 0x");
+        size += sprintf(&buf[size], "H/ Completed     : [ 0x");
 
         for (n = dd->slot_groups-1; n >= 0; n--)
                 size += sprintf(&buf[size], "%08X ",
                                 readl(dd->port->completed[n]));
 
         size += sprintf(&buf[size], "]\n");
-        size += sprintf(&buf[size], "PORT IRQ STAT : [ 0x%08X ]\n",
+        size += sprintf(&buf[size], "H/ PORT IRQ STAT : [ 0x%08X ]\n",
                                 readl(dd->port->mmio + PORT_IRQ_STAT));
-        size += sprintf(&buf[size], "HOST IRQ STAT : [ 0x%08X ]\n",
+        size += sprintf(&buf[size], "H/ HOST IRQ STAT : [ 0x%08X ]\n",
                                 readl(dd->mmio + HOST_IRQ_STAT));
         size += sprintf(&buf[size], "\n");
 
-        size += sprintf(&buf[size], "Local\n-----\n");
-        size += sprintf(&buf[size], "Allocated    : [ 0x");
+        size += sprintf(&buf[size], "L/ Allocated     : [ 0x");
 
         for (n = dd->slot_groups-1; n >= 0; n--) {
                 if (sizeof(long) > sizeof(u32))
@@ -2605,7 +2630,7 @@ static ssize_t mtip_hw_show_registers(struct device *dev,
         }
         size += sprintf(&buf[size], "]\n");
 
-        size += sprintf(&buf[size], "Commands in Q: [ 0x");
+        size += sprintf(&buf[size], "L/ Commands in Q : [ 0x");
 
         for (n = dd->slot_groups-1; n >= 0; n--) {
                 if (sizeof(long) > sizeof(u32))
@@ -2617,44 +2642,53 @@ static ssize_t mtip_hw_show_registers(struct device *dev,
         }
         size += sprintf(&buf[size], "]\n");
 
-        return size;
+        *offset = size <= len ? size : len;
+        size = copy_to_user(ubuf, buf, *offset);
+        if (size)
+                return -EFAULT;
+
+        return *offset;
 }
 
-static ssize_t mtip_hw_show_status(struct device *dev,
-                                struct device_attribute *attr,
-                                char *buf)
+static ssize_t mtip_hw_read_flags(struct file *f, char __user *ubuf,
+                                  size_t len, loff_t *offset)
 {
-        struct driver_data *dd = dev_to_disk(dev)->private_data;
-        int size = 0;
+        struct driver_data *dd =  (struct driver_data *)f->private_data;
+        char buf[MTIP_DFS_MAX_BUF_SIZE];
+        int size = *offset;
 
-        if (test_bit(MTIP_DDF_OVER_TEMP_BIT, &dd->dd_flag))
-                size += sprintf(buf, "%s", "thermal_shutdown\n");
-        else if (test_bit(MTIP_DDF_WRITE_PROTECT_BIT, &dd->dd_flag))
-                size += sprintf(buf, "%s", "write_protect\n");
-        else
-                size += sprintf(buf, "%s", "online\n");
-
-        return size;
-}
+        if (!len || size)
+                return 0;
 
-static ssize_t mtip_hw_show_flags(struct device *dev,
-                                struct device_attribute *attr,
-                                char *buf)
-{
-        struct driver_data *dd = dev_to_disk(dev)->private_data;
-        int size = 0;
+        if (size < 0)
+                return -EINVAL;
 
-        size += sprintf(&buf[size], "Flag in port struct : [ %08lX ]\n",
+        size += sprintf(&buf[size], "Flag-port : [ %08lX ]\n",
                                                         dd->port->flags);
-        size += sprintf(&buf[size], "Flag in dd struct   : [ %08lX ]\n",
+        size += sprintf(&buf[size], "Flag-dd   : [ %08lX ]\n",
                                                         dd->dd_flag);
 
-        return size;
+        *offset = size <= len ? size : len;
+        size = copy_to_user(ubuf, buf, *offset);
+        if (size)
+                return -EFAULT;
+
+        return *offset;
 }
 
-static DEVICE_ATTR(registers, S_IRUGO, mtip_hw_show_registers, NULL);
-static DEVICE_ATTR(status, S_IRUGO, mtip_hw_show_status, NULL);
-static DEVICE_ATTR(flags, S_IRUGO, mtip_hw_show_flags, NULL);
+static const struct file_operations mtip_regs_fops = {
+        .owner  = THIS_MODULE,
+        .open   = simple_open,
+        .read   = mtip_hw_read_registers,
+        .llseek = no_llseek,
+};
+
+static const struct file_operations mtip_flags_fops = {
+        .owner  = THIS_MODULE,
+        .open   = simple_open,
+        .read   = mtip_hw_read_flags,
+        .llseek = no_llseek,
+};
 
 /*
  * Create the sysfs related attributes.
@@ -2671,15 +2705,9 @@ static int mtip_hw_sysfs_init(struct driver_data *dd, struct kobject *kobj)
         if (!kobj || !dd)
                 return -EINVAL;
 
-        if (sysfs_create_file(kobj, &dev_attr_registers.attr))
-                dev_warn(&dd->pdev->dev,
-                        "Error creating 'registers' sysfs entry\n");
         if (sysfs_create_file(kobj, &dev_attr_status.attr))
                 dev_warn(&dd->pdev->dev,
                         "Error creating 'status' sysfs entry\n");
-        if (sysfs_create_file(kobj, &dev_attr_flags.attr))
-                dev_warn(&dd->pdev->dev,
-                        "Error creating 'flags' sysfs entry\n");
         return 0;
 }
 
@@ -2698,13 +2726,39 @@ static int mtip_hw_sysfs_exit(struct driver_data *dd, struct kobject *kobj)
         if (!kobj || !dd)
                 return -EINVAL;
 
-        sysfs_remove_file(kobj, &dev_attr_registers.attr);
         sysfs_remove_file(kobj, &dev_attr_status.attr);
-        sysfs_remove_file(kobj, &dev_attr_flags.attr);
 
         return 0;
 }
 
+static int mtip_hw_debugfs_init(struct driver_data *dd)
+{
+        if (!dfs_parent)
+                return -1;
+
+        dd->dfs_node = debugfs_create_dir(dd->disk->disk_name, dfs_parent);
+        if (IS_ERR_OR_NULL(dd->dfs_node)) {
+                dev_warn(&dd->pdev->dev,
+                        "Error creating node %s under debugfs\n",
+                                                dd->disk->disk_name);
+                dd->dfs_node = NULL;
+                return -1;
+        }
+
+        debugfs_create_file("flags", S_IRUGO, dd->dfs_node, dd,
+                                                        &mtip_flags_fops);
+        debugfs_create_file("registers", S_IRUGO, dd->dfs_node, dd,
+                                                        &mtip_regs_fops);
+
+        return 0;
+}
+
+static void mtip_hw_debugfs_exit(struct driver_data *dd)
+{
+        debugfs_remove_recursive(dd->dfs_node);
+}
+
+
 /*
  * Perform any init/resume time hardware setup
  *
@@ -3730,6 +3784,7 @@ skip_create_disk:
                 mtip_hw_sysfs_init(dd, kobj);
                 kobject_put(kobj);
         }
+        mtip_hw_debugfs_init(dd);
 
         if (dd->mtip_svc_handler) {
                 set_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag);
@@ -3755,6 +3810,8 @@ start_service_thread:
         return rv;
 
 kthread_run_error:
+        mtip_hw_debugfs_exit(dd);
+
         /* Delete our gendisk. This also removes the device from /dev */
         del_gendisk(dd->disk);
 
@@ -3805,6 +3862,7 @@ static int mtip_block_remove(struct driver_data *dd)
                         kobject_put(kobj);
                 }
         }
+        mtip_hw_debugfs_exit(dd);
 
         /*
          * Delete our gendisk structure. This also removes the device
@@ -4152,10 +4210,20 @@ static int __init mtip_init(void)
         }
         mtip_major = error;
 
+        if (!dfs_parent) {
+                dfs_parent = debugfs_create_dir("rssd", NULL);
+                if (IS_ERR_OR_NULL(dfs_parent)) {
+                        printk(KERN_WARNING "Error creating debugfs parent\n");
+                        dfs_parent = NULL;
+                }
+        }
+
         /* Register our PCI operations. */
         error = pci_register_driver(&mtip_pci_driver);
-        if (error)
+        if (error) {
+                debugfs_remove(dfs_parent);
                 unregister_blkdev(mtip_major, MTIP_DRV_NAME);
+        }
 
         return error;
 }
@@ -4172,6 +4240,8 @@ static int __init mtip_init(void)
  */
 static void __exit mtip_exit(void)
 {
+        debugfs_remove_recursive(dfs_parent);
+
         /* Release the allocated major block device number. */
         unregister_blkdev(mtip_major, MTIP_DRV_NAME);
 
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index b2c88da26b2..f51fc23d17b 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -26,7 +26,6 @@
 #include <linux/ata.h>
 #include <linux/interrupt.h>
 #include <linux/genhd.h>
-#include <linux/version.h>
 
 /* Offset of Subsystem Device ID in pci confoguration space */
 #define PCI_SUBSYSTEM_DEVICEID  0x2E
@@ -111,6 +110,8 @@
  #define dbg_printk(format, arg...)
 #endif
 
+#define MTIP_DFS_MAX_BUF_SIZE 1024
+
 #define __force_bit2int (unsigned int __force)
 
 enum {
@@ -447,6 +448,8 @@ struct driver_data {
         unsigned long dd_flag; /* NOTE: use atomic bit operations on this */
 
         struct task_struct *mtip_svc_handler; /* task_struct of svc thd */
+
+        struct dentry *dfs_node;
 };
 
 #endif
diff --git a/drivers/block/umem.c b/drivers/block/umem.c
index aa2712060bf..9a72277a31d 100644
--- a/drivers/block/umem.c
+++ b/drivers/block/umem.c
@@ -513,6 +513,44 @@ static void process_page(unsigned long data)
         }
 }
 
+struct mm_plug_cb {
+        struct blk_plug_cb cb;
+        struct cardinfo *card;
+};
+
+static void mm_unplug(struct blk_plug_cb *cb)
+{
+        struct mm_plug_cb *mmcb = container_of(cb, struct mm_plug_cb, cb);
+
+        spin_lock_irq(&mmcb->card->lock);
+        activate(mmcb->card);
+        spin_unlock_irq(&mmcb->card->lock);
+        kfree(mmcb);
+}
+
+static int mm_check_plugged(struct cardinfo *card)
+{
+        struct blk_plug *plug = current->plug;
+        struct mm_plug_cb *mmcb;
+
+        if (!plug)
+                return 0;
+
+        list_for_each_entry(mmcb, &plug->cb_list, cb.list) {
+                if (mmcb->cb.callback == mm_unplug && mmcb->card == card)
+                        return 1;
+        }
+        /* Not currently on the callback list */
+        mmcb = kmalloc(sizeof(*mmcb), GFP_ATOMIC);
+        if (!mmcb)
+                return 0;
+
+        mmcb->card = card;
+        mmcb->cb.callback = mm_unplug;
+        list_add(&mmcb->cb.list, &plug->cb_list);
+        return 1;
+}
+
 static void mm_make_request(struct request_queue *q, struct bio *bio)
 {
         struct cardinfo *card = q->queuedata;
@@ -523,6 +561,8 @@ static void mm_make_request(struct request_queue *q, struct bio *bio)
         *card->biotail = bio;
         bio->bi_next = NULL;
         card->biotail = &bio->bi_next;
+        if (bio->bi_rw & REQ_SYNC || !mm_check_plugged(card))
+                activate(card);
         spin_unlock_irq(&card->lock);
 
         return;
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index 773cf27dc23..9ad3b5ec1dc 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -257,6 +257,7 @@ static inline void blkif_get_x86_32_req(struct blkif_request *dst,
                 break;
         case BLKIF_OP_DISCARD:
                 dst->u.discard.flag = src->u.discard.flag;
+                dst->u.discard.id = src->u.discard.id;
                 dst->u.discard.sector_number = src->u.discard.sector_number;
                 dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
                 break;
@@ -287,6 +288,7 @@ static inline void blkif_get_x86_64_req(struct blkif_request *dst,
                 break;
         case BLKIF_OP_DISCARD:
                 dst->u.discard.flag = src->u.discard.flag;
+                dst->u.discard.id = src->u.discard.id;
                 dst->u.discard.sector_number = src->u.discard.sector_number;
                 dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
                 break;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 60eed4bdd2e..e4fb3374dcd 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -141,14 +141,36 @@ static int get_id_from_freelist(struct blkfront_info *info)
         return free;
 }
 
