Merge tag 'v3.9-rc7' into asoc-dma

Linux 3.9-rc7

655 files changed, 7253 insertions, 3999 deletions

diff --git a/Documentation/DocBook/device-drivers.tmpl b/Documentation/DocBook/device-drivers.tmpl
index 7514dbf0a679..c36892c072da 100644
--- a/Documentation/DocBook/device-drivers.tmpl
+++ b/Documentation/DocBook/device-drivers.tmpl
@@ -227,7 +227,7 @@ X!Isound/sound_firmware.c
   <chapter id="uart16x50">
      <title>16x50 UART Driver</title>
 !Edrivers/tty/serial/serial_core.c
-!Edrivers/tty/serial/8250/8250.c
+!Edrivers/tty/serial/8250/8250_core.c
   </chapter>
 
   <chapter id="fbdev">
diff --git a/Documentation/networking/ipvs-sysctl.txt b/Documentation/networking/ipvs-sysctl.txt
index f2a2488f1bf3..9573d0c48c6e 100644
--- a/Documentation/networking/ipvs-sysctl.txt
+++ b/Documentation/networking/ipvs-sysctl.txt
@@ -15,6 +15,13 @@ amemthresh - INTEGER
         enabled and the variable is automatically set to 2, otherwise
         the strategy is disabled and the variable is  set  to 1.
 
+backup_only - BOOLEAN
+        0 - disabled (default)
+        not 0 - enabled
+
+        If set, disable the director function while the server is
+        in backup mode to avoid packet loops for DR/TUN methods.
+
 conntrack - BOOLEAN
         0 - disabled (default)
         not 0 - enabled
diff --git a/Documentation/scsi/LICENSE.qla2xxx b/Documentation/scsi/LICENSE.qla2xxx
index 27a91cf43d6d..5020b7b5a244 100644
--- a/Documentation/scsi/LICENSE.qla2xxx
+++ b/Documentation/scsi/LICENSE.qla2xxx
@@ -1,4 +1,4 @@
-Copyright (c) 2003-2012 QLogic Corporation
+Copyright (c) 2003-2013 QLogic Corporation
 QLogic Linux FC-FCoE Driver
 
 This program includes a device driver for Linux 3.x.
diff --git a/Documentation/sound/alsa/ALSA-Configuration.txt b/Documentation/sound/alsa/ALSA-Configuration.txt
index 4499bd948860..95731a08f257 100644
--- a/Documentation/sound/alsa/ALSA-Configuration.txt
+++ b/Documentation/sound/alsa/ALSA-Configuration.txt
@@ -890,9 +890,8 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     enable_msi  - Enable Message Signaled Interrupt (MSI) (default = off)
     power_save  - Automatic power-saving timeout (in second, 0 =
                 disable)
-    power_save_controller - Support runtime D3 of HD-audio controller
-                (-1 = on for supported chip (default), false = off,
-                 true = force to on even for unsupported hardware)
+    power_save_controller - Reset HD-audio controller in power-saving mode
+                (default = on)
     align_buffer_size - Force rounding of buffer/period sizes to multiples
                       of 128 bytes. This is more efficient in terms of memory
                       access but isn't required by the HDA spec and prevents
diff --git a/MAINTAINERS b/MAINTAINERS
index 4cf5fd334a06..8bdd7a7ef2f4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3242,6 +3242,12 @@ F:	Documentation/firmware_class/
 F:      drivers/base/firmware*.c
 F:      include/linux/firmware.h
 
+FLASHSYSTEM DRIVER (IBM FlashSystem 70/80 PCI SSD Flash Card)
+M:      Joshua Morris <josh.h.morris@us.ibm.com>
+M:      Philip Kelleher <pjk1939@linux.vnet.ibm.com>
+S:      Maintained
+F:      drivers/block/rsxx/
+
 FLOPPY DRIVER
 M:      Jiri Kosina <jkosina@suse.cz>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/floppy.git
@@ -4935,6 +4941,12 @@ W:	logfs.org
 S:      Maintained
 F:      fs/logfs/
 
+LPC32XX MACHINE SUPPORT
+M:      Roland Stigge <stigge@antcom.de>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/mach-lpc32xx/
+
 LSILOGIC MPT FUSION DRIVERS (FC/SAS/SPI)
 M:      Nagalakshmi Nandigama <Nagalakshmi.Nandigama@lsi.com>
 M:      Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
@@ -5059,9 +5071,8 @@ S:	Maintained
 F:      drivers/net/ethernet/marvell/sk*
 
 MARVELL LIBERTAS WIRELESS DRIVER
-M:      Dan Williams <dcbw@redhat.com>
 L:      libertas-dev@lists.infradead.org
-S:      Maintained
+S:      Orphan
 F:      drivers/net/wireless/libertas/
 
 MARVELL MV643XX ETHERNET DRIVER
@@ -5563,6 +5574,7 @@ F:	include/uapi/linux/if_*
 F:      include/uapi/linux/netdevice.h
 
 NETXEN (1/10) GbE SUPPORT
+M:      Manish Chopra <manish.chopra@qlogic.com>
 M:      Sony Chacko <sony.chacko@qlogic.com>
 M:      Rajesh Borundia <rajesh.borundia@qlogic.com>
 L:      netdev@vger.kernel.org
@@ -5683,7 +5695,7 @@ S:	Maintained
 F:      arch/arm/*omap*/*clock*
 
 OMAP POWER MANAGEMENT SUPPORT
-M:      Kevin Hilman <khilman@ti.com>
+M:      Kevin Hilman <khilman@deeprootsystems.com>
 L:      linux-omap@vger.kernel.org
 S:      Maintained
 F:      arch/arm/*omap*/*pm*
@@ -5777,7 +5789,7 @@ F:	arch/arm/*omap*/usb*
 
 OMAP GPIO DRIVER
 M:      Santosh Shilimkar <santosh.shilimkar@ti.com>
-M:      Kevin Hilman <khilman@ti.com>
+M:      Kevin Hilman <khilman@deeprootsystems.com>
 L:      linux-omap@vger.kernel.org
 S:      Maintained
 F:      drivers/gpio/gpio-omap.c
@@ -6209,7 +6221,7 @@ F:	include/linux/power_supply.h
 F:      drivers/power/
 
 PNP SUPPORT
-M:      Adam Belay <abelay@mit.edu>
+M:      Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 M:      Bjorn Helgaas <bhelgaas@google.com>
 S:      Maintained
 F:      drivers/pnp/
@@ -6551,12 +6563,6 @@ S:	Maintained
 F:      Documentation/blockdev/ramdisk.txt
 F:      drivers/block/brd.c
 
-RAMSAM DRIVER (IBM RamSan 70/80 PCI SSD Flash Card)
-M:      Joshua Morris <josh.h.morris@us.ibm.com>
-M:      Philip Kelleher <pjk1939@linux.vnet.ibm.com>
-S:      Maintained
-F:      drivers/block/rsxx/
-
 RANDOM NUMBER DRIVER
 M:      Theodore Ts'o" <tytso@mit.edu>
 S:      Maintained
@@ -6625,7 +6631,7 @@ S:	Supported
 F:      fs/reiserfs/
 
 REGISTER MAP ABSTRACTION
-M:      Mark Brown <broonie@opensource.wolfsonmicro.com>
+M:      Mark Brown <broonie@kernel.org>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git
 S:      Supported
 F:      drivers/base/regmap/
@@ -6951,7 +6957,6 @@ F:	drivers/scsi/st*
 
 SCTP PROTOCOL
 M:      Vlad Yasevich <vyasevich@gmail.com>
-M:      Sridhar Samudrala <sri@us.ibm.com>
 M:      Neil Horman <nhorman@tuxdriver.com>
 L:      linux-sctp@vger.kernel.org
 W:      http://lksctp.sourceforge.net
@@ -7173,7 +7178,7 @@ F:	arch/arm/mach-s3c2410/bast-irq.c
 
 TI DAVINCI MACHINE SUPPORT
 M:      Sekhar Nori <nsekhar@ti.com>
-M:      Kevin Hilman <khilman@ti.com>
+M:      Kevin Hilman <khilman@deeprootsystems.com>
 L:      davinci-linux-open-source@linux.davincidsp.com (moderated for non-subscribers)
 T:      git git://gitorious.org/linux-davinci/linux-davinci.git
 Q:      http://patchwork.kernel.org/project/linux-davinci/list/
@@ -7374,7 +7379,7 @@ F:	sound/
 
 SOUND - SOC LAYER / DYNAMIC AUDIO POWER MANAGEMENT (ASoC)
 M:      Liam Girdwood <lgirdwood@gmail.com>
-M:      Mark Brown <broonie@opensource.wolfsonmicro.com>
+M:      Mark Brown <broonie@kernel.org>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 W:      http://alsa-project.org/main/index.php/ASoC
@@ -7463,7 +7468,7 @@ F:	drivers/clk/spear/
 
 SPI SUBSYSTEM
 M:      Grant Likely <grant.likely@secretlab.ca>
-M:      Mark Brown <broonie@opensource.wolfsonmicro.com>
+M:      Mark Brown <broonie@kernel.org>
 L:      spi-devel-general@lists.sourceforge.net
 Q:      http://patchwork.kernel.org/project/spi-devel-general/list/
 T:      git git://git.secretlab.ca/git/linux-2.6.git
@@ -7706,9 +7711,10 @@ F:	include/linux/swiotlb.h
 
 SYNOPSYS ARC ARCHITECTURE
 M:      Vineet Gupta <vgupta@synopsys.com>
-L:      linux-snps-arc@vger.kernel.org
 S:      Supported
 F:      arch/arc/
+F:      Documentation/devicetree/bindings/arc/
+F:      drivers/tty/serial/arc-uart.c
 
 SYSV FILESYSTEM
 M:      Christoph Hellwig <hch@infradead.org>
@@ -8707,7 +8713,7 @@ F:	drivers/scsi/vmw_pvscsi.h
 
 VOLTAGE AND CURRENT REGULATOR FRAMEWORK
 M:      Liam Girdwood <lrg@ti.com>
-M:      Mark Brown <broonie@opensource.wolfsonmicro.com>
+M:      Mark Brown <broonie@kernel.org>
 W:      http://opensource.wolfsonmicro.com/node/15
 W:      http://www.slimlogic.co.uk/?p=48
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/lrg/regulator.git
diff --git a/Makefile b/Makefile
index 54d2b2a0fef0..9cf6783c2ec3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 9
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc7
 NAME = Unicycling Gorilla
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/Makefile b/arch/alpha/Makefile
index 4759fe751aa1..2cc3cc519c54 100644
--- a/arch/alpha/Makefile
+++ b/arch/alpha/Makefile
@@ -12,7 +12,7 @@ NM := $(NM) -B
 
 LDFLAGS_vmlinux := -static -N #-relax
 CHECKFLAGS      += -D__alpha__ -m64
-cflags-y        := -pipe -mno-fp-regs -ffixed-8 -msmall-data
+cflags-y        := -pipe -mno-fp-regs -ffixed-8
 cflags-y        += $(call cc-option, -fno-jump-tables)
 
 cpuflags-$(CONFIG_ALPHA_EV4)            := -mcpu=ev4
diff --git a/arch/alpha/include/asm/floppy.h b/arch/alpha/include/asm/floppy.h
index 46cefbd50e73..bae97eb19d26 100644
--- a/arch/alpha/include/asm/floppy.h
+++ b/arch/alpha/include/asm/floppy.h
@@ -26,7 +26,7 @@
 #define fd_disable_irq()        disable_irq(FLOPPY_IRQ)
 #define fd_cacheflush(addr,size) /* nothing */
 #define fd_request_irq()        request_irq(FLOPPY_IRQ, floppy_interrupt,\
-                                            IRQF_DISABLED, "floppy", NULL)
+                                            0, "floppy", NULL)
 #define fd_free_irq()           free_irq(FLOPPY_IRQ, NULL)
 
 #ifdef CONFIG_PCI
diff --git a/arch/alpha/kernel/irq.c b/arch/alpha/kernel/irq.c
index 2872accd2215..7b2be251c30f 100644
--- a/arch/alpha/kernel/irq.c
+++ b/arch/alpha/kernel/irq.c
@@ -117,13 +117,6 @@ handle_irq(int irq)
                 return;
         }
 
-        /*
-         * From here we must proceed with IPL_MAX. Note that we do not
-         * explicitly enable interrupts afterwards - some MILO PALcode
-         * (namely LX164 one) seems to have severe problems with RTI
-         * at IPL 0.
-         */
-        local_irq_disable();
         irq_enter();
         generic_handle_irq_desc(irq, desc);
         irq_exit();
diff --git a/arch/alpha/kernel/irq_alpha.c b/arch/alpha/kernel/irq_alpha.c
index 772ddfdb71a8..f433fc11877a 100644
--- a/arch/alpha/kernel/irq_alpha.c
+++ b/arch/alpha/kernel/irq_alpha.c
@@ -45,6 +45,14 @@ do_entInt(unsigned long type, unsigned long vector,
           unsigned long la_ptr, struct pt_regs *regs)
 {
         struct pt_regs *old_regs;
+
+        /*
+         * Disable interrupts during IRQ handling.
+         * Note that there is no matching local_irq_enable() due to
+         * severe problems with RTI at IPL0 and some MILO PALcode
+         * (namely LX164).
+         */
+        local_irq_disable();
         switch (type) {
         case 0:
 #ifdef CONFIG_SMP
@@ -62,7 +70,6 @@ do_entInt(unsigned long type, unsigned long vector,
           {
                 long cpu;
 
-                local_irq_disable();
                 smp_percpu_timer_interrupt(regs);
                 cpu = smp_processor_id();
                 if (cpu != boot_cpuid) {
@@ -222,7 +229,6 @@ process_mcheck_info(unsigned long vector, unsigned long la_ptr,
 
 struct irqaction timer_irqaction = {
         .handler        = timer_interrupt,
-        .flags          = IRQF_DISABLED,
         .name           = "timer",
 };
 
diff --git a/arch/alpha/kernel/sys_nautilus.c b/arch/alpha/kernel/sys_nautilus.c
index 4d4c046f708d..1383f8601a93 100644
--- a/arch/alpha/kernel/sys_nautilus.c
+++ b/arch/alpha/kernel/sys_nautilus.c
@@ -188,6 +188,10 @@ nautilus_machine_check(unsigned long vector, unsigned long la_ptr)
 extern void free_reserved_mem(void *, void *);
 extern void pcibios_claim_one_bus(struct pci_bus *);
 
+static struct resource irongate_io = {
+        .name   = "Irongate PCI IO",
+        .flags  = IORESOURCE_IO,
+};
 static struct resource irongate_mem = {
         .name   = "Irongate PCI MEM",
         .flags  = IORESOURCE_MEM,
@@ -209,6 +213,7 @@ nautilus_init_pci(void)
 
         irongate = pci_get_bus_and_slot(0, 0);
         bus->self = irongate;
+        bus->resource[0] = &irongate_io;
         bus->resource[1] = &irongate_mem;
 
         pci_bus_size_bridges(bus);
diff --git a/arch/alpha/kernel/sys_titan.c b/arch/alpha/kernel/sys_titan.c
index 5cf4a481b8c5..a53cf03f49d5 100644
--- a/arch/alpha/kernel/sys_titan.c
+++ b/arch/alpha/kernel/sys_titan.c
@@ -280,15 +280,15 @@ titan_late_init(void)
          * all reported to the kernel as machine checks, so the handler
          * is a nop so it can be called to count the individual events.
          */
-        titan_request_irq(63+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(63+16, titan_intr_nop, 0,
                     "CChip Error", NULL);
-        titan_request_irq(62+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(62+16, titan_intr_nop, 0,
                     "PChip 0 H_Error", NULL);
-        titan_request_irq(61+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(61+16, titan_intr_nop, 0,
                     "PChip 1 H_Error", NULL);
-        titan_request_irq(60+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(60+16, titan_intr_nop, 0,
                     "PChip 0 C_Error", NULL);
-        titan_request_irq(59+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(59+16, titan_intr_nop, 0,
                     "PChip 1 C_Error", NULL);
 
         /* 
@@ -348,9 +348,9 @@ privateer_init_pci(void)
          * Hook a couple of extra err interrupts that the
          * common titan code won't.
          */
-        titan_request_irq(53+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(53+16, titan_intr_nop, 0,
                     "NMI", NULL);
-        titan_request_irq(50+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(50+16, titan_intr_nop, 0,
                     "Temperature Warning", NULL);
 
         /*
diff --git a/arch/arc/include/asm/dma-mapping.h b/arch/arc/include/asm/dma-mapping.h
index 31f77aec0823..45b8e0cea176 100644
--- a/arch/arc/include/asm/dma-mapping.h
+++ b/arch/arc/include/asm/dma-mapping.h
@@ -126,7 +126,7 @@ dma_map_sg(struct device *dev, struct scatterlist *sg,
         int i;
 
         for_each_sg(sg, s, nents, i)
-                sg->dma_address = dma_map_page(dev, sg_page(s), s->offset,
+                s->dma_address = dma_map_page(dev, sg_page(s), s->offset,
                                                s->length, dir);
 
         return nents;
diff --git a/arch/arc/include/asm/elf.h b/arch/arc/include/asm/elf.h
index f4c8d36ebecb..a26282857683 100644
--- a/arch/arc/include/asm/elf.h
+++ b/arch/arc/include/asm/elf.h
@@ -72,7 +72,4 @@ extern int elf_check_arch(const struct elf32_hdr *);
  */
 #define ELF_PLATFORM    (NULL)
 
-#define SET_PERSONALITY(ex) \
-        set_personality(PER_LINUX | (current->personality & (~PER_MASK)))
-
 #endif
diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h
index 23daa326fc9b..eb2ae53187d9 100644
--- a/arch/arc/include/asm/entry.h
+++ b/arch/arc/include/asm/entry.h
@@ -415,7 +415,7 @@
  *-------------------------------------------------------------*/
 .macro SAVE_ALL_EXCEPTION   marker
 
-        st      \marker, [sp, 8]
+        st      \marker, [sp, 8]        /* orig_r8 */
         st      r0, [sp, 4]    /* orig_r0, needed only for sys calls */
 
         /* Restore r9 used to code the early prologue */
diff --git a/arch/arc/include/asm/irqflags.h b/arch/arc/include/asm/irqflags.h
index ccd84806b62f..eac071668201 100644
--- a/arch/arc/include/asm/irqflags.h
+++ b/arch/arc/include/asm/irqflags.h
@@ -39,7 +39,7 @@ static inline long arch_local_irq_save(void)
         "       flag.nz %0              \n"
         : "=r"(temp), "=r"(flags)
         : "n"((STATUS_E1_MASK | STATUS_E2_MASK))
-        : "cc");
+        : "memory", "cc");
 
         return flags;
 }
@@ -53,7 +53,8 @@ static inline void arch_local_irq_restore(unsigned long flags)
         __asm__ __volatile__(
         "       flag %0                 \n"
         :
-        : "r"(flags));
+        : "r"(flags)
+        : "memory");
 }
 
 /*
@@ -73,7 +74,8 @@ static inline void arch_local_irq_disable(void)
         "       and %0, %0, %1          \n"
         "       flag %0                 \n"
         : "=&r"(temp)
-        : "n"(~(STATUS_E1_MASK | STATUS_E2_MASK)));
+        : "n"(~(STATUS_E1_MASK | STATUS_E2_MASK))
+        : "memory");
 }
 
 /*
@@ -85,7 +87,9 @@ static inline long arch_local_save_flags(void)
 
         __asm__ __volatile__(
         "       lr  %0, [status32]      \n"
-        : "=&r"(temp));
+        : "=&r"(temp)
+        :
+        : "memory");
 
         return temp;
 }
diff --git a/arch/arc/include/asm/kgdb.h b/arch/arc/include/asm/kgdb.h
index f3c4934f0ca9..4930957ca3d3 100644
--- a/arch/arc/include/asm/kgdb.h
+++ b/arch/arc/include/asm/kgdb.h
@@ -13,7 +13,7 @@
 
 #ifdef CONFIG_KGDB
 
-#include <asm/user.h>
+#include <asm/ptrace.h>
 
 /* to ensure compatibility with Linux 2.6.35, we don't implement the get/set
  * register API yet */
@@ -53,9 +53,7 @@ enum arc700_linux_regnums {
 };
 
 #else
-static inline void kgdb_trap(struct pt_regs *regs, int param)
-{
-}
+#define kgdb_trap(regs, param)
 #endif
 
 #endif  /* __ARC_KGDB_H__ */
diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
index 8ae783d20a81..6179de7e07c2 100644
--- a/arch/arc/include/asm/ptrace.h
+++ b/arch/arc/include/asm/ptrace.h
@@ -123,7 +123,7 @@ static inline long regs_return_value(struct pt_regs *regs)
 #define orig_r8_IS_SCALL                0x0001
 #define orig_r8_IS_SCALL_RESTARTED      0x0002
 #define orig_r8_IS_BRKPT                0x0004
-#define orig_r8_IS_EXCPN                0x0004
+#define orig_r8_IS_EXCPN                0x0008
 #define orig_r8_IS_IRQ1                 0x0010
 #define orig_r8_IS_IRQ2                 0x0020
 
diff --git a/arch/arc/include/asm/syscalls.h b/arch/arc/include/asm/syscalls.h
index e53a5340ba4f..dd785befe7fd 100644
--- a/arch/arc/include/asm/syscalls.h
+++ b/arch/arc/include/asm/syscalls.h
@@ -16,8 +16,6 @@
 #include <linux/types.h>
 
 int sys_clone_wrapper(int, int, int, int, int);
-int sys_fork_wrapper(void);
-int sys_vfork_wrapper(void);
 int sys_cacheflush(uint32_t, uint32_t uint32_t);
 int sys_arc_settls(void *);
 int sys_arc_gettls(void);
diff --git a/arch/arc/include/uapi/asm/ptrace.h b/arch/arc/include/uapi/asm/ptrace.h
index 6afa4f702075..30333cec0fef 100644
--- a/arch/arc/include/uapi/asm/ptrace.h
+++ b/arch/arc/include/uapi/asm/ptrace.h
@@ -28,14 +28,14 @@
 */
 struct user_regs_struct {
 
-        struct scratch {
+        struct {
                 long pad;
                 long bta, lp_start, lp_end, lp_count;
                 long status32, ret, blink, fp, gp;
                 long r12, r11, r10, r9, r8, r7, r6, r5, r4, r3, r2, r1, r0;
                 long sp;
         } scratch;
-        struct callee {
+        struct {
                 long pad;
                 long r25, r24, r23, r22, r21, r20;
                 long r19, r18, r17, r16, r15, r14, r13;
diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
index ef6800ba2f03..91eeab81f52d 100644
--- a/arch/arc/kernel/entry.S
+++ b/arch/arc/kernel/entry.S
@@ -452,7 +452,7 @@ tracesys:
         ; using ERET won't work since next-PC has already committed
         lr  r12, [efa]
         GET_CURR_TASK_FIELD_PTR   TASK_THREAD, r11
-        st  r12, [r11, THREAD_FAULT_ADDR]
+        st  r12, [r11, THREAD_FAULT_ADDR]       ; thread.fault_address
 
         ; PRE Sys Call Ptrace hook
         mov r0, sp                      ; pt_regs needed
@@ -792,31 +792,6 @@ ARC_EXIT ret_from_fork
 
 ;################### Special Sys Call Wrappers ##########################
 
-; TBD: call do_fork directly from here
-ARC_ENTRY sys_fork_wrapper
-        SAVE_CALLEE_SAVED_USER
-        bl  @sys_fork
-        DISCARD_CALLEE_SAVED_USER
-
-        GET_CURR_THR_INFO_FLAGS   r10
-        btst r10, TIF_SYSCALL_TRACE
-        bnz  tracesys_exit
-
-        b ret_from_system_call
-ARC_EXIT sys_fork_wrapper
-
-ARC_ENTRY sys_vfork_wrapper
-        SAVE_CALLEE_SAVED_USER
-        bl  @sys_vfork
-        DISCARD_CALLEE_SAVED_USER
-
-        GET_CURR_THR_INFO_FLAGS   r10
-        btst r10, TIF_SYSCALL_TRACE
-        bnz  tracesys_exit
-
-        b ret_from_system_call
-ARC_EXIT sys_vfork_wrapper
-
 ARC_ENTRY sys_clone_wrapper
         SAVE_CALLEE_SAVED_USER
         bl  @sys_clone
diff --git a/arch/arc/kernel/kgdb.c b/arch/arc/kernel/kgdb.c
index 2888ba5be47e..52bdc83c1495 100644
--- a/arch/arc/kernel/kgdb.c
+++ b/arch/arc/kernel/kgdb.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/kgdb.h>
+#include <linux/sched.h>
 #include <asm/disasm.h>
 #include <asm/cacheflush.h>
 
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index dc0f968dae0a..2d95ac07df7b 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -232,10 +232,8 @@ char *arc_extn_mumbojumbo(int cpu_id, char *buf, int len)
 
         n += scnprintf(buf + n, len - n, "\n");
 
-#ifdef _ASM_GENERIC_UNISTD_H
         n += scnprintf(buf + n, len - n,
-                       "OS ABI [v2]\t: asm-generic/{unistd,stat,fcntl}\n");
-#endif
+                       "OS ABI [v3]\t: no-legacy-syscalls\n");
 
         return buf;
 }
diff --git a/arch/arc/kernel/sys.c b/arch/arc/kernel/sys.c
index f6bdd07583f3..9d6c1ca26af6 100644
--- a/arch/arc/kernel/sys.c
+++ b/arch/arc/kernel/sys.c
@@ -6,8 +6,6 @@
 #include <asm/syscalls.h>
 
 #define sys_clone       sys_clone_wrapper
-#define sys_fork        sys_fork_wrapper
-#define sys_vfork       sys_vfork_wrapper
 
 #undef __SYSCALL
 #define __SYSCALL(nr, call) [nr] = (call),
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 13b739469c51..1cacda426a0e 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1183,9 +1183,9 @@ config ARM_NR_BANKS
         default 8
 
 config IWMMXT
-        bool "Enable iWMMXt support"
+        bool "Enable iWMMXt support" if !CPU_PJ4
         depends on CPU_XSCALE || CPU_XSC3 || CPU_MOHAWK || CPU_PJ4
-        default y if PXA27x || PXA3xx || ARCH_MMP
+        default y if PXA27x || PXA3xx || ARCH_MMP || CPU_PJ4
         help
           Enable support for iWMMXt context switching at run time if
           running on a CPU that supports it.
@@ -1439,6 +1439,16 @@ config ARM_ERRATA_775420
          to deadlock. This workaround puts DSB before executing ISB if
          an abort may occur on cache maintenance.
 