-static void add_id_to_freelist(struct blkfront_info *info,
+static int add_id_to_freelist(struct blkfront_info *info,
                                unsigned long id)
 {
+        if (info->shadow[id].req.u.rw.id != id)
+                return -EINVAL;
+        if (info->shadow[id].request == NULL)
+                return -EINVAL;
         info->shadow[id].req.u.rw.id  = info->shadow_free;
         info->shadow[id].request = NULL;
         info->shadow_free = id;
+        return 0;
 }
 
+static const char *op_name(int op)
+{
+        static const char *const names[] = {
+                [BLKIF_OP_READ] = "read",
+                [BLKIF_OP_WRITE] = "write",
+                [BLKIF_OP_WRITE_BARRIER] = "barrier",
+                [BLKIF_OP_FLUSH_DISKCACHE] = "flush",
+                [BLKIF_OP_DISCARD] = "discard" };
+
+        if (op < 0 || op >= ARRAY_SIZE(names))
+                return "unknown";
+
+        if (!names[op])
+                return "reserved";
+
+        return names[op];
+}
 static int xlbd_reserve_minors(unsigned int minor, unsigned int nr)
 {
         unsigned int end = minor + nr;
@@ -746,20 +768,36 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
 
                 bret = RING_GET_RESPONSE(&info->ring, i);
                 id   = bret->id;
+                /*
+                 * The backend has messed up and given us an id that we would
+                 * never have given to it (we stamp it up to BLK_RING_SIZE -
+                 * look in get_id_from_freelist.
+                 */
+                if (id >= BLK_RING_SIZE) {
+                        WARN(1, "%s: response to %s has incorrect id (%ld)\n",
+                             info->gd->disk_name, op_name(bret->operation), id);
+                        /* We can't safely get the 'struct request' as
+                         * the id is busted. */
+                        continue;
+                }
                 req  = info->shadow[id].request;
 
                 if (bret->operation != BLKIF_OP_DISCARD)
                         blkif_completion(&info->shadow[id]);
 
-                add_id_to_freelist(info, id);
+                if (add_id_to_freelist(info, id)) {
+                        WARN(1, "%s: response to %s (id %ld) couldn't be recycled!\n",
+                             info->gd->disk_name, op_name(bret->operation), id);
+                        continue;
+                }
 
                 error = (bret->status == BLKIF_RSP_OKAY) ? 0 : -EIO;
                 switch (bret->operation) {
                 case BLKIF_OP_DISCARD:
                         if (unlikely(bret->status == BLKIF_RSP_EOPNOTSUPP)) {
                                 struct request_queue *rq = info->rq;
-                                printk(KERN_WARNING "blkfront: %s: discard op failed\n",
-                                           info->gd->disk_name);
+                                printk(KERN_WARNING "blkfront: %s: %s op failed\n",
+                                           info->gd->disk_name, op_name(bret->operation));
                                 error = -EOPNOTSUPP;
                                 info->feature_discard = 0;
                                 info->feature_secdiscard = 0;
@@ -771,18 +809,14 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
                 case BLKIF_OP_FLUSH_DISKCACHE:
                 case BLKIF_OP_WRITE_BARRIER:
                         if (unlikely(bret->status == BLKIF_RSP_EOPNOTSUPP)) {
-                                printk(KERN_WARNING "blkfront: %s: write %s op failed\n",
-                                       info->flush_op == BLKIF_OP_WRITE_BARRIER ?
-                                       "barrier" :  "flush disk cache",
-                                       info->gd->disk_name);
+                                printk(KERN_WARNING "blkfront: %s: %s op failed\n",
+                                       info->gd->disk_name, op_name(bret->operation));
                                 error = -EOPNOTSUPP;
                         }
                         if (unlikely(bret->status == BLKIF_RSP_ERROR &&
                                      info->shadow[id].req.u.rw.nr_segments == 0)) {
-                                printk(KERN_WARNING "blkfront: %s: empty write %s op failed\n",
-                                       info->flush_op == BLKIF_OP_WRITE_BARRIER ?
-                                       "barrier" :  "flush disk cache",
-                                       info->gd->disk_name);
+                                printk(KERN_WARNING "blkfront: %s: empty %s op failed\n",
+                                       info->gd->disk_name, op_name(bret->operation));
                                 error = -EOPNOTSUPP;
                         }
                         if (unlikely(error)) {
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index dcbe0561609..9a1eb0cfa95 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1067,26 +1067,24 @@ static int __clk_set_parent(struct clk *clk, struct clk *parent)
 
         old_parent = clk->parent;
 
-        /* find index of new parent clock using cached parent ptrs */
-        if (clk->parents)
-                for (i = 0; i < clk->num_parents; i++)
-                        if (clk->parents[i] == parent)
-                                break;
-        else
+        if (!clk->parents)
                 clk->parents = kzalloc((sizeof(struct clk*) * clk->num_parents),
                                                                 GFP_KERNEL);
 
         /*
-         * find index of new parent clock using string name comparison
-         * also try to cache the parent to avoid future calls to __clk_lookup
+         * find index of new parent clock using cached parent ptrs,
+         * or if not yet cached, use string name comparison and cache
+         * them now to avoid future calls to __clk_lookup.
          */
-        if (i == clk->num_parents)
-                for (i = 0; i < clk->num_parents; i++)
-                        if (!strcmp(clk->parent_names[i], parent->name)) {
-                                if (clk->parents)
-                                        clk->parents[i] = __clk_lookup(parent->name);
-                                break;
-                        }
+        for (i = 0; i < clk->num_parents; i++) {
+                if (clk->parents && clk->parents[i] == parent)
+                        break;
+                else if (!strcmp(clk->parent_names[i], parent->name)) {
+                        if (clk->parents)
+                                clk->parents[i] = __clk_lookup(parent->name);
+                        break;
+                }
+        }
 
         if (i == clk->num_parents) {
                 pr_debug("%s: clock %s is not a possible parent of clock %s\n",
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 5873e481e5d..a8743c399e8 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1039,6 +1039,24 @@ mode_in_range(const struct drm_display_mode *mode, struct edid *edid,
         return true;
 }
 
+static bool valid_inferred_mode(const struct drm_connector *connector,
+                                const struct drm_display_mode *mode)
+{
+        struct drm_display_mode *m;
+        bool ok = false;
+
+        list_for_each_entry(m, &connector->probed_modes, head) {
+                if (mode->hdisplay == m->hdisplay &&
+                    mode->vdisplay == m->vdisplay &&
+                    drm_mode_vrefresh(mode) == drm_mode_vrefresh(m))
+                        return false; /* duplicated */
+                if (mode->hdisplay <= m->hdisplay &&
+                    mode->vdisplay <= m->vdisplay)
+                        ok = true;
+        }
+        return ok;
+}
+
 static int
 drm_dmt_modes_for_range(struct drm_connector *connector, struct edid *edid,
                         struct detailed_timing *timing)
@@ -1048,7 +1066,8 @@ drm_dmt_modes_for_range(struct drm_connector *connector, struct edid *edid,
         struct drm_device *dev = connector->dev;
 
         for (i = 0; i < drm_num_dmt_modes; i++) {
-                if (mode_in_range(drm_dmt_modes + i, edid, timing)) {
+                if (mode_in_range(drm_dmt_modes + i, edid, timing) &&
+                    valid_inferred_mode(connector, drm_dmt_modes + i)) {
                         newmode = drm_mode_duplicate(dev, &drm_dmt_modes[i]);
                         if (newmode) {
                                 drm_mode_probed_add(connector, newmode);
@@ -1088,7 +1107,8 @@ drm_gtf_modes_for_range(struct drm_connector *connector, struct edid *edid,
                         return modes;
 
                 fixup_mode_1366x768(newmode);
-                if (!mode_in_range(newmode, edid, timing)) {
+                if (!mode_in_range(newmode, edid, timing) ||
+                    !valid_inferred_mode(connector, newmode)) {
                         drm_mode_destroy(dev, newmode);
                         continue;
                 }
@@ -1116,7 +1136,8 @@ drm_cvt_modes_for_range(struct drm_connector *connector, struct edid *edid,
                         return modes;
 
                 fixup_mode_1366x768(newmode);
-                if (!mode_in_range(newmode, edid, timing)) {
+                if (!mode_in_range(newmode, edid, timing) ||
+                    !valid_inferred_mode(connector, newmode)) {
                         drm_mode_destroy(dev, newmode);
                         continue;
                 }
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index f94792626b9..36822b924eb 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1401,6 +1401,27 @@ i915_mtrr_setup(struct drm_i915_private *dev_priv, unsigned long base,
         }
 }
 
+static void i915_kick_out_firmware_fb(struct drm_i915_private *dev_priv)
+{
+        struct apertures_struct *ap;
+        struct pci_dev *pdev = dev_priv->dev->pdev;
+        bool primary;
+
+        ap = alloc_apertures(1);
+        if (!ap)
+                return;
+
+        ap->ranges[0].base = dev_priv->dev->agp->base;
+        ap->ranges[0].size =
+                dev_priv->mm.gtt->gtt_mappable_entries << PAGE_SHIFT;
+        primary =
+                pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW;
+
+        remove_conflicting_framebuffers(ap, "inteldrmfb", primary);
+
+        kfree(ap);
+}
+
 /**
  * i915_driver_load - setup chip and create an initial config
  * @dev: DRM device
@@ -1446,6 +1467,15 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                 goto free_priv;
         }
 
+        dev_priv->mm.gtt = intel_gtt_get();
+        if (!dev_priv->mm.gtt) {
+                DRM_ERROR("Failed to initialize GTT\n");
+                ret = -ENODEV;
+                goto put_bridge;
+        }
+
+        i915_kick_out_firmware_fb(dev_priv);
+
         pci_set_master(dev->pdev);
 
         /* overlay on gen2 is broken and can't address above 1G */
@@ -1471,13 +1501,6 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                 goto put_bridge;
         }
 
-        dev_priv->mm.gtt = intel_gtt_get();
-        if (!dev_priv->mm.gtt) {
-                DRM_ERROR("Failed to initialize GTT\n");
-                ret = -ENODEV;
-                goto out_rmmap;
-        }
-
         aperture_size = dev_priv->mm.gtt->gtt_mappable_entries << PAGE_SHIFT;
 
         dev_priv->mm.gtt_mapping =
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 59d44937dd9..84b648a7ddd 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -289,8 +289,9 @@ int radeon_vm_manager_init(struct radeon_device *rdev)
         rdev->vm_manager.enabled = false;
 
         /* mark first vm as always in use, it's the system one */
+        /* allocate enough for 2 full VM pts */
         r = radeon_sa_bo_manager_init(rdev, &rdev->vm_manager.sa_manager,
-                                      rdev->vm_manager.max_pfn * 8,
+                                      rdev->vm_manager.max_pfn * 8 * 2,
                                       RADEON_GEM_DOMAIN_VRAM);
         if (r) {
                 dev_err(rdev->dev, "failed to allocate vm bo (%dKB)\n",
@@ -633,7 +634,15 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
         mutex_init(&vm->mutex);
         INIT_LIST_HEAD(&vm->list);
         INIT_LIST_HEAD(&vm->va);
-        vm->last_pfn = 0;
+        /* SI requires equal sized PTs for all VMs, so always set
+         * last_pfn to max_pfn.  cayman allows variable sized
+         * pts so we can grow then as needed.  Once we switch
+         * to two level pts we can unify this again.
+         */
+        if (rdev->family >= CHIP_TAHITI)
+                vm->last_pfn = rdev->vm_manager.max_pfn;
+        else
+                vm->last_pfn = 0;
         /* map the ib pool buffer at 0 in virtual address space, set
          * read only
          */
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index f28bd4b7ef9..21ec9f5653c 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -292,6 +292,7 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data,
 int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
                           struct drm_file *filp)
 {
+        struct radeon_device *rdev = dev->dev_private;
         struct drm_radeon_gem_busy *args = data;
         struct drm_gem_object *gobj;
         struct radeon_bo *robj;
@@ -317,13 +318,14 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
                 break;
         }
         drm_gem_object_unreference_unlocked(gobj);
-        r = radeon_gem_handle_lockup(robj->rdev, r);
+        r = radeon_gem_handle_lockup(rdev, r);
         return r;
 }
 
 int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
                               struct drm_file *filp)
 {
+        struct radeon_device *rdev = dev->dev_private;
         struct drm_radeon_gem_wait_idle *args = data;
         struct drm_gem_object *gobj;
         struct radeon_bo *robj;
@@ -336,10 +338,10 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
         robj = gem_to_radeon_bo(gobj);
         r = radeon_bo_wait(robj, NULL, false);
         /* callback hw specific functions if any */
-        if (robj->rdev->asic->ioctl_wait_idle)
-                robj->rdev->asic->ioctl_wait_idle(robj->rdev, robj);
+        if (rdev->asic->ioctl_wait_idle)
+                robj->rdev->asic->ioctl_wait_idle(rdev, robj);
         drm_gem_object_unreference_unlocked(gobj);
-        r = radeon_gem_handle_lockup(robj->rdev, r);
+        r = radeon_gem_handle_lockup(rdev, r);
         return r;
 }
 