+config ARM_ERRATA_798181
+        bool "ARM errata: TLBI/DSB failure on Cortex-A15"
+        depends on CPU_V7 && SMP
+        help
+          On Cortex-A15 (r0p0..r3p2) the TLBI*IS/DSB operations are not
+          adequately shooting down all use of the old entries. This
+          option enables the Linux kernel workaround for this erratum
+          which sends an IPI to the CPUs that are running the same ASID
+          as the one being invalidated.
+
 endmenu
 
 source "arch/arm/common/Kconfig"
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index ecfcdba2d17c..9b31f4311ea2 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -495,6 +495,7 @@ config DEBUG_IMX_UART_PORT
                                                 DEBUG_IMX53_UART || \
                                                 DEBUG_IMX6Q_UART
         default 1
+        depends on ARCH_MXC
         help
           Choose UART port on which kernel low-level debug messages
           should be output.
diff --git a/arch/arm/boot/dts/armada-370-mirabox.dts b/arch/arm/boot/dts/armada-370-mirabox.dts
index dd0c57dd9f30..3234875824dc 100644
--- a/arch/arm/boot/dts/armada-370-mirabox.dts
+++ b/arch/arm/boot/dts/armada-370-mirabox.dts
@@ -54,7 +54,7 @@
                 };
 
                 mvsdio@d00d4000 {
-                        pinctrl-0 = <&sdio_pins2>;
+                        pinctrl-0 = <&sdio_pins3>;
                         pinctrl-names = "default";
                         status = "okay";
                         /*
diff --git a/arch/arm/boot/dts/armada-370.dtsi b/arch/arm/boot/dts/armada-370.dtsi
index 8188d138020e..a195debb67d3 100644
--- a/arch/arm/boot/dts/armada-370.dtsi
+++ b/arch/arm/boot/dts/armada-370.dtsi
@@ -59,6 +59,12 @@
                                              "mpp50", "mpp51", "mpp52";
                               marvell,function = "sd0";
                         };
+
+                        sdio_pins3: sdio-pins3 {
+                              marvell,pins = "mpp48", "mpp49", "mpp50",
+                                             "mpp51", "mpp52", "mpp53";
+                              marvell,function = "sd0";
+                        };
                 };
 
                 gpio0: gpio@d0018100 {
diff --git a/arch/arm/boot/dts/dbx5x0.dtsi b/arch/arm/boot/dts/dbx5x0.dtsi
index 9de93096601a..aaa63d0a8096 100644
--- a/arch/arm/boot/dts/dbx5x0.dtsi
+++ b/arch/arm/boot/dts/dbx5x0.dtsi
@@ -191,8 +191,8 @@
 
                 prcmu: prcmu@80157000 {
                         compatible = "stericsson,db8500-prcmu";
-                        reg = <0x80157000 0x1000>;
-                        reg-names = "prcmu";
+                        reg = <0x80157000 0x1000>, <0x801b0000 0x8000>, <0x801b8000 0x1000>;
+                        reg-names = "prcmu", "prcmu-tcpm", "prcmu-tcdm";
                         interrupts = <0 47 0x4>;
                         #address-cells = <1>;
                         #size-cells = <1>;
diff --git a/arch/arm/boot/dts/imx28-m28evk.dts b/arch/arm/boot/dts/imx28-m28evk.dts
index 6ce3d17c3a29..fd36e1cca104 100644
--- a/arch/arm/boot/dts/imx28-m28evk.dts
+++ b/arch/arm/boot/dts/imx28-m28evk.dts
@@ -152,7 +152,6 @@
                         i2c0: i2c@80058000 {
                                 pinctrl-names = "default";
                                 pinctrl-0 = <&i2c0_pins_a>;
-                                clock-frequency = <400000>;
                                 status = "okay";
 
                                 sgtl5000: codec@0a {
diff --git a/arch/arm/boot/dts/imx28-sps1.dts b/arch/arm/boot/dts/imx28-sps1.dts
index e6cde8aa7fff..6c6a5442800a 100644
--- a/arch/arm/boot/dts/imx28-sps1.dts
+++ b/arch/arm/boot/dts/imx28-sps1.dts
@@ -70,7 +70,6 @@
                         i2c0: i2c@80058000 {
                                 pinctrl-names = "default";
                                 pinctrl-0 = <&i2c0_pins_a>;
-                                clock-frequency = <400000>;
                                 status = "okay";
 
                                 rtc: rtc@51 {
diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
index 06ec460b4581..281a223591ff 100644
--- a/arch/arm/boot/dts/imx6qdl.dtsi
+++ b/arch/arm/boot/dts/imx6qdl.dtsi
@@ -91,6 +91,7 @@
                         compatible = "arm,cortex-a9-twd-timer";
                         reg = <0x00a00600 0x20>;
                         interrupts = <1 13 0xf01>;
+                        clocks = <&clks 15>;
                 };
 
                 L2: l2-cache@00a02000 {
diff --git a/arch/arm/boot/dts/kirkwood-goflexnet.dts b/arch/arm/boot/dts/kirkwood-goflexnet.dts
index bd83b8fc7c83..c3573be7b92c 100644
--- a/arch/arm/boot/dts/kirkwood-goflexnet.dts
+++ b/arch/arm/boot/dts/kirkwood-goflexnet.dts
@@ -77,6 +77,7 @@
                 };
 
                 nand@3000000 {
+                        chip-delay = <40>;
                         status = "okay";
 
                         partition@0 {
diff --git a/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts b/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
index 93c3afbef9ee..3694e94f6e99 100644
--- a/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
+++ b/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
@@ -96,11 +96,11 @@
                                 marvell,function = "gpio";
                         };
                         pmx_led_rebuild_brt_ctrl_1: pmx-led-rebuild-brt-ctrl-1 {
-                                marvell,pins = "mpp44";
+                                marvell,pins = "mpp46";
                                 marvell,function = "gpio";
                         };
                         pmx_led_rebuild_brt_ctrl_2: pmx-led-rebuild-brt-ctrl-2 {
-                                marvell,pins = "mpp45";
+                                marvell,pins = "mpp47";
                                 marvell,function = "gpio";
                         };
 
@@ -157,14 +157,14 @@
                         gpios = <&gpio0 16 0>;
                         linux,default-trigger = "default-on";
                 };
-                health_led1 {
+                rebuild_led {
+                        label = "status:white:rebuild_led";
+                        gpios = <&gpio1 4 0>;
+                };
+                health_led {
                         label = "status:red:health_led";
                         gpios = <&gpio1 5 0>;
                 };
-                health_led2 {
-                        label = "status:white:health_led";
-                        gpios = <&gpio1 4 0>;
-                };
                 backup_led {
                         label = "status:blue:backup_led";
                         gpios = <&gpio0 15 0>;
diff --git a/arch/arm/boot/dts/orion5x.dtsi b/arch/arm/boot/dts/orion5x.dtsi
index 8aad00f81ed9..f7bec3b1ba32 100644
--- a/arch/arm/boot/dts/orion5x.dtsi
+++ b/arch/arm/boot/dts/orion5x.dtsi
@@ -13,6 +13,9 @@
         compatible = "marvell,orion5x";
         interrupt-parent = <&intc>;
 
+        aliases {
+                gpio0 = &gpio0;
+        };
         intc: interrupt-controller {
                 compatible = "marvell,orion-intc", "marvell,intc";
                 interrupt-controller;
@@ -32,7 +35,9 @@
                         #gpio-cells = <2>;
                         gpio-controller;
                         reg = <0x10100 0x40>;
-                        ngpio = <32>;
+                        ngpios = <32>;
+                        interrupt-controller;
+                        #interrupt-cells = <2>;
                         interrupts = <6>, <7>, <8>, <9>;
                 };
 
@@ -91,7 +96,7 @@
                         reg = <0x90000 0x10000>,
                               <0xf2200000 0x800>;
                         reg-names = "regs", "sram";
-                        interrupts = <22>;
+                        interrupts = <28>;
                         status = "okay";
                 };
         };
diff --git a/arch/arm/boot/dts/tegra20.dtsi b/arch/arm/boot/dts/tegra20.dtsi
index 48d00a099ce3..3d3f64d2111a 100644
--- a/arch/arm/boot/dts/tegra20.dtsi
+++ b/arch/arm/boot/dts/tegra20.dtsi
@@ -385,7 +385,7 @@
 
         spi@7000d800 {
                 compatible = "nvidia,tegra20-slink";
-                reg = <0x7000d480 0x200>;
+                reg = <0x7000d800 0x200>;
                 interrupts = <0 83 0x04>;
                 nvidia,dma-request-selector = <&apbdma 17>;
                 #address-cells = <1>;
diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi
index 9d87a3ffe998..dbf46c272562 100644
--- a/arch/arm/boot/dts/tegra30.dtsi
+++ b/arch/arm/boot/dts/tegra30.dtsi
@@ -372,7 +372,7 @@
 
         spi@7000d800 {
                 compatible = "nvidia,tegra30-slink", "nvidia,tegra20-slink";
-                reg = <0x7000d480 0x200>;
+                reg = <0x7000d800 0x200>;
                 interrupts = <0 83 0x04>;
                 nvidia,dma-request-selector = <&apbdma 17>;
                 #address-cells = <1>;
diff --git a/arch/arm/include/asm/delay.h b/arch/arm/include/asm/delay.h
index 720799fd3a81..dff714d886d5 100644
--- a/arch/arm/include/asm/delay.h
+++ b/arch/arm/include/asm/delay.h
@@ -24,7 +24,7 @@ extern struct arm_delay_ops {
         void (*delay)(unsigned long);
         void (*const_udelay)(unsigned long);
         void (*udelay)(unsigned long);
-        bool const_clock;
+        unsigned long ticks_per_jiffy;
 } arm_delay_ops;
 
 #define __delay(n)              arm_delay_ops.delay(n)
diff --git a/arch/arm/include/asm/highmem.h b/arch/arm/include/asm/highmem.h
index 8c5e828f484d..91b99abe7a95 100644
--- a/arch/arm/include/asm/highmem.h
+++ b/arch/arm/include/asm/highmem.h
@@ -41,6 +41,13 @@ extern void kunmap_high(struct page *page);
 #endif
 #endif
 
+/*
+ * Needed to be able to broadcast the TLB invalidation for kmap.
+ */
+#ifdef CONFIG_ARM_ERRATA_798181
+#undef ARCH_NEEDS_KMAP_HIGH_GET
+#endif
+
 #ifdef ARCH_NEEDS_KMAP_HIGH_GET
 extern void *kmap_high_get(struct page *page);
 #else
diff --git a/arch/arm/include/asm/mmu_context.h b/arch/arm/include/asm/mmu_context.h
index 863a6611323c..a7b85e0d0cc1 100644
--- a/arch/arm/include/asm/mmu_context.h
+++ b/arch/arm/include/asm/mmu_context.h
@@ -27,6 +27,8 @@ void __check_vmalloc_seq(struct mm_struct *mm);
 void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk);
 #define init_new_context(tsk,mm)        ({ atomic64_set(&mm->context.id, 0); 0; })
 
+DECLARE_PER_CPU(atomic64_t, active_asids);
+
 #else   /* !CONFIG_CPU_HAS_ASID */
 
 #ifdef CONFIG_MMU
diff --git a/arch/arm/include/asm/tlbflush.h b/arch/arm/include/asm/tlbflush.h
index 4db8c8820f0d..9e9c041358ca 100644
--- a/arch/arm/include/asm/tlbflush.h
+++ b/arch/arm/include/asm/tlbflush.h
@@ -450,6 +450,21 @@ static inline void local_flush_bp_all(void)
                 isb();
 }
 
+#ifdef CONFIG_ARM_ERRATA_798181
+static inline void dummy_flush_tlb_a15_erratum(void)
+{
+        /*
+         * Dummy TLBIMVAIS. Using the unmapped address 0 and ASID 0.
+         */
+        asm("mcr p15, 0, %0, c8, c3, 1" : : "r" (0));
+        dsb();
+}
+#else
+static inline void dummy_flush_tlb_a15_erratum(void)
+{
+}
+#endif
+
 /*
  *      flush_pmd_entry
  *
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 3248cde504ed..fefd7f971437 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -276,7 +276,13 @@ ENDPROC(ftrace_graph_caller_old)
  */
 
 .macro mcount_enter
+/*
+ * This pad compensates for the push {lr} at the call site.  Note that we are
+ * unable to unwind through a function which does not otherwise save its lr.
+ */
+ UNWIND(.pad    #4)
         stmdb   sp!, {r0-r3, lr}
+ UNWIND(.save   {r0-r3, lr})
 .endm
 
 .macro mcount_get_lr reg
@@ -289,6 +295,7 @@ ENDPROC(ftrace_graph_caller_old)
 .endm
 
 ENTRY(__gnu_mcount_nc)
+UNWIND(.fnstart)
 #ifdef CONFIG_DYNAMIC_FTRACE
         mov     ip, lr
         ldmia   sp!, {lr}
@@ -296,17 +303,22 @@ ENTRY(__gnu_mcount_nc)
 #else
         __mcount
 #endif
+UNWIND(.fnend)
 ENDPROC(__gnu_mcount_nc)
 
 #ifdef CONFIG_DYNAMIC_FTRACE
 ENTRY(ftrace_caller)
+UNWIND(.fnstart)
         __ftrace_caller
+UNWIND(.fnend)
 ENDPROC(ftrace_caller)
 #endif
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 ENTRY(ftrace_graph_caller)
+UNWIND(.fnstart)
         __ftrace_graph_caller
+UNWIND(.fnend)
 ENDPROC(ftrace_graph_caller)
 #endif
 
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index e0eb9a1cae77..8bac553fe213 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -267,7 +267,7 @@ __create_page_tables:
         addne   r6, r6, #1 << SECTION_SHIFT
         strne   r6, [r3]
 
-#if defined(CONFIG_LPAE) && defined(CONFIG_CPU_ENDIAN_BE8)
+#if defined(CONFIG_ARM_LPAE) && defined(CONFIG_CPU_ENDIAN_BE8)
         sub     r4, r4, #4                      @ Fixup page table pointer
                                                 @ for 64-bit descriptors
 #endif
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index 96093b75ab90..5dc1aa6f0f7d 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -966,7 +966,7 @@ static void reset_ctrl_regs(void *unused)
         }
 
         if (err) {
-                pr_warning("CPU %d debug is powered down!\n", cpu);
+                pr_warn_once("CPU %d debug is powered down!\n", cpu);
                 cpumask_or(&debug_err_mask, &debug_err_mask, cpumask_of(cpu));
                 return;
         }
@@ -987,7 +987,7 @@ clear_vcr:
         isb();
 
         if (cpumask_intersects(&debug_err_mask, cpumask_of(cpu))) {
-                pr_warning("CPU %d failed to disable vector catch\n", cpu);
+                pr_warn_once("CPU %d failed to disable vector catch\n", cpu);
                 return;
         }
 
@@ -1007,7 +1007,7 @@ clear_vcr:
         }
 
         if (cpumask_intersects(&debug_err_mask, cpumask_of(cpu))) {
-                pr_warning("CPU %d failed to clear debug register pairs\n", cpu);
+                pr_warn_once("CPU %d failed to clear debug register pairs\n", cpu);
                 return;
         }
 
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 3f6cbb2e3eda..d343a6c3a6d1 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -353,6 +353,23 @@ void __init early_print(const char *str, ...)
         printk("%s", buf);
 }
 
+static void __init cpuid_init_hwcaps(void)
+{
+        unsigned int divide_instrs;
+
+        if (cpu_architecture() < CPU_ARCH_ARMv7)
+                return;
+
+        divide_instrs = (read_cpuid_ext(CPUID_EXT_ISAR0) & 0x0f000000) >> 24;
+
+        switch (divide_instrs) {
+        case 2:
+                elf_hwcap |= HWCAP_IDIVA;
+        case 1:
+                elf_hwcap |= HWCAP_IDIVT;
+        }
+}
+
 static void __init feat_v6_fixup(void)
 {
         int id = read_cpuid_id();
@@ -483,8 +500,11 @@ static void __init setup_processor(void)
         snprintf(elf_platform, ELF_PLATFORM_SIZE, "%s%c",
                  list->elf_name, ENDIANNESS);
         elf_hwcap = list->elf_hwcap;
+
+        cpuid_init_hwcaps();
+
 #ifndef CONFIG_ARM_THUMB
-        elf_hwcap &= ~HWCAP_THUMB;
+        elf_hwcap &= ~(HWCAP_THUMB | HWCAP_IDIVT);
 #endif
 
         feat_v6_fixup();
@@ -524,7 +544,7 @@ int __init arm_add_memory(phys_addr_t start, phys_addr_t size)
         size -= start & ~PAGE_MASK;
         bank->start = PAGE_ALIGN(start);
 
-#ifndef CONFIG_LPAE
+#ifndef CONFIG_ARM_LPAE
         if (bank->start + size < bank->start) {
                 printk(KERN_CRIT "Truncating memory at 0x%08llx to fit in "
                         "32-bit physical address space\n", (long long)start);
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 79078edbb9bc..1f2ccccaf009 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -673,9 +673,6 @@ static int cpufreq_callback(struct notifier_block *nb,
         if (freq->flags & CPUFREQ_CONST_LOOPS)
                 return NOTIFY_OK;
 
-        if (arm_delay_ops.const_clock)
-                return NOTIFY_OK;
-
         if (!per_cpu(l_p_j_ref, cpu)) {
                 per_cpu(l_p_j_ref, cpu) =
                         per_cpu(cpu_data, cpu).loops_per_jiffy;
diff --git a/arch/arm/kernel/smp_tlb.c b/arch/arm/kernel/smp_tlb.c
index bd0300531399..e82e1d248772 100644
--- a/arch/arm/kernel/smp_tlb.c
+++ b/arch/arm/kernel/smp_tlb.c
@@ -12,6 +12,7 @@
 
 #include <asm/smp_plat.h>
 #include <asm/tlbflush.h>
+#include <asm/mmu_context.h>
 
 /**********************************************************************/
 
@@ -69,12 +70,72 @@ static inline void ipi_flush_bp_all(void *ignored)
         local_flush_bp_all();
 }
 
+#ifdef CONFIG_ARM_ERRATA_798181
+static int erratum_a15_798181(void)
+{
+        unsigned int midr = read_cpuid_id();
+
+        /* Cortex-A15 r0p0..r3p2 affected */
+        if ((midr & 0xff0ffff0) != 0x410fc0f0 || midr > 0x413fc0f2)
+                return 0;
+        return 1;
+}
+#else
+static int erratum_a15_798181(void)
+{
+        return 0;
+}
+#endif
+
+static void ipi_flush_tlb_a15_erratum(void *arg)
+{
+        dmb();
+}
+
+static void broadcast_tlb_a15_erratum(void)
+{
+        if (!erratum_a15_798181())
+                return;
+
+        dummy_flush_tlb_a15_erratum();
+        smp_call_function_many(cpu_online_mask, ipi_flush_tlb_a15_erratum,
+                               NULL, 1);
+}
+
+static void broadcast_tlb_mm_a15_erratum(struct mm_struct *mm)
+{
+        int cpu;
+        cpumask_t mask = { CPU_BITS_NONE };
+
+        if (!erratum_a15_798181())
+                return;
+
+        dummy_flush_tlb_a15_erratum();
+        for_each_online_cpu(cpu) {
+                if (cpu == smp_processor_id())
+                        continue;
+                /*
+                 * We only need to send an IPI if the other CPUs are running
+                 * the same ASID as the one being invalidated. There is no
+                 * need for locking around the active_asids check since the
+                 * switch_mm() function has at least one dmb() (as required by
+                 * this workaround) in case a context switch happens on
+                 * another CPU after the condition below.
+                 */
+                if (atomic64_read(&mm->context.id) ==
+                    atomic64_read(&per_cpu(active_asids, cpu)))
+                        cpumask_set_cpu(cpu, &mask);
+        }
+        smp_call_function_many(&mask, ipi_flush_tlb_a15_erratum, NULL, 1);
+}
+
 void flush_tlb_all(void)
 {
         if (tlb_ops_need_broadcast())
                 on_each_cpu(ipi_flush_tlb_all, NULL, 1);
         else
                 local_flush_tlb_all();
+        broadcast_tlb_a15_erratum();
 }
 
 void flush_tlb_mm(struct mm_struct *mm)
@@ -83,6 +144,7 @@ void flush_tlb_mm(struct mm_struct *mm)
                 on_each_cpu_mask(mm_cpumask(mm), ipi_flush_tlb_mm, mm, 1);
         else
                 local_flush_tlb_mm(mm);
+        broadcast_tlb_mm_a15_erratum(mm);
 }
 
 void flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr)
@@ -95,6 +157,7 @@ void flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr)
                                         &ta, 1);
         } else
                 local_flush_tlb_page(vma, uaddr);
+        broadcast_tlb_mm_a15_erratum(vma->vm_mm);
 }
 
 void flush_tlb_kernel_page(unsigned long kaddr)
@@ -105,6 +168,7 @@ void flush_tlb_kernel_page(unsigned long kaddr)
                 on_each_cpu(ipi_flush_tlb_kernel_page, &ta, 1);
         } else
                 local_flush_tlb_kernel_page(kaddr);
+        broadcast_tlb_a15_erratum();
 }
 
 void flush_tlb_range(struct vm_area_struct *vma,
@@ -119,6 +183,7 @@ void flush_tlb_range(struct vm_area_struct *vma,
                                         &ta, 1);
         } else
                 local_flush_tlb_range(vma, start, end);
+        broadcast_tlb_mm_a15_erratum(vma->vm_mm);
 }
 
 void flush_tlb_kernel_range(unsigned long start, unsigned long end)
@@ -130,6 +195,7 @@ void flush_tlb_kernel_range(unsigned long start, unsigned long end)
                 on_each_cpu(ipi_flush_tlb_kernel_range, &ta, 1);
         } else
                 local_flush_tlb_kernel_range(start, end);
+        broadcast_tlb_a15_erratum();
 }
 
 void flush_bp_all(void)
diff --git a/arch/arm/kvm/vgic.c b/arch/arm/kvm/vgic.c
index c9a17316e9fe..0e4cfe123b38 100644
--- a/arch/arm/kvm/vgic.c
+++ b/arch/arm/kvm/vgic.c
@@ -883,8 +883,7 @@ static bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
                           lr, irq, vgic_cpu->vgic_lr[lr]);
                 BUG_ON(!test_bit(lr, vgic_cpu->lr_used));
                 vgic_cpu->vgic_lr[lr] |= GICH_LR_PENDING_BIT;
-
-                goto out;
+                return true;
         }
 
         /* Try to use another LR for this interrupt */
@@ -898,7 +897,6 @@ static bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
         vgic_cpu->vgic_irq_lr_map[irq] = lr;
         set_bit(lr, vgic_cpu->lr_used);
 
-out:
         if (!vgic_irq_is_edge(vcpu, irq))
                 vgic_cpu->vgic_lr[lr] |= GICH_LR_EOI;
 
@@ -1018,21 +1016,6 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
 
         kvm_debug("MISR = %08x\n", vgic_cpu->vgic_misr);
 
-        /*
-         * We do not need to take the distributor lock here, since the only
-         * action we perform is clearing the irq_active_bit for an EOIed
-         * level interrupt.  There is a potential race with
-         * the queuing of an interrupt in __kvm_vgic_flush_hwstate(), where we
-         * check if the interrupt is already active. Two possibilities:
-         *
-         * - The queuing is occurring on the same vcpu: cannot happen,
-         *   as we're already in the context of this vcpu, and
-         *   executing the handler
-         * - The interrupt has been migrated to another vcpu, and we
-         *   ignore this interrupt for this run. Big deal. It is still
-         *   pending though, and will get considered when this vcpu
-         *   exits.
-         */
         if (vgic_cpu->vgic_misr & GICH_MISR_EOI) {
                 /*
                  * Some level interrupts have been EOIed. Clear their
@@ -1054,6 +1037,13 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
                         } else {
                                 vgic_cpu_irq_clear(vcpu, irq);
                         }
+
+                        /*
+                         * Despite being EOIed, the LR may not have
+                         * been marked as empty.
+                         */
+                        set_bit(lr, (unsigned long *)vgic_cpu->vgic_elrsr);
+                        vgic_cpu->vgic_lr[lr] &= ~GICH_LR_ACTIVE_BIT;
                 }
         }
 
@@ -1064,9 +1054,8 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
 }
 
 /*
- * Sync back the VGIC state after a guest run. We do not really touch
- * the distributor here (the irq_pending_on_cpu bit is safe to set),
- * so there is no need for taking its lock.
+ * Sync back the VGIC state after a guest run. The distributor lock is
+ * needed so we don't get preempted in the middle of the state processing.
  */
 static void __kvm_vgic_sync_hwstate(struct kvm_vcpu *vcpu)
 {
@@ -1112,10 +1101,14 @@ void kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
 
 void kvm_vgic_sync_hwstate(struct kvm_vcpu *vcpu)
 {
+        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
+
         if (!irqchip_in_kernel(vcpu->kvm))
                 return;
 
+        spin_lock(&dist->lock);
         __kvm_vgic_sync_hwstate(vcpu);
+        spin_unlock(&dist->lock);
 }
 
 int kvm_vgic_vcpu_pending_irq(struct kvm_vcpu *vcpu)
diff --git a/arch/arm/lib/delay.c b/arch/arm/lib/delay.c
index 6b93f6a1a3c7..64dbfa57204a 100644
--- a/arch/arm/lib/delay.c
+++ b/arch/arm/lib/delay.c
@@ -58,7 +58,7 @@ static void __timer_delay(unsigned long cycles)
 static void __timer_const_udelay(unsigned long xloops)
 {
         unsigned long long loops = xloops;
-        loops *= loops_per_jiffy;
+        loops *= arm_delay_ops.ticks_per_jiffy;
         __timer_delay(loops >> UDELAY_SHIFT);
 }
 
@@ -73,11 +73,13 @@ void __init register_current_timer_delay(const struct delay_timer *timer)
                 pr_info("Switching to timer-based delay loop\n");
                 delay_timer                     = timer;
                 lpj_fine                        = timer->freq / HZ;
-                loops_per_jiffy                 = lpj_fine;
+
+                /* cpufreq may scale loops_per_jiffy, so keep a private copy */
+                arm_delay_ops.ticks_per_jiffy   = lpj_fine;
                 arm_delay_ops.delay             = __timer_delay;
                 arm_delay_ops.const_udelay      = __timer_const_udelay;
                 arm_delay_ops.udelay            = __timer_udelay;
-                arm_delay_ops.const_clock       = true;
+
                 delay_calibrated                = true;
         } else {
                 pr_info("Ignoring duplicate/late registration of read_current_timer delay\n");
diff --git a/arch/arm/mach-cns3xxx/core.c b/arch/arm/mach-cns3xxx/core.c
index e698f26cc0cb..52e4bb5cf12d 100644
--- a/arch/arm/mach-cns3xxx/core.c
+++ b/arch/arm/mach-cns3xxx/core.c
@@ -22,19 +22,9 @@
 
 static struct map_desc cns3xxx_io_desc[] __initdata = {
         {
-                .virtual        = CNS3XXX_TC11MP_TWD_BASE_VIRT,
-                .pfn            = __phys_to_pfn(CNS3XXX_TC11MP_TWD_BASE),
-                .length         = SZ_4K,
-                .type           = MT_DEVICE,
-        }, {
-                .virtual        = CNS3XXX_TC11MP_GIC_CPU_BASE_VIRT,
-                .pfn            = __phys_to_pfn(CNS3XXX_TC11MP_GIC_CPU_BASE),
-                .length         = SZ_4K,
-                .type           = MT_DEVICE,
-        }, {
-                .virtual        = CNS3XXX_TC11MP_GIC_DIST_BASE_VIRT,
-                .pfn            = __phys_to_pfn(CNS3XXX_TC11MP_GIC_DIST_BASE),
-                .length         = SZ_4K,
+                .virtual        = CNS3XXX_TC11MP_SCU_BASE_VIRT,
+                .pfn            = __phys_to_pfn(CNS3XXX_TC11MP_SCU_BASE),
+                .length         = SZ_8K,
                 .type           = MT_DEVICE,
         }, {
                 .virtual        = CNS3XXX_TIMER1_2_3_BASE_VIRT,
diff --git a/arch/arm/mach-cns3xxx/include/mach/cns3xxx.h b/arch/arm/mach-cns3xxx/include/mach/cns3xxx.h
index 191c8e57f289..b1021aafa481 100644
--- a/arch/arm/mach-cns3xxx/include/mach/cns3xxx.h
+++ b/arch/arm/mach-cns3xxx/include/mach/cns3xxx.h
@@ -94,10 +94,10 @@
 #define RTC_INTR_STS_OFFSET                     0x34
 