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index c7b61f16ecf..0b0279291a7 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2365,12 +2365,12 @@ int si_pcie_gart_enable(struct radeon_device *rdev)
         WREG32(0x15DC, 0);
 
         /* empty context1-15 */
-        /* FIXME start with 1G, once using 2 level pt switch to full
+        /* FIXME start with 4G, once using 2 level pt switch to full
          * vm size space
          */
         /* set vm size, must be a multiple of 4 */
         WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
-        WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, (1 << 30) / RADEON_GPU_PAGE_SIZE);
+        WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
         for (i = 1; i < 16; i++) {
                 if (i < 8)
                         WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
diff --git a/drivers/input/joystick/as5011.c b/drivers/input/joystick/as5011.c
index 57d19d4e0a2..c96653b5886 100644
--- a/drivers/input/joystick/as5011.c
+++ b/drivers/input/joystick/as5011.c
@@ -282,7 +282,8 @@ static int __devinit as5011_probe(struct i2c_client *client,
 
         error = request_threaded_irq(as5011->button_irq,
                                      NULL, as5011_button_interrupt,
-                                     IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
+                                     IRQF_TRIGGER_RISING |
+                                        IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                      "as5011_button", as5011);
         if (error < 0) {
                 dev_err(&client->dev,
@@ -296,7 +297,7 @@ static int __devinit as5011_probe(struct i2c_client *client,
 
         error = request_threaded_irq(as5011->axis_irq, NULL,
                                      as5011_axis_interrupt,
-                                     plat_data->axis_irqflags,
+                                     plat_data->axis_irqflags | IRQF_ONESHOT,
                                      "as5011_joystick", as5011);
         if (error) {
                 dev_err(&client->dev,
diff --git a/drivers/input/keyboard/mcs_touchkey.c b/drivers/input/keyboard/mcs_touchkey.c
index 64a0ca4c92f..0d77f6c8495 100644
--- a/drivers/input/keyboard/mcs_touchkey.c
+++ b/drivers/input/keyboard/mcs_touchkey.c
@@ -178,7 +178,8 @@ static int __devinit mcs_touchkey_probe(struct i2c_client *client,
         }
 
         error = request_threaded_irq(client->irq, NULL, mcs_touchkey_interrupt,
-                        IRQF_TRIGGER_FALLING, client->dev.driver->name, data);
+                                     IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+                                     client->dev.driver->name, data);
         if (error) {
                 dev_err(&client->dev, "Failed to register interrupt\n");
                 goto err_free_mem;
diff --git a/drivers/input/keyboard/mpr121_touchkey.c b/drivers/input/keyboard/mpr121_touchkey.c
index caa218a51b5..7613f1cac95 100644
--- a/drivers/input/keyboard/mpr121_touchkey.c
+++ b/drivers/input/keyboard/mpr121_touchkey.c
@@ -248,7 +248,7 @@ static int __devinit mpr_touchkey_probe(struct i2c_client *client,
 
         error = request_threaded_irq(client->irq, NULL,
                                      mpr_touchkey_interrupt,
-                                     IRQF_TRIGGER_FALLING,
+                                     IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                      client->dev.driver->name, mpr121);
         if (error) {
                 dev_err(&client->dev, "Failed to register interrupt\n");
diff --git a/drivers/input/keyboard/qt1070.c b/drivers/input/keyboard/qt1070.c
index 0b7b2f89175..ca68f2992d7 100644
--- a/drivers/input/keyboard/qt1070.c
+++ b/drivers/input/keyboard/qt1070.c
@@ -201,7 +201,8 @@ static int __devinit qt1070_probe(struct i2c_client *client,
         msleep(QT1070_RESET_TIME);
 
         err = request_threaded_irq(client->irq, NULL, qt1070_interrupt,
-                IRQF_TRIGGER_NONE, client->dev.driver->name, data);
+                                   IRQF_TRIGGER_NONE | IRQF_ONESHOT,
+                                   client->dev.driver->name, data);
         if (err) {
                 dev_err(&client->dev, "fail to request irq\n");
                 goto err_free_mem;
diff --git a/drivers/input/keyboard/tca6416-keypad.c b/drivers/input/keyboard/tca6416-keypad.c
index 3afea3f8971..c355cdde8d2 100644
--- a/drivers/input/keyboard/tca6416-keypad.c
+++ b/drivers/input/keyboard/tca6416-keypad.c
@@ -278,7 +278,8 @@ static int __devinit tca6416_keypad_probe(struct i2c_client *client,
 
                 error = request_threaded_irq(chip->irqnum, NULL,
                                              tca6416_keys_isr,
-                                             IRQF_TRIGGER_FALLING,
+                                             IRQF_TRIGGER_FALLING |
+                                                IRQF_ONESHOT,
                                              "tca6416-keypad", chip);
                 if (error) {
                         dev_dbg(&client->dev,
diff --git a/drivers/input/keyboard/tca8418_keypad.c b/drivers/input/keyboard/tca8418_keypad.c
index 5f87b28b319..893869b29ed 100644
--- a/drivers/input/keyboard/tca8418_keypad.c
+++ b/drivers/input/keyboard/tca8418_keypad.c
@@ -360,7 +360,7 @@ static int __devinit tca8418_keypad_probe(struct i2c_client *client,
                 client->irq = gpio_to_irq(client->irq);
 
         error = request_threaded_irq(client->irq, NULL, tca8418_irq_handler,
-                                     IRQF_TRIGGER_FALLING,
+                                     IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                      client->name, keypad_data);
         if (error) {
                 dev_dbg(&client->dev,
diff --git a/drivers/input/keyboard/tnetv107x-keypad.c b/drivers/input/keyboard/tnetv107x-keypad.c
index a4a445fb702..4c34f21fbe2 100644
--- a/drivers/input/keyboard/tnetv107x-keypad.c
+++ b/drivers/input/keyboard/tnetv107x-keypad.c
@@ -227,15 +227,15 @@ static int __devinit keypad_probe(struct platform_device *pdev)
                 goto error_clk;
         }
 
-        error = request_threaded_irq(kp->irq_press, NULL, keypad_irq, 0,
-                                     dev_name(dev), kp);
+        error = request_threaded_irq(kp->irq_press, NULL, keypad_irq,
+                                     IRQF_ONESHOT, dev_name(dev), kp);
         if (error < 0) {
                 dev_err(kp->dev, "Could not allocate keypad press key irq\n");
                 goto error_irq_press;
         }
 
-        error = request_threaded_irq(kp->irq_release, NULL, keypad_irq, 0,
-                                     dev_name(dev), kp);
+        error = request_threaded_irq(kp->irq_release, NULL, keypad_irq,
+                                     IRQF_ONESHOT, dev_name(dev), kp);
         if (error < 0) {
                 dev_err(kp->dev, "Could not allocate keypad release key irq\n");
                 goto error_irq_release;
diff --git a/drivers/input/misc/ad714x.c b/drivers/input/misc/ad714x.c
index 0ac75bbad4d..2e5d5e1de64 100644
--- a/drivers/input/misc/ad714x.c
+++ b/drivers/input/misc/ad714x.c
@@ -972,6 +972,7 @@ struct ad714x_chip *ad714x_probe(struct device *dev, u16 bus_type, int irq,
         struct ad714x_platform_data *plat_data = dev->platform_data;
         struct ad714x_chip *ad714x;
         void *drv_mem;
+        unsigned long irqflags;
 
         struct ad714x_button_drv *bt_drv;
         struct ad714x_slider_drv *sd_drv;
@@ -1162,10 +1163,11 @@ struct ad714x_chip *ad714x_probe(struct device *dev, u16 bus_type, int irq,
                 alloc_idx++;
         }
 
+        irqflags = plat_data->irqflags ?: IRQF_TRIGGER_FALLING;
+        irqflags |= IRQF_ONESHOT;
+
         error = request_threaded_irq(ad714x->irq, NULL, ad714x_interrupt_thread,
-                                plat_data->irqflags ?
-                                        plat_data->irqflags : IRQF_TRIGGER_FALLING,
-                                "ad714x_captouch", ad714x);
+                                     irqflags, "ad714x_captouch", ad714x);
         if (error) {
                 dev_err(dev, "can't allocate irq %d\n", ad714x->irq);
                 goto err_unreg_dev;
diff --git a/drivers/input/misc/dm355evm_keys.c b/drivers/input/misc/dm355evm_keys.c
index 35083c6836c..c1313d8535c 100644
--- a/drivers/input/misc/dm355evm_keys.c
+++ b/drivers/input/misc/dm355evm_keys.c
@@ -213,7 +213,8 @@ static int __devinit dm355evm_keys_probe(struct platform_device *pdev)
         /* REVISIT:  flush the event queue? */
 
         status = request_threaded_irq(keys->irq, NULL, dm355evm_keys_irq,
-                        IRQF_TRIGGER_FALLING, dev_name(&pdev->dev), keys);
+                                      IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+                                      dev_name(&pdev->dev), keys);
         if (status < 0)
                 goto fail2;
 
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index cad5602d3ce..8b31473a81f 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -216,7 +216,7 @@ static void wacom_retrieve_report_data(struct usb_interface *intf,
 
                 rep_data[0] = 12;
                 result = wacom_get_report(intf, WAC_HID_FEATURE_REPORT,
-                                          rep_data[0], &rep_data, 2,
+                                          rep_data[0], rep_data, 2,
                                           WAC_MSG_RETRIES);
 
                 if (result >= 0 && rep_data[1] > 2)
@@ -401,7 +401,9 @@ static int wacom_parse_hid(struct usb_interface *intf,
                                 break;
 
                         case HID_USAGE_CONTACTMAX:
-                                wacom_retrieve_report_data(intf, features);
+                                /* leave touch_max as is if predefined */
+                                if (!features->touch_max)
+                                        wacom_retrieve_report_data(intf, features);
                                 i++;
                                 break;
                         }
diff --git a/drivers/input/touchscreen/ad7879.c b/drivers/input/touchscreen/ad7879.c
index e2482b40da5..bd4eb427769 100644
--- a/drivers/input/touchscreen/ad7879.c
+++ b/drivers/input/touchscreen/ad7879.c
@@ -597,7 +597,7 @@ struct ad7879 *ad7879_probe(struct device *dev, u8 devid, unsigned int irq,
                         AD7879_TMR(ts->pen_down_acc_interval);
 
         err = request_threaded_irq(ts->irq, NULL, ad7879_irq,
-                                   IRQF_TRIGGER_FALLING,
+                                   IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                    dev_name(dev), ts);
         if (err) {
                 dev_err(dev, "irq %d busy?\n", ts->irq);
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 42e645062c2..25fd0561a17 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -1149,7 +1149,8 @@ static int __devinit mxt_probe(struct i2c_client *client,
                 goto err_free_object;
 
         error = request_threaded_irq(client->irq, NULL, mxt_interrupt,
-                        pdata->irqflags, client->dev.driver->name, data);
+                                     pdata->irqflags | IRQF_ONESHOT,
+                                     client->dev.driver->name, data);
         if (error) {
                 dev_err(&client->dev, "Failed to register interrupt\n");
                 goto err_free_object;
diff --git a/drivers/input/touchscreen/bu21013_ts.c b/drivers/input/touchscreen/bu21013_ts.c
index f2d03c06c2d..5c487d23f11 100644
--- a/drivers/input/touchscreen/bu21013_ts.c
+++ b/drivers/input/touchscreen/bu21013_ts.c
@@ -509,7 +509,8 @@ static int __devinit bu21013_probe(struct i2c_client *client,
         input_set_drvdata(in_dev, bu21013_data);
 
         error = request_threaded_irq(pdata->irq, NULL, bu21013_gpio_irq,
-                                     IRQF_TRIGGER_FALLING | IRQF_SHARED,
+                                     IRQF_TRIGGER_FALLING | IRQF_SHARED |
+                                        IRQF_ONESHOT,
                                      DRIVER_TP, bu21013_data);
         if (error) {
                 dev_err(&client->dev, "request irq %d failed\n", pdata->irq);
diff --git a/drivers/input/touchscreen/cy8ctmg110_ts.c b/drivers/input/touchscreen/cy8ctmg110_ts.c
index 237753ad103..464f1bf4b61 100644
--- a/drivers/input/touchscreen/cy8ctmg110_ts.c
+++ b/drivers/input/touchscreen/cy8ctmg110_ts.c
@@ -251,7 +251,8 @@ static int __devinit cy8ctmg110_probe(struct i2c_client *client,
         }
 
         err = request_threaded_irq(client->irq, NULL, cy8ctmg110_irq_thread,
-                                   IRQF_TRIGGER_RISING, "touch_reset_key", ts);
+                                   IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+                                   "touch_reset_key", ts);
         if (err < 0) {
                 dev_err(&client->dev,
                         "irq %d busy? error %d\n", client->irq, err);
diff --git a/drivers/input/touchscreen/intel-mid-touch.c b/drivers/input/touchscreen/intel-mid-touch.c
index 3cd7a837f82..cf299377fc4 100644
--- a/drivers/input/touchscreen/intel-mid-touch.c
+++ b/drivers/input/touchscreen/intel-mid-touch.c
@@ -620,7 +620,7 @@ static int __devinit mrstouch_probe(struct platform_device *pdev)
                              MRST_PRESSURE_MIN, MRST_PRESSURE_MAX, 0, 0);
 
         err = request_threaded_irq(tsdev->irq, NULL, mrstouch_pendet_irq,
-                                   0, "mrstouch", tsdev);
+                                   IRQF_ONESHOT, "mrstouch", tsdev);
         if (err) {
                 dev_err(tsdev->dev, "unable to allocate irq\n");
                 goto err_free_mem;
diff --git a/drivers/input/touchscreen/pixcir_i2c_ts.c b/drivers/input/touchscreen/pixcir_i2c_ts.c
index 72f6ba3a470..953b4c105ca 100644
--- a/drivers/input/touchscreen/pixcir_i2c_ts.c
+++ b/drivers/input/touchscreen/pixcir_i2c_ts.c
@@ -165,7 +165,7 @@ static int __devinit pixcir_i2c_ts_probe(struct i2c_client *client,
         input_set_drvdata(input, tsdata);
 
         error = request_threaded_irq(client->irq, NULL, pixcir_ts_isr,
-                                     IRQF_TRIGGER_FALLING,
+                                     IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                      client->name, tsdata);
         if (error) {
                 dev_err(&client->dev, "Unable to request touchscreen IRQ.\n");
diff --git a/drivers/input/touchscreen/tnetv107x-ts.c b/drivers/input/touchscreen/tnetv107x-ts.c
index 7e748809735..368d2c6cf78 100644
--- a/drivers/input/touchscreen/tnetv107x-ts.c
+++ b/drivers/input/touchscreen/tnetv107x-ts.c
@@ -297,7 +297,7 @@ static int __devinit tsc_probe(struct platform_device *pdev)
                 goto error_clk;
         }
 
-        error = request_threaded_irq(ts->tsc_irq, NULL, tsc_irq, 0,
+        error = request_threaded_irq(ts->tsc_irq, NULL, tsc_irq, IRQF_ONESHOT,
                                      dev_name(dev), ts);
         if (error < 0) {
                 dev_err(ts->dev, "Could not allocate ts irq\n");
diff --git a/drivers/input/touchscreen/tsc2005.c b/drivers/input/touchscreen/tsc2005.c
index b6adeaee9cc..5ce3fa8ce64 100644
--- a/drivers/input/touchscreen/tsc2005.c
+++ b/drivers/input/touchscreen/tsc2005.c
@@ -650,7 +650,8 @@ static int __devinit tsc2005_probe(struct spi_device *spi)
         tsc2005_stop_scan(ts);
 
         error = request_threaded_irq(spi->irq, NULL, tsc2005_irq_thread,
-                                     IRQF_TRIGGER_RISING, "tsc2005", ts);
+                                     IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+                                     "tsc2005", ts);
         if (error) {
                 dev_err(&spi->dev, "Failed to request irq, err: %d\n", error);
                 goto err_free_mem;
diff --git a/drivers/leds/ledtrig-heartbeat.c b/drivers/leds/ledtrig-heartbeat.c
index 41dc76db431..a019fbb7088 100644
--- a/drivers/leds/ledtrig-heartbeat.c
+++ b/drivers/leds/ledtrig-heartbeat.c
@@ -21,6 +21,8 @@
 #include <linux/reboot.h>
 #include "leds.h"
 
+static int panic_heartbeats;
+
 struct heartbeat_trig_data {
         unsigned int phase;
         unsigned int period;
@@ -34,6 +36,11 @@ static void led_heartbeat_function(unsigned long data)
         unsigned long brightness = LED_OFF;
         unsigned long delay = 0;
 
+        if (unlikely(panic_heartbeats)) {
+                led_set_brightness(led_cdev, LED_OFF);
+                return;
+        }
+
         /* acts like an actual heart beat -- ie thump-thump-pause... */
         switch (heartbeat_data->phase) {
         case 0:
@@ -111,12 +118,19 @@ static int heartbeat_reboot_notifier(struct notifier_block *nb,
         return NOTIFY_DONE;
 }
 
+static int heartbeat_panic_notifier(struct notifier_block *nb,
+                                     unsigned long code, void *unused)
+{
+        panic_heartbeats = 1;
+        return NOTIFY_DONE;
+}
+
 static struct notifier_block heartbeat_reboot_nb = {
         .notifier_call = heartbeat_reboot_notifier,
 };
 
 static struct notifier_block heartbeat_panic_nb = {
-        .notifier_call = heartbeat_reboot_notifier,
+        .notifier_call = heartbeat_panic_notifier,
 };
 
 static int __init heartbeat_trig_init(void)
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 37fdaf81bd1..ce59824fb41 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2292,6 +2292,13 @@ static int process_reserve_metadata_snap_mesg(unsigned argc, char **argv, struct
         if (r)
                 return r;
 
+        r = dm_pool_commit_metadata(pool->pmd);
+        if (r) {
+                DMERR("%s: dm_pool_commit_metadata() failed, error = %d",
+                      __func__, r);
+                return r;
+        }
+
         r = dm_pool_reserve_metadata_snap(pool->pmd);
         if (r)
                 DMWARN("reserve_metadata_snap message failed.");
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 1c2f9048e1a..a4c219e3c85 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5784,8 +5784,7 @@ static int add_new_disk(struct mddev * mddev, mdu_disk_info_t *info)
                         super_types[mddev->major_version].
                                 validate_super(mddev, rdev);
                 if ((info->state & (1<<MD_DISK_SYNC)) &&
-                    (!test_bit(In_sync, &rdev->flags) ||
-                     rdev->raid_disk != info->raid_disk)) {
+                     rdev->raid_disk != info->raid_disk) {
                         /* This was a hot-add request, but events doesn't
                          * match, so reject it.
                          */
@@ -6751,7 +6750,7 @@ struct md_thread *md_register_thread(void (*run) (struct mddev *), struct mddev
         thread->tsk = kthread_run(md_thread, thread,
                                   "%s_%s",
                                   mdname(thread->mddev),
-                                  name ?: mddev->pers->name);
+                                  name);
         if (IS_ERR(thread->tsk)) {
                 kfree(thread);
                 return NULL;
@@ -7298,6 +7297,7 @@ void md_do_sync(struct mddev *mddev)
         int skipped = 0;
         struct md_rdev *rdev;
         char *desc;
+        struct blk_plug plug;
 
         /* just incase thread restarts... */
         if (test_bit(MD_RECOVERY_DONE, &mddev->recovery))
@@ -7447,6 +7447,7 @@ void md_do_sync(struct mddev *mddev)
         }
         mddev->curr_resync_completed = j;
 
+        blk_start_plug(&plug);
         while (j < max_sectors) {
                 sector_t sectors;
 
@@ -7552,6 +7553,7 @@ void md_do_sync(struct mddev *mddev)
          * this also signals 'finished resyncing' to md_stop
          */
  out:
+        blk_finish_plug(&plug);
         wait_event(mddev->recovery_wait, !atomic_read(&mddev->recovery_active));
 
         /* tell personality that we are finished */
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index 9339e67fcc7..61a1833ebaf 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -474,7 +474,8 @@ static int multipath_run (struct mddev *mddev)
         }
 
         {
-                mddev->thread = md_register_thread(multipathd, mddev, NULL);
+                mddev->thread = md_register_thread(multipathd, mddev,
+                                                   "multipath");
                 if (!mddev->thread) {
                         printk(KERN_ERR "multipath: couldn't allocate thread"
                                 " for %s\n", mdname(mddev));
diff --git a/drivers/md/persistent-data/dm-space-map-checker.c b/drivers/md/persistent-data/dm-space-map-checker.c
index 50ed53bf4aa..fc90c11620a 100644
--- a/drivers/md/persistent-data/dm-space-map-checker.c
+++ b/drivers/md/persistent-data/dm-space-map-checker.c
@@ -8,6 +8,7 @@
 
 #include <linux/device-mapper.h>
 #include <linux/export.h>
+#include <linux/vmalloc.h>
 
 #ifdef CONFIG_DM_DEBUG_SPACE_MAPS
 
@@ -89,13 +90,23 @@ static int ca_create(struct count_array *ca, struct dm_space_map *sm)
 
         ca->nr = nr_blocks;
         ca->nr_free = nr_blocks;
-        ca->counts = kzalloc(sizeof(*ca->counts) * nr_blocks, GFP_KERNEL);
-        if (!ca->counts)
-                return -ENOMEM;
+
+        if (!nr_blocks)
+                ca->counts = NULL;
+        else {
+                ca->counts = vzalloc(sizeof(*ca->counts) * nr_blocks);
+                if (!ca->counts)
+                        return -ENOMEM;
+        }
 
         return 0;
 }
 
+static void ca_destroy(struct count_array *ca)
+{
+        vfree(ca->counts);
+}
+
 static int ca_load(struct count_array *ca, struct dm_space_map *sm)
 {
         int r;
@@ -126,12 +137,14 @@ static int ca_load(struct count_array *ca, struct dm_space_map *sm)
 static int ca_extend(struct count_array *ca, dm_block_t extra_blocks)
 {
         dm_block_t nr_blocks = ca->nr + extra_blocks;
-        uint32_t *counts = kzalloc(sizeof(*counts) * nr_blocks, GFP_KERNEL);
+        uint32_t *counts = vzalloc(sizeof(*counts) * nr_blocks);
         if (!counts)
                 return -ENOMEM;
 
-        memcpy(counts, ca->counts, sizeof(*counts) * ca->nr);
-        kfree(ca->counts);
+        if (ca->counts) {
+                memcpy(counts, ca->counts, sizeof(*counts) * ca->nr);
+                ca_destroy(ca);
+        }
         ca->nr = nr_blocks;
         ca->nr_free += extra_blocks;
         ca->counts = counts;
@@ -151,11 +164,6 @@ static int ca_commit(struct count_array *old, struct count_array *new)
         return 0;
 }
 
-static void ca_destroy(struct count_array *ca)
-{
-        kfree(ca->counts);
-}
-
 /*----------------------------------------------------------------*/
 
 struct sm_checker {
@@ -343,25 +351,25 @@ struct dm_space_map *dm_sm_checker_create(struct dm_space_map *sm)
         int r;
         struct sm_checker *smc;
 
-        if (!sm)
-                return NULL;
+        if (IS_ERR_OR_NULL(sm))
+                return ERR_PTR(-EINVAL);
 
         smc = kmalloc(sizeof(*smc), GFP_KERNEL);
         if (!smc)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         memcpy(&smc->sm, &ops_, sizeof(smc->sm));
         r = ca_create(&smc->old_counts, sm);
         if (r) {
                 kfree(smc);
-                return NULL;
+                return ERR_PTR(r);
         }
 
         r = ca_create(&smc->counts, sm);
         if (r) {
                 ca_destroy(&smc->old_counts);
                 kfree(smc);
-                return NULL;
+                return ERR_PTR(r);
         }
 
         smc->real_sm = sm;
@@ -371,7 +379,7 @@ struct dm_space_map *dm_sm_checker_create(struct dm_space_map *sm)
                 ca_destroy(&smc->counts);
                 ca_destroy(&smc->old_counts);
                 kfree(smc);
-                return NULL;
+                return ERR_PTR(r);
         }
 
         r = ca_commit(&smc->old_counts, &smc->counts);
@@ -379,7 +387,7 @@ struct dm_space_map *dm_sm_checker_create(struct dm_space_map *sm)
                 ca_destroy(&smc->counts);
                 ca_destroy(&smc->old_counts);
                 kfree(smc);
-                return NULL;
+                return ERR_PTR(r);
         }
 
         return &smc->sm;
@@ -391,25 +399,25 @@ struct dm_space_map *dm_sm_checker_create_fresh(struct dm_space_map *sm)
         int r;
         struct sm_checker *smc;
 