 #define CNS3XXX_MISC_BASE                       0x76000000      /* Misc Control */
-#define CNS3XXX_MISC_BASE_VIRT                  0xFFF07000      /* Misc Control */
+#define CNS3XXX_MISC_BASE_VIRT                  0xFB000000      /* Misc Control */
 
 #define CNS3XXX_PM_BASE                         0x77000000      /* Power Management Control */
-#define CNS3XXX_PM_BASE_VIRT                    0xFFF08000
+#define CNS3XXX_PM_BASE_VIRT                    0xFB001000
 
 #define PM_CLK_GATE_OFFSET                      0x00
 #define PM_SOFT_RST_OFFSET                      0x04
@@ -109,7 +109,7 @@
 #define PM_PLL_HM_PD_OFFSET                     0x1C
 
 #define CNS3XXX_UART0_BASE                      0x78000000      /* UART 0 */
-#define CNS3XXX_UART0_BASE_VIRT                 0xFFF09000
+#define CNS3XXX_UART0_BASE_VIRT                 0xFB002000
 
 #define CNS3XXX_UART1_BASE                      0x78400000      /* UART 1 */
 #define CNS3XXX_UART1_BASE_VIRT                 0xFFF0A000
@@ -130,7 +130,7 @@
 #define CNS3XXX_I2S_BASE_VIRT                   0xFFF10000
 
 #define CNS3XXX_TIMER1_2_3_BASE                 0x7C800000      /* Timer */
-#define CNS3XXX_TIMER1_2_3_BASE_VIRT            0xFFF10800
+#define CNS3XXX_TIMER1_2_3_BASE_VIRT            0xFB003000
 
 #define TIMER1_COUNTER_OFFSET                   0x00
 #define TIMER1_AUTO_RELOAD_OFFSET               0x04
@@ -227,16 +227,16 @@
  * Testchip peripheral and fpga gic regions
  */
 #define CNS3XXX_TC11MP_SCU_BASE                 0x90000000      /* IRQ, Test chip */
-#define CNS3XXX_TC11MP_SCU_BASE_VIRT            0xFF000000
+#define CNS3XXX_TC11MP_SCU_BASE_VIRT            0xFB004000
 
 #define CNS3XXX_TC11MP_GIC_CPU_BASE             0x90000100      /* Test chip interrupt controller CPU interface */
-#define CNS3XXX_TC11MP_GIC_CPU_BASE_VIRT        0xFF000100
+#define CNS3XXX_TC11MP_GIC_CPU_BASE_VIRT        (CNS3XXX_TC11MP_SCU_BASE_VIRT + 0x100)
 
 #define CNS3XXX_TC11MP_TWD_BASE                 0x90000600
-#define CNS3XXX_TC11MP_TWD_BASE_VIRT            0xFF000600
+#define CNS3XXX_TC11MP_TWD_BASE_VIRT            (CNS3XXX_TC11MP_SCU_BASE_VIRT + 0x600)
 
 #define CNS3XXX_TC11MP_GIC_DIST_BASE            0x90001000      /* Test chip interrupt controller distributor */
-#define CNS3XXX_TC11MP_GIC_DIST_BASE_VIRT       0xFF001000
+#define CNS3XXX_TC11MP_GIC_DIST_BASE_VIRT       (CNS3XXX_TC11MP_SCU_BASE_VIRT + 0x1000)
 
 #define CNS3XXX_TC11MP_L220_BASE                0x92002000      /* L220 registers */
 #define CNS3XXX_TC11MP_L220_BASE_VIRT           0xFF002000
diff --git a/arch/arm/mach-ep93xx/include/mach/uncompress.h b/arch/arm/mach-ep93xx/include/mach/uncompress.h
index d2afb4dd82ab..b5cc77d2380b 100644
--- a/arch/arm/mach-ep93xx/include/mach/uncompress.h
+++ b/arch/arm/mach-ep93xx/include/mach/uncompress.h
@@ -47,9 +47,13 @@ static void __raw_writel(unsigned int value, unsigned int ptr)
 
 static inline void putc(int c)
 {
-        /* Transmit fifo not full?  */
-        while (__raw_readb(PHYS_UART_FLAG) & UART_FLAG_TXFF)
-                ;
+        int i;
+
+        for (i = 0; i < 10000; i++) {
+                /* Transmit fifo not full? */
+                if (!(__raw_readb(PHYS_UART_FLAG) & UART_FLAG_TXFF))
+                        break;
+        }
 
         __raw_writeb(c, PHYS_UART_DATA);
 }
diff --git a/arch/arm/mach-imx/clk-imx35.c b/arch/arm/mach-imx/clk-imx35.c
index e13a8fa5e62c..2193c834f55c 100644
--- a/arch/arm/mach-imx/clk-imx35.c
+++ b/arch/arm/mach-imx/clk-imx35.c
@@ -257,6 +257,7 @@ int __init mx35_clocks_init(void)
         clk_register_clkdev(clk[wdog_gate], NULL, "imx2-wdt.0");
         clk_register_clkdev(clk[nfc_div], NULL, "imx25-nand.0");
         clk_register_clkdev(clk[csi_gate], NULL, "mx3-camera.0");
+        clk_register_clkdev(clk[admux_gate], "audmux", NULL);
 
         clk_prepare_enable(clk[spba_gate]);
         clk_prepare_enable(clk[gpio1_gate]);
@@ -265,6 +266,7 @@ int __init mx35_clocks_init(void)
         clk_prepare_enable(clk[iim_gate]);
         clk_prepare_enable(clk[emi_gate]);
         clk_prepare_enable(clk[max_gate]);
+        clk_prepare_enable(clk[iomuxc_gate]);
 
         /*
          * SCC is needed to boot via mmc after a watchdog reset. The clock code
diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
index 2f9ff93a4e61..d38e54f5b6d7 100644
--- a/arch/arm/mach-imx/clk-imx6q.c
+++ b/arch/arm/mach-imx/clk-imx6q.c
@@ -115,7 +115,7 @@ static const char *gpu2d_core_sels[]	= { "axi", "pll3_usb_otg", "pll2_pfd0_352m"
 static const char *gpu3d_core_sels[]    = { "mmdc_ch0_axi", "pll3_usb_otg", "pll2_pfd1_594m", "pll2_pfd2_396m", };
 static const char *gpu3d_shader_sels[] = { "mmdc_ch0_axi", "pll3_usb_otg", "pll2_pfd1_594m", "pll2_pfd9_720m", };
 static const char *ipu_sels[]           = { "mmdc_ch0_axi", "pll2_pfd2_396m", "pll3_120m", "pll3_pfd1_540m", };
-static const char *ldb_di_sels[]        = { "pll5_video", "pll2_pfd0_352m", "pll2_pfd2_396m", "mmdc_ch1_axi", "pll3_pfd1_540m", };
+static const char *ldb_di_sels[]        = { "pll5_video", "pll2_pfd0_352m", "pll2_pfd2_396m", "mmdc_ch1_axi", "pll3_usb_otg", };
 static const char *ipu_di_pre_sels[]    = { "mmdc_ch0_axi", "pll3_usb_otg", "pll5_video", "pll2_pfd0_352m", "pll2_pfd2_396m", "pll3_pfd1_540m", };
 static const char *ipu1_di0_sels[]      = { "ipu1_di0_pre", "dummy", "dummy", "ldb_di0", "ldb_di1", };
 static const char *ipu1_di1_sels[]      = { "ipu1_di1_pre", "dummy", "dummy", "ldb_di0", "ldb_di1", };
@@ -443,7 +443,6 @@ int __init mx6q_clocks_init(void)
 
         clk_register_clkdev(clk[gpt_ipg], "ipg", "imx-gpt.0");
         clk_register_clkdev(clk[gpt_ipg_per], "per", "imx-gpt.0");
-        clk_register_clkdev(clk[twd], NULL, "smp_twd");
         clk_register_clkdev(clk[cko1_sel], "cko1_sel", NULL);
         clk_register_clkdev(clk[ahb], "ahb", NULL);
         clk_register_clkdev(clk[cko1], "cko1", NULL);
diff --git a/arch/arm/mach-imx/common.h b/arch/arm/mach-imx/common.h
index 5a800bfcec5b..5bf4a97ab241 100644
--- a/arch/arm/mach-imx/common.h
+++ b/arch/arm/mach-imx/common.h
@@ -110,6 +110,8 @@ void tzic_handle_irq(struct pt_regs *);
 
 extern void imx_enable_cpu(int cpu, bool enable);
 extern void imx_set_cpu_jump(int cpu, void *jump_addr);
+extern u32 imx_get_cpu_arg(int cpu);
+extern void imx_set_cpu_arg(int cpu, u32 arg);
 extern void v7_cpu_resume(void);
 extern u32 *pl310_get_save_ptr(void);
 #ifdef CONFIG_SMP
diff --git a/arch/arm/mach-imx/hotplug.c b/arch/arm/mach-imx/hotplug.c
index 7bc5fe15dda2..361a253e2b63 100644
--- a/arch/arm/mach-imx/hotplug.c
+++ b/arch/arm/mach-imx/hotplug.c
@@ -46,11 +46,23 @@ static inline void cpu_enter_lowpower(void)
 void imx_cpu_die(unsigned int cpu)
 {
         cpu_enter_lowpower();
+        /*
+         * We use the cpu jumping argument register to sync with
+         * imx_cpu_kill() which is running on cpu0 and waiting for
+         * the register being cleared to kill the cpu.
+         */
+        imx_set_cpu_arg(cpu, ~0);
         cpu_do_idle();
 }
 
 int imx_cpu_kill(unsigned int cpu)
 {
+        unsigned long timeout = jiffies + msecs_to_jiffies(50);
+
+        while (imx_get_cpu_arg(cpu) == 0)
+                if (time_after(jiffies, timeout))
+                        return 0;
         imx_enable_cpu(cpu, false);
+        imx_set_cpu_arg(cpu, 0);
         return 1;
 }
diff --git a/arch/arm/mach-imx/src.c b/arch/arm/mach-imx/src.c
index e15f1555c59b..09a742f8c7ab 100644
--- a/arch/arm/mach-imx/src.c
+++ b/arch/arm/mach-imx/src.c
@@ -43,6 +43,18 @@ void imx_set_cpu_jump(int cpu, void *jump_addr)
                        src_base + SRC_GPR1 + cpu * 8);
 }
 
+u32 imx_get_cpu_arg(int cpu)
+{
+        cpu = cpu_logical_map(cpu);
+        return readl_relaxed(src_base + SRC_GPR1 + cpu * 8 + 4);
+}
+
+void imx_set_cpu_arg(int cpu, u32 arg)
+{
+        cpu = cpu_logical_map(cpu);
+        writel_relaxed(arg, src_base + SRC_GPR1 + cpu * 8 + 4);
+}
+
 void imx_src_prepare_restart(void)
 {
         u32 val;
diff --git a/arch/arm/mach-kirkwood/board-iomega_ix2_200.c b/arch/arm/mach-kirkwood/board-iomega_ix2_200.c
index f655b2637b0e..e5f70415905a 100644
--- a/arch/arm/mach-kirkwood/board-iomega_ix2_200.c
+++ b/arch/arm/mach-kirkwood/board-iomega_ix2_200.c
@@ -20,10 +20,15 @@ static struct mv643xx_eth_platform_data iomega_ix2_200_ge00_data = {
         .duplex         = DUPLEX_FULL,
 };
 
+static struct mv643xx_eth_platform_data iomega_ix2_200_ge01_data = {
+        .phy_addr       = MV643XX_ETH_PHY_ADDR(11),
+};
+
 void __init iomega_ix2_200_init(void)
 {
         /*
          * Basic setup. Needs to be called early.
          */
-        kirkwood_ge01_init(&iomega_ix2_200_ge00_data);
+        kirkwood_ge00_init(&iomega_ix2_200_ge00_data);
+        kirkwood_ge01_init(&iomega_ix2_200_ge01_data);
 }
diff --git a/arch/arm/mach-kirkwood/guruplug-setup.c b/arch/arm/mach-kirkwood/guruplug-setup.c
index 1c6e736cbbf8..08dd739aa709 100644
--- a/arch/arm/mach-kirkwood/guruplug-setup.c
+++ b/arch/arm/mach-kirkwood/guruplug-setup.c
@@ -53,6 +53,8 @@ static struct mv_sata_platform_data guruplug_sata_data = {
 
 static struct mvsdio_platform_data guruplug_mvsdio_data = {
         /* unfortunately the CD signal has not been connected */
+        .gpio_card_detect = -1,
+        .gpio_write_protect = -1,
 };
 
 static struct gpio_led guruplug_led_pins[] = {
diff --git a/arch/arm/mach-kirkwood/openrd-setup.c b/arch/arm/mach-kirkwood/openrd-setup.c
index 8ddd69fdc937..6a6eb548307d 100644
--- a/arch/arm/mach-kirkwood/openrd-setup.c
+++ b/arch/arm/mach-kirkwood/openrd-setup.c
@@ -55,6 +55,7 @@ static struct mv_sata_platform_data openrd_sata_data = {
 
 static struct mvsdio_platform_data openrd_mvsdio_data = {
         .gpio_card_detect = 29, /* MPP29 used as SD card detect */
+        .gpio_write_protect = -1,
 };
 
 static unsigned int openrd_mpp_config[] __initdata = {
diff --git a/arch/arm/mach-kirkwood/rd88f6281-setup.c b/arch/arm/mach-kirkwood/rd88f6281-setup.c
index c7d93b48926b..d24223166e06 100644
--- a/arch/arm/mach-kirkwood/rd88f6281-setup.c
+++ b/arch/arm/mach-kirkwood/rd88f6281-setup.c
@@ -69,6 +69,7 @@ static struct mv_sata_platform_data rd88f6281_sata_data = {
 
 static struct mvsdio_platform_data rd88f6281_mvsdio_data = {
         .gpio_card_detect = 28,
+        .gpio_write_protect = -1,
 };
 
 static unsigned int rd88f6281_mpp_config[] __initdata = {
diff --git a/arch/arm/mach-msm/timer.c b/arch/arm/mach-msm/timer.c
index 2969027f02fa..f9fd77e8f1f5 100644
--- a/arch/arm/mach-msm/timer.c
+++ b/arch/arm/mach-msm/timer.c
@@ -62,7 +62,10 @@ static int msm_timer_set_next_event(unsigned long cycles,
 {
         u32 ctrl = readl_relaxed(event_base + TIMER_ENABLE);
 
-        writel_relaxed(0, event_base + TIMER_CLEAR);
+        ctrl &= ~TIMER_ENABLE_EN;
+        writel_relaxed(ctrl, event_base + TIMER_ENABLE);
+
+        writel_relaxed(ctrl, event_base + TIMER_CLEAR);
         writel_relaxed(cycles, event_base + TIMER_MATCH_VAL);
         writel_relaxed(ctrl | TIMER_ENABLE_EN, event_base + TIMER_ENABLE);
         return 0;
diff --git a/arch/arm/mach-mvebu/irq-armada-370-xp.c b/arch/arm/mach-mvebu/irq-armada-370-xp.c
index 274ff58271de..d5970f5a1e8d 100644
--- a/arch/arm/mach-mvebu/irq-armada-370-xp.c
+++ b/arch/arm/mach-mvebu/irq-armada-370-xp.c
@@ -44,6 +44,8 @@
 
 #define ARMADA_370_XP_MAX_PER_CPU_IRQS          (28)
 
+#define ARMADA_370_XP_TIMER0_PER_CPU_IRQ        (5)
+
 #define ACTIVE_DOORBELLS                        (8)
 
 static DEFINE_RAW_SPINLOCK(irq_controller_lock);
@@ -59,36 +61,26 @@ static struct irq_domain *armada_370_xp_mpic_domain;
  */
 static void armada_370_xp_irq_mask(struct irq_data *d)
 {
-#ifdef CONFIG_SMP
         irq_hw_number_t hwirq = irqd_to_hwirq(d);
 
-        if (hwirq > ARMADA_370_XP_MAX_PER_CPU_IRQS)
+        if (hwirq != ARMADA_370_XP_TIMER0_PER_CPU_IRQ)
                 writel(hwirq, main_int_base +
                                 ARMADA_370_XP_INT_CLEAR_ENABLE_OFFS);
         else
                 writel(hwirq, per_cpu_int_base +
                                 ARMADA_370_XP_INT_SET_MASK_OFFS);
-#else
-        writel(irqd_to_hwirq(d),
-               per_cpu_int_base + ARMADA_370_XP_INT_SET_MASK_OFFS);
-#endif
 }
 
 static void armada_370_xp_irq_unmask(struct irq_data *d)
 {
-#ifdef CONFIG_SMP
         irq_hw_number_t hwirq = irqd_to_hwirq(d);
 
-        if (hwirq > ARMADA_370_XP_MAX_PER_CPU_IRQS)
+        if (hwirq != ARMADA_370_XP_TIMER0_PER_CPU_IRQ)
                 writel(hwirq, main_int_base +
                                 ARMADA_370_XP_INT_SET_ENABLE_OFFS);
         else
                 writel(hwirq, per_cpu_int_base +
                                 ARMADA_370_XP_INT_CLEAR_MASK_OFFS);
-#else
-        writel(irqd_to_hwirq(d),
-               per_cpu_int_base + ARMADA_370_XP_INT_CLEAR_MASK_OFFS);
-#endif
 }
 
 #ifdef CONFIG_SMP
@@ -144,10 +136,14 @@ static int armada_370_xp_mpic_irq_map(struct irq_domain *h,
                                       unsigned int virq, irq_hw_number_t hw)
 {
         armada_370_xp_irq_mask(irq_get_irq_data(virq));
-        writel(hw, main_int_base + ARMADA_370_XP_INT_SET_ENABLE_OFFS);
+        if (hw != ARMADA_370_XP_TIMER0_PER_CPU_IRQ)
+                writel(hw, per_cpu_int_base +
+                        ARMADA_370_XP_INT_CLEAR_MASK_OFFS);
+        else
+                writel(hw, main_int_base + ARMADA_370_XP_INT_SET_ENABLE_OFFS);
         irq_set_status_flags(virq, IRQ_LEVEL);
 
-        if (hw < ARMADA_370_XP_MAX_PER_CPU_IRQS) {
+        if (hw == ARMADA_370_XP_TIMER0_PER_CPU_IRQ) {
                 irq_set_percpu_devid(virq);
                 irq_set_chip_and_handler(virq, &armada_370_xp_irq_chip,
                                         handle_percpu_devid_irq);
diff --git a/arch/arm/mach-mxs/mach-mxs.c b/arch/arm/mach-mxs/mach-mxs.c
index 3218f1f2c0e0..e7b781d3788f 100644
--- a/arch/arm/mach-mxs/mach-mxs.c
+++ b/arch/arm/mach-mxs/mach-mxs.c
@@ -41,8 +41,6 @@ static struct fb_videomode mx23evk_video_modes[] = {
                 .lower_margin   = 4,
                 .hsync_len      = 1,
                 .vsync_len      = 1,
-                .sync           = FB_SYNC_DATA_ENABLE_HIGH_ACT |
-                                  FB_SYNC_DOTCLK_FAILING_ACT,
         },
 };
 
@@ -59,8 +57,6 @@ static struct fb_videomode mx28evk_video_modes[] = {
                 .lower_margin   = 10,
                 .hsync_len      = 10,
                 .vsync_len      = 10,
-                .sync           = FB_SYNC_DATA_ENABLE_HIGH_ACT |
-                                  FB_SYNC_DOTCLK_FAILING_ACT,
         },
 };
 
@@ -77,7 +73,6 @@ static struct fb_videomode m28evk_video_modes[] = {
                 .lower_margin   = 45,
                 .hsync_len      = 1,
                 .vsync_len      = 1,
-                .sync           = FB_SYNC_DATA_ENABLE_HIGH_ACT,
         },
 };
 
@@ -94,9 +89,7 @@ static struct fb_videomode apx4devkit_video_modes[] = {
                 .lower_margin   = 13,
                 .hsync_len      = 48,
                 .vsync_len      = 3,
-                .sync           = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT |
-                                  FB_SYNC_DATA_ENABLE_HIGH_ACT |
-                                  FB_SYNC_DOTCLK_FAILING_ACT,
+                .sync           = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
         },
 };
 
@@ -113,9 +106,7 @@ static struct fb_videomode apf28dev_video_modes[] = {
                 .lower_margin = 0x15,
                 .hsync_len = 64,
                 .vsync_len = 4,
-                .sync = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT |
-                                FB_SYNC_DATA_ENABLE_HIGH_ACT |
-                                FB_SYNC_DOTCLK_FAILING_ACT,
+                .sync = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
         },
 };
 
@@ -132,7 +123,6 @@ static struct fb_videomode cfa10049_video_modes[] = {
                 .lower_margin   = 2,
                 .hsync_len      = 15,
                 .vsync_len      = 15,
-                .sync           = FB_SYNC_DATA_ENABLE_HIGH_ACT
         },
 };
 
@@ -259,6 +249,8 @@ static void __init imx23_evk_init(void)
         mxsfb_pdata.mode_count = ARRAY_SIZE(mx23evk_video_modes);
         mxsfb_pdata.default_bpp = 32;
         mxsfb_pdata.ld_intf_width = STMLCDIF_24BIT;
+        mxsfb_pdata.sync = MXSFB_SYNC_DATA_ENABLE_HIGH_ACT |
+                                MXSFB_SYNC_DOTCLK_FAILING_ACT;
 }
 
 static inline void enable_clk_enet_out(void)
@@ -278,6 +270,8 @@ static void __init imx28_evk_init(void)
         mxsfb_pdata.mode_count = ARRAY_SIZE(mx28evk_video_modes);
         mxsfb_pdata.default_bpp = 32;
         mxsfb_pdata.ld_intf_width = STMLCDIF_24BIT;
+        mxsfb_pdata.sync = MXSFB_SYNC_DATA_ENABLE_HIGH_ACT |
+                                MXSFB_SYNC_DOTCLK_FAILING_ACT;
 
         mxs_saif_clkmux_select(MXS_DIGCTL_SAIF_CLKMUX_EXTMSTR0);
 }
@@ -297,6 +291,7 @@ static void __init m28evk_init(void)
         mxsfb_pdata.mode_count = ARRAY_SIZE(m28evk_video_modes);
         mxsfb_pdata.default_bpp = 16;
         mxsfb_pdata.ld_intf_width = STMLCDIF_18BIT;
+        mxsfb_pdata.sync = MXSFB_SYNC_DATA_ENABLE_HIGH_ACT;
 }
 
 static void __init sc_sps1_init(void)
@@ -322,6 +317,8 @@ static void __init apx4devkit_init(void)
         mxsfb_pdata.mode_count = ARRAY_SIZE(apx4devkit_video_modes);
         mxsfb_pdata.default_bpp = 32;
         mxsfb_pdata.ld_intf_width = STMLCDIF_24BIT;
+        mxsfb_pdata.sync = MXSFB_SYNC_DATA_ENABLE_HIGH_ACT |
+                                MXSFB_SYNC_DOTCLK_FAILING_ACT;
 }
 
 #define ENET0_MDC__GPIO_4_0     MXS_GPIO_NR(4, 0)
@@ -407,6 +404,7 @@ static void __init cfa10049_init(void)
         mxsfb_pdata.mode_count = ARRAY_SIZE(cfa10049_video_modes);
         mxsfb_pdata.default_bpp = 32;
         mxsfb_pdata.ld_intf_width = STMLCDIF_18BIT;
+        mxsfb_pdata.sync = MXSFB_SYNC_DATA_ENABLE_HIGH_ACT;
 }
 
 static void __init cfa10037_init(void)
@@ -423,6 +421,8 @@ static void __init apf28_init(void)
         mxsfb_pdata.mode_count = ARRAY_SIZE(apf28dev_video_modes);
         mxsfb_pdata.default_bpp = 16;
         mxsfb_pdata.ld_intf_width = STMLCDIF_16BIT;
+        mxsfb_pdata.sync = MXSFB_SYNC_DATA_ENABLE_HIGH_ACT |
+                                MXSFB_SYNC_DOTCLK_FAILING_ACT;
 }
 
 static void __init mxs_machine_init(void)
diff --git a/arch/arm/mach-omap1/clock_data.c b/arch/arm/mach-omap1/clock_data.c
index cb7c6ae2e3fc..6c4f766365a2 100644
--- a/arch/arm/mach-omap1/clock_data.c
+++ b/arch/arm/mach-omap1/clock_data.c
@@ -543,15 +543,6 @@ static struct clk usb_dc_ck = {
         /* Direct from ULPD, no parent */
         .rate           = 48000000,
         .enable_reg     = OMAP1_IO_ADDRESS(SOFT_REQ_REG),
-        .enable_bit     = USB_REQ_EN_SHIFT,
-};
-
-static struct clk usb_dc_ck7xx = {
-        .name           = "usb_dc_ck",
-        .ops            = &clkops_generic,
-        /* Direct from ULPD, no parent */
-        .rate           = 48000000,
-        .enable_reg     = OMAP1_IO_ADDRESS(SOFT_REQ_REG),
         .enable_bit     = SOFT_USB_OTG_DPLL_REQ_SHIFT,
 };
 
@@ -727,8 +718,7 @@ static struct omap_clk omap_clks[] = {
         CLK(NULL,       "usb_clko",     &usb_clko,      CK_16XX | CK_1510 | CK_310),
         CLK(NULL,       "usb_hhc_ck",   &usb_hhc_ck1510, CK_1510 | CK_310),
         CLK(NULL,       "usb_hhc_ck",   &usb_hhc_ck16xx, CK_16XX),
-        CLK(NULL,       "usb_dc_ck",    &usb_dc_ck,     CK_16XX),
-        CLK(NULL,       "usb_dc_ck",    &usb_dc_ck7xx,  CK_7XX),
+        CLK(NULL,       "usb_dc_ck",    &usb_dc_ck,     CK_16XX | CK_7XX),
         CLK(NULL,       "mclk",         &mclk_1510,     CK_1510 | CK_310),
         CLK(NULL,       "mclk",         &mclk_16xx,     CK_16XX),
         CLK(NULL,       "bclk",         &bclk_1510,     CK_1510 | CK_310),
diff --git a/arch/arm/mach-omap2/cclock44xx_data.c b/arch/arm/mach-omap2/cclock44xx_data.c
index 3d58f335f173..0c6834ae1fc4 100644
--- a/arch/arm/mach-omap2/cclock44xx_data.c
+++ b/arch/arm/mach-omap2/cclock44xx_data.c
@@ -52,6 +52,13 @@
  */
 #define OMAP4_DPLL_ABE_DEFFREQ                          98304000
 