-        if (!sm)
-                return NULL;
+        if (IS_ERR_OR_NULL(sm))
+                return ERR_PTR(-EINVAL);
 
         smc = kmalloc(sizeof(*smc), GFP_KERNEL);
         if (!smc)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         memcpy(&smc->sm, &ops_, sizeof(smc->sm));
         r = ca_create(&smc->old_counts, sm);
         if (r) {
                 kfree(smc);
-                return NULL;
+                return ERR_PTR(r);
         }
 
         r = ca_create(&smc->counts, sm);
         if (r) {
                 ca_destroy(&smc->old_counts);
                 kfree(smc);
-                return NULL;
+                return ERR_PTR(r);
         }
 
         smc->real_sm = sm;
diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
index fc469ba9f62..3d0ed533288 100644
--- a/drivers/md/persistent-data/dm-space-map-disk.c
+++ b/drivers/md/persistent-data/dm-space-map-disk.c
@@ -290,7 +290,16 @@ struct dm_space_map *dm_sm_disk_create(struct dm_transaction_manager *tm,
                                        dm_block_t nr_blocks)
 {
         struct dm_space_map *sm = dm_sm_disk_create_real(tm, nr_blocks);
-        return dm_sm_checker_create_fresh(sm);
+        struct dm_space_map *smc;
+
+        if (IS_ERR_OR_NULL(sm))
+                return sm;
+
+        smc = dm_sm_checker_create_fresh(sm);
+        if (IS_ERR(smc))
+                dm_sm_destroy(sm);
+
+        return smc;
 }
 EXPORT_SYMBOL_GPL(dm_sm_disk_create);
 
diff --git a/drivers/md/persistent-data/dm-transaction-manager.c b/drivers/md/persistent-data/dm-transaction-manager.c
index 400fe144c0c..e5604b32d91 100644
--- a/drivers/md/persistent-data/dm-transaction-manager.c
+++ b/drivers/md/persistent-data/dm-transaction-manager.c
@@ -138,6 +138,9 @@ EXPORT_SYMBOL_GPL(dm_tm_create_non_blocking_clone);
 
 void dm_tm_destroy(struct dm_transaction_manager *tm)
 {
+        if (!tm->is_clone)
+                wipe_shadow_table(tm);
+
         kfree(tm);
 }
 EXPORT_SYMBOL_GPL(dm_tm_destroy);
@@ -344,8 +347,10 @@ static int dm_tm_create_internal(struct dm_block_manager *bm,
                 }
 
                 *sm = dm_sm_checker_create(inner);
-                if (!*sm)
+                if (IS_ERR(*sm)) {
+                        r = PTR_ERR(*sm);
                         goto bad2;
+                }
 
         } else {
                 r = dm_bm_write_lock(dm_tm_get_bm(*tm), sb_location,
@@ -364,8 +369,10 @@ static int dm_tm_create_internal(struct dm_block_manager *bm,
                 }
 
                 *sm = dm_sm_checker_create(inner);
-                if (!*sm)
+                if (IS_ERR(*sm)) {
+                        r = PTR_ERR(*sm);
                         goto bad2;
+                }
         }
 
         return 0;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index a9c7981ddd2..8c2754f835e 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -517,8 +517,8 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
                 int bad_sectors;
 
                 int disk = start_disk + i;
-                if (disk >= conf->raid_disks)
-                        disk -= conf->raid_disks;
+                if (disk >= conf->raid_disks * 2)
+                        disk -= conf->raid_disks * 2;
 
                 rdev = rcu_dereference(conf->mirrors[disk].rdev);
                 if (r1_bio->bios[disk] == IO_BLOCKED
@@ -883,7 +883,6 @@ static void make_request(struct mddev *mddev, struct bio * bio)
         const unsigned long do_sync = (bio->bi_rw & REQ_SYNC);
         const unsigned long do_flush_fua = (bio->bi_rw & (REQ_FLUSH | REQ_FUA));
         struct md_rdev *blocked_rdev;
-        int plugged;
         int first_clone;
         int sectors_handled;
         int max_sectors;
@@ -1034,7 +1033,6 @@ read_again:
          * the bad blocks.  Each set of writes gets it's own r1bio
          * with a set of bios attached.
          */
-        plugged = mddev_check_plugged(mddev);
 
         disks = conf->raid_disks * 2;
  retry_write:
@@ -1191,6 +1189,8 @@ read_again:
                 bio_list_add(&conf->pending_bio_list, mbio);
                 conf->pending_count++;
                 spin_unlock_irqrestore(&conf->device_lock, flags);
+                if (!mddev_check_plugged(mddev))
+                        md_wakeup_thread(mddev->thread);
         }
         /* Mustn't call r1_bio_write_done before this next test,
          * as it could result in the bio being freed.
@@ -1213,9 +1213,6 @@ read_again:
 
         /* In case raid1d snuck in to freeze_array */
         wake_up(&conf->wait_barrier);
-
-        if (do_sync || !bitmap || !plugged)
-                md_wakeup_thread(mddev->thread);
 }
 
 static void status(struct seq_file *seq, struct mddev *mddev)
@@ -2621,7 +2618,7 @@ static struct r1conf *setup_conf(struct mddev *mddev)
                 goto abort;
         }
         err = -ENOMEM;
-        conf->thread = md_register_thread(raid1d, mddev, NULL);
+        conf->thread = md_register_thread(raid1d, mddev, "raid1");
         if (!conf->thread) {
                 printk(KERN_ERR
                        "md/raid1:%s: couldn't allocate thread\n",
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 99ae6068e45..8da6282254c 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1039,7 +1039,6 @@ static void make_request(struct mddev *mddev, struct bio * bio)
         const unsigned long do_fua = (bio->bi_rw & REQ_FUA);
         unsigned long flags;
         struct md_rdev *blocked_rdev;
-        int plugged;
         int sectors_handled;
         int max_sectors;
         int sectors;
@@ -1239,7 +1238,6 @@ read_again:
          * of r10_bios is recored in bio->bi_phys_segments just as with
          * the read case.
          */
-        plugged = mddev_check_plugged(mddev);
 
         r10_bio->read_slot = -1; /* make sure repl_bio gets freed */
         raid10_find_phys(conf, r10_bio);
@@ -1396,6 +1394,8 @@ retry_write:
                 bio_list_add(&conf->pending_bio_list, mbio);
                 conf->pending_count++;
                 spin_unlock_irqrestore(&conf->device_lock, flags);
+                if (!mddev_check_plugged(mddev))
+                        md_wakeup_thread(mddev->thread);
 
                 if (!r10_bio->devs[i].repl_bio)
                         continue;
@@ -1423,6 +1423,8 @@ retry_write:
                 bio_list_add(&conf->pending_bio_list, mbio);
                 conf->pending_count++;
                 spin_unlock_irqrestore(&conf->device_lock, flags);
+                if (!mddev_check_plugged(mddev))
+                        md_wakeup_thread(mddev->thread);
         }
 
         /* Don't remove the bias on 'remaining' (one_write_done) until
@@ -1448,9 +1450,6 @@ retry_write:
 
         /* In case raid10d snuck in to freeze_array */
         wake_up(&conf->wait_barrier);
-
-        if (do_sync || !mddev->bitmap || !plugged)
-                md_wakeup_thread(mddev->thread);
 }
 
 static void status(struct seq_file *seq, struct mddev *mddev)
@@ -2310,7 +2309,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                         if (r10_sync_page_io(rdev,
                                              r10_bio->devs[sl].addr +
                                              sect,
-                                             s<<9, conf->tmppage, WRITE)
+                                             s, conf->tmppage, WRITE)
                             == 0) {
                                 /* Well, this device is dead */
                                 printk(KERN_NOTICE
@@ -2349,7 +2348,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                         switch (r10_sync_page_io(rdev,
                                              r10_bio->devs[sl].addr +
                                              sect,
-                                             s<<9, conf->tmppage,
+                                             s, conf->tmppage,
                                                  READ)) {
                         case 0:
                                 /* Well, this device is dead */
@@ -2512,7 +2511,7 @@ read_more:
         slot = r10_bio->read_slot;
         printk_ratelimited(
                 KERN_ERR
-                "md/raid10:%s: %s: redirecting"
+                "md/raid10:%s: %s: redirecting "
                 "sector %llu to another mirror\n",
                 mdname(mddev),
                 bdevname(rdev->bdev, b),
@@ -2661,7 +2660,8 @@ static void raid10d(struct mddev *mddev)
         blk_start_plug(&plug);
         for (;;) {
 
-                flush_pending_writes(conf);
+                if (atomic_read(&mddev->plug_cnt) == 0)
+                        flush_pending_writes(conf);
 
                 spin_lock_irqsave(&conf->device_lock, flags);
                 if (list_empty(head)) {
@@ -2890,6 +2890,12 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
                         /* want to reconstruct this device */
                         rb2 = r10_bio;
                         sect = raid10_find_virt(conf, sector_nr, i);
+                        if (sect >= mddev->resync_max_sectors) {
+                                /* last stripe is not complete - don't
+                                 * try to recover this sector.
+                                 */
+                                continue;
+                        }
                         /* Unless we are doing a full sync, or a replacement
                          * we only need to recover the block if it is set in
                          * the bitmap
@@ -3421,7 +3427,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
         spin_lock_init(&conf->resync_lock);
         init_waitqueue_head(&conf->wait_barrier);
 
-        conf->thread = md_register_thread(raid10d, mddev, NULL);
+        conf->thread = md_register_thread(raid10d, mddev, "raid10");
         if (!conf->thread)
                 goto out;
 
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index d26767246d2..04348d76bb3 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -196,12 +196,14 @@ static void __release_stripe(struct r5conf *conf, struct stripe_head *sh)
                 BUG_ON(!list_empty(&sh->lru));
                 BUG_ON(atomic_read(&conf->active_stripes)==0);
                 if (test_bit(STRIPE_HANDLE, &sh->state)) {
-                        if (test_bit(STRIPE_DELAYED, &sh->state))
+                        if (test_bit(STRIPE_DELAYED, &sh->state) &&
+                            !test_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
                                 list_add_tail(&sh->lru, &conf->delayed_list);
                         else if (test_bit(STRIPE_BIT_DELAY, &sh->state) &&
                                    sh->bm_seq - conf->seq_write > 0)
                                 list_add_tail(&sh->lru, &conf->bitmap_list);
                         else {
+                                clear_bit(STRIPE_DELAYED, &sh->state);
                                 clear_bit(STRIPE_BIT_DELAY, &sh->state);
                                 list_add_tail(&sh->lru, &conf->handle_list);
                         }
@@ -606,6 +608,12 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                                          * a chance*/
                                         md_check_recovery(conf->mddev);
                                 }
+                                /*
+                                 * Because md_wait_for_blocked_rdev
+                                 * will dec nr_pending, we must
+                                 * increment it first.
+                                 */
+                                atomic_inc(&rdev->nr_pending);
                                 md_wait_for_blocked_rdev(rdev, conf->mddev);
                         } else {
                                 /* Acknowledged bad block - skip the write */
@@ -1737,6 +1745,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
         } else {
                 const char *bdn = bdevname(rdev->bdev, b);
                 int retry = 0;
+                int set_bad = 0;
 
                 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
                 atomic_inc(&rdev->read_errors);
@@ -1748,7 +1757,8 @@ static void raid5_end_read_request(struct bio * bi, int error)
                                 mdname(conf->mddev),
                                 (unsigned long long)s,
                                 bdn);
-                else if (conf->mddev->degraded >= conf->max_degraded)
+                else if (conf->mddev->degraded >= conf->max_degraded) {
+                        set_bad = 1;
                         printk_ratelimited(
                                 KERN_WARNING
                                 "md/raid:%s: read error not correctable "
@@ -1756,8 +1766,9 @@ static void raid5_end_read_request(struct bio * bi, int error)
                                 mdname(conf->mddev),
                                 (unsigned long long)s,
                                 bdn);
-                else if (test_bit(R5_ReWrite, &sh->dev[i].flags))
+                } else if (test_bit(R5_ReWrite, &sh->dev[i].flags)) {
                         /* Oh, no!!! */
+                        set_bad = 1;
                         printk_ratelimited(
                                 KERN_WARNING
                                 "md/raid:%s: read error NOT corrected!! "
@@ -1765,7 +1776,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
                                 mdname(conf->mddev),
                                 (unsigned long long)s,
                                 bdn);
-                else if (atomic_read(&rdev->read_errors)
+                } else if (atomic_read(&rdev->read_errors)
                          > conf->max_nr_stripes)
                         printk(KERN_WARNING
                                "md/raid:%s: Too many read errors, failing device %s.\n",
@@ -1777,7 +1788,11 @@ static void raid5_end_read_request(struct bio * bi, int error)
                 else {
                         clear_bit(R5_ReadError, &sh->dev[i].flags);
                         clear_bit(R5_ReWrite, &sh->dev[i].flags);
-                        md_error(conf->mddev, rdev);
+                        if (!(set_bad
+                              && test_bit(In_sync, &rdev->flags)
+                              && rdev_set_badblocks(
+                                      rdev, sh->sector, STRIPE_SECTORS, 0)))
+                                md_error(conf->mddev, rdev);
                 }
         }
         rdev_dec_pending(rdev, conf->mddev);
@@ -3582,8 +3597,18 @@ static void handle_stripe(struct stripe_head *sh)
 
 finish:
         /* wait for this device to become unblocked */
-        if (conf->mddev->external && unlikely(s.blocked_rdev))
-                md_wait_for_blocked_rdev(s.blocked_rdev, conf->mddev);
+        if (unlikely(s.blocked_rdev)) {
+                if (conf->mddev->external)
+                        md_wait_for_blocked_rdev(s.blocked_rdev,
+                                                 conf->mddev);
+                else
+                        /* Internal metadata will immediately
+                         * be written by raid5d, so we don't
+                         * need to wait here.
+                         */
+                        rdev_dec_pending(s.blocked_rdev,
+                                         conf->mddev);
+        }
 
         if (s.handle_bad_blocks)
                 for (i = disks; i--; ) {
@@ -3881,8 +3906,6 @@ static int chunk_aligned_read(struct mddev *mddev, struct bio * raid_bio)
                 raid_bio->bi_next = (void*)rdev;
                 align_bi->bi_bdev =  rdev->bdev;
                 align_bi->bi_flags &= ~(1 << BIO_SEG_VALID);
-                /* No reshape active, so we can trust rdev->data_offset */
-                align_bi->bi_sector += rdev->data_offset;
 
                 if (!bio_fits_rdev(align_bi) ||
                     is_badblock(rdev, align_bi->bi_sector, align_bi->bi_size>>9,
@@ -3893,6 +3916,9 @@ static int chunk_aligned_read(struct mddev *mddev, struct bio * raid_bio)
                         return 0;
                 }
 
+                /* No reshape active, so we can trust rdev->data_offset */
+                align_bi->bi_sector += rdev->data_offset;
+
                 spin_lock_irq(&conf->device_lock);
                 wait_event_lock_irq(conf->wait_for_stripe,
                                     conf->quiesce == 0,
@@ -3971,7 +3997,6 @@ static void make_request(struct mddev *mddev, struct bio * bi)
         struct stripe_head *sh;
         const int rw = bio_data_dir(bi);
         int remaining;
-        int plugged;
 
         if (unlikely(bi->bi_rw & REQ_FLUSH)) {
                 md_flush_request(mddev, bi);
@@ -3990,7 +4015,6 @@ static void make_request(struct mddev *mddev, struct bio * bi)
         bi->bi_next = NULL;
         bi->bi_phys_segments = 1;       /* over-loaded to count active stripes */
 
-        plugged = mddev_check_plugged(mddev);
         for (;logical_sector < last_sector; logical_sector += STRIPE_SECTORS) {
                 DEFINE_WAIT(w);
                 int previous;
@@ -4092,6 +4116,7 @@ static void make_request(struct mddev *mddev, struct bio * bi)
                         if ((bi->bi_rw & REQ_SYNC) &&
                             !test_and_set_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
                                 atomic_inc(&conf->preread_active_stripes);
+                        mddev_check_plugged(mddev);
                         release_stripe(sh);
                 } else {
                         /* cannot get stripe for read-ahead, just give-up */
@@ -4099,10 +4124,7 @@ static void make_request(struct mddev *mddev, struct bio * bi)
                         finish_wait(&conf->wait_for_overlap, &w);
                         break;
                 }
-                        
         }
-        if (!plugged)
-                md_wakeup_thread(mddev->thread);
 
         spin_lock_irq(&conf->device_lock);
         remaining = raid5_dec_bi_phys_segments(bi);
@@ -4823,6 +4845,7 @@ static struct r5conf *setup_conf(struct mddev *mddev)
         int raid_disk, memory, max_disks;
         struct md_rdev *rdev;
         struct disk_info *disk;
+        char pers_name[6];
 
         if (mddev->new_level != 5
             && mddev->new_level != 4
@@ -4946,7 +4969,8 @@ static struct r5conf *setup_conf(struct mddev *mddev)
                 printk(KERN_INFO "md/raid:%s: allocated %dkB\n",
                        mdname(mddev), memory);
 
-        conf->thread = md_register_thread(raid5d, mddev, NULL);
+        sprintf(pers_name, "raid%d", mddev->new_level);
+        conf->thread = md_register_thread(raid5d, mddev, pers_name);
         if (!conf->thread) {
                 printk(KERN_ERR
                        "md/raid:%s: couldn't allocate thread.\n",
@@ -5465,10 +5489,9 @@ static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)
         if (rdev->saved_raid_disk >= 0 &&
             rdev->saved_raid_disk >= first &&
             conf->disks[rdev->saved_raid_disk].rdev == NULL)
-                disk = rdev->saved_raid_disk;
-        else
-                disk = first;
-        for ( ; disk <= last ; disk++) {
+                first = rdev->saved_raid_disk;
+
+        for (disk = first; disk <= last; disk++) {
                 p = conf->disks + disk;
                 if (p->rdev == NULL) {
                         clear_bit(In_sync, &rdev->flags);
@@ -5477,8 +5500,11 @@ static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)
                         if (rdev->saved_raid_disk != disk)
                                 conf->fullsync = 1;
                         rcu_assign_pointer(p->rdev, rdev);
-                        break;
+                        goto out;
                 }
+        }
+        for (disk = first; disk <= last; disk++) {
+                p = conf->disks + disk;
                 if (test_bit(WantReplacement, &p->rdev->flags) &&
                     p->replacement == NULL) {
                         clear_bit(In_sync, &rdev->flags);
@@ -5490,6 +5516,7 @@ static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)
                         break;
                 }
         }
+out:
         print_raid5_conf(conf);
         return err;
 }
diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c
index 41371ba1a81..f3f6cfedd69 100644
--- a/drivers/mtd/nand/cafe_nand.c
+++ b/drivers/mtd/nand/cafe_nand.c
@@ -102,7 +102,7 @@ static const char *part_probes[] = { "cmdlinepart", "RedBoot", NULL };
 static int cafe_device_ready(struct mtd_info *mtd)
 {
         struct cafe_priv *cafe = mtd->priv;
-        int result = !!(cafe_readl(cafe, NAND_STATUS) | 0x40000000);
+        int result = !!(cafe_readl(cafe, NAND_STATUS) & 0x40000000);
         uint32_t irqs = cafe_readl(cafe, NAND_IRQ);
 
         cafe_writel(cafe, irqs, NAND_IRQ);
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index d47586cf64c..a11253a0fca 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -3501,6 +3501,13 @@ int nand_scan_tail(struct mtd_info *mtd)
         /* propagate ecc info to mtd_info */
         mtd->ecclayout = chip->ecc.layout;
         mtd->ecc_strength = chip->ecc.strength;
+        /*
+         * Initialize bitflip_threshold to its default prior scan_bbt() call.
+         * scan_bbt() might invoke mtd_read(), thus bitflip_threshold must be
+         * properly set.
+         */
+        if (!mtd->bitflip_threshold)
+                mtd->bitflip_threshold = mtd->ecc_strength;
 
         /* Check, if we should skip the bad block table scan */
         if (chip->options & NAND_SKIP_BBTSCAN)
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 0741aded9eb..f2db8fca46a 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1804,18 +1804,16 @@ void gfar_configure_coalescing(struct gfar_private *priv,
         if (priv->mode == MQ_MG_MODE) {
                 baddr = &regs->txic0;
                 for_each_set_bit(i, &tx_mask, priv->num_tx_queues) {
-                        if (likely(priv->tx_queue[i]->txcoalescing)) {
-                                gfar_write(baddr + i, 0);
+                        gfar_write(baddr + i, 0);
+                        if (likely(priv->tx_queue[i]->txcoalescing))
                                 gfar_write(baddr + i, priv->tx_queue[i]->txic);
-                        }
                 }
 
                 baddr = &regs->rxic0;
                 for_each_set_bit(i, &rx_mask, priv->num_rx_queues) {
-                        if (likely(priv->rx_queue[i]->rxcoalescing)) {
-                                gfar_write(baddr + i, 0);
+                        gfar_write(baddr + i, 0);
+                        if (likely(priv->rx_queue[i]->rxcoalescing))
                                 gfar_write(baddr + i, priv->rx_queue[i]->rxic);
-                        }
                 }
         }
 }
diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h
index 351a4097b2b..76edbc1be33 100644
--- a/drivers/net/ethernet/intel/e1000e/defines.h
+++ b/drivers/net/ethernet/intel/e1000e/defines.h
@@ -103,6 +103,7 @@
 #define E1000_RXD_ERR_SEQ       0x04    /* Sequence Error */
 #define E1000_RXD_ERR_CXE       0x10    /* Carrier Extension Error */
 #define E1000_RXD_ERR_TCPE      0x20    /* TCP/UDP Checksum Error */
+#define E1000_RXD_ERR_IPE       0x40    /* IP Checksum Error */
 #define E1000_RXD_ERR_RXE       0x80    /* Rx Data Error */
 #define E1000_RXD_SPC_VLAN_MASK 0x0FFF  /* VLAN ID is in lower 12 bits */
 
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 31d37a2b5ba..623e30b9964 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -496,7 +496,7 @@ static void e1000_receive_skb(struct e1000_adapter *adapter,
  * @sk_buff: socket buffer with received data
  **/
 static void e1000_rx_checksum(struct e1000_adapter *adapter, u32 status_err,
-                              __le16 csum, struct sk_buff *skb)
+                              struct sk_buff *skb)
 {
         u16 status = (u16)status_err;
         u8 errors = (u8)(status_err >> 24);
@@ -511,8 +511,8 @@ static void e1000_rx_checksum(struct e1000_adapter *adapter, u32 status_err,
         if (status & E1000_RXD_STAT_IXSM)
                 return;
 
-        /* TCP/UDP checksum error bit is set */
-        if (errors & E1000_RXD_ERR_TCPE) {
+        /* TCP/UDP checksum error bit or IP checksum error bit is set */
+        if (errors & (E1000_RXD_ERR_TCPE | E1000_RXD_ERR_IPE)) {
                 /* let the stack verify checksum errors */
                 adapter->hw_csum_err++;
                 return;
@@ -523,19 +523,7 @@ static void e1000_rx_checksum(struct e1000_adapter *adapter, u32 status_err,
                 return;
 
         /* It must be a TCP or UDP packet with a valid checksum */
-        if (status & E1000_RXD_STAT_TCPCS) {
-                /* TCP checksum is good */
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-        } else {
-                /*
-                 * IP fragment with UDP payload
-                 * Hardware complements the payload checksum, so we undo it
-                 * and then put the value in host order for further stack use.
-                 */
-                __sum16 sum = (__force __sum16)swab16((__force u16)csum);
-                skb->csum = csum_unfold(~sum);
-                skb->ip_summed = CHECKSUM_COMPLETE;
-        }
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
         adapter->hw_csum_good++;
 }
 
@@ -954,8 +942,7 @@ static bool e1000_clean_rx_irq(struct e1000_ring *rx_ring, int *work_done,
                 skb_put(skb, length);
 
                 /* Receive Checksum Offload */
-                e1000_rx_checksum(adapter, staterr,
-                                  rx_desc->wb.lower.hi_dword.csum_ip.csum, skb);
+                e1000_rx_checksum(adapter, staterr, skb);
 
                 e1000_rx_hash(netdev, rx_desc->wb.lower.hi_dword.rss, skb);
 
@@ -1341,8 +1328,7 @@ copydone:
                 total_rx_bytes += skb->len;
                 total_rx_packets++;
 
-                e1000_rx_checksum(adapter, staterr,
-                                  rx_desc->wb.lower.hi_dword.csum_ip.csum, skb);
+                e1000_rx_checksum(adapter, staterr, skb);
 
                 e1000_rx_hash(netdev, rx_desc->wb.lower.hi_dword.rss, skb);
 
@@ -1512,9 +1498,8 @@ static bool e1000_clean_jumbo_rx_irq(struct e1000_ring *rx_ring, int *work_done,
                         }
                 }
 
-                /* Receive Checksum Offload XXX recompute due to CRC strip? */
-                e1000_rx_checksum(adapter, staterr,
-                                  rx_desc->wb.lower.hi_dword.csum_ip.csum, skb);
+                /* Receive Checksum Offload */
+                e1000_rx_checksum(adapter, staterr, skb);
 
                 e1000_rx_hash(netdev, rx_desc->wb.lower.hi_dword.rss, skb);
 
@@ -3098,19 +3083,10 @@ static void e1000_configure_rx(struct e1000_adapter *adapter)
 