+/*
+ * OMAP4 USB DPLL default frequency. In OMAP4430 TRM version V, section
+ * "3.6.3.9.5 DPLL_USB Preferred Settings" shows that the preferred
+ * locked frequency for the USB DPLL is 960MHz.
+ */
+#define OMAP4_DPLL_USB_DEFFREQ                          960000000
+
 /* Root clocks */
 
 DEFINE_CLK_FIXED_RATE(extalt_clkin_ck, CLK_IS_ROOT, 59000000, 0x0);
@@ -1011,6 +1018,10 @@ DEFINE_CLK_OMAP_MUX(hsmmc2_fclk, "l3_init_clkdm", hsmmc1_fclk_sel,
                     OMAP4430_CM_L3INIT_MMC2_CLKCTRL, OMAP4430_CLKSEL_MASK,
                     hsmmc1_fclk_parents, func_dmic_abe_gfclk_ops);
 
+DEFINE_CLK_GATE(ocp2scp_usb_phy_phy_48m, "func_48m_fclk", &func_48m_fclk, 0x0,
+                OMAP4430_CM_L3INIT_USBPHYOCP2SCP_CLKCTRL,
+                OMAP4430_OPTFCLKEN_PHY_48M_SHIFT, 0x0, NULL);
+
 DEFINE_CLK_GATE(sha2md5_fck, "l3_div_ck", &l3_div_ck, 0x0,
                 OMAP4430_CM_L4SEC_SHA2MD51_CLKCTRL,
                 OMAP4430_MODULEMODE_SWCTRL_SHIFT, 0x0, NULL);
@@ -1538,6 +1549,7 @@ static struct omap_clk omap44xx_clks[] = {
         CLK(NULL,       "per_mcbsp4_gfclk",                     &per_mcbsp4_gfclk,      CK_443X),
         CLK(NULL,       "hsmmc1_fclk",                  &hsmmc1_fclk,   CK_443X),
         CLK(NULL,       "hsmmc2_fclk",                  &hsmmc2_fclk,   CK_443X),
+        CLK(NULL,       "ocp2scp_usb_phy_phy_48m",      &ocp2scp_usb_phy_phy_48m,       CK_443X),
         CLK(NULL,       "sha2md5_fck",                  &sha2md5_fck,   CK_443X),
         CLK(NULL,       "slimbus1_fclk_1",              &slimbus1_fclk_1,       CK_443X),
         CLK(NULL,       "slimbus1_fclk_0",              &slimbus1_fclk_0,       CK_443X),
@@ -1705,5 +1717,13 @@ int __init omap4xxx_clk_init(void)
         if (rc)
                 pr_err("%s: failed to configure ABE DPLL!\n", __func__);
 
+        /*
+         * Lock USB DPLL on OMAP4 devices so that the L3INIT power
+         * domain can transition to retention state when not in use.
+         */
+        rc = clk_set_rate(&dpll_usb_ck, OMAP4_DPLL_USB_DEFFREQ);
+        if (rc)
+                pr_err("%s: failed to configure USB DPLL!\n", __func__);
+
         return 0;
 }
diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
index 40f4a03d728f..d6ba13e1c540 100644
--- a/arch/arm/mach-omap2/common.h
+++ b/arch/arm/mach-omap2/common.h
@@ -293,5 +293,8 @@ extern void omap_reserve(void);
 struct omap_hwmod;
 extern int omap_dss_reset(struct omap_hwmod *);
 
+/* SoC specific clock initializer */
+extern int (*omap_clk_init)(void);
+
 #endif /* __ASSEMBLER__ */
 #endif /* __ARCH_ARM_MACH_OMAP2PLUS_COMMON_H */
diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
index 2c3fdd65387b..5c445ca1e271 100644
--- a/arch/arm/mach-omap2/io.c
+++ b/arch/arm/mach-omap2/io.c
@@ -55,6 +55,12 @@
 #include "prm44xx.h"
 
 /*
+ * omap_clk_init: points to a function that does the SoC-specific
+ * clock initializations
+ */
+int (*omap_clk_init)(void);
+
+/*
  * The machine specific code may provide the extra mapping besides the
  * default mapping provided here.
  */
@@ -397,7 +403,7 @@ void __init omap2420_init_early(void)
         omap242x_clockdomains_init();
         omap2420_hwmod_init();
         omap_hwmod_init_postsetup();
-        omap2420_clk_init();
+        omap_clk_init = omap2420_clk_init;
 }
 
 void __init omap2420_init_late(void)
@@ -427,7 +433,7 @@ void __init omap2430_init_early(void)
         omap243x_clockdomains_init();
         omap2430_hwmod_init();
         omap_hwmod_init_postsetup();
-        omap2430_clk_init();
+        omap_clk_init = omap2430_clk_init;
 }
 
 void __init omap2430_init_late(void)
@@ -462,7 +468,7 @@ void __init omap3_init_early(void)
         omap3xxx_clockdomains_init();
         omap3xxx_hwmod_init();
         omap_hwmod_init_postsetup();
-        omap3xxx_clk_init();
+        omap_clk_init = omap3xxx_clk_init;
 }
 
 void __init omap3430_init_early(void)
@@ -500,7 +506,7 @@ void __init ti81xx_init_early(void)
         omap3xxx_clockdomains_init();
         omap3xxx_hwmod_init();
         omap_hwmod_init_postsetup();
-        omap3xxx_clk_init();
+        omap_clk_init = omap3xxx_clk_init;
 }
 
 void __init omap3_init_late(void)
@@ -568,7 +574,7 @@ void __init am33xx_init_early(void)
         am33xx_clockdomains_init();
         am33xx_hwmod_init();
         omap_hwmod_init_postsetup();
-        am33xx_clk_init();
+        omap_clk_init = am33xx_clk_init;
 }
 #endif
 
@@ -593,7 +599,7 @@ void __init omap4430_init_early(void)
         omap44xx_clockdomains_init();
         omap44xx_hwmod_init();
         omap_hwmod_init_postsetup();
-        omap4xxx_clk_init();
+        omap_clk_init = omap4xxx_clk_init;
 }
 
 void __init omap4430_init_late(void)
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index c2c798c08c2b..a202a4785104 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1368,7 +1368,9 @@ static void _enable_sysc(struct omap_hwmod *oh)
         }
 
         if (sf & SYSC_HAS_MIDLEMODE) {
-                if (oh->flags & HWMOD_SWSUP_MSTANDBY) {
+                if (oh->flags & HWMOD_FORCE_MSTANDBY) {
+                        idlemode = HWMOD_IDLEMODE_FORCE;
+                } else if (oh->flags & HWMOD_SWSUP_MSTANDBY) {
                         idlemode = HWMOD_IDLEMODE_NO;
                 } else {
                         if (sf & SYSC_HAS_ENAWAKEUP)
@@ -1440,7 +1442,8 @@ static void _idle_sysc(struct omap_hwmod *oh)
         }
 
         if (sf & SYSC_HAS_MIDLEMODE) {
-                if (oh->flags & HWMOD_SWSUP_MSTANDBY) {
+                if ((oh->flags & HWMOD_SWSUP_MSTANDBY) ||
+                    (oh->flags & HWMOD_FORCE_MSTANDBY)) {
                         idlemode = HWMOD_IDLEMODE_FORCE;
                 } else {
                         if (sf & SYSC_HAS_ENAWAKEUP)
diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h
index d43d9b608eda..d5dc935f6060 100644
--- a/arch/arm/mach-omap2/omap_hwmod.h
+++ b/arch/arm/mach-omap2/omap_hwmod.h
@@ -427,8 +427,8 @@ struct omap_hwmod_omap4_prcm {
  *
  * HWMOD_SWSUP_SIDLE: omap_hwmod code should manually bring module in and out
  *     of idle, rather than relying on module smart-idle
- * HWMOD_SWSUP_MSTDBY: omap_hwmod code should manually bring module in and out
- *     of standby, rather than relying on module smart-standby
+ * HWMOD_SWSUP_MSTANDBY: omap_hwmod code should manually bring module in and
+ *     out of standby, rather than relying on module smart-standby
  * HWMOD_INIT_NO_RESET: don't reset this module at boot - important for
  *     SDRAM controller, etc. XXX probably belongs outside the main hwmod file
  *     XXX Should be HWMOD_SETUP_NO_RESET
@@ -459,6 +459,10 @@ struct omap_hwmod_omap4_prcm {
  *     correctly, or this is being abused to deal with some PM latency
  *     issues -- but we're currently suffering from a shortage of
  *     folks who are able to track these issues down properly.
+ * HWMOD_FORCE_MSTANDBY: Always keep MIDLEMODE bits cleared so that device
+ *     is kept in force-standby mode. Failing to do so causes PM problems
+ *     with musb on OMAP3630 at least. Note that musb has a dedicated register
+ *     to control MSTANDBY signal when MIDLEMODE is set to force-standby.
  */
 #define HWMOD_SWSUP_SIDLE                       (1 << 0)
 #define HWMOD_SWSUP_MSTANDBY                    (1 << 1)
@@ -471,6 +475,7 @@ struct omap_hwmod_omap4_prcm {
 #define HWMOD_16BIT_REG                         (1 << 8)
 #define HWMOD_EXT_OPT_MAIN_CLK                  (1 << 9)
 #define HWMOD_BLOCK_WFI                         (1 << 10)
+#define HWMOD_FORCE_MSTANDBY                    (1 << 11)
 
 /*
  * omap_hwmod._int_flags definitions
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index ac7e03ec952f..5112d04e7b79 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -1707,9 +1707,14 @@ static struct omap_hwmod omap3xxx_usbhsotg_hwmod = {
          * Erratum ID: i479  idle_req / idle_ack mechanism potentially
          * broken when autoidle is enabled
          * workaround is to disable the autoidle bit at module level.
+         *
+         * Enabling the device in any other MIDLEMODE setting but force-idle
+         * causes core_pwrdm not enter idle states at least on OMAP3630.
+         * Note that musb has OTG_FORCESTDBY register that controls MSTANDBY
+         * signal when MIDLEMODE is set to force-idle.
          */
         .flags          = HWMOD_NO_OCP_AUTOIDLE | HWMOD_SWSUP_SIDLE
-                                | HWMOD_SWSUP_MSTANDBY,
+                                | HWMOD_FORCE_MSTANDBY,
 };
 
 /* usb_otg_hs */
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index 0e47d2e1687c..9e0576569e07 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -2714,6 +2714,10 @@ static struct omap_ocp2scp_dev ocp2scp_dev_attr[] = {
         { }
 };
 
+static struct omap_hwmod_opt_clk ocp2scp_usb_phy_opt_clks[] = {
+        { .role = "48mhz", .clk = "ocp2scp_usb_phy_phy_48m" },
+};
+
 /* ocp2scp_usb_phy */
 static struct omap_hwmod omap44xx_ocp2scp_usb_phy_hwmod = {
         .name           = "ocp2scp_usb_phy",
@@ -2728,6 +2732,8 @@ static struct omap_hwmod omap44xx_ocp2scp_usb_phy_hwmod = {
                 },
         },
         .dev_attr       = ocp2scp_dev_attr,
+        .opt_clks       = ocp2scp_usb_phy_opt_clks,
+        .opt_clks_cnt   = ARRAY_SIZE(ocp2scp_usb_phy_opt_clks),
 };
 
 /*
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index 2bdd4cf17a8f..f62b509ed08d 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -547,6 +547,8 @@ static inline void __init realtime_counter_init(void)
                                clksrc_nr, clksrc_src)                   \
 void __init omap##name##_gptimer_timer_init(void)                       \
 {                                                                       \
+        if (omap_clk_init)                                              \
+                omap_clk_init();                                        \
         omap_dmtimer_init();                                            \
         omap2_gp_clockevent_init((clkev_nr), clkev_src, clkev_prop);    \
         omap2_gptimer_clocksource_init((clksrc_nr), clksrc_src);        \
@@ -556,6 +558,8 @@ void __init omap##name##_gptimer_timer_init(void)			\
                                 clksrc_nr, clksrc_src)                  \
 void __init omap##name##_sync32k_timer_init(void)               \
 {                                                                       \
+        if (omap_clk_init)                                              \
+                omap_clk_init();                                        \
         omap_dmtimer_init();                                            \
         omap2_gp_clockevent_init((clkev_nr), clkev_src, clkev_prop);    \
         /* Enable the use of clocksource="gp_timer" kernel parameter */ \
diff --git a/arch/arm/mach-s3c24xx/include/mach/irqs.h b/arch/arm/mach-s3c24xx/include/mach/irqs.h
index b7a9f4d469e8..1e73f5fa8659 100644
--- a/arch/arm/mach-s3c24xx/include/mach/irqs.h
+++ b/arch/arm/mach-s3c24xx/include/mach/irqs.h
@@ -188,10 +188,8 @@
 
 #if defined(CONFIG_CPU_S3C2416)
 #define NR_IRQS (IRQ_S3C2416_I2S1 + 1)
-#elif defined(CONFIG_CPU_S3C2443)
-#define NR_IRQS (IRQ_S3C2443_AC97+1)
 #else
-#define NR_IRQS (IRQ_S3C2440_AC97+1)
+#define NR_IRQS (IRQ_S3C2443_AC97 + 1)
 #endif
 
 /* compatibility define. */
diff --git a/arch/arm/mach-s3c24xx/irq.c b/arch/arm/mach-s3c24xx/irq.c
index cb9f5e011e73..d8ba9bee4c7e 100644
--- a/arch/arm/mach-s3c24xx/irq.c
+++ b/arch/arm/mach-s3c24xx/irq.c
@@ -500,7 +500,7 @@ struct s3c_irq_intc *s3c24xx_init_intc(struct device_node *np,
                 base = (void *)0xfd000000;
 
                 intc->reg_mask = base + 0xa4;
-                intc->reg_pending = base + 0x08;
+                intc->reg_pending = base + 0xa8;
                 irq_num = 20;
                 irq_start = S3C2410_IRQ(32);
                 irq_offset = 4;
diff --git a/arch/arm/mach-ux500/board-mop500-sdi.c b/arch/arm/mach-ux500/board-mop500-sdi.c
index 051b62c27102..7f2cb6c5e2c1 100644
--- a/arch/arm/mach-ux500/board-mop500-sdi.c
+++ b/arch/arm/mach-ux500/board-mop500-sdi.c
@@ -81,7 +81,6 @@ static struct stedma40_chan_cfg mop500_sdi0_dma_cfg_tx = {
 #endif
 
 struct mmci_platform_data mop500_sdi0_data = {
-        .ios_handler    = mop500_sdi0_ios_handler,
         .ocr_mask       = MMC_VDD_29_30,
         .f_max          = 50000000,
         .capabilities   = MMC_CAP_4_BIT_DATA |
diff --git a/arch/arm/mach-ux500/board-mop500.c b/arch/arm/mach-ux500/board-mop500.c
index b03457881c4b..87d2d7b38ce9 100644
--- a/arch/arm/mach-ux500/board-mop500.c
+++ b/arch/arm/mach-ux500/board-mop500.c
@@ -12,6 +12,7 @@
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/platform_device.h>
+#include <linux/clk.h>
 #include <linux/io.h>
 #include <linux/i2c.h>
 #include <linux/platform_data/i2c-nomadik.h>
@@ -439,6 +440,15 @@ static void mop500_prox_deactivate(struct device *dev)
         regulator_put(prox_regulator);
 }
 
+void mop500_snowball_ethernet_clock_enable(void)
+{
+        struct clk *clk;
+
+        clk = clk_get_sys("fsmc", NULL);
+        if (!IS_ERR(clk))
+                clk_prepare_enable(clk);
+}
+
 static struct cryp_platform_data u8500_cryp1_platform_data = {
                 .mem_to_engine = {
                                 .dir = STEDMA40_MEM_TO_PERIPH,
@@ -683,6 +693,8 @@ static void __init snowball_init_machine(void)
         mop500_audio_init(parent);
         mop500_uart_init(parent);
 
+        mop500_snowball_ethernet_clock_enable();
+
         /* This board has full regulator constraints */
         regulator_has_full_constraints();
 }
diff --git a/arch/arm/mach-ux500/board-mop500.h b/arch/arm/mach-ux500/board-mop500.h
index eaa605f5d90d..d38951be70df 100644
--- a/arch/arm/mach-ux500/board-mop500.h
+++ b/arch/arm/mach-ux500/board-mop500.h
@@ -104,6 +104,7 @@ void __init mop500_pinmaps_init(void);
 void __init snowball_pinmaps_init(void);
 void __init hrefv60_pinmaps_init(void);
 void mop500_audio_init(struct device *parent);
+void mop500_snowball_ethernet_clock_enable(void);
 
 int __init mop500_uib_init(void);
 void mop500_uib_i2c_add(int busnum, struct i2c_board_info *info,
diff --git a/arch/arm/mach-ux500/cpu-db8500.c b/arch/arm/mach-ux500/cpu-db8500.c
index 19235cf7bbe3..f1a581844372 100644
--- a/arch/arm/mach-ux500/cpu-db8500.c
+++ b/arch/arm/mach-ux500/cpu-db8500.c
@@ -312,9 +312,10 @@ static void __init u8500_init_machine(void)
         /* Pinmaps must be in place before devices register */
         if (of_machine_is_compatible("st-ericsson,mop500"))
                 mop500_pinmaps_init();
-        else if (of_machine_is_compatible("calaosystems,snowball-a9500"))
+        else if (of_machine_is_compatible("calaosystems,snowball-a9500")) {
                 snowball_pinmaps_init();
-        else if (of_machine_is_compatible("st-ericsson,hrefv60+"))
+                mop500_snowball_ethernet_clock_enable();
+        } else if (of_machine_is_compatible("st-ericsson,hrefv60+"))
                 hrefv60_pinmaps_init();
         else if (of_machine_is_compatible("st-ericsson,ccu9540")) {}
                 /* TODO: Add pinmaps for ccu9540 board. */
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index c2f37390308a..c465faca51b0 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -299,7 +299,7 @@ static void l2x0_unlock(u32 cache_id)
         int lockregs;
         int i;
 
-        switch (cache_id) {
+        switch (cache_id & L2X0_CACHE_ID_PART_MASK) {
         case L2X0_CACHE_ID_PART_L310:
                 lockregs = 8;
                 break;
@@ -333,15 +333,14 @@ void __init l2x0_init(void __iomem *base, u32 aux_val, u32 aux_mask)
         if (cache_id_part_number_from_dt)
                 cache_id = cache_id_part_number_from_dt;
         else
-                cache_id = readl_relaxed(l2x0_base + L2X0_CACHE_ID)
-                        & L2X0_CACHE_ID_PART_MASK;
+                cache_id = readl_relaxed(l2x0_base + L2X0_CACHE_ID);
         aux = readl_relaxed(l2x0_base + L2X0_AUX_CTRL);
 
         aux &= aux_mask;
         aux |= aux_val;
 
         /* Determine the number of ways */
-        switch (cache_id) {
+        switch (cache_id & L2X0_CACHE_ID_PART_MASK) {
         case L2X0_CACHE_ID_PART_L310:
                 if (aux & (1 << 16))
                         ways = 16;
@@ -725,7 +724,6 @@ static const struct l2x0_of_data pl310_data = {
                 .flush_all   = l2x0_flush_all,
                 .inv_all     = l2x0_inv_all,
                 .disable     = l2x0_disable,
-                .set_debug   = pl310_set_debug,
         },
 };
 
@@ -814,9 +812,8 @@ int __init l2x0_of_init(u32 aux_val, u32 aux_mask)
                 data->save();
 
         of_init = true;
-        l2x0_init(l2x0_base, aux_val, aux_mask);
-
         memcpy(&outer_cache, &data->outer_cache, sizeof(outer_cache));
+        l2x0_init(l2x0_base, aux_val, aux_mask);
 
         return 0;
 }
diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
index a5a4b2bc42ba..2ac37372ef52 100644
--- a/arch/arm/mm/context.c
+++ b/arch/arm/mm/context.c
@@ -48,7 +48,7 @@ static DEFINE_RAW_SPINLOCK(cpu_asid_lock);
 static atomic64_t asid_generation = ATOMIC64_INIT(ASID_FIRST_VERSION);
 static DECLARE_BITMAP(asid_map, NUM_USER_ASIDS);
 
-static DEFINE_PER_CPU(atomic64_t, active_asids);
+DEFINE_PER_CPU(atomic64_t, active_asids);
 static DEFINE_PER_CPU(u64, reserved_asids);
 static cpumask_t tlb_flush_pending;
 
@@ -215,6 +215,7 @@ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk)
         if (cpumask_test_and_clear_cpu(cpu, &tlb_flush_pending)) {
                 local_flush_bp_all();
                 local_flush_tlb_all();
+                dummy_flush_tlb_a15_erratum();
         }
 
         atomic64_set(&per_cpu(active_asids, cpu), asid);
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index e95a996ab78f..78978945492a 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -598,39 +598,60 @@ static void __init alloc_init_pte(pmd_t *pmd, unsigned long addr,
         } while (pte++, addr += PAGE_SIZE, addr != end);
 }
 
-static void __init alloc_init_section(pud_t *pud, unsigned long addr,
-                                      unsigned long end, phys_addr_t phys,
-                                      const struct mem_type *type)
+static void __init map_init_section(pmd_t *pmd, unsigned long addr,
+                        unsigned long end, phys_addr_t phys,
+                        const struct mem_type *type)
 {
-        pmd_t *pmd = pmd_offset(pud, addr);
-
+#ifndef CONFIG_ARM_LPAE
         /*
-         * Try a section mapping - end, addr and phys must all be aligned
-         * to a section boundary.  Note that PMDs refer to the individual
-         * L1 entries, whereas PGDs refer to a group of L1 entries making
-         * up one logical pointer to an L2 table.
+         * In classic MMU format, puds and pmds are folded in to
+         * the pgds. pmd_offset gives the PGD entry. PGDs refer to a
+         * group of L1 entries making up one logical pointer to
+         * an L2 table (2MB), where as PMDs refer to the individual
+         * L1 entries (1MB). Hence increment to get the correct
+         * offset for odd 1MB sections.
+         * (See arch/arm/include/asm/pgtable-2level.h)
          */
-        if (type->prot_sect && ((addr | end | phys) & ~SECTION_MASK) == 0) {
-                pmd_t *p = pmd;
-
-#ifndef CONFIG_ARM_LPAE
-                if (addr & SECTION_SIZE)
-                        pmd++;
+        if (addr & SECTION_SIZE)
+                pmd++;
 #endif
+        do {
+                *pmd = __pmd(phys | type->prot_sect);
+                phys += SECTION_SIZE;
+        } while (pmd++, addr += SECTION_SIZE, addr != end);
 
-                do {
-                        *pmd = __pmd(phys | type->prot_sect);
-                        phys += SECTION_SIZE;
-                } while (pmd++, addr += SECTION_SIZE, addr != end);
+        flush_pmd_entry(pmd);
+}
 
-                flush_pmd_entry(p);
-        } else {
+static void __init alloc_init_pmd(pud_t *pud, unsigned long addr,
+                                      unsigned long end, phys_addr_t phys,
+                                      const struct mem_type *type)
+{
+        pmd_t *pmd = pmd_offset(pud, addr);
+        unsigned long next;
+
+        do {
                 /*
-                 * No need to loop; pte's aren't interested in the
-                 * individual L1 entries.
+                 * With LPAE, we must loop over to map
+                 * all the pmds for the given range.
                  */
-                alloc_init_pte(pmd, addr, end, __phys_to_pfn(phys), type);
-        }
+                next = pmd_addr_end(addr, end);
+
+                /*
+                 * Try a section mapping - addr, next and phys must all be
+                 * aligned to a section boundary.
+                 */
+                if (type->prot_sect &&
+                                ((addr | next | phys) & ~SECTION_MASK) == 0) {
+                        map_init_section(pmd, addr, next, phys, type);
+                } else {
+                        alloc_init_pte(pmd, addr, next,
+                                                __phys_to_pfn(phys), type);
+                }
+
+                phys += next - addr;
+
+        } while (pmd++, addr = next, addr != end);
 }
 
 static void __init alloc_init_pud(pgd_t *pgd, unsigned long addr,
@@ -641,7 +662,7 @@ static void __init alloc_init_pud(pgd_t *pgd, unsigned long addr,
 
         do {
                 next = pud_addr_end(addr, end);
-                alloc_init_section(pud, addr, next, phys, type);
+                alloc_init_pmd(pud, addr, next, phys, type);
                 phys += next - addr;
         } while (pud++, addr = next, addr != end);
 }
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 3a3c015f8d5c..f584d3f5b37c 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -420,7 +420,7 @@ __v7_pj4b_proc_info:
 __v7_ca7mp_proc_info:
         .long   0x410fc070
         .long   0xff0ffff0
-        __v7_proc __v7_ca7mp_setup, hwcaps = HWCAP_IDIV
+        __v7_proc __v7_ca7mp_setup
         .size   __v7_ca7mp_proc_info, . - __v7_ca7mp_proc_info
 
         /*
@@ -430,10 +430,25 @@ __v7_ca7mp_proc_info:
 __v7_ca15mp_proc_info:
         .long   0x410fc0f0
         .long   0xff0ffff0
-        __v7_proc __v7_ca15mp_setup, hwcaps = HWCAP_IDIV
+        __v7_proc __v7_ca15mp_setup
         .size   __v7_ca15mp_proc_info, . - __v7_ca15mp_proc_info
 
         /*
+         * Qualcomm Inc. Krait processors.
+         */
+        .type   __krait_proc_info, #object
+__krait_proc_info:
+        .long   0x510f0400              @ Required ID value
+        .long   0xff0ffc00              @ Mask for ID
+        /*
+         * Some Krait processors don't indicate support for SDIV and UDIV
+         * instructions in the ARM instruction set, even though they actually
+         * do support them.
+         */
+        __v7_proc __v7_setup, hwcaps = HWCAP_IDIV
+        .size   __krait_proc_info, . - __krait_proc_info
+
+        /*
          * Match any ARMv7 processor core.
          */
         .type   __v7_proc_info, #object
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 224b44ab534e..70b8cd4021c4 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -261,7 +261,7 @@ static void __init create_mapping(phys_addr_t phys, unsigned long virt,
 void __iomem * __init early_io_map(phys_addr_t phys, unsigned long virt)
 {
         unsigned long size, mask;
-        bool page64k = IS_ENABLED(ARM64_64K_PAGES);
+        bool page64k = IS_ENABLED(CONFIG_ARM64_64K_PAGES);
         pgd_t *pgd;
         pud_t *pud;
         pmd_t *pmd;
diff --git a/arch/c6x/include/asm/irqflags.h b/arch/c6x/include/asm/irqflags.h
index cf78e09e18c3..2c71d5634ec2 100644
--- a/arch/c6x/include/asm/irqflags.h
+++ b/arch/c6x/include/asm/irqflags.h
@@ -27,7 +27,7 @@ static inline unsigned long arch_local_save_flags(void)
 /* set interrupt enabled status */
 static inline void arch_local_irq_restore(unsigned long flags)
 {
-        asm volatile (" mvc .s2 %0,CSR\n" : : "b"(flags));
+        asm volatile (" mvc .s2 %0,CSR\n" : : "b"(flags) : "memory");
 }
 