         /* Enable Receive Checksum Offload for TCP and UDP */
         rxcsum = er32(RXCSUM);
-        if (adapter->netdev->features & NETIF_F_RXCSUM) {
+        if (adapter->netdev->features & NETIF_F_RXCSUM)
                 rxcsum |= E1000_RXCSUM_TUOFL;
-
-                /*
-                 * IPv4 payload checksum for UDP fragments must be
-                 * used in conjunction with packet-split.
-                 */
-                if (adapter->rx_ps_pages)
-                        rxcsum |= E1000_RXCSUM_IPPCSE;
-        } else {
+        else
                 rxcsum &= ~E1000_RXCSUM_TUOFL;
-                /* no need to clear IPPCSE as it defaults to 0 */
-        }
         ew32(RXCSUM, rxcsum);
 
         if (adapter->hw.mac.type == e1000_pch2lan) {
@@ -5241,22 +5217,10 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
         int max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN;
 
         /* Jumbo frame support */
-        if (max_frame > ETH_FRAME_LEN + ETH_FCS_LEN) {
-                if (!(adapter->flags & FLAG_HAS_JUMBO_FRAMES)) {
-                        e_err("Jumbo Frames not supported.\n");
-                        return -EINVAL;
-                }
-
-                /*
-                 * IP payload checksum (enabled with jumbos/packet-split when
-                 * Rx checksum is enabled) and generation of RSS hash is
-                 * mutually exclusive in the hardware.
-                 */
-                if ((netdev->features & NETIF_F_RXCSUM) &&
-                    (netdev->features & NETIF_F_RXHASH)) {
-                        e_err("Jumbo frames cannot be enabled when both receive checksum offload and receive hashing are enabled.  Disable one of the receive offload features before enabling jumbos.\n");
-                        return -EINVAL;
-                }
+        if ((max_frame > ETH_FRAME_LEN + ETH_FCS_LEN) &&
+            !(adapter->flags & FLAG_HAS_JUMBO_FRAMES)) {
+                e_err("Jumbo Frames not supported.\n");
+                return -EINVAL;
         }
 
         /* Supported frame sizes */
@@ -6030,17 +5994,6 @@ static int e1000_set_features(struct net_device *netdev,
                          NETIF_F_RXALL)))
                 return 0;
 
-        /*
-         * IP payload checksum (enabled with jumbos/packet-split when Rx
-         * checksum is enabled) and generation of RSS hash is mutually
-         * exclusive in the hardware.
-         */
-        if (adapter->rx_ps_pages &&
-            (features & NETIF_F_RXCSUM) && (features & NETIF_F_RXHASH)) {
-                e_err("Enabling both receive checksum offload and receive hashing is not possible with jumbo frames.  Disable jumbos or enable only one of the receive offload features.\n");
-                return -EINVAL;
-        }
-
         if (changed & NETIF_F_RXFCS) {
                 if (features & NETIF_F_RXFCS) {
                         adapter->flags2 &= ~FLAG2_CRC_STRIPPING;
diff --git a/drivers/net/ethernet/intel/igbvf/ethtool.c b/drivers/net/ethernet/intel/igbvf/ethtool.c
index 8ce67064b9c..90eef07943f 100644
--- a/drivers/net/ethernet/intel/igbvf/ethtool.c
+++ b/drivers/net/ethernet/intel/igbvf/ethtool.c
@@ -357,21 +357,28 @@ static int igbvf_set_coalesce(struct net_device *netdev,
         struct igbvf_adapter *adapter = netdev_priv(netdev);
         struct e1000_hw *hw = &adapter->hw;
 
-        if ((ec->rx_coalesce_usecs > IGBVF_MAX_ITR_USECS) ||
-            ((ec->rx_coalesce_usecs > 3) &&
-             (ec->rx_coalesce_usecs < IGBVF_MIN_ITR_USECS)) ||
-            (ec->rx_coalesce_usecs == 2))
-                return -EINVAL;
-
-        /* convert to rate of irq's per second */
-        if (ec->rx_coalesce_usecs && ec->rx_coalesce_usecs <= 3) {
+        if ((ec->rx_coalesce_usecs >= IGBVF_MIN_ITR_USECS) &&
+             (ec->rx_coalesce_usecs <= IGBVF_MAX_ITR_USECS)) {
+                adapter->current_itr = ec->rx_coalesce_usecs << 2;
+                adapter->requested_itr = 1000000000 /
+                                        (adapter->current_itr * 256);
+        } else if ((ec->rx_coalesce_usecs == 3) ||
+                   (ec->rx_coalesce_usecs == 2)) {
                 adapter->current_itr = IGBVF_START_ITR;
                 adapter->requested_itr = ec->rx_coalesce_usecs;
-        } else {
-                adapter->current_itr = ec->rx_coalesce_usecs << 2;
+        } else if (ec->rx_coalesce_usecs == 0) {
+                /*
+                 * The user's desire is to turn off interrupt throttling
+                 * altogether, but due to HW limitations, we can't do that.
+                 * Instead we set a very small value in EITR, which would
+                 * allow ~967k interrupts per second, but allow the adapter's
+                 * internal clocking to still function properly.
+                 */
+                adapter->current_itr = 4;
                 adapter->requested_itr = 1000000000 /
                                         (adapter->current_itr * 256);
-        }
+        } else
+                return -EINVAL;
 
         writel(adapter->current_itr,
                hw->hw_addr + adapter->rx_ring->itr_register);
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index d614c374ed9..3b5c4571b55 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -15,6 +15,7 @@
 #include <linux/kernel.h>
 #include <linux/spinlock.h>
 #include <linux/device.h>
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/dma-mapping.h>
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 3767a122586..b01960fcfbc 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -197,6 +197,10 @@ err:
 static int qmi_wwan_cdc_wdm_manage_power(struct usb_interface *intf, int on)
 {
         struct usbnet *dev = usb_get_intfdata(intf);
+
+        /* can be called while disconnecting */
+        if (!dev)
+                return 0;
         return qmi_wwan_manage_power(dev, on);
 }
 
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index c54b7d37bff..420d69b2674 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -143,6 +143,7 @@ struct ath_common {
         u32 keymax;
         DECLARE_BITMAP(keymap, ATH_KEYMAX);
         DECLARE_BITMAP(tkip_keymap, ATH_KEYMAX);
+        DECLARE_BITMAP(ccmp_keymap, ATH_KEYMAX);
         enum ath_crypt_caps crypt_caps;
 
         unsigned int clockrate;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 1c68e564f50..995ca8e1302 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -622,7 +622,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
 
         if (NR_CPUS > 1 && ah->config.serialize_regmode == SER_REG_MODE_AUTO) {
                 if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCI ||
-                    ((AR_SREV_9160(ah) || AR_SREV_9280(ah)) &&
+                    ((AR_SREV_9160(ah) || AR_SREV_9280(ah) || AR_SREV_9287(ah)) &&
                      !ah->is_pciexpress)) {
                         ah->config.serialize_regmode =
                                 SER_REG_MODE_ON;
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index e1fcc68124d..0735aeb3b26 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -695,9 +695,9 @@ static bool ath_edma_get_buffers(struct ath_softc *sc,
                         __skb_unlink(skb, &rx_edma->rx_fifo);
                         list_add_tail(&bf->list, &sc->rx.rxbuf);
                         ath_rx_edma_buf_link(sc, qtype);
-                } else {
-                        bf = NULL;
                 }
+
+                bf = NULL;
         }
 
         *dest = bf;
@@ -822,7 +822,8 @@ static bool ath9k_rx_accept(struct ath_common *common,
          * descriptor does contain a valid key index. This has been observed
          * mostly with CCMP encryption.
          */
-        if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID)
+        if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID ||
+            !test_bit(rx_stats->rs_keyix, common->ccmp_keymap))
                 rx_stats->rs_status &= ~ATH9K_RXERR_KEYMISS;
 
         if (!rx_stats->rs_datalen) {
diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c
index 0e81904956c..5c54aa43ca2 100644
--- a/drivers/net/wireless/ath/key.c
+++ b/drivers/net/wireless/ath/key.c
@@ -556,6 +556,9 @@ int ath_key_config(struct ath_common *common,
                 return -EIO;
 
         set_bit(idx, common->keymap);
+        if (key->cipher == WLAN_CIPHER_SUITE_CCMP)
+                set_bit(idx, common->ccmp_keymap);
+
         if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
                 set_bit(idx + 64, common->keymap);
                 set_bit(idx, common->tkip_keymap);
@@ -582,6 +585,7 @@ void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key)
                 return;
 
         clear_bit(key->hw_key_idx, common->keymap);
+        clear_bit(key->hw_key_idx, common->ccmp_keymap);
         if (key->cipher != WLAN_CIPHER_SUITE_TKIP)
                 return;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-mac80211.c b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
index 3ee23134c02..013680332f0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-mac80211.c
+++ b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
@@ -796,6 +796,18 @@ int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
         switch (op) {
         case ADD:
                 ret = iwlagn_mac_sta_add(hw, vif, sta);
+                if (ret)
+                        break;
+                /*
+                 * Clear the in-progress flag, the AP station entry was added
+                 * but we'll initialize LQ only when we've associated (which
+                 * would also clear the in-progress flag). This is necessary
+                 * in case we never initialize LQ because association fails.
+                 */
+                spin_lock_bh(&priv->sta_lock);
+                priv->stations[iwl_sta_id(sta)].used &=
+                        ~IWL_STA_UCODE_INPROGRESS;
+                spin_unlock_bh(&priv->sta_lock);
                 break;
         case REMOVE:
                 ret = iwlagn_mac_sta_remove(hw, vif, sta);
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index 9c44088054d..900ee129e82 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -256,7 +256,8 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         else
                 last_seq = priv->rx_seq[tid];
 
-        if (last_seq >= new_node->start_win)
+        if (last_seq != MWIFIEX_DEF_11N_RX_SEQ_NUM &&
+            last_seq >= new_node->start_win)
                 new_node->start_win = last_seq + 1;
 
         new_node->win_size = win_size;
@@ -596,5 +597,5 @@ void mwifiex_11n_cleanup_reorder_tbl(struct mwifiex_private *priv)
         spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
 
         INIT_LIST_HEAD(&priv->rx_reorder_tbl_ptr);
-        memset(priv->rx_seq, 0, sizeof(priv->rx_seq));
+        mwifiex_reset_11n_rx_seq_num(priv);
 }
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.h b/drivers/net/wireless/mwifiex/11n_rxreorder.h
index f1bffebabc6..6c9815a0f5d 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.h
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.h
@@ -37,6 +37,13 @@
 
 #define ADDBA_RSP_STATUS_ACCEPT 0
 
+#define MWIFIEX_DEF_11N_RX_SEQ_NUM      0xffff
+
+static inline void mwifiex_reset_11n_rx_seq_num(struct mwifiex_private *priv)
+{
+        memset(priv->rx_seq, 0xff, sizeof(priv->rx_seq));
+}
+
 int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *,
                                u16 seqNum,
                                u16 tid, u8 *ta,
diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c
index ceb82cd749c..383820a52be 100644
--- a/drivers/net/wireless/mwifiex/ie.c
+++ b/drivers/net/wireless/mwifiex/ie.c
@@ -213,6 +213,7 @@ mwifiex_update_uap_custom_ie(struct mwifiex_private *priv,
                 /* save assoc resp ie index after auto-indexing */
                 *assoc_idx = *((u16 *)pos);
 
+        kfree(ap_custom_ie);
         return ret;
 }
 
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index e0377473282..fc8a9bfa124 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -978,10 +978,10 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
                 dev_dbg(adapter->dev, "info: --- Rx: Event ---\n");
                 adapter->event_cause = *(u32 *) skb->data;
 
-                skb_pull(skb, MWIFIEX_EVENT_HEADER_LEN);
-
                 if ((skb->len > 0) && (skb->len  < MAX_EVENT_SIZE))
-                        memcpy(adapter->event_body, skb->data, skb->len);
+                        memcpy(adapter->event_body,
+                               skb->data + MWIFIEX_EVENT_HEADER_LEN,
+                               skb->len);
 
                 /* event cause has been saved to adapter->event_cause */
                 adapter->event_received = true;
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index 4ace5a3dcd2..11e731f3581 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -406,9 +406,9 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                 break;
 
         case EVENT_UAP_STA_ASSOC:
-                skb_pull(adapter->event_skb, MWIFIEX_UAP_EVENT_EXTRA_HEADER);
                 memset(&sinfo, 0, sizeof(sinfo));
-                event = (struct mwifiex_assoc_event *)adapter->event_skb->data;
+                event = (struct mwifiex_assoc_event *)
+                        (adapter->event_body + MWIFIEX_UAP_EVENT_EXTRA_HEADER);
                 if (le16_to_cpu(event->type) == TLV_TYPE_UAP_MGMT_FRAME) {
                         len = -1;
 
@@ -433,9 +433,8 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                                  GFP_KERNEL);
                 break;
         case EVENT_UAP_STA_DEAUTH:
-                skb_pull(adapter->event_skb, MWIFIEX_UAP_EVENT_EXTRA_HEADER);
-                cfg80211_del_sta(priv->netdev, adapter->event_skb->data,
-                                 GFP_KERNEL);
+                cfg80211_del_sta(priv->netdev, adapter->event_body +
+                                 MWIFIEX_UAP_EVENT_EXTRA_HEADER, GFP_KERNEL);
                 break;
         case EVENT_UAP_BSS_IDLE:
                 priv->media_connected = false;
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 49ebf20c56e..22a5916564b 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -49,6 +49,7 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
         struct device *dev = adapter->dev;
         u32 recv_type;
         __le32 tmp;
+        int ret;
 
         if (adapter->hs_activated)
                 mwifiex_process_hs_config(adapter);
@@ -69,16 +70,19 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
                 case MWIFIEX_USB_TYPE_CMD:
                         if (skb->len > MWIFIEX_SIZE_OF_CMD_BUFFER) {
                                 dev_err(dev, "CMD: skb->len too large\n");
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                         } else if (!adapter->curr_cmd) {
                                 dev_dbg(dev, "CMD: no curr_cmd\n");
                                 if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
                                         mwifiex_process_sleep_confirm_resp(
                                                         adapter, skb->data,
                                                         skb->len);
-                                        return 0;
+                                        ret = 0;
+                                        goto exit_restore_skb;
                                 }
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                         }
 
                         adapter->curr_cmd->resp_skb = skb;
@@ -87,20 +91,22 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
                 case MWIFIEX_USB_TYPE_EVENT:
                         if (skb->len < sizeof(u32)) {
                                 dev_err(dev, "EVENT: skb->len too small\n");
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                         }
                         skb_copy_from_linear_data(skb, &tmp, sizeof(u32));
                         adapter->event_cause = le32_to_cpu(tmp);
-                        skb_pull(skb, sizeof(u32));
                         dev_dbg(dev, "event_cause %#x\n", adapter->event_cause);
 
                         if (skb->len > MAX_EVENT_SIZE) {
                                 dev_err(dev, "EVENT: event body too large\n");
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                         }
 
-                        skb_copy_from_linear_data(skb, adapter->event_body,
-                                                  skb->len);
+                        memcpy(adapter->event_body, skb->data +
+                               MWIFIEX_EVENT_HEADER_LEN, skb->len);
+
                         adapter->event_received = true;
                         adapter->event_skb = skb;
                         break;
@@ -124,6 +130,12 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
         }
 
         return -EINPROGRESS;
+
+exit_restore_skb:
+        /* The buffer will be reused for further cmds/events */
+        skb_push(skb, INTF_HEADER_LEN);
+
+        return ret;
 }
 
 static void mwifiex_usb_rx_complete(struct urb *urb)
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index f3fc6551585..3fa4d417699 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -404,6 +404,8 @@ mwifiex_wmm_init(struct mwifiex_adapter *adapter)
                 priv->add_ba_param.tx_win_size = MWIFIEX_AMPDU_DEF_TXWINSIZE;
                 priv->add_ba_param.rx_win_size = MWIFIEX_AMPDU_DEF_RXWINSIZE;
 
+                mwifiex_reset_11n_rx_seq_num(priv);
+
                 atomic_set(&priv->wmm.tx_pkts_queued, 0);
                 atomic_set(&priv->wmm.highest_queued_prio, HIGH_PRIO_TID);
         }
@@ -1221,6 +1223,7 @@ mwifiex_dequeue_tx_packet(struct mwifiex_adapter *adapter)
 
         if (!ptr->is_11n_enabled ||
             mwifiex_is_ba_stream_setup(priv, ptr, tid) ||
+            priv->wps.session_enable ||
             ((priv->sec_info.wpa_enabled ||
               priv->sec_info.wpa2_enabled) &&
              !priv->wpa_is_gtk_set)) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index d228358e6a4..9970c2b1b19 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -301,9 +301,11 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
         {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
         {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
+        {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
         {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
         {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
         {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+        {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
         /* HP - Lite-On ,8188CUS Slim Combo */
         {RTL_USB_DEVICE(0x103c, 0x1629, rtl92cu_hal_cfg)},
         {RTL_USB_DEVICE(0x13d3, 0x3357, rtl92cu_hal_cfg)}, /* AzureWave */
@@ -346,6 +348,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Funai -Abocom*/
         {RTL_USB_DEVICE(0x0846, 0x9021, rtl92cu_hal_cfg)}, /*Netgear-Sercomm*/
         {RTL_USB_DEVICE(0x0b05, 0x17ab, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
+        {RTL_USB_DEVICE(0x0bda, 0x8186, rtl92cu_hal_cfg)}, /*Realtek 92CE-VAU*/
         {RTL_USB_DEVICE(0x0df6, 0x0061, rtl92cu_hal_cfg)}, /*Sitecom-Edimax*/
         {RTL_USB_DEVICE(0x0e66, 0x0019, rtl92cu_hal_cfg)}, /*Hawking-Edimax*/
         {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
diff --git a/drivers/net/wireless/ti/wlcore/Kconfig b/drivers/net/wireless/ti/wlcore/Kconfig
index 54156b0b5c2..d7b907e6717 100644
--- a/drivers/net/wireless/ti/wlcore/Kconfig
+++ b/drivers/net/wireless/ti/wlcore/Kconfig
@@ -1,7 +1,6 @@
 config WLCORE
         tristate "TI wlcore support"
         depends on WL_TI && GENERIC_HARDIRQS && MAC80211
-        depends on INET
         select FW_LOADER
         ---help---
           This module contains the main code for TI WLAN chips.  It abstracts
diff --git a/drivers/of/base.c b/drivers/of/base.c
index d9bfd49b193..eada3f4ef80 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -511,6 +511,22 @@ out:
 }
 EXPORT_SYMBOL(of_find_node_with_property);
 
+static const struct of_device_id *of_match_compat(const struct of_device_id *matches,
+                                                  const char *compat)
+{
+        while (matches->name[0] || matches->type[0] || matches->compatible[0]) {
+                const char *cp = matches->compatible;
+                int len = strlen(cp);
+
+                if (len > 0 && of_compat_cmp(compat, cp, len) == 0)
+                        return matches;
+
+                matches++;
+        }
+
+        return NULL;
+}
+
 /**
  * of_match_node - Tell if an device_node has a matching of_match structure
  *      @matches:       array of of device match structures to search in
@@ -521,9 +537,18 @@ EXPORT_SYMBOL(of_find_node_with_property);
 const struct of_device_id *of_match_node(const struct of_device_id *matches,
                                          const struct device_node *node)
 {
+        struct property *prop;
+        const char *cp;
+
         if (!matches)
                 return NULL;
 
+        of_property_for_each_string(node, "compatible", prop, cp) {
+                const struct of_device_id *match = of_match_compat(matches, cp);
+                if (match)
+                        return match;
+        }
+
         while (matches->name[0] || matches->type[0] || matches->compatible[0]) {
                 int match = 1;
                 if (matches->name[0])
@@ -532,10 +557,7 @@ const struct of_device_id *of_match_node(const struct of_device_id *matches,
                 if (matches->type[0])
                         match &= node->type
                                 && !strcmp(matches->type, node->type);
-                if (matches->compatible[0])
-                        match &= of_device_is_compatible(node,
-                                                matches->compatible);
-                if (match)
+                if (match && !matches->compatible[0])
                         return matches;
                 matches++;
         }
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 343ad29e211..3132ea068d9 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -462,4 +462,5 @@ int of_platform_populate(struct device_node *root,
         of_node_put(root);
         return rc;
 }
+EXPORT_SYMBOL_GPL(of_platform_populate);
 #endif /* CONFIG_OF_ADDRESS */
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 6986552b47e..77759c78cc2 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -3960,7 +3960,7 @@ void qlt_async_event(uint16_t code, struct scsi_qla_host *vha,
 {
         struct qla_hw_data *ha = vha->hw;
         struct qla_tgt *tgt = ha->tgt.qla_tgt;
-        int reason_code;
+        int login_code;
 
         ql_dbg(ql_dbg_tgt, vha, 0xe039,
             "scsi(%ld): ha state %d init_done %d oper_mode %d topo %d\n",
@@ -4003,9 +4003,9 @@ void qlt_async_event(uint16_t code, struct scsi_qla_host *vha,
         {
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf03b,
                     "qla_target(%d): Async LOOP_UP occured "
-                    "(m[1]=%x, m[2]=%x, m[3]=%x, m[4]=%x)", vha->vp_idx,
-                    le16_to_cpu(mailbox[1]), le16_to_cpu(mailbox[2]),
-                    le16_to_cpu(mailbox[3]), le16_to_cpu(mailbox[4]));
+                    "(m[0]=%x, m[1]=%x, m[2]=%x, m[3]=%x)", vha->vp_idx,
+                    le16_to_cpu(mailbox[0]), le16_to_cpu(mailbox[1]),
+                    le16_to_cpu(mailbox[2]), le16_to_cpu(mailbox[3]));
                 if (tgt->link_reinit_iocb_pending) {
                         qlt_send_notify_ack(vha, (void *)&tgt->link_reinit_iocb,
                             0, 0, 0, 0, 0, 0);
@@ -4020,23 +4020,24 @@ void qlt_async_event(uint16_t code, struct scsi_qla_host *vha,
         case MBA_RSCN_UPDATE:
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf03c,
                     "qla_target(%d): Async event %#x occured "
-                    "(m[1]=%x, m[2]=%x, m[3]=%x, m[4]=%x)", vha->vp_idx, code,
-                    le16_to_cpu(mailbox[1]), le16_to_cpu(mailbox[2]),
-                    le16_to_cpu(mailbox[3]), le16_to_cpu(mailbox[4]));
+                    "(m[0]=%x, m[1]=%x, m[2]=%x, m[3]=%x)", vha->vp_idx, code,
+                    le16_to_cpu(mailbox[0]), le16_to_cpu(mailbox[1]),
+                    le16_to_cpu(mailbox[2]), le16_to_cpu(mailbox[3]));
                 break;
 
         case MBA_PORT_UPDATE:
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf03d,
                     "qla_target(%d): Port update async event %#x "
-                    "occured: updating the ports database (m[1]=%x, m[2]=%x, "
-                    "m[3]=%x, m[4]=%x)", vha->vp_idx, code,
-                    le16_to_cpu(mailbox[1]), le16_to_cpu(mailbox[2]),
-                    le16_to_cpu(mailbox[3]), le16_to_cpu(mailbox[4]));
-                reason_code = le16_to_cpu(mailbox[2]);
-                if (reason_code == 0x4)
+                    "occured: updating the ports database (m[0]=%x, m[1]=%x, "
+                    "m[2]=%x, m[3]=%x)", vha->vp_idx, code,
+                    le16_to_cpu(mailbox[0]), le16_to_cpu(mailbox[1]),
+                    le16_to_cpu(mailbox[2]), le16_to_cpu(mailbox[3]));
+
+                login_code = le16_to_cpu(mailbox[2]);
+                if (login_code == 0x4)
                         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf03e,
                             "Async MB 2: Got PLOGI Complete\n");
-                else if (reason_code == 0x7)
+                else if (login_code == 0x7)
                         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf03f,
                             "Async MB 2: Port Logged Out\n");
                 break;
@@ -4044,9 +4045,9 @@ void qlt_async_event(uint16_t code, struct scsi_qla_host *vha,
         default:
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf040,
                     "qla_target(%d): Async event %#x occured: "
-                    "ignore (m[1]=%x, m[2]=%x, m[3]=%x, m[4]=%x)", vha->vp_idx,
-                    code, le16_to_cpu(mailbox[1]), le16_to_cpu(mailbox[2]),
-                    le16_to_cpu(mailbox[3]), le16_to_cpu(mailbox[4]));
+                    "ignore (m[0]=%x, m[1]=%x, m[2]=%x, m[3]=%x)", vha->vp_idx,
+                    code, le16_to_cpu(mailbox[0]), le16_to_cpu(mailbox[1]),
+                    le16_to_cpu(mailbox[2]), le16_to_cpu(mailbox[3]));
                 break;
         }
 
diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
index cb99da92006..87901fa74dd 100644
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -58,7 +58,8 @@ static struct ft_tport *ft_tport_create(struct fc_lport *lport)
         struct ft_tport *tport;
         int i;
 
-        tport = rcu_dereference(lport->prov[FC_TYPE_FCP]);
+        tport = rcu_dereference_protected(lport->prov[FC_TYPE_FCP],
+                                          lockdep_is_held(&ft_lport_lock));
         if (tport && tport->tpg)
                 return tport;