 /* unconditionally enable interrupts */
diff --git a/arch/ia64/kernel/palinfo.c b/arch/ia64/kernel/palinfo.c
index 77597e5ea60a..79521d5499f9 100644
--- a/arch/ia64/kernel/palinfo.c
+++ b/arch/ia64/kernel/palinfo.c
@@ -849,17 +849,6 @@ static palinfo_entry_t palinfo_entries[]={
 
 #define NR_PALINFO_ENTRIES      (int) ARRAY_SIZE(palinfo_entries)
 
-/*
- * this array is used to keep track of the proc entries we create. This is
- * required in the module mode when we need to remove all entries. The procfs code
- * does not do recursion of deletion
- *
- * Notes:
- *      - +1 accounts for the cpuN directory entry in /proc/pal
- */
-#define NR_PALINFO_PROC_ENTRIES (NR_CPUS*(NR_PALINFO_ENTRIES+1))
-
-static struct proc_dir_entry *palinfo_proc_entries[NR_PALINFO_PROC_ENTRIES];
 static struct proc_dir_entry *palinfo_dir;
 
 /*
@@ -971,60 +960,32 @@ palinfo_read_entry(char *page, char **start, off_t off, int count, int *eof, voi
 static void __cpuinit
 create_palinfo_proc_entries(unsigned int cpu)
 {
-#       define CPUSTR   "cpu%d"
-
         pal_func_cpu_u_t f;
-        struct proc_dir_entry **pdir;
         struct proc_dir_entry *cpu_dir;
         int j;
-        char cpustr[sizeof(CPUSTR)];
-
-
-        /*
-         * we keep track of created entries in a depth-first order for
-         * cleanup purposes. Each entry is stored into palinfo_proc_entries
-         */
-        sprintf(cpustr,CPUSTR, cpu);
+        char cpustr[3+4+1];     /* cpu numbers are up to 4095 on itanic */
+        sprintf(cpustr, "cpu%d", cpu);
 
         cpu_dir = proc_mkdir(cpustr, palinfo_dir);
+        if (!cpu_dir)
+                return;
 
         f.req_cpu = cpu;
 
-        /*
-         * Compute the location to store per cpu entries
-         * We dont store the top level entry in this list, but
-         * remove it finally after removing all cpu entries.
-         */
-        pdir = &palinfo_proc_entries[cpu*(NR_PALINFO_ENTRIES+1)];
-        *pdir++ = cpu_dir;
         for (j=0; j < NR_PALINFO_ENTRIES; j++) {
                 f.func_id = j;
-                *pdir = create_proc_read_entry(
-                                palinfo_entries[j].name, 0, cpu_dir,
-                                palinfo_read_entry, (void *)f.value);
-                pdir++;
+                create_proc_read_entry(
+                        palinfo_entries[j].name, 0, cpu_dir,
+                        palinfo_read_entry, (void *)f.value);
         }
 }
 
 static void
 remove_palinfo_proc_entries(unsigned int hcpu)
 {
-        int j;
-        struct proc_dir_entry *cpu_dir, **pdir;
-
-        pdir = &palinfo_proc_entries[hcpu*(NR_PALINFO_ENTRIES+1)];
-        cpu_dir = *pdir;
-        *pdir++=NULL;
-        for (j=0; j < (NR_PALINFO_ENTRIES); j++) {
-                if ((*pdir)) {
-                        remove_proc_entry ((*pdir)->name, cpu_dir);
-                        *pdir ++= NULL;
-                }
-        }
-
-        if (cpu_dir) {
-                remove_proc_entry(cpu_dir->name, palinfo_dir);
-        }
+        char cpustr[3+4+1];     /* cpu numbers are up to 4095 on itanic */
+        sprintf(cpustr, "cpu%d", hcpu);
+        remove_proc_subtree(cpustr, palinfo_dir);
 }
 
 static int __cpuinit palinfo_cpu_callback(struct notifier_block *nfb,
@@ -1058,6 +1019,8 @@ palinfo_init(void)
 
         printk(KERN_INFO "PAL Information Facility v%s\n", PALINFO_VERSION);
         palinfo_dir = proc_mkdir("pal", NULL);
+        if (!palinfo_dir)
+                return -ENOMEM;
 
         /* Create palinfo dirs in /proc for all online cpus */
         for_each_online_cpu(i) {
@@ -1073,22 +1036,8 @@ palinfo_init(void)
 static void __exit
 palinfo_exit(void)
 {
-        int i = 0;
-
-        /* remove all nodes: depth first pass. Could optimize this  */
-        for_each_online_cpu(i) {
-                remove_palinfo_proc_entries(i);
-        }
-
-        /*
-         * Remove the top level entry finally
-         */
-        remove_proc_entry(palinfo_dir->name, NULL);
-
-        /*
-         * Unregister from cpu notifier callbacks
-         */
         unregister_hotcpu_notifier(&palinfo_cpu_notifier);
+        remove_proc_subtree("pal", NULL);
 }
 
 module_init(palinfo_init);
diff --git a/arch/ia64/kernel/process.c b/arch/ia64/kernel/process.c
index e34f565f595a..6f7dc8b7b35c 100644
--- a/arch/ia64/kernel/process.c
+++ b/arch/ia64/kernel/process.c
@@ -291,7 +291,6 @@ cpu_idle (void)
                 }
 
                 if (!need_resched()) {
-                        void (*idle)(void);
 #ifdef CONFIG_SMP
                         min_xtp();
 #endif
@@ -299,9 +298,7 @@ cpu_idle (void)
                         if (mark_idle)
                                 (*mark_idle)(1);
 
-                        if (!idle)
-                                idle = default_idle;
-                        (*idle)();
+                        default_idle();
                         if (mark_idle)
                                 (*mark_idle)(0);
 #ifdef CONFIG_SMP
diff --git a/arch/m68k/include/asm/gpio.h b/arch/m68k/include/asm/gpio.h
index 4395ffc51fdb..8cc83431805b 100644
--- a/arch/m68k/include/asm/gpio.h
+++ b/arch/m68k/include/asm/gpio.h
@@ -86,4 +86,24 @@ static inline int gpio_cansleep(unsigned gpio)
         return gpio < MCFGPIO_PIN_MAX ? 0 : __gpio_cansleep(gpio);
 }
 
+static inline int gpio_request_one(unsigned gpio, unsigned long flags, const char *label)
+{
+        int err;
+
+        err = gpio_request(gpio, label);
+        if (err)
+                return err;
+
+        if (flags & GPIOF_DIR_IN)
+                err = gpio_direction_input(gpio);
+        else
+                err = gpio_direction_output(gpio,
+                        (flags & GPIOF_INIT_HIGH) ? 1 : 0);
+
+        if (err)
+                gpio_free(gpio);
+
+        return err;
+}
+
 #endif
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index cd2e21ff562a..51244bf97271 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -18,7 +18,7 @@ config MIPS
         select HAVE_KRETPROBES
         select HAVE_DEBUG_KMEMLEAK
         select ARCH_BINFMT_ELF_RANDOMIZE_PIE
-        select HAVE_ARCH_TRANSPARENT_HUGEPAGE
+        select HAVE_ARCH_TRANSPARENT_HUGEPAGE if CPU_SUPPORTS_HUGEPAGES && 64BIT
         select RTC_LIB if !MACH_LOONGSON
         select GENERIC_ATOMIC64 if !64BIT
         select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
@@ -657,7 +657,7 @@ config SNI_RM
         bool "SNI RM200/300/400"
         select FW_ARC if CPU_LITTLE_ENDIAN
         select FW_ARC32 if CPU_LITTLE_ENDIAN
-        select SNIPROM if CPU_BIG_ENDIAN
+        select FW_SNIPROM if CPU_BIG_ENDIAN
         select ARCH_MAY_HAVE_PC_FDC
         select BOOT_ELF32
         select CEVT_R4K
@@ -1144,7 +1144,7 @@ config DEFAULT_SGI_PARTITION
 config FW_ARC32
         bool
 
-config SNIPROM
+config FW_SNIPROM
         bool
 
 config BOOT_ELF32
@@ -1493,7 +1493,6 @@ config CPU_XLP
         select CPU_SUPPORTS_32BIT_KERNEL
         select CPU_SUPPORTS_64BIT_KERNEL
         select CPU_SUPPORTS_HIGHMEM
-        select CPU_HAS_LLSC
         select WEAK_ORDERING
         select WEAK_REORDERING_BEYOND_LLSC
         select CPU_HAS_PREFETCH
diff --git a/arch/mips/bcm63xx/boards/board_bcm963xx.c b/arch/mips/bcm63xx/boards/board_bcm963xx.c
index ed1949c29508..9aa7d44898ed 100644
--- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
+++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
@@ -745,10 +745,7 @@ void __init board_prom_init(void)
                 strcpy(cfe_version, "unknown");
         printk(KERN_INFO PFX "CFE version: %s\n", cfe_version);
 
-        if (bcm63xx_nvram_init(boot_addr + BCM963XX_NVRAM_OFFSET)) {
-                printk(KERN_ERR PFX "invalid nvram checksum\n");
-                return;
-        }
+        bcm63xx_nvram_init(boot_addr + BCM963XX_NVRAM_OFFSET);
 
         board_name = bcm63xx_nvram_get_name();
         /* find board by name */
diff --git a/arch/mips/bcm63xx/nvram.c b/arch/mips/bcm63xx/nvram.c
index 620611680839..a4b8864f9307 100644
--- a/arch/mips/bcm63xx/nvram.c
+++ b/arch/mips/bcm63xx/nvram.c
@@ -38,7 +38,7 @@ struct bcm963xx_nvram {
 static struct bcm963xx_nvram nvram;
 static int mac_addr_used;
 
-int __init bcm63xx_nvram_init(void *addr)
+void __init bcm63xx_nvram_init(void *addr)
 {
         unsigned int check_len;
         u32 crc, expected_crc;
@@ -60,9 +60,8 @@ int __init bcm63xx_nvram_init(void *addr)
         crc = crc32_le(~0, (u8 *)&nvram, check_len);
 
         if (crc != expected_crc)
-                return -EINVAL;
-
-        return 0;
+                pr_warn("nvram checksum failed, contents may be invalid (expected %08x, got %08x)\n",
+                        expected_crc, crc);
 }
 
 u8 *bcm63xx_nvram_get_name(void)
diff --git a/arch/mips/bcm63xx/setup.c b/arch/mips/bcm63xx/setup.c
index 314231be788c..35e18e98beb9 100644
--- a/arch/mips/bcm63xx/setup.c
+++ b/arch/mips/bcm63xx/setup.c
@@ -157,4 +157,4 @@ int __init bcm63xx_register_devices(void)
         return board_register_devices();
 }
 
-device_initcall(bcm63xx_register_devices);
+arch_initcall(bcm63xx_register_devices);
diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
index c594a3d4f743..b0baa299f899 100644
--- a/arch/mips/cavium-octeon/setup.c
+++ b/arch/mips/cavium-octeon/setup.c
@@ -174,7 +174,10 @@ static int octeon_kexec_prepare(struct kimage *image)
 
 static void octeon_generic_shutdown(void)
 {
-        int cpu, i;
+        int i;
+#ifdef CONFIG_SMP
+        int cpu;
+#endif
         struct cvmx_bootmem_desc *bootmem_desc;
         void *named_block_array_ptr;
 
diff --git a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_nvram.h b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_nvram.h
index 62d6a3b4d3b7..4e0b6bc1165e 100644
--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_nvram.h
+++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_nvram.h
@@ -9,10 +9,8 @@
  *
  * Initialized the local nvram copy from the target address and checks
  * its checksum.
- *
- * Returns 0 on success.
  */
-int __init bcm63xx_nvram_init(void *nvram);
+void bcm63xx_nvram_init(void *nvram);
 
 /**
  * bcm63xx_nvram_get_name() - returns the board name according to nvram
diff --git a/arch/mips/include/asm/mach-sead3/cpu-feature-overrides.h b/arch/mips/include/asm/mach-sead3/cpu-feature-overrides.h
index d9c828419037..193c0912d38e 100644
--- a/arch/mips/include/asm/mach-sead3/cpu-feature-overrides.h
+++ b/arch/mips/include/asm/mach-sead3/cpu-feature-overrides.h
@@ -28,11 +28,7 @@
 /* #define cpu_has_prefetch     ? */
 #define cpu_has_mcheck          1
 /* #define cpu_has_ejtag        ? */
-#ifdef CONFIG_CPU_HAS_LLSC
 #define cpu_has_llsc            1
-#else
-#define cpu_has_llsc            0
-#endif
 /* #define cpu_has_vtag_icache  ? */
 /* #define cpu_has_dc_aliases   ? */
 /* #define cpu_has_ic_fills_f_dc ? */
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index 12b70c25906a..0da44d422f5b 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -1166,7 +1166,10 @@ do {									\
         unsigned int __dspctl;                                          \
                                                                         \
         __asm__ __volatile__(                                           \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
         "       rddsp   %0, %x1                                 \n"     \
+        "       .set pop                                        \n"     \
         : "=r" (__dspctl)                                               \
         : "i" (mask));                                                  \
         __dspctl;                                                       \
@@ -1175,30 +1178,198 @@ do {									\
 #define wrdsp(val, mask)                                                \
 do {                                                                    \
         __asm__ __volatile__(                                           \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
         "       wrdsp   %0, %x1                                 \n"     \
+        "       .set pop                                        \n"     \
         :                                                               \
         : "r" (val), "i" (mask));                                       \
 } while (0)
 
-#define mflo0() ({ long mflo0; __asm__("mflo %0, $ac0" : "=r" (mflo0)); mflo0;})
-#define mflo1() ({ long mflo1; __asm__("mflo %0, $ac1" : "=r" (mflo1)); mflo1;})
-#define mflo2() ({ long mflo2; __asm__("mflo %0, $ac2" : "=r" (mflo2)); mflo2;})
-#define mflo3() ({ long mflo3; __asm__("mflo %0, $ac3" : "=r" (mflo3)); mflo3;})
-
-#define mfhi0() ({ long mfhi0; __asm__("mfhi %0, $ac0" : "=r" (mfhi0)); mfhi0;})
-#define mfhi1() ({ long mfhi1; __asm__("mfhi %0, $ac1" : "=r" (mfhi1)); mfhi1;})
-#define mfhi2() ({ long mfhi2; __asm__("mfhi %0, $ac2" : "=r" (mfhi2)); mfhi2;})
-#define mfhi3() ({ long mfhi3; __asm__("mfhi %0, $ac3" : "=r" (mfhi3)); mfhi3;})
-
-#define mtlo0(x) __asm__("mtlo %0, $ac0" ::"r" (x))
-#define mtlo1(x) __asm__("mtlo %0, $ac1" ::"r" (x))
-#define mtlo2(x) __asm__("mtlo %0, $ac2" ::"r" (x))
-#define mtlo3(x) __asm__("mtlo %0, $ac3" ::"r" (x))
-
-#define mthi0(x) __asm__("mthi %0, $ac0" ::"r" (x))
-#define mthi1(x) __asm__("mthi %0, $ac1" ::"r" (x))
-#define mthi2(x) __asm__("mthi %0, $ac2" ::"r" (x))
-#define mthi3(x) __asm__("mthi %0, $ac3" ::"r" (x))
+#define mflo0()                                                         \
+({                                                                      \
+        long mflo0;                                                     \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mflo %0, $ac0                                   \n"     \
+        "       .set pop                                        \n"     \
+        : "=r" (mflo0));                                                \
+        mflo0;                                                          \
+})
+
+#define mflo1()                                                         \
+({                                                                      \
+        long mflo1;                                                     \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mflo %0, $ac1                                   \n"     \
+        "       .set pop                                        \n"     \
+        : "=r" (mflo1));                                                \
+        mflo1;                                                          \
+})
+
+#define mflo2()                                                         \
+({                                                                      \
+        long mflo2;                                                     \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mflo %0, $ac2                                   \n"     \
+        "       .set pop                                        \n"     \
+        : "=r" (mflo2));                                                \
+        mflo2;                                                          \
+})
+
+#define mflo3()                                                         \
+({                                                                      \
+        long mflo3;                                                     \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mflo %0, $ac3                                   \n"     \
+        "       .set pop                                        \n"     \
+        : "=r" (mflo3));                                                \
+        mflo3;                                                          \
+})
+
+#define mfhi0()                                                         \
+({                                                                      \
+        long mfhi0;                                                     \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mfhi %0, $ac0                                   \n"     \
+        "       .set pop                                        \n"     \
+        : "=r" (mfhi0));                                                \
+        mfhi0;                                                          \
+})
+
+#define mfhi1()                                                         \
+({                                                                      \
+        long mfhi1;                                                     \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mfhi %0, $ac1                                   \n"     \
+        "       .set pop                                        \n"     \
+        : "=r" (mfhi1));                                                \
+        mfhi1;                                                          \
+})
+
+#define mfhi2()                                                         \
+({                                                                      \
+        long mfhi2;                                                     \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mfhi %0, $ac2                                   \n"     \
+        "       .set pop                                        \n"     \
+        : "=r" (mfhi2));                                                \
+        mfhi2;                                                          \
+})
+
+#define mfhi3()                                                         \
+({                                                                      \
+        long mfhi3;                                                     \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mfhi %0, $ac3                                   \n"     \
+        "       .set pop                                        \n"     \
+        : "=r" (mfhi3));                                                \
+        mfhi3;                                                          \
+})
+
+
+#define mtlo0(x)                                                        \
+({                                                                      \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mtlo %0, $ac0                                   \n"     \
+        "       .set pop                                        \n"     \
+        :                                                               \
+        : "r" (x));                                                     \
+})
+
+#define mtlo1(x)                                                        \
+({                                                                      \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mtlo %0, $ac1                                   \n"     \
+        "       .set pop                                        \n"     \
+        :                                                               \
+        : "r" (x));                                                     \
+})
+
+#define mtlo2(x)                                                        \
+({                                                                      \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mtlo %0, $ac2                                   \n"     \
+        "       .set pop                                        \n"     \
+        :                                                               \
+        : "r" (x));                                                     \
+})
+
+#define mtlo3(x)                                                        \
+({                                                                      \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mtlo %0, $ac3                                   \n"     \
+        "       .set pop                                        \n"     \
+        :                                                               \
+        : "r" (x));                                                     \
+})
+
+#define mthi0(x)                                                        \
+({                                                                      \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mthi %0, $ac0                                   \n"     \
+        "       .set pop                                        \n"     \
+        :                                                               \
+        : "r" (x));                                                     \
+})
+
+#define mthi1(x)                                                        \
+({                                                                      \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mthi %0, $ac1                                   \n"     \
+        "       .set pop                                        \n"     \
+        :                                                               \
+        : "r" (x));                                                     \
+})
+
+#define mthi2(x)                                                        \
+({                                                                      \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mthi %0, $ac2                                   \n"     \
+        "       .set pop                                        \n"     \
+        :                                                               \
+        : "r" (x));                                                     \
+})
+
+#define mthi3(x)                                                        \
+({                                                                      \
+        __asm__(                                                        \
+        "       .set push                                       \n"     \
+        "       .set dsp                                        \n"     \
+        "       mthi %0, $ac3                                   \n"     \
+        "       .set pop                                        \n"     \
+        :                                                               \
+        : "r" (x));                                                     \
+})
 
 #else
 
diff --git a/arch/mips/include/asm/signal.h b/arch/mips/include/asm/signal.h
index 197f6367c201..8efe5a9e2c3e 100644
--- a/arch/mips/include/asm/signal.h
+++ b/arch/mips/include/asm/signal.h
@@ -21,6 +21,6 @@
 #include <asm/sigcontext.h>
 #include <asm/siginfo.h>
 
-#define __ARCH_HAS_ODD_SIGACTION
+#define __ARCH_HAS_IRIX_SIGACTION
 
 #endif /* _ASM_SIGNAL_H */
diff --git a/arch/mips/include/uapi/asm/signal.h b/arch/mips/include/uapi/asm/signal.h
index d6b18b4d0f3a..addb9f556b71 100644
--- a/arch/mips/include/uapi/asm/signal.h
+++ b/arch/mips/include/uapi/asm/signal.h
@@ -72,6 +72,12 @@ typedef unsigned long old_sigset_t;		/* at least 32 bits */
  *
  * SA_ONESHOT and SA_NOMASK are the historical Linux names for the Single
  * Unix names RESETHAND and NODEFER respectively.
+ *
+ * SA_RESTORER used to be defined as 0x04000000 but only the O32 ABI ever
+ * supported its use and no libc was using it, so the entire sa-restorer
+ * functionality was removed with lmo commit 39bffc12c3580ab for 2.5.48
+ * retaining only the SA_RESTORER definition as a reminder to avoid
+ * accidental reuse of the mask bit.
  */
 #define SA_ONSTACK      0x08000000
 #define SA_RESETHAND    0x80000000
@@ -84,8 +90,6 @@ typedef unsigned long old_sigset_t;		/* at least 32 bits */
 #define SA_NOMASK       SA_NODEFER
 #define SA_ONESHOT      SA_RESETHAND
 
-#define SA_RESTORER     0x04000000      /* Only for o32 */
-
 #define MINSIGSTKSZ    2048
 #define SIGSTKSZ       8192
 
diff --git a/arch/mips/kernel/Makefile b/arch/mips/kernel/Makefile
index f81d98f6184c..de75fb50562b 100644
--- a/arch/mips/kernel/Makefile
+++ b/arch/mips/kernel/Makefile
@@ -100,29 +100,16 @@ obj-$(CONFIG_HW_PERF_EVENTS)	+= perf_event_mipsxx.o
 obj-$(CONFIG_JUMP_LABEL)        += jump_label.o
 
 #
-# DSP ASE supported for MIPS32 or MIPS64 Release 2 cores only. It is safe
-# to enable DSP assembler support here even if the MIPS Release 2 CPU we
-# are targetting does not support DSP because all code-paths making use of
-# it properly check that the running CPU *actually does* support these
-# instructions.
+# DSP ASE supported for MIPS32 or MIPS64 Release 2 cores only. It is not
+# safe to unconditionnaly use the assembler -mdsp / -mdspr2 switches
+# here because the compiler may use DSP ASE instructions (such as lwx) in
+# code paths where we cannot check that the CPU we are running on supports it.
+# Proper abstraction using HAVE_AS_DSP and macros is done in
+# arch/mips/include/asm/mipsregs.h.
 #
 ifeq ($(CONFIG_CPU_MIPSR2), y)
 CFLAGS_DSP                      = -DHAVE_AS_DSP
 
-#
-# Check if assembler supports DSP ASE
-#
-ifeq ($(call cc-option-yn,-mdsp), y)
-CFLAGS_DSP                      += -mdsp
-endif
-
-#
-# Check if assembler supports DSP ASE Rev2
-#
-ifeq ($(call cc-option-yn,-mdspr2), y)
-CFLAGS_DSP                      += -mdspr2
-endif
-
 CFLAGS_signal.o                 = $(CFLAGS_DSP)
 CFLAGS_signal32.o               = $(CFLAGS_DSP)
 CFLAGS_process.o                = $(CFLAGS_DSP)
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index 6bfccc227a95..5fe66a0c3224 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -580,6 +580,9 @@ static inline void cpu_probe_legacy(struct cpuinfo_mips *c, unsigned int cpu)
                 c->tlbsize = 48;
                 break;
         case PRID_IMP_VR41XX:
+                set_isa(c, MIPS_CPU_ISA_III);
+                c->options = R4K_OPTS;
+                c->tlbsize = 32;
                 switch (c->processor_id & 0xf0) {
                 case PRID_REV_VR4111:
                         c->cputype = CPU_VR4111;
@@ -604,6 +607,7 @@ static inline void cpu_probe_legacy(struct cpuinfo_mips *c, unsigned int cpu)
                                 __cpu_name[cpu] = "NEC VR4131";
                         } else {
                                 c->cputype = CPU_VR4133;
+                                c->options |= MIPS_CPU_LLSC;
                                 __cpu_name[cpu] = "NEC VR4133";
                         }
                         break;
@@ -613,9 +617,6 @@ static inline void cpu_probe_legacy(struct cpuinfo_mips *c, unsigned int cpu)
                         __cpu_name[cpu] = "NEC Vr41xx";
                         break;
                 }
-                set_isa(c, MIPS_CPU_ISA_III);
-                c->options = R4K_OPTS;
-                c->tlbsize = 32;
                 break;
         case PRID_IMP_R4300:
                 c->cputype = CPU_R4300;
@@ -1226,10 +1227,8 @@ __cpuinit void cpu_probe(void)
         if (c->options & MIPS_CPU_FPU) {
                 c->fpu_id = cpu_get_fpu_id();
 
-                if (c->isa_level == MIPS_CPU_ISA_M32R1 ||
-                    c->isa_level == MIPS_CPU_ISA_M32R2 ||
-                    c->isa_level == MIPS_CPU_ISA_M64R1 ||
-                    c->isa_level == MIPS_CPU_ISA_M64R2) {
+                if (c->isa_level & (MIPS_CPU_ISA_M32R1 | MIPS_CPU_ISA_M32R2 |
+                                    MIPS_CPU_ISA_M64R1 | MIPS_CPU_ISA_M64R2)) {
                         if (c->fpu_id & MIPS_FPIR_3D)
                                 c->ases |= MIPS_ASE_MIPS3D;
                 }
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 8eeee1c860c0..db9655f08892 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -171,7 +171,7 @@ SYSCALL_DEFINE6(32_ipc, u32, call, long, first, long, second, long, third,
                 err = compat_sys_shmctl(first, second, compat_ptr(ptr));
                 break;
         default:
-                err = -EINVAL;
+                err = -ENOSYS;
                 break;
         }
 
diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S
index 165867673357..33d067148e61 100644
--- a/arch/mips/kernel/mcount.S
+++ b/arch/mips/kernel/mcount.S
@@ -46,10 +46,9 @@
         PTR_L   a5, PT_R9(sp)
         PTR_L   a6, PT_R10(sp)
         PTR_L   a7, PT_R11(sp)
-#else
-        PTR_ADDIU       sp, PT_SIZE
 #endif
-.endm
+        PTR_ADDIU       sp, PT_SIZE
+        .endm
 
         .macro RETURN_BACK
         jr ra
@@ -68,7 +67,11 @@ NESTED(ftrace_caller, PT_SIZE, ra)
         .globl _mcount
 _mcount:
         b       ftrace_stub
-        addiu sp,sp,8
+#ifdef CONFIG_32BIT
+         addiu sp,sp,8
+#else
+         nop
+#endif
 
         /* When tracing is activated, it calls ftrace_caller+8 (aka here) */
         lw      t1, function_trace_stop
diff --git a/arch/mips/kernel/proc.c b/arch/mips/kernel/proc.c
index 135c4aadccbe..7a54f74b7818 100644
--- a/arch/mips/kernel/proc.c
+++ b/arch/mips/kernel/proc.c
@@ -67,7 +67,7 @@ static int show_cpuinfo(struct seq_file *m, void *v)
         if (cpu_has_mips_r) {
                 seq_printf(m, "isa\t\t\t:");
                 if (cpu_has_mips_1)
-                        seq_printf(m, "%s", "mips1");
+                        seq_printf(m, "%s", " mips1");
                 if (cpu_has_mips_2)
                         seq_printf(m, "%s", " mips2");
                 if (cpu_has_mips_3)
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index a200b5bdbb87..c3abb88170fc 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -1571,7 +1571,7 @@ void __cpuinit per_cpu_trap_init(bool is_boot_cpu)
 #ifdef CONFIG_64BIT
         status_set |= ST0_FR|ST0_KX|ST0_SX|ST0_UX;
 #endif
-        if (current_cpu_data.isa_level == MIPS_CPU_ISA_IV)
+        if (current_cpu_data.isa_level & MIPS_CPU_ISA_IV)
                 status_set |= ST0_XX;
         if (cpu_has_dsp)
                 status_set |= ST0_MX;
diff --git a/arch/mips/lib/bitops.c b/arch/mips/lib/bitops.c
index 81f1dcfdcab8..a64daee740ee 100644
--- a/arch/mips/lib/bitops.c
+++ b/arch/mips/lib/bitops.c
@@ -90,12 +90,12 @@ int __mips_test_and_set_bit(unsigned long nr,
         unsigned bit = nr & SZLONG_MASK;
         unsigned long mask;
         unsigned long flags;
-        unsigned long res;
+        int res;
 
         a += nr >> SZLONG_LOG;
         mask = 1UL << bit;
         raw_local_irq_save(flags);
-        res = (mask & *a);
+        res = (mask & *a) != 0;
         *a |= mask;
         raw_local_irq_restore(flags);
         return res;
@@ -116,12 +116,12 @@ int __mips_test_and_set_bit_lock(unsigned long nr,
         unsigned bit = nr & SZLONG_MASK;
         unsigned long mask;
         unsigned long flags;
-        unsigned long res;
+        int res;
 
         a += nr >> SZLONG_LOG;
         mask = 1UL << bit;
         raw_local_irq_save(flags);
-        res = (mask & *a);
+        res = (mask & *a) != 0;
         *a |= mask;
         raw_local_irq_restore(flags);
         return res;
@@ -141,12 +141,12 @@ int __mips_test_and_clear_bit(unsigned long nr, volatile unsigned long *addr)
         unsigned bit = nr & SZLONG_MASK;
         unsigned long mask;
         unsigned long flags;
-        unsigned long res;
+        int res;
 
         a += nr >> SZLONG_LOG;
         mask = 1UL << bit;
         raw_local_irq_save(flags);
-        res = (mask & *a);
+        res = (mask & *a) != 0;
         *a &= ~mask;
         raw_local_irq_restore(flags);
         return res;
@@ -166,12 +166,12 @@ int __mips_test_and_change_bit(unsigned long nr, volatile unsigned long *addr)
         unsigned bit = nr & SZLONG_MASK;
         unsigned long mask;
         unsigned long flags;
-        unsigned long res;
+        int res;
 
         a += nr >> SZLONG_LOG;
         mask = 1UL << bit;
         raw_local_irq_save(flags);
-        res = (mask & *a);
+        res = (mask & *a) != 0;
         *a ^= mask;
         raw_local_irq_restore(flags);
         return res;
diff --git a/arch/mips/lib/csum_partial.S b/arch/mips/lib/csum_partial.S
index 507147aebd41..a6adffbb4e5f 100644
--- a/arch/mips/lib/csum_partial.S
+++ b/arch/mips/lib/csum_partial.S
@@ -270,7 +270,7 @@ LEAF(csum_partial)
 #endif
 
         /* odd buffer alignment? */
-#ifdef CPU_MIPSR2
+#ifdef CONFIG_CPU_MIPSR2
         wsbh    v1, sum
         movn    sum, v1, t7
 #else
@@ -670,7 +670,7 @@ EXC(	sb	t0, NBYTES-2(dst), .Ls_exc)
         addu    sum, v1
 #endif
 
-#ifdef CPU_MIPSR2
+#ifdef CONFIG_CPU_MIPSR2
         wsbh    v1, sum
         movn    sum, v1, odd
 #else
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index ecca559b8d7b..2078915eacb9 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -1247,10 +1247,8 @@ static void __cpuinit setup_scache(void)
                 return;
 
         default:
-                if (c->isa_level == MIPS_CPU_ISA_M32R1 ||
-                    c->isa_level == MIPS_CPU_ISA_M32R2 ||
-                    c->isa_level == MIPS_CPU_ISA_M64R1 ||
-                    c->isa_level == MIPS_CPU_ISA_M64R2) {
+                if (c->isa_level & (MIPS_CPU_ISA_M32R1 | MIPS_CPU_ISA_M32R2 |
+                                    MIPS_CPU_ISA_M64R1 | MIPS_CPU_ISA_M64R2)) {
 #ifdef CONFIG_MIPS_CPU_SCACHE
                         if (mips_sc_init ()) {
                                 scache_size = c->scache.ways * c->scache.sets * c->scache.linesz;
diff --git a/arch/mips/mm/sc-mips.c b/arch/mips/mm/sc-mips.c
index 93d937b4b1ba..df96da7e939b 100644
--- a/arch/mips/mm/sc-mips.c
+++ b/arch/mips/mm/sc-mips.c
@@ -98,10 +98,8 @@ static inline int __init mips_sc_probe(void)
         c->scache.flags |= MIPS_CACHE_NOT_PRESENT;
 
         /* Ignore anything but MIPSxx processors */
-        if (c->isa_level != MIPS_CPU_ISA_M32R1 &&
-            c->isa_level != MIPS_CPU_ISA_M32R2 &&
-            c->isa_level != MIPS_CPU_ISA_M64R1 &&
-            c->isa_level != MIPS_CPU_ISA_M64R2)
+        if (!(c->isa_level & (MIPS_CPU_ISA_M32R1 | MIPS_CPU_ISA_M32R2 |
+                              MIPS_CPU_ISA_M64R1 | MIPS_CPU_ISA_M64R2)))
                 return 0;
 
         /* Does this MIPS32/MIPS64 CPU have a config2 register? */
diff --git a/arch/mips/pci/pci-alchemy.c b/arch/mips/pci/pci-alchemy.c
index 38a80c83fd67..d1faece21b6a 100644
--- a/arch/mips/pci/pci-alchemy.c
+++ b/arch/mips/pci/pci-alchemy.c
@@ -19,7 +19,7 @@
 #include <asm/mach-au1x00/au1000.h>
 #include <asm/tlbmisc.h>
 
-#ifdef CONFIG_DEBUG_PCI
+#ifdef CONFIG_PCI_DEBUG
 #define DBG(x...) printk(KERN_DEBUG x)
 #else
 #define DBG(x...) do {} while (0)
@@ -162,7 +162,7 @@ static int config_access(unsigned char access_type, struct pci_bus *bus,
         if (status & (1 << 29)) {
                 *data = 0xffffffff;
                 error = -1;
-                DBG("alchemy-pci: master abort on cfg access %d bus %d dev %d",
+                DBG("alchemy-pci: master abort on cfg access %d bus %d dev %d\n",
                     access_type, bus->number, device);
         } else if ((status >> 28) & 0xf) {
                 DBG("alchemy-pci: PCI ERR detected: dev %d, status %lx\n",
diff --git a/arch/powerpc/kernel/epapr_paravirt.c b/arch/powerpc/kernel/epapr_paravirt.c
index f3eab8594d9f..d44a571e45a7 100644
--- a/arch/powerpc/kernel/epapr_paravirt.c
+++ b/arch/powerpc/kernel/epapr_paravirt.c
@@ -23,8 +23,10 @@
 #include <asm/code-patching.h>
 #include <asm/machdep.h>
 
+#if !defined(CONFIG_64BIT) || defined(CONFIG_PPC_BOOK3E_64)
 extern void epapr_ev_idle(void);
 extern u32 epapr_ev_idle_start[];
+#endif
 
 bool epapr_paravirt_enabled;
 
@@ -47,11 +49,15 @@ static int __init epapr_paravirt_init(void)
 
         for (i = 0; i < (len / 4); i++) {
                 patch_instruction(epapr_hypercall_start + i, insts[i]);
+#if !defined(CONFIG_64BIT) || defined(CONFIG_PPC_BOOK3E_64)
                 patch_instruction(epapr_ev_idle_start + i, insts[i]);
+#endif
         }
 
+#if !defined(CONFIG_64BIT) || defined(CONFIG_PPC_BOOK3E_64)
         if (of_get_property(hyper_node, "has-idle", NULL))
                 ppc_md.power_save = epapr_ev_idle;
+#endif
 
         epapr_paravirt_enabled = true;
 
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 200afa5bcfb7..56bd92362ce1 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1066,78 +1066,6 @@ unrecov_user_slb:
 #endif /* __DISABLED__ */
 
 
-/*
- * r13 points to the PACA, r9 contains the saved CR,
- * r12 contain the saved SRR1, SRR0 is still ready for return
- * r3 has the faulting address
- * r9 - r13 are saved in paca->exslb.
- * r3 is saved in paca->slb_r3
- * We assume we aren't going to take any exceptions during this procedure.
- */
-_GLOBAL(slb_miss_realmode)
-        mflr    r10
-#ifdef CONFIG_RELOCATABLE
-        mtctr   r11
-#endif
-
-        stw     r9,PACA_EXSLB+EX_CCR(r13)       /* save CR in exc. frame */
-        std     r10,PACA_EXSLB+EX_LR(r13)       /* save LR */
-
-        bl      .slb_allocate_realmode
-
-        /* All done -- return from exception. */
-
-        ld      r10,PACA_EXSLB+EX_LR(r13)
-        ld      r3,PACA_EXSLB+EX_R3(r13)
-        lwz     r9,PACA_EXSLB+EX_CCR(r13)       /* get saved CR */
-
-        mtlr    r10
-
-        andi.   r10,r12,MSR_RI  /* check for unrecoverable exception */
-        beq-    2f
-
-.machine        push
-.machine        "power4"
-        mtcrf   0x80,r9
-        mtcrf   0x01,r9         /* slb_allocate uses cr0 and cr7 */
-.machine        pop
-
-        RESTORE_PPR_PACA(PACA_EXSLB, r9)
-        ld      r9,PACA_EXSLB+EX_R9(r13)
-        ld      r10,PACA_EXSLB+EX_R10(r13)
-        ld      r11,PACA_EXSLB+EX_R11(r13)
-        ld      r12,PACA_EXSLB+EX_R12(r13)
-        ld      r13,PACA_EXSLB+EX_R13(r13)
-        rfid
-        b       .       /* prevent speculative execution */
-
-2:      mfspr   r11,SPRN_SRR0
-        ld      r10,PACAKBASE(r13)
-        LOAD_HANDLER(r10,unrecov_slb)
-        mtspr   SPRN_SRR0,r10
-        ld      r10,PACAKMSR(r13)
-        mtspr   SPRN_SRR1,r10
-        rfid
-        b       .
-
-unrecov_slb:
-        EXCEPTION_PROLOG_COMMON(0x4100, PACA_EXSLB)
-        DISABLE_INTS
-        bl      .save_nvgprs
-1:      addi    r3,r1,STACK_FRAME_OVERHEAD
-        bl      .unrecoverable_exception
-        b       1b
-
-
-#ifdef CONFIG_PPC_970_NAP
-power4_fixup_nap:
-        andc    r9,r9,r10
-        std     r9,TI_LOCAL_FLAGS(r11)
-        ld      r10,_LINK(r1)           /* make idle task do the */
-        std     r10,_NIP(r1)            /* equivalent of a blr */
-        blr
-#endif
-
         .align  7
         .globl alignment_common
 alignment_common:
@@ -1336,6 +1264,78 @@ _GLOBAL(opal_mc_secondary_handler)
 
 
 /*
+ * r13 points to the PACA, r9 contains the saved CR,
+ * r12 contain the saved SRR1, SRR0 is still ready for return
+ * r3 has the faulting address
+ * r9 - r13 are saved in paca->exslb.
+ * r3 is saved in paca->slb_r3
+ * We assume we aren't going to take any exceptions during this procedure.
+ */
+_GLOBAL(slb_miss_realmode)
+        mflr    r10
+#ifdef CONFIG_RELOCATABLE
+        mtctr   r11
+#endif
+
+        stw     r9,PACA_EXSLB+EX_CCR(r13)       /* save CR in exc. frame */
+        std     r10,PACA_EXSLB+EX_LR(r13)       /* save LR */
+
+        bl      .slb_allocate_realmode
+
+        /* All done -- return from exception. */
+
+        ld      r10,PACA_EXSLB+EX_LR(r13)
+        ld      r3,PACA_EXSLB+EX_R3(r13)
+        lwz     r9,PACA_EXSLB+EX_CCR(r13)       /* get saved CR */
+
+        mtlr    r10
+
+        andi.   r10,r12,MSR_RI  /* check for unrecoverable exception */
+        beq-    2f
+
+.machine        push
+.machine        "power4"
+        mtcrf   0x80,r9
+        mtcrf   0x01,r9         /* slb_allocate uses cr0 and cr7 */
+.machine        pop
+
+        RESTORE_PPR_PACA(PACA_EXSLB, r9)
+        ld      r9,PACA_EXSLB+EX_R9(r13)
+        ld      r10,PACA_EXSLB+EX_R10(r13)
+        ld      r11,PACA_EXSLB+EX_R11(r13)
+        ld      r12,PACA_EXSLB+EX_R12(r13)
+        ld      r13,PACA_EXSLB+EX_R13(r13)
+        rfid
+        b       .       /* prevent speculative execution */
+
+2:      mfspr   r11,SPRN_SRR0
+        ld      r10,PACAKBASE(r13)
+        LOAD_HANDLER(r10,unrecov_slb)
+        mtspr   SPRN_SRR0,r10
+        ld      r10,PACAKMSR(r13)
+        mtspr   SPRN_SRR1,r10
+        rfid
+        b       .
+
+unrecov_slb:
+        EXCEPTION_PROLOG_COMMON(0x4100, PACA_EXSLB)
+        DISABLE_INTS
+        bl      .save_nvgprs
+1:      addi    r3,r1,STACK_FRAME_OVERHEAD
+        bl      .unrecoverable_exception
+        b       1b
+
+
+#ifdef CONFIG_PPC_970_NAP
+power4_fixup_nap:
+        andc    r9,r9,r10
+        std     r9,TI_LOCAL_FLAGS(r11)
+        ld      r10,_LINK(r1)           /* make idle task do the */
+        std     r10,_NIP(r1)            /* equivalent of a blr */
+        blr
+#endif
+
+/*
  * Hash table stuff
  */
         .align  7
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 0da39fed355a..299731e9036b 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -186,7 +186,13 @@ static long pSeries_lpar_hpte_remove(unsigned long hpte_group)
                                            (0x1UL << 4), &dummy1, &dummy2);
                 if (lpar_rc == H_SUCCESS)
                         return i;
-                BUG_ON(lpar_rc != H_NOT_FOUND);
+
+                /*
+                 * The test for adjunct partition is performed before the
+                 * ANDCOND test.  H_RESOURCE may be returned, so we need to
+                 * check for that as well.
+                 */
+                BUG_ON(lpar_rc != H_NOT_FOUND && lpar_rc != H_RESOURCE);
 
                 slot_offset++;
                 slot_offset &= 0x7;
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 4a2930844d43..4a5443118cfb 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -344,6 +344,7 @@ extern unsigned long MODULES_END;
 #define _REGION3_ENTRY_CO       0x100   /* change-recording override        */
 
 /* Bits in the segment table entry */
+#define _SEGMENT_ENTRY_ORIGIN_LARGE ~0xfffffUL /* large page address        */
 #define _SEGMENT_ENTRY_ORIGIN   ~0x7ffUL/* segment table origin             */
 #define _SEGMENT_ENTRY_RO       0x200   /* page protection bit              */
 #define _SEGMENT_ENTRY_INV      0x20    /* invalid segment table entry      */
@@ -1531,7 +1532,8 @@ extern int s390_enable_sie(void);
 /*
  * No page table caches to initialise
  */
-#define pgtable_cache_init()    do { } while (0)
+static inline void pgtable_cache_init(void) { }
+static inline void check_pgt_cache(void) { }
 
 #include <asm-generic/pgtable.h>
 
diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
index dff631d34b45..466fb3383960 100644
--- a/arch/s390/lib/uaccess_pt.c
+++ b/arch/s390/lib/uaccess_pt.c
@@ -77,42 +77,69 @@ static size_t copy_in_kernel(size_t count, void __user *to,
  * >= -4095 (IS_ERR_VALUE(x) returns true), a fault has occured and the address
  * contains the (negative) exception code.
  */
-static __always_inline unsigned long follow_table(struct mm_struct *mm,
-                                                  unsigned long addr, int write)
+#ifdef CONFIG_64BIT
+static unsigned long follow_table(struct mm_struct *mm,
+                                  unsigned long address, int write)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *ptep;
+        unsigned long *table = (unsigned long *)__pa(mm->pgd);
+
+        switch (mm->context.asce_bits & _ASCE_TYPE_MASK) {
+        case _ASCE_TYPE_REGION1:
+                table = table + ((address >> 53) & 0x7ff);
+                if (unlikely(*table & _REGION_ENTRY_INV))
+                        return -0x39UL;
+                table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
+        case _ASCE_TYPE_REGION2:
+                table = table + ((address >> 42) & 0x7ff);
+                if (unlikely(*table & _REGION_ENTRY_INV))
+                        return -0x3aUL;
+                table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
+        case _ASCE_TYPE_REGION3:
+                table = table + ((address >> 31) & 0x7ff);
+                if (unlikely(*table & _REGION_ENTRY_INV))
+                        return -0x3bUL;
+                table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
+        case _ASCE_TYPE_SEGMENT:
+                table = table + ((address >> 20) & 0x7ff);
+                if (unlikely(*table & _SEGMENT_ENTRY_INV))
+                        return -0x10UL;
+                if (unlikely(*table & _SEGMENT_ENTRY_LARGE)) {
+                        if (write && (*table & _SEGMENT_ENTRY_RO))
+                                return -0x04UL;
+                        return (*table & _SEGMENT_ENTRY_ORIGIN_LARGE) +
+                                (address & ~_SEGMENT_ENTRY_ORIGIN_LARGE);
+                }
+                table = (unsigned long *)(*table & _SEGMENT_ENTRY_ORIGIN);
+        }
+        table = table + ((address >> 12) & 0xff);
+        if (unlikely(*table & _PAGE_INVALID))
+                return -0x11UL;
+        if (write && (*table & _PAGE_RO))
+                return -0x04UL;
+        return (*table & PAGE_MASK) + (address & ~PAGE_MASK);
+}
 
-        pgd = pgd_offset(mm, addr);
-        if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd)))
-                return -0x3aUL;
+#else /* CONFIG_64BIT */
 
-        pud = pud_offset(pgd, addr);
-        if (pud_none(*pud) || unlikely(pud_bad(*pud)))
-                return -0x3bUL;
+static unsigned long follow_table(struct mm_struct *mm,
+                                  unsigned long address, int write)
+{
+        unsigned long *table = (unsigned long *)__pa(mm->pgd);
 
-        pmd = pmd_offset(pud, addr);
-        if (pmd_none(*pmd))
+        table = table + ((address >> 20) & 0x7ff);
+        if (unlikely(*table & _SEGMENT_ENTRY_INV))
                 return -0x10UL;
-        if (pmd_large(*pmd)) {
-                if (write && (pmd_val(*pmd) & _SEGMENT_ENTRY_RO))
-                        return -0x04UL;
-                return (pmd_val(*pmd) & HPAGE_MASK) + (addr & ~HPAGE_MASK);
-        }
-        if (unlikely(pmd_bad(*pmd)))
-                return -0x10UL;
-
-        ptep = pte_offset_map(pmd, addr);
-        if (!pte_present(*ptep))
+        table = (unsigned long *)(*table & _SEGMENT_ENTRY_ORIGIN);
+        table = table + ((address >> 12) & 0xff);
+        if (unlikely(*table & _PAGE_INVALID))
                 return -0x11UL;
-        if (write && (!pte_write(*ptep) || !pte_dirty(*ptep)))
+        if (write && (*table & _PAGE_RO))
                 return -0x04UL;
-
-        return (pte_val(*ptep) & PAGE_MASK) + (addr & ~PAGE_MASK);
+        return (*table & PAGE_MASK) + (address & ~PAGE_MASK);
 }
 
+#endif /* CONFIG_64BIT */
+
 static __always_inline size_t __user_copy_pt(unsigned long uaddr, void *kptr,
                                              size_t n, int write_user)
 {
@@ -197,7 +224,7 @@ size_t copy_to_user_pt(size_t n, void __user *to, const void *from)
 
 static size_t clear_user_pt(size_t n, void __user *to)
 {
-        void *zpage = &empty_zero_page;
+        void *zpage = (void *) empty_zero_page;
         long done, size, ret;
 
         done = 0;
diff --git a/arch/tile/include/asm/irqflags.h b/arch/tile/include/asm/irqflags.h
index 241c0bb60b12..c96f9bbb760d 100644
--- a/arch/tile/include/asm/irqflags.h
+++ b/arch/tile/include/asm/irqflags.h
@@ -40,7 +40,15 @@
 #include <asm/percpu.h>
 #include <arch/spr_def.h>
 
-/* Set and clear kernel interrupt masks. */
+/*
+ * Set and clear kernel interrupt masks.
+ *
+ * NOTE: __insn_mtspr() is a compiler builtin marked as a memory
+ * clobber.  We rely on it being equivalent to a compiler barrier in
+ * this code since arch_local_irq_save() and friends must act as
+ * compiler barriers.  This compiler semantic is baked into enough
+ * places that the compiler will maintain it going forward.
+ */
 #if CHIP_HAS_SPLIT_INTR_MASK()
 #if INT_PERF_COUNT < 32 || INT_AUX_PERF_COUNT < 32 || INT_MEM_ERROR >= 32
 # error Fix assumptions about which word various interrupts are in
diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
index d1e15f7b59c6..7a5aa1a7864e 100644
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -1004,15 +1004,8 @@ void __cpuinit setup_cpu(int boot)
 
 #ifdef CONFIG_BLK_DEV_INITRD
 
-/*
- * Note that the kernel can potentially support other compression
- * techniques than gz, though we don't do so by default.  If we ever
- * decide to do so we can either look for other filename extensions,
- * or just allow a file with this name to be compressed with an
- * arbitrary compressor (somewhat counterintuitively).
- */
 static int __initdata set_initramfs_file;
-static char __initdata initramfs_file[128] = "initramfs.cpio.gz";
+static char __initdata initramfs_file[128] = "initramfs";
 
 static int __init setup_initramfs_file(char *str)
 {
@@ -1026,9 +1019,9 @@ static int __init setup_initramfs_file(char *str)
 early_param("initramfs_file", setup_initramfs_file);
 
 /*
- * We look for an "initramfs.cpio.gz" file in the hvfs.
- * If there is one, we allocate some memory for it and it will be
- * unpacked to the initramfs.
+ * We look for a file called "initramfs" in the hvfs.  If there is one, we
+ * allocate some memory for it and it will be unpacked to the initramfs.
+ * If it's compressed, the initd code will uncompress it first.
  */
 static void __init load_hv_initrd(void)
 {
@@ -1038,10 +1031,16 @@ static void __init load_hv_initrd(void)
 
         fd = hv_fs_findfile((HV_VirtAddr) initramfs_file);
         if (fd == HV_ENOENT) {
-                if (set_initramfs_file)
+                if (set_initramfs_file) {
                         pr_warning("No such hvfs initramfs file '%s'\n",
                                    initramfs_file);
-                return;
+                        return;
+                } else {
+                        /* Try old backwards-compatible name. */
+                        fd = hv_fs_findfile((HV_VirtAddr)"initramfs.cpio.gz");
+                        if (fd == HV_ENOENT)
+                                return;
+                }
         }
         BUG_ON(fd < 0);
         stat = hv_fs_fstat(fd);
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index 8a84501acb1b..5ef205c5f37b 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -4,7 +4,7 @@
 # create a compressed vmlinux image from the original vmlinux
 #
 
-targets := vmlinux.lds vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma vmlinux.bin.xz vmlinux.bin.lzo head_$(BITS).o misc.o string.o cmdline.o early_serial_console.o piggy.o
+targets := vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma vmlinux.bin.xz vmlinux.bin.lzo
 
 KBUILD_CFLAGS := -m$(BITS) -D__KERNEL__ $(LINUX_INCLUDE) -O2
 KBUILD_CFLAGS += -fno-strict-aliasing -fPIC
@@ -29,7 +29,6 @@ VMLINUX_OBJS = $(obj)/vmlinux.lds $(obj)/head_$(BITS).o $(obj)/misc.o \
         $(obj)/piggy.o
 
 $(obj)/eboot.o: KBUILD_CFLAGS += -fshort-wchar -mno-red-zone
-$(obj)/efi_stub_$(BITS).o: KBUILD_CLFAGS += -fshort-wchar -mno-red-zone
 
 ifeq ($(CONFIG_EFI_STUB), y)
         VMLINUX_OBJS += $(obj)/eboot.o $(obj)/efi_stub_$(BITS).o
@@ -43,7 +42,7 @@ OBJCOPYFLAGS_vmlinux.bin :=  -R .comment -S
 $(obj)/vmlinux.bin: vmlinux FORCE
         $(call if_changed,objcopy)
 
-targets += vmlinux.bin.all vmlinux.relocs
+targets += $(patsubst $(obj)/%,%,$(VMLINUX_OBJS)) vmlinux.bin.all vmlinux.relocs
 
 CMD_RELOCS = arch/x86/tools/relocs
 quiet_cmd_relocs = RELOCS  $@
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index 5edd1742cfd0..7361e47db79f 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -703,7 +703,10 @@ static inline void arch_leave_lazy_mmu_mode(void)
         PVOP_VCALL0(pv_mmu_ops.lazy_mode.leave);
 }
 
-void arch_flush_lazy_mmu_mode(void);
+static inline void arch_flush_lazy_mmu_mode(void)
+{
+        PVOP_VCALL0(pv_mmu_ops.lazy_mode.flush);
+}
 
 static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
                                 phys_addr_t phys, pgprot_t flags)
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index 142236ed83af..b3b0ec1dac86 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -91,6 +91,7 @@ struct pv_lazy_ops {
         /* Set deferred update mode, used for batching operations. */
         void (*enter)(void);
         void (*leave)(void);
+        void (*flush)(void);
 };
 
 struct pv_time_ops {
@@ -679,6 +680,7 @@ void paravirt_end_context_switch(struct task_struct *next);
 
 void paravirt_enter_lazy_mmu(void);
 void paravirt_leave_lazy_mmu(void);
+void paravirt_flush_lazy_mmu(void);
 
 void _paravirt_nop(void);
 u32 _paravirt_ident_32(u32);
diff --git a/arch/x86/include/asm/syscall.h b/arch/x86/include/asm/syscall.h
index 1ace47b62592..2e188d68397c 100644
--- a/arch/x86/include/asm/syscall.h
+++ b/arch/x86/include/asm/syscall.h
@@ -29,13 +29,13 @@ extern const unsigned long sys_call_table[];
  */
 static inline int syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
 {
-        return regs->orig_ax & __SYSCALL_MASK;
+        return regs->orig_ax;
 }
 
 static inline void syscall_rollback(struct task_struct *task,
                                     struct pt_regs *regs)
 {
-        regs->ax = regs->orig_ax & __SYSCALL_MASK;
+        regs->ax = regs->orig_ax;
 }
 
 static inline long syscall_get_error(struct task_struct *task,
diff --git a/arch/x86/include/asm/tlb.h b/arch/x86/include/asm/tlb.h
index 4fef20773b8f..c7797307fc2b 100644
--- a/arch/x86/include/asm/tlb.h
+++ b/arch/x86/include/asm/tlb.h
@@ -7,7 +7,7 @@
 
 #define tlb_flush(tlb)                                                  \
 {                                                                       \
-        if (tlb->fullmm == 0)                                           \
+        if (!tlb->fullmm && !tlb->need_flush_all)                       \
                 flush_tlb_mm_range(tlb->mm, tlb->start, tlb->end, 0UL); \
         else                                                            \
                 flush_tlb_mm_range(tlb->mm, 0UL, TLB_FLUSH_ALL, 0UL);   \
diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
index c20d1ce62dc6..e709884d0ef9 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -382,14 +382,14 @@ HYPERVISOR_console_io(int cmd, int count, char *str)
         return _hypercall3(int, console_io, cmd, count, str);
 }
 
-extern int __must_check HYPERVISOR_physdev_op_compat(int, void *);
+extern int __must_check xen_physdev_op_compat(int, void *);
 
 static inline int
 HYPERVISOR_physdev_op(int cmd, void *arg)
 {
         int rc = _hypercall2(int, physdev_op, cmd, arg);
         if (unlikely(rc == -ENOSYS))
-                rc = HYPERVISOR_physdev_op_compat(cmd, arg);
+                rc = xen_physdev_op_compat(cmd, arg);
         return rc;
 }
 
diff --git a/arch/x86/include/uapi/asm/msr-index.h b/arch/x86/include/uapi/asm/msr-index.h
index 892ce40a7470..7a060f4b411f 100644
--- a/arch/x86/include/uapi/asm/msr-index.h
+++ b/arch/x86/include/uapi/asm/msr-index.h
@@ -44,6 +44,7 @@
 #define SNB_C1_AUTO_UNDEMOTE            (1UL << 27)
 #define SNB_C3_AUTO_UNDEMOTE            (1UL << 28)
 
+#define MSR_PLATFORM_INFO               0x000000ce
 #define MSR_MTRRcap                     0x000000fe
 #define MSR_IA32_BBL_CR_CTL             0x00000119
 #define MSR_IA32_BBL_CR_CTL3            0x0000011e
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index b05a575d56f4..26830f3af0df 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -314,10 +314,11 @@ int intel_pmu_drain_bts_buffer(void)
         if (top <= at)
                 return 0;
 
+        memset(&regs, 0, sizeof(regs));
+
         ds->bts_index = ds->bts_buffer_base;
 
         perf_sample_data_init(&data, 0, event->hw.last_period);
-        regs.ip     = 0;
 
         /*
          * Prepare a generic sample, i.e. fill in the invariant fields.
diff --git a/arch/x86/kernel/microcode_intel_early.c b/arch/x86/kernel/microcode_intel_early.c
index 7890bc838952..d893e8ed8ac9 100644
--- a/arch/x86/kernel/microcode_intel_early.c
+++ b/arch/x86/kernel/microcode_intel_early.c
@@ -90,13 +90,13 @@ microcode_phys(struct microcode_intel **mc_saved_tmp,
         struct microcode_intel ***mc_saved;
 
         mc_saved = (struct microcode_intel ***)
-                   __pa_symbol(&mc_saved_data->mc_saved);
+                   __pa_nodebug(&mc_saved_data->mc_saved);
         for (i = 0; i < mc_saved_data->mc_saved_count; i++) {
                 struct microcode_intel *p;
 
                 p = *(struct microcode_intel **)
-                        __pa(mc_saved_data->mc_saved + i);
-                mc_saved_tmp[i] = (struct microcode_intel *)__pa(p);
+                        __pa_nodebug(mc_saved_data->mc_saved + i);
+                mc_saved_tmp[i] = (struct microcode_intel *)__pa_nodebug(p);
         }
 }
 #endif
@@ -562,7 +562,7 @@ scan_microcode(unsigned long start, unsigned long end,
         struct cpio_data cd;
         long offset = 0;
 #ifdef CONFIG_X86_32
-        char *p = (char *)__pa_symbol(ucode_name);
+        char *p = (char *)__pa_nodebug(ucode_name);
 #else
         char *p = ucode_name;
 #endif
@@ -630,8 +630,8 @@ static void __cpuinit print_ucode(struct ucode_cpu_info *uci)
         if (mc_intel == NULL)
                 return;
 
-        delay_ucode_info_p = (int *)__pa_symbol(&delay_ucode_info);
-        current_mc_date_p = (int *)__pa_symbol(&current_mc_date);
+        delay_ucode_info_p = (int *)__pa_nodebug(&delay_ucode_info);
+        current_mc_date_p = (int *)__pa_nodebug(&current_mc_date);
 
         *delay_ucode_info_p = 1;
         *current_mc_date_p = mc_intel->hdr.date;
@@ -659,8 +659,8 @@ static inline void __cpuinit print_ucode(struct ucode_cpu_info *uci)
 }
 #endif
 
-static int apply_microcode_early(struct mc_saved_data *mc_saved_data,
-                                 struct ucode_cpu_info *uci)
+static int __cpuinit apply_microcode_early(struct mc_saved_data *mc_saved_data,
+                                           struct ucode_cpu_info *uci)
 {
         struct microcode_intel *mc_intel;
         unsigned int val[2];
@@ -741,15 +741,15 @@ load_ucode_intel_bsp(void)
 #ifdef CONFIG_X86_32
         struct boot_params *boot_params_p;
 
-        boot_params_p = (struct boot_params *)__pa_symbol(&boot_params);
+        boot_params_p = (struct boot_params *)__pa_nodebug(&boot_params);
         ramdisk_image = boot_params_p->hdr.ramdisk_image;
         ramdisk_size  = boot_params_p->hdr.ramdisk_size;
         initrd_start_early = ramdisk_image;
         initrd_end_early = initrd_start_early + ramdisk_size;
 
         _load_ucode_intel_bsp(
-                (struct mc_saved_data *)__pa_symbol(&mc_saved_data),
-                (unsigned long *)__pa_symbol(&mc_saved_in_initrd),
+                (struct mc_saved_data *)__pa_nodebug(&mc_saved_data),
+                (unsigned long *)__pa_nodebug(&mc_saved_in_initrd),
                 initrd_start_early, initrd_end_early, &uci);
 #else
         ramdisk_image = boot_params.hdr.ramdisk_image;
@@ -772,10 +772,10 @@ void __cpuinit load_ucode_intel_ap(void)
         unsigned long *initrd_start_p;
 
         mc_saved_in_initrd_p =
-                (unsigned long *)__pa_symbol(mc_saved_in_initrd);
-        mc_saved_data_p = (struct mc_saved_data *)__pa_symbol(&mc_saved_data);
-        initrd_start_p = (unsigned long *)__pa_symbol(&initrd_start);
-        initrd_start_addr = (unsigned long)__pa_symbol(*initrd_start_p);
+                (unsigned long *)__pa_nodebug(mc_saved_in_initrd);
+        mc_saved_data_p = (struct mc_saved_data *)__pa_nodebug(&mc_saved_data);
+        initrd_start_p = (unsigned long *)__pa_nodebug(&initrd_start);
+        initrd_start_addr = (unsigned long)__pa_nodebug(*initrd_start_p);
 #else
         mc_saved_data_p = &mc_saved_data;
         mc_saved_in_initrd_p = mc_saved_in_initrd;
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index 17fff18a1031..8bfb335f74bb 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -263,6 +263,18 @@ void paravirt_leave_lazy_mmu(void)
         leave_lazy(PARAVIRT_LAZY_MMU);
 }
 
+void paravirt_flush_lazy_mmu(void)
+{
+        preempt_disable();
+
+        if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
+                arch_leave_lazy_mmu_mode();
+                arch_enter_lazy_mmu_mode();
+        }
+
+        preempt_enable();
+}
+
 void paravirt_start_context_switch(struct task_struct *prev)
 {
         BUG_ON(preemptible());
@@ -292,18 +304,6 @@ enum paravirt_lazy_mode paravirt_get_lazy_mode(void)
         return this_cpu_read(paravirt_lazy_mode);
 }
 
-void arch_flush_lazy_mmu_mode(void)
-{
-        preempt_disable();
-
-        if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
-                arch_leave_lazy_mmu_mode();
-                arch_enter_lazy_mmu_mode();
-        }
-
-        preempt_enable();
-}
-
 struct pv_info pv_info = {
         .name = "bare hardware",
         .paravirt_enabled = 0,
@@ -475,6 +475,7 @@ struct pv_mmu_ops pv_mmu_ops = {
         .lazy_mode = {
                 .enter = paravirt_nop,
                 .leave = paravirt_nop,
+                .flush = paravirt_nop,
         },
 
         .set_fixmap = native_set_fixmap,
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 02b51dd4e4ad..f77df1c5de6e 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1857,7 +1857,7 @@ int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data)
         if (!pv_eoi_enabled(vcpu))
                 return 0;
         return kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.pv_eoi.data,
-                                         addr);
+                                         addr, sizeof(u8));
 }
 
 void kvm_lapic_init(void)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index f19ac0aca60d..e1721324c271 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1823,7 +1823,8 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
                 return 0;
         }
 
-        if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa))
+        if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa,
+                                        sizeof(u32)))
                 return 1;
 
         vcpu->arch.apf.send_user_only = !(data & KVM_ASYNC_PF_SEND_ALWAYS);
@@ -1952,12 +1953,9 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 
                 gpa_offset = data & ~(PAGE_MASK | 1);
 
-                /* Check that the address is 32-byte aligned. */
-                if (gpa_offset & (sizeof(struct pvclock_vcpu_time_info) - 1))
-                        break;
-
                 if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
-                     &vcpu->arch.pv_time, data & ~1ULL))
+                     &vcpu->arch.pv_time, data & ~1ULL,
+                     sizeof(struct pvclock_vcpu_time_info)))
                         vcpu->arch.pv_time_enabled = false;
                 else
                         vcpu->arch.pv_time_enabled = true;
@@ -1977,7 +1975,8 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                         return 1;
 
                 if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.st.stime,
-                                                        data & KVM_STEAL_VALID_BITS))
+                                                data & KVM_STEAL_VALID_BITS,
+                                                sizeof(struct kvm_steal_time)))
                         return 1;
 
                 vcpu->arch.st.msr_val = data;
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index 1cbd89ca5569..7114c63f047d 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -1334,6 +1334,7 @@ __init void lguest_init(void)
         pv_mmu_ops.read_cr3 = lguest_read_cr3;
         pv_mmu_ops.lazy_mode.enter = paravirt_enter_lazy_mmu;
         pv_mmu_ops.lazy_mode.leave = lguest_leave_lazy_mmu_mode;
+        pv_mmu_ops.lazy_mode.flush = paravirt_flush_lazy_mmu;
         pv_mmu_ops.pte_update = lguest_pte_update;
         pv_mmu_ops.pte_update_defer = lguest_pte_update;
 
diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
index 05928aae911e..906fea315791 100644
--- a/arch/x86/lib/usercopy_64.c
+++ b/arch/x86/lib/usercopy_64.c
@@ -74,10 +74,10 @@ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
         char c;
         unsigned zero_len;
 
-        for (; len; --len) {
+        for (; len; --len, to++) {
                 if (__get_user_nocheck(c, from++, sizeof(char)))
                         break;
-                if (__put_user_nocheck(c, to++, sizeof(char)))
+                if (__put_user_nocheck(c, to, sizeof(char)))
                         break;
         }
 
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 2b97525246d4..0e883364abb5 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -378,10 +378,12 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
         if (pgd_none(*pgd_ref))
                 return -1;
 
-        if (pgd_none(*pgd))
+        if (pgd_none(*pgd)) {
                 set_pgd(pgd, *pgd_ref);
-        else
+                arch_flush_lazy_mmu_mode();
+        } else {
                 BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
+        }
 
         /*
          * Below here mismatches are bugs because these lower tables
diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
index b0086567271c..0e38951e65eb 100644
--- a/arch/x86/mm/pageattr-test.c
+++ b/arch/x86/mm/pageattr-test.c
@@ -68,7 +68,7 @@ static int print_split(struct split_state *s)
                         s->gpg++;
                         i += GPS/PAGE_SIZE;
                 } else if (level == PG_LEVEL_2M) {
-                        if (!(pte_val(*pte) & _PAGE_PSE)) {
+                        if ((pte_val(*pte) & _PAGE_PRESENT) && !(pte_val(*pte) & _PAGE_PSE)) {
                                 printk(KERN_ERR
                                         "%lx level %d but not PSE %Lx\n",
                                         addr, level, (u64)pte_val(*pte));
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 091934e1d0d9..fb4e73ec24d8 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -467,7 +467,7 @@ try_preserve_large_page(pte_t *kpte, unsigned long address,
          * We are safe now. Check whether the new pgprot is the same:
          */
         old_pte = *kpte;
-        old_prot = new_prot = req_prot = pte_pgprot(old_pte);
+        old_prot = req_prot = pte_pgprot(old_pte);
 
         pgprot_val(req_prot) &= ~pgprot_val(cpa->mask_clr);
         pgprot_val(req_prot) |= pgprot_val(cpa->mask_set);
@@ -478,12 +478,12 @@ try_preserve_large_page(pte_t *kpte, unsigned long address,
          * a non present pmd. The canon_pgprot will clear _PAGE_GLOBAL
          * for the ancient hardware that doesn't support it.
          */
-        if (pgprot_val(new_prot) & _PAGE_PRESENT)
-                pgprot_val(new_prot) |= _PAGE_PSE | _PAGE_GLOBAL;
+        if (pgprot_val(req_prot) & _PAGE_PRESENT)
+                pgprot_val(req_prot) |= _PAGE_PSE | _PAGE_GLOBAL;
         else
-                pgprot_val(new_prot) &= ~(_PAGE_PSE | _PAGE_GLOBAL);
+                pgprot_val(req_prot) &= ~(_PAGE_PSE | _PAGE_GLOBAL);
 
-        new_prot = canon_pgprot(new_prot);
+        req_prot = canon_pgprot(req_prot);
 
         /*
          * old_pte points to the large page base address. So we need
@@ -1413,6 +1413,8 @@ void kernel_map_pages(struct page *page, int numpages, int enable)
          * but that can deadlock->flush only current cpu:
          */
         __flush_tlb_all();
+
+        arch_flush_lazy_mmu_mode();
 }
 
 #ifdef CONFIG_HIBERNATION
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 193350b51f90..17fda6a8b3c2 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -58,6 +58,13 @@ void ___pte_free_tlb(struct mmu_gather *tlb, struct page *pte)
 void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
 {
         paravirt_release_pmd(__pa(pmd) >> PAGE_SHIFT);
+        /*
+         * NOTE! For PAE, any changes to the top page-directory-pointer-table
+         * entries need a full cr3 reload to flush.
+         */
+#ifdef CONFIG_X86_PAE
+        tlb->need_flush_all = 1;
+#endif
         tlb_remove_page(tlb, virt_to_page(pmd));
 }
 
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index e8e34938c57d..e006c18d288a 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1467,8 +1467,6 @@ static void __init xen_write_cr3_init(unsigned long cr3)
         __xen_write_cr3(true, cr3);
 
         xen_mc_issue(PARAVIRT_LAZY_CPU);  /* interrupts restored */
-
-        pv_mmu_ops.write_cr3 = &xen_write_cr3;
 }
 #endif
 
@@ -1750,14 +1748,18 @@ static void *m2v(phys_addr_t maddr)
 }
 
 /* Set the page permissions on an identity-mapped pages */
-static void set_page_prot(void *addr, pgprot_t prot)
+static void set_page_prot_flags(void *addr, pgprot_t prot, unsigned long flags)
 {
         unsigned long pfn = __pa(addr) >> PAGE_SHIFT;
         pte_t pte = pfn_pte(pfn, prot);
 
-        if (HYPERVISOR_update_va_mapping((unsigned long)addr, pte, 0))
+        if (HYPERVISOR_update_va_mapping((unsigned long)addr, pte, flags))
                 BUG();
 }
+static void set_page_prot(void *addr, pgprot_t prot)
+{
+        return set_page_prot_flags(addr, prot, UVMF_NONE);
+}
 #ifdef CONFIG_X86_32
 static void __init xen_map_identity_early(pmd_t *pmd, unsigned long max_pfn)
 {
@@ -1841,12 +1843,12 @@ static void __init check_pt_base(unsigned long *pt_base, unsigned long *pt_end,
                                  unsigned long addr)
 {
         if (*pt_base == PFN_DOWN(__pa(addr))) {
-                set_page_prot((void *)addr, PAGE_KERNEL);
+                set_page_prot_flags((void *)addr, PAGE_KERNEL, UVMF_INVLPG);
                 clear_page((void *)addr);
                 (*pt_base)++;
         }
         if (*pt_end == PFN_DOWN(__pa(addr))) {
-                set_page_prot((void *)addr, PAGE_KERNEL);
+                set_page_prot_flags((void *)addr, PAGE_KERNEL, UVMF_INVLPG);
                 clear_page((void *)addr);
                 (*pt_end)--;
         }
@@ -2122,6 +2124,7 @@ static void __init xen_post_allocator_init(void)
 #endif
 
 #ifdef CONFIG_X86_64
+        pv_mmu_ops.write_cr3 = &xen_write_cr3;
         SetPagePinned(virt_to_page(level3_user_vsyscall));
 #endif
         xen_mark_init_mm_pinned();
@@ -2197,6 +2200,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
         .lazy_mode = {
                 .enter = paravirt_enter_lazy_mmu,
                 .leave = xen_leave_lazy_mmu,
+                .flush = paravirt_flush_lazy_mmu,
         },
 
         .set_fixmap = xen_set_fixmap,
diff --git a/block/blk-flush.c b/block/blk-flush.c
index db8f1b507857..cc2b827a853c 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -444,7 +444,7 @@ int blkdev_issue_flush(struct block_device *bdev, gfp_t gfp_mask,
          * copied from blk_rq_pos(rq).
          */
         if (error_sector)
-               *error_sector = bio->bi_sector;
+                *error_sector = bio->bi_sector;
 
         if (!bio_flagged(bio, BIO_UPTODATE))
                 ret = -EIO;
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 6206a934eb8c..5efc5a647183 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -229,6 +229,8 @@ queue_store_##name(struct request_queue *q, const char *page, size_t count) \
         unsigned long val;                                              \
         ssize_t ret;                                                    \
         ret = queue_var_store(&val, page, count);                       \
+        if (ret < 0)                                                    \
+                 return ret;                                            \
         if (neg)                                                        \
                 val = !val;                                             \
                                                                         \
diff --git a/crypto/gcm.c b/crypto/gcm.c
index 137ad1ec5438..13ccbda34ff9 100644
--- a/crypto/gcm.c
+++ b/crypto/gcm.c
@@ -44,6 +44,7 @@ struct crypto_rfc4543_ctx {
 
 struct crypto_rfc4543_req_ctx {
         u8 auth_tag[16];
+        u8 assocbuf[32];
         struct scatterlist cipher[1];
         struct scatterlist payload[2];
         struct scatterlist assoc[2];
@@ -1133,9 +1134,19 @@ static struct aead_request *crypto_rfc4543_crypt(struct aead_request *req,
         scatterwalk_crypto_chain(payload, dst, vdst == req->iv + 8, 2);
         assoclen += 8 + req->cryptlen - (enc ? 0 : authsize);
 
-        sg_init_table(assoc, 2);
-        sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
-                    req->assoc->offset);
+        if (req->assoc->length == req->assoclen) {
+                sg_init_table(assoc, 2);
+                sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
+                            req->assoc->offset);
+        } else {
+                BUG_ON(req->assoclen > sizeof(rctx->assocbuf));
+
+                scatterwalk_map_and_copy(rctx->assocbuf, req->assoc, 0,
+                                         req->assoclen, 0);
+
+                sg_init_table(assoc, 2);
+                sg_set_buf(assoc, rctx->assocbuf, req->assoclen);
+        }
         scatterwalk_crypto_chain(assoc, payload, 0, 2);
 
         aead_request_set_tfm(subreq, ctx->child);
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 92ed9692c47e..4bf68c8d4797 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -396,7 +396,7 @@ config ACPI_CUSTOM_METHOD
 
 config ACPI_BGRT
         bool "Boottime Graphics Resource Table support"
-        depends on EFI
+        depends on EFI && X86
         help
           This driver adds support for exposing the ACPI Boottime Graphics
           Resource Table, which allows the operating system to obtain
diff --git a/drivers/acpi/acpi_i2c.c b/drivers/acpi/acpi_i2c.c
index 82045e3f5cac..a82c7626aa9b 100644
--- a/drivers/acpi/acpi_i2c.c
+++ b/drivers/acpi/acpi_i2c.c
@@ -90,7 +90,7 @@ void acpi_i2c_register_devices(struct i2c_adapter *adapter)
         acpi_handle handle;
         acpi_status status;
 
-        handle = ACPI_HANDLE(&adapter->dev);
+        handle = ACPI_HANDLE(adapter->dev.parent);
         if (!handle)
                 return;
 
diff --git a/drivers/acpi/apei/cper.c b/drivers/acpi/apei/cper.c
index 1e5d8a40101e..fefc2ca7cc3e 100644
--- a/drivers/acpi/apei/cper.c
+++ b/drivers/acpi/apei/cper.c
@@ -405,7 +405,7 @@ int apei_estatus_check(const struct acpi_hest_generic_status *estatus)
                 return rc;
         data_len = estatus->data_length;
         gdata = (struct acpi_hest_generic_data *)(estatus + 1);
-        while (data_len > sizeof(*gdata)) {
+        while (data_len >= sizeof(*gdata)) {
                 gedata_len = gdata->error_data_length;
                 if (gedata_len > data_len - sizeof(*gdata))
                         return -EINVAL;
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index 0ac546d5e53f..6ae5e440436e 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -415,7 +415,6 @@ static int acpi_pci_root_add(struct acpi_device *device,
         struct acpi_pci_root *root;
         struct acpi_pci_driver *driver;
         u32 flags, base_flags;
-        bool is_osc_granted = false;
 
         root = kzalloc(sizeof(struct acpi_pci_root), GFP_KERNEL);
         if (!root)
@@ -476,6 +475,30 @@ static int acpi_pci_root_add(struct acpi_device *device,
         flags = base_flags = OSC_PCI_SEGMENT_GROUPS_SUPPORT;
         acpi_pci_osc_support(root, flags);
 
+        /*
+         * TBD: Need PCI interface for enumeration/configuration of roots.
+         */
+
+        mutex_lock(&acpi_pci_root_lock);
+        list_add_tail(&root->node, &acpi_pci_roots);
+        mutex_unlock(&acpi_pci_root_lock);
+
+        /*
+         * Scan the Root Bridge
+         * --------------------
+         * Must do this prior to any attempt to bind the root device, as the
+         * PCI namespace does not get created until this call is made (and
+         * thus the root bridge's pci_dev does not exist).
+         */
+        root->bus = pci_acpi_scan_root(root);
+        if (!root->bus) {
+                printk(KERN_ERR PREFIX
+                            "Bus %04x:%02x not present in PCI namespace\n",
+                            root->segment, (unsigned int)root->secondary.start);
+                result = -ENODEV;
+                goto out_del_root;
+        }
+
         /* Indicate support for various _OSC capabilities. */
         if (pci_ext_cfg_avail())
                 flags |= OSC_EXT_PCI_CONFIG_SUPPORT;
@@ -494,6 +517,7 @@ static int acpi_pci_root_add(struct acpi_device *device,
                         flags = base_flags;
                 }
         }
+
         if (!pcie_ports_disabled
             && (flags & ACPI_PCIE_REQ_SUPPORT) == ACPI_PCIE_REQ_SUPPORT) {
                 flags = OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL
@@ -514,54 +538,28 @@ static int acpi_pci_root_add(struct acpi_device *device,
                 status = acpi_pci_osc_control_set(device->handle, &flags,
                                        OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL);
                 if (ACPI_SUCCESS(status)) {
-                        is_osc_granted = true;
                         dev_info(&device->dev,
                                 "ACPI _OSC control (0x%02x) granted\n", flags);
+                        if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM) {
+                                /*
+                                 * We have ASPM control, but the FADT indicates
+                                 * that it's unsupported. Clear it.
+                                 */
+                                pcie_clear_aspm(root->bus);
+                        }
                 } else {
-                        is_osc_granted = false;
                         dev_info(&device->dev,
                                 "ACPI _OSC request failed (%s), "
                                 "returned control mask: 0x%02x\n",
                                 acpi_format_exception(status), flags);
+                        pr_info("ACPI _OSC control for PCIe not granted, "
+                                "disabling ASPM\n");
+                        pcie_no_aspm();
                 }
         } else {
                 dev_info(&device->dev,
-                        "Unable to request _OSC control "
-                        "(_OSC support mask: 0x%02x)\n", flags);
-        }
-
-        /*
-         * TBD: Need PCI interface for enumeration/configuration of roots.
-         */
-
-        mutex_lock(&acpi_pci_root_lock);
-        list_add_tail(&root->node, &acpi_pci_roots);
-        mutex_unlock(&acpi_pci_root_lock);
-
-        /*
-         * Scan the Root Bridge
-         * --------------------
-         * Must do this prior to any attempt to bind the root device, as the
-         * PCI namespace does not get created until this call is made (and 
-         * thus the root bridge's pci_dev does not exist).
-         */
-        root->bus = pci_acpi_scan_root(root);
-        if (!root->bus) {
-                printk(KERN_ERR PREFIX
-                            "Bus %04x:%02x not present in PCI namespace\n",
-                            root->segment, (unsigned int)root->secondary.start);
-                result = -ENODEV;
-                goto out_del_root;
-        }
-
-        /* ASPM setting */
-        if (is_osc_granted) {
-                if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM)
-                        pcie_clear_aspm(root->bus);
-        } else {
-                pr_info("ACPI _OSC control for PCIe not granted, "
-                        "disabling ASPM\n");
-                pcie_no_aspm();
+                         "Unable to request _OSC control "
+                         "(_OSC support mask: 0x%02x)\n", flags);
         }
 
         pci_acpi_add_bus_pm_notifier(device, root->bus);
@@ -646,6 +644,7 @@ static void handle_root_bridge_insertion(acpi_handle handle)
 
 static void handle_root_bridge_removal(struct acpi_device *device)
 {
+        acpi_status status;
         struct acpi_eject_event *ej_event;
 
         ej_event = kmalloc(sizeof(*ej_event), GFP_KERNEL);
@@ -661,7 +660,9 @@ static void handle_root_bridge_removal(struct acpi_device *device)
         ej_event->device = device;
         ej_event->event = ACPI_NOTIFY_EJECT_REQUEST;
 
-        acpi_bus_hot_remove_device(ej_event);
+        status = acpi_os_hotplug_execute(acpi_bus_hot_remove_device, ej_event);
+        if (ACPI_FAILURE(status))
+                kfree(ej_event);
 }
 
 static void _handle_hotplug_event_root(struct work_struct *work)
@@ -676,8 +677,9 @@ static void _handle_hotplug_event_root(struct work_struct *work)
         handle = hp_work->handle;
         type = hp_work->type;
 
-        root = acpi_pci_find_root(handle);
+        acpi_scan_lock_acquire();
 
+        root = acpi_pci_find_root(handle);
         acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer);
 
         switch (type) {
@@ -711,6 +713,7 @@ static void _handle_hotplug_event_root(struct work_struct *work)
                 break;
         }
 
+        acpi_scan_lock_release();
         kfree(hp_work); /* allocated in handle_hotplug_event_bridge */
         kfree(buffer.pointer);
 }
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index fc95308e9a11..ee255c60bdac 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -66,7 +66,8 @@ module_param(latency_factor, uint, 0644);
 
 static DEFINE_PER_CPU(struct cpuidle_device *, acpi_cpuidle_device);
 
-static struct acpi_processor_cx *acpi_cstate[CPUIDLE_STATE_MAX];
+static DEFINE_PER_CPU(struct acpi_processor_cx * [CPUIDLE_STATE_MAX],
+                                                                acpi_cstate);
 
 static int disabled_by_idle_boot_param(void)
 {
@@ -722,7 +723,7 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
                 struct cpuidle_driver *drv, int index)
 {
         struct acpi_processor *pr;
-        struct acpi_processor_cx *cx = acpi_cstate[index];
+        struct acpi_processor_cx *cx = per_cpu(acpi_cstate[index], dev->cpu);
 
         pr = __this_cpu_read(processors);
 
@@ -745,7 +746,7 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
  */
 static int acpi_idle_play_dead(struct cpuidle_device *dev, int index)
 {
-        struct acpi_processor_cx *cx = acpi_cstate[index];
+        struct acpi_processor_cx *cx = per_cpu(acpi_cstate[index], dev->cpu);
 
         ACPI_FLUSH_CPU_CACHE();
 
@@ -775,7 +776,7 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
                 struct cpuidle_driver *drv, int index)
 {
         struct acpi_processor *pr;
-        struct acpi_processor_cx *cx = acpi_cstate[index];
+        struct acpi_processor_cx *cx = per_cpu(acpi_cstate[index], dev->cpu);
 
         pr = __this_cpu_read(processors);
 
@@ -833,7 +834,7 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
                 struct cpuidle_driver *drv, int index)
 {
         struct acpi_processor *pr;
-        struct acpi_processor_cx *cx = acpi_cstate[index];
+        struct acpi_processor_cx *cx = per_cpu(acpi_cstate[index], dev->cpu);
 
         pr = __this_cpu_read(processors);
 
@@ -960,7 +961,7 @@ static int acpi_processor_setup_cpuidle_cx(struct acpi_processor *pr,
                     !(acpi_gbl_FADT.flags & ACPI_FADT_C2_MP_SUPPORTED))
                         continue;
 #endif
-                acpi_cstate[count] = cx;
+                per_cpu(acpi_cstate[count], dev->cpu) = cx;
 
                 count++;
                 if (count == CPUIDLE_STATE_MAX)
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 24213033fbae..9c1a435d10e6 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -193,6 +193,14 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
         },
         {
         .callback = init_nvs_nosave,
+        .ident = "Sony Vaio VGN-FW21M",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FW21M"),
+                },
+        },
+        {
+        .callback = init_nvs_nosave,
         .ident = "Sony Vaio VPCEB17FX",
         .matches = {
                 DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index ffdd32d22602..2f48123d74c4 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -150,6 +150,7 @@ enum piix_controller_ids {
         tolapai_sata,
         piix_pata_vmw,                  /* PIIX4 for VMware, spurious DMA_ERR */
         ich8_sata_snb,
+        ich8_2port_sata_snb,
 };
 
 struct piix_map_db {
@@ -304,7 +305,7 @@ static const struct pci_device_id piix_pci_tbl[] = {
         /* SATA Controller IDE (Lynx Point) */
         { 0x8086, 0x8c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
         /* SATA Controller IDE (Lynx Point) */
-        { 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+        { 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
         /* SATA Controller IDE (Lynx Point) */
         { 0x8086, 0x8c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
         /* SATA Controller IDE (Lynx Point-LP) */
@@ -439,6 +440,7 @@ static const struct piix_map_db *piix_map_db_table[] = {
         [ich8m_apple_sata]      = &ich8m_apple_map_db,
         [tolapai_sata]          = &tolapai_map_db,
         [ich8_sata_snb]         = &ich8_map_db,
+        [ich8_2port_sata_snb]   = &ich8_2port_map_db,
 };
 
 static struct pci_bits piix_enable_bits[] = {
@@ -1242,6 +1244,16 @@ static struct ata_port_info piix_port_info[] = {
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &piix_sata_ops,
         },
+
+        [ich8_2port_sata_snb] =
+        {
+                .flags          = PIIX_SATA_FLAGS | PIIX_FLAG_SIDPR
+                                        | PIIX_FLAG_PIO16,
+                .pio_mask       = ATA_PIO4,
+                .mwdma_mask     = ATA_MWDMA2,
+                .udma_mask      = ATA_UDMA6,
+                .port_ops       = &piix_sata_ops,
+        },
 };
 
 #define AHCI_PCI_BAR 5
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 497adea1f0d6..63c743baf920 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2329,7 +2329,7 @@ int ata_dev_configure(struct ata_device *dev)
                  * from SATA Settings page of Identify Device Data Log.
                  */
                 if (ata_id_has_devslp(dev->id)) {
-                        u8 sata_setting[ATA_SECT_SIZE];
+                        u8 *sata_setting = ap->sector_buf;
                         int i, j;
 
                         dev->flags |= ATA_DFLAG_DEVSLP;
@@ -2439,6 +2439,9 @@ int ata_dev_configure(struct ata_device *dev)
                 dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
                                          dev->max_sectors);
 
+        if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48)
+                dev->max_sectors = ATA_MAX_SECTORS_LBA48;
+
         if (ap->ops->dev_config)
                 ap->ops->dev_config(dev);
 
@@ -4100,6 +4103,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         /* Weird ATAPI devices */
         { "TORiSAN DVD-ROM DRD-N216", NULL,     ATA_HORKAGE_MAX_SEC_128 },
         { "QUANTUM DAT    DAT72-000", NULL,     ATA_HORKAGE_ATAPI_MOD16_DMA },
+        { "Slimtype DVD A  DS8A8SH", NULL,      ATA_HORKAGE_MAX_SEC_LBA48 },
 
         /* Devices we expect to fail diagnostics */
 
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 318b41358187..ff44787e5a45 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -532,8 +532,8 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg)
                         struct scsi_sense_hdr sshdr;
                         scsi_normalize_sense(sensebuf, SCSI_SENSE_BUFFERSIZE,
                                              &sshdr);
-                        if (sshdr.sense_key == 0 &&
-                            sshdr.asc == 0 && sshdr.ascq == 0)
+                        if (sshdr.sense_key == RECOVERED_ERROR &&
+                            sshdr.asc == 0 && sshdr.ascq == 0x1d)
                                 cmd_result &= ~SAM_STAT_CHECK_CONDITION;
                 }
 
@@ -618,8 +618,8 @@ int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg)
                         struct scsi_sense_hdr sshdr;
                         scsi_normalize_sense(sensebuf, SCSI_SENSE_BUFFERSIZE,
                                                 &sshdr);
-                        if (sshdr.sense_key == 0 &&
-                                sshdr.asc == 0 && sshdr.ascq == 0)
+                        if (sshdr.sense_key == RECOVERED_ERROR &&
+                            sshdr.asc == 0 && sshdr.ascq == 0x1d)
                                 cmd_result &= ~SAM_STAT_CHECK_CONDITION;
                 }
 
diff --git a/drivers/base/power/qos.c b/drivers/base/power/qos.c
index 5f74587ef258..71671c42ef45 100644
--- a/drivers/base/power/qos.c
+++ b/drivers/base/power/qos.c
@@ -46,6 +46,7 @@
 #include "power.h"
 
 static DEFINE_MUTEX(dev_pm_qos_mtx);
+static DEFINE_MUTEX(dev_pm_qos_sysfs_mtx);
 
 static BLOCKING_NOTIFIER_HEAD(dev_pm_notifiers);
 
@@ -216,12 +217,17 @@ void dev_pm_qos_constraints_destroy(struct device *dev)
         struct pm_qos_constraints *c;
         struct pm_qos_flags *f;
 
-        mutex_lock(&dev_pm_qos_mtx);
+        mutex_lock(&dev_pm_qos_sysfs_mtx);
 
         /*
          * If the device's PM QoS resume latency limit or PM QoS flags have been
          * exposed to user space, they have to be hidden at this point.
          */
+        pm_qos_sysfs_remove_latency(dev);
+        pm_qos_sysfs_remove_flags(dev);
+
+        mutex_lock(&dev_pm_qos_mtx);
+
         __dev_pm_qos_hide_latency_limit(dev);
         __dev_pm_qos_hide_flags(dev);
 
@@ -254,6 +260,8 @@ void dev_pm_qos_constraints_destroy(struct device *dev)
 
  out:
         mutex_unlock(&dev_pm_qos_mtx);
+
+        mutex_unlock(&dev_pm_qos_sysfs_mtx);
 }
 
 /**
@@ -558,6 +566,14 @@ static void __dev_pm_qos_drop_user_request(struct device *dev,
         kfree(req);
 }
 
+static void dev_pm_qos_drop_user_request(struct device *dev,
+                                         enum dev_pm_qos_req_type type)
+{
+        mutex_lock(&dev_pm_qos_mtx);
+        __dev_pm_qos_drop_user_request(dev, type);
+        mutex_unlock(&dev_pm_qos_mtx);
+}
+
 /**
  * dev_pm_qos_expose_latency_limit - Expose PM QoS latency limit to user space.
  * @dev: Device whose PM QoS latency limit is to be exposed to user space.
@@ -581,6 +597,8 @@ int dev_pm_qos_expose_latency_limit(struct device *dev, s32 value)
                 return ret;
         }
 
+        mutex_lock(&dev_pm_qos_sysfs_mtx);
+
         mutex_lock(&dev_pm_qos_mtx);
 
         if (IS_ERR_OR_NULL(dev->power.qos))
@@ -591,26 +609,27 @@ int dev_pm_qos_expose_latency_limit(struct device *dev, s32 value)
         if (ret < 0) {
                 __dev_pm_qos_remove_request(req);
                 kfree(req);
+                mutex_unlock(&dev_pm_qos_mtx);
                 goto out;
         }
-
         dev->power.qos->latency_req = req;
+
+        mutex_unlock(&dev_pm_qos_mtx);
+
         ret = pm_qos_sysfs_add_latency(dev);
         if (ret)
-                __dev_pm_qos_drop_user_request(dev, DEV_PM_QOS_LATENCY);
+                dev_pm_qos_drop_user_request(dev, DEV_PM_QOS_LATENCY);
 
  out:
-        mutex_unlock(&dev_pm_qos_mtx);
+        mutex_unlock(&dev_pm_qos_sysfs_mtx);
         return ret;
 }
 EXPORT_SYMBOL_GPL(dev_pm_qos_expose_latency_limit);
 
 static void __dev_pm_qos_hide_latency_limit(struct device *dev)
 {
-        if (!IS_ERR_OR_NULL(dev->power.qos) && dev->power.qos->latency_req) {
-                pm_qos_sysfs_remove_latency(dev);
+        if (!IS_ERR_OR_NULL(dev->power.qos) && dev->power.qos->latency_req)
                 __dev_pm_qos_drop_user_request(dev, DEV_PM_QOS_LATENCY);
-        }
 }
 
 /**
@@ -619,9 +638,15 @@ static void __dev_pm_qos_hide_latency_limit(struct device *dev)
  */
 void dev_pm_qos_hide_latency_limit(struct device *dev)
 {
+        mutex_lock(&dev_pm_qos_sysfs_mtx);
+
+        pm_qos_sysfs_remove_latency(dev);
+
         mutex_lock(&dev_pm_qos_mtx);
         __dev_pm_qos_hide_latency_limit(dev);
         mutex_unlock(&dev_pm_qos_mtx);
+
+        mutex_unlock(&dev_pm_qos_sysfs_mtx);
 }
 EXPORT_SYMBOL_GPL(dev_pm_qos_hide_latency_limit);
 
@@ -649,6 +674,8 @@ int dev_pm_qos_expose_flags(struct device *dev, s32 val)
         }
 
         pm_runtime_get_sync(dev);
+        mutex_lock(&dev_pm_qos_sysfs_mtx);
+
         mutex_lock(&dev_pm_qos_mtx);
 
         if (IS_ERR_OR_NULL(dev->power.qos))
@@ -659,16 +686,19 @@ int dev_pm_qos_expose_flags(struct device *dev, s32 val)
         if (ret < 0) {
                 __dev_pm_qos_remove_request(req);
                 kfree(req);
+                mutex_unlock(&dev_pm_qos_mtx);
                 goto out;
         }
-
         dev->power.qos->flags_req = req;
+
+        mutex_unlock(&dev_pm_qos_mtx);
+
         ret = pm_qos_sysfs_add_flags(dev);
         if (ret)
-                __dev_pm_qos_drop_user_request(dev, DEV_PM_QOS_FLAGS);
+                dev_pm_qos_drop_user_request(dev, DEV_PM_QOS_FLAGS);
 
  out:
-        mutex_unlock(&dev_pm_qos_mtx);
+        mutex_unlock(&dev_pm_qos_sysfs_mtx);
         pm_runtime_put(dev);
         return ret;
 }
@@ -676,10 +706,8 @@ EXPORT_SYMBOL_GPL(dev_pm_qos_expose_flags);
 
 static void __dev_pm_qos_hide_flags(struct device *dev)
 {
-        if (!IS_ERR_OR_NULL(dev->power.qos) && dev->power.qos->flags_req) {
-                pm_qos_sysfs_remove_flags(dev);
+        if (!IS_ERR_OR_NULL(dev->power.qos) && dev->power.qos->flags_req)
                 __dev_pm_qos_drop_user_request(dev, DEV_PM_QOS_FLAGS);
-        }
 }
 
 /**
@@ -689,9 +717,15 @@ static void __dev_pm_qos_hide_flags(struct device *dev)
 void dev_pm_qos_hide_flags(struct device *dev)
 {
         pm_runtime_get_sync(dev);
+        mutex_lock(&dev_pm_qos_sysfs_mtx);
+
+        pm_qos_sysfs_remove_flags(dev);
+
         mutex_lock(&dev_pm_qos_mtx);
         __dev_pm_qos_hide_flags(dev);
         mutex_unlock(&dev_pm_qos_mtx);
+
+        mutex_unlock(&dev_pm_qos_sysfs_mtx);
         pm_runtime_put(dev);
 }
 EXPORT_SYMBOL_GPL(dev_pm_qos_hide_flags);
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index e6732cf7c06e..79f4fca9877a 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -398,7 +398,7 @@ static int regcache_rbtree_sync(struct regmap *map, unsigned int min,
                         base = 0;
 
                 if (max < rbnode->base_reg + rbnode->blklen)
-                        end = rbnode->base_reg + rbnode->blklen - max;
+                        end = max - rbnode->base_reg + 1;
                 else
                         end = rbnode->blklen;
 
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 3d2367501fd0..58cfb3232428 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -710,12 +710,12 @@ skip_format_initialization:
                 }
         }
 
+        regmap_debugfs_init(map, config->name);
+
         ret = regcache_init(map, config);
         if (ret != 0)
                 goto err_range;
 
-        regmap_debugfs_init(map, config->name);
-
         /* Add a devres resource for dev_get_regmap() */
         m = devres_alloc(dev_get_regmap_release, sizeof(*m), GFP_KERNEL);
         if (!m) {
@@ -1036,6 +1036,8 @@ static int _regmap_raw_write(struct regmap *map, unsigned int reg,
                         kfree(async->work_buf);
                         kfree(async);
                 }
+
+                return ret;
         }
 
         trace_regmap_hw_write_start(map->dev, reg,
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index 5dc0daed8fac..b81ddfea1da0 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -532,11 +532,11 @@ config BLK_DEV_RBD
           If unsure, say N.
 
 config BLK_DEV_RSXX
-        tristate "RamSam PCIe Flash SSD Device Driver"
+        tristate "IBM FlashSystem 70/80 PCIe SSD Device Driver"
         depends on PCI
         help
           Device driver for IBM's high speed PCIe SSD
-          storage devices: RamSan-70 and RamSan-80.
+          storage devices: FlashSystem-70 and FlashSystem-80.
 
           To compile this driver as a module, choose M here: the
           module will be called rsxx.
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 25ef5c014fca..92b6d7c51e39 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -51,8 +51,9 @@ new_skb(ulong len)
 {
         struct sk_buff *skb;
 
-        skb = alloc_skb(len, GFP_ATOMIC);
+        skb = alloc_skb(len + MAX_HEADER, GFP_ATOMIC);
         if (skb) {
+                skb_reserve(skb, MAX_HEADER);
                 skb_reset_mac_header(skb);
                 skb_reset_network_header(skb);
                 skb->protocol = __constant_htons(ETH_P_AOE);
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index ade58bc8f3c4..1c1b8e544aa2 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -4206,7 +4206,7 @@ static int cciss_find_cfgtables(ctlr_info_t *h)
         if (rc)
                 return rc;
         h->cfgtable = remap_pci_mem(pci_resource_start(h->pdev,
-                cfg_base_addr_index) + cfg_offset, sizeof(h->cfgtable));
+                cfg_base_addr_index) + cfg_offset, sizeof(*h->cfgtable));
         if (!h->cfgtable)
                 return -ENOMEM;
         rc = write_driver_ver_to_cfgtable(h->cfgtable);
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 747bb2af69dc..dfe758382eaf 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -922,6 +922,11 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
                 lo->lo_flags |= LO_FLAGS_PARTSCAN;
         if (lo->lo_flags & LO_FLAGS_PARTSCAN)
                 ioctl_by_bdev(bdev, BLKRRPART, 0);
+
+        /* Grab the block_device to prevent its destruction after we
+         * put /dev/loopXX inode. Later in loop_clr_fd() we bdput(bdev).
+         */
+        bdgrab(bdev);
         return 0;
 
 out_clr:
@@ -1031,8 +1036,10 @@ static int loop_clr_fd(struct loop_device *lo)
         memset(lo->lo_encrypt_key, 0, LO_KEY_SIZE);
         memset(lo->lo_crypt_name, 0, LO_NAME_SIZE);
         memset(lo->lo_file_name, 0, LO_NAME_SIZE);
-        if (bdev)
+        if (bdev) {
+                bdput(bdev);
                 invalidate_bdev(bdev);
+        }
         set_capacity(lo->lo_disk, 0);
         loop_sysfs_exit(lo);
         if (bdev) {
@@ -1623,6 +1630,7 @@ static int loop_add(struct loop_device **l, int i)
                 goto out_free_dev;
         i = err;
 
+        err = -ENOMEM;
         lo->lo_queue = blk_alloc_queue(GFP_KERNEL);
         if (!lo->lo_queue)
                 goto out_free_dev;
diff --git a/drivers/block/mg_disk.c b/drivers/block/mg_disk.c
index 1788f491e0fb..076ae7f1b781 100644
--- a/drivers/block/mg_disk.c
+++ b/drivers/block/mg_disk.c
@@ -890,8 +890,10 @@ static int mg_probe(struct platform_device *plat_dev)
         gpio_direction_output(host->rst, 1);
 
         /* reset out pin */
-        if (!(prv_data->dev_attr & MG_DEV_MASK))
+        if (!(prv_data->dev_attr & MG_DEV_MASK)) {
+                err = -EINVAL;
                 goto probe_err_3a;
+        }
 
         if (prv_data->dev_attr != MG_BOOT_DEV) {
                 rsc = platform_get_resource_byname(plat_dev, IORESOURCE_IO,
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 11cc9522cdd4..32c678028e53 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -81,12 +81,17 @@
 /* Device instance number, incremented each time a device is probed. */
 static int instance;
 
+struct list_head online_list;
+struct list_head removing_list;
+spinlock_t dev_lock;
+
 /*
  * Global variable used to hold the major block device number
  * allocated in mtip_init().
  */
 static int mtip_major;
 static struct dentry *dfs_parent;
+static struct dentry *dfs_device_status;
 
 static u32 cpu_use[NR_CPUS];
 
@@ -243,40 +248,31 @@ static inline void release_slot(struct mtip_port *port, int tag)
 /*
  * Reset the HBA (without sleeping)
  *
- * Just like hba_reset, except does not call sleep, so can be
- * run from interrupt/tasklet context.
- *
  * @dd Pointer to the driver data structure.
  *
  * return value
  *      0       The reset was successful.
  *      -1      The HBA Reset bit did not clear.
  */
-static int hba_reset_nosleep(struct driver_data *dd)
+static int mtip_hba_reset(struct driver_data *dd)
 {
         unsigned long timeout;
 
-        /* Chip quirk: quiesce any chip function */
-        mdelay(10);
-
         /* Set the reset bit */
         writel(HOST_RESET, dd->mmio + HOST_CTL);
 
         /* Flush */
         readl(dd->mmio + HOST_CTL);
 
-        /*
-         * Wait 10ms then spin for up to 1 second
-         * waiting for reset acknowledgement
-         */
-        timeout = jiffies + msecs_to_jiffies(1000);
-        mdelay(10);
-        while ((readl(dd->mmio + HOST_CTL) & HOST_RESET)
-                 && time_before(jiffies, timeout))
-                mdelay(1);
+        /* Spin for up to 2 seconds, waiting for reset acknowledgement */
+        timeout = jiffies + msecs_to_jiffies(2000);
+        do {
+                mdelay(10);
+                if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag))
+                        return -1;
 
-        if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag))
-                return -1;
+        } while ((readl(dd->mmio + HOST_CTL) & HOST_RESET)
+                 && time_before(jiffies, timeout));
 
         if (readl(dd->mmio + HOST_CTL) & HOST_RESET)
                 return -1;
@@ -481,7 +477,7 @@ static void mtip_restart_port(struct mtip_port *port)
                 dev_warn(&port->dd->pdev->dev,
                         "PxCMD.CR not clear, escalating reset\n");
 
-                if (hba_reset_nosleep(port->dd))
+                if (mtip_hba_reset(port->dd))
                         dev_err(&port->dd->pdev->dev,
                                 "HBA reset escalation failed.\n");
 
@@ -527,6 +523,26 @@ static void mtip_restart_port(struct mtip_port *port)
 
 }
 
+static int mtip_device_reset(struct driver_data *dd)
+{
+        int rv = 0;
+
+        if (mtip_check_surprise_removal(dd->pdev))
+                return 0;
+
+        if (mtip_hba_reset(dd) < 0)
+                rv = -EFAULT;
+
+        mdelay(1);
+        mtip_init_port(dd->port);
+        mtip_start_port(dd->port);
+
+        /* Enable interrupts on the HBA. */
+        writel(readl(dd->mmio + HOST_CTL) | HOST_IRQ_EN,
+                                        dd->mmio + HOST_CTL);
+        return rv;
+}
+
 /*
  * Helper function for tag logging
  */
@@ -632,7 +648,7 @@ static void mtip_timeout_function(unsigned long int data)
         if (cmdto_cnt) {
                 print_tags(port->dd, "timed out", tagaccum, cmdto_cnt);
                 if (!test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags)) {
-                        mtip_restart_port(port);
+                        mtip_device_reset(port->dd);
                         wake_up_interruptible(&port->svc_wait);
                 }
                 clear_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags);
@@ -1283,11 +1299,11 @@ static int mtip_exec_internal_command(struct mtip_port *port,
         int rv = 0, ready2go = 1;
         struct mtip_cmd *int_cmd = &port->commands[MTIP_TAG_INTERNAL];
         unsigned long to;
+        struct driver_data *dd = port->dd;
 
         /* Make sure the buffer is 8 byte aligned. This is asic specific. */
         if (buffer & 0x00000007) {
-                dev_err(&port->dd->pdev->dev,
-                        "SG buffer is not 8 byte aligned\n");
+                dev_err(&dd->pdev->dev, "SG buffer is not 8 byte aligned\n");
                 return -EFAULT;
         }
 
@@ -1300,23 +1316,21 @@ static int mtip_exec_internal_command(struct mtip_port *port,
                 mdelay(100);
         } while (time_before(jiffies, to));
         if (!ready2go) {
-                dev_warn(&port->dd->pdev->dev,
+                dev_warn(&dd->pdev->dev,
                         "Internal cmd active. new cmd [%02X]\n", fis->command);
                 return -EBUSY;
         }
         set_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags);
         port->ic_pause_timer = 0;
 
-        if (fis->command == ATA_CMD_SEC_ERASE_UNIT)
-                clear_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags);
-        else if (fis->command == ATA_CMD_DOWNLOAD_MICRO)
-                clear_bit(MTIP_PF_DM_ACTIVE_BIT, &port->flags);
+        clear_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags);
+        clear_bit(MTIP_PF_DM_ACTIVE_BIT, &port->flags);
 
         if (atomic == GFP_KERNEL) {
                 if (fis->command != ATA_CMD_STANDBYNOW1) {
                         /* wait for io to complete if non atomic */
                         if (mtip_quiesce_io(port, 5000) < 0) {
-                                dev_warn(&port->dd->pdev->dev,
+                                dev_warn(&dd->pdev->dev,
                                         "Failed to quiesce IO\n");
                                 release_slot(port, MTIP_TAG_INTERNAL);
                                 clear_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags);
@@ -1361,58 +1375,84 @@ static int mtip_exec_internal_command(struct mtip_port *port,
         /* Issue the command to the hardware */
         mtip_issue_non_ncq_command(port, MTIP_TAG_INTERNAL);
 
-        /* Poll if atomic, wait_for_completion otherwise */
         if (atomic == GFP_KERNEL) {
                 /* Wait for the command to complete or timeout. */
-                if (wait_for_completion_timeout(
+                if (wait_for_completion_interruptible_timeout(
                                 &wait,
-                                msecs_to_jiffies(timeout)) == 0) {
-                        dev_err(&port->dd->pdev->dev,
-                                "Internal command did not complete [%d] "
-                                "within timeout of  %lu ms\n",
-                                atomic, timeout);
-                        if (mtip_check_surprise_removal(port->dd->pdev) ||
+                                msecs_to_jiffies(timeout)) <= 0) {
+                        if (rv == -ERESTARTSYS) { /* interrupted */
+                                dev_err(&dd->pdev->dev,
+                                        "Internal command [%02X] was interrupted after %lu ms\n",
+                                        fis->command, timeout);
+                                rv = -EINTR;
+                                goto exec_ic_exit;
+                        } else if (rv == 0) /* timeout */
+                                dev_err(&dd->pdev->dev,
+                                        "Internal command did not complete [%02X] within timeout of  %lu ms\n",
+                                        fis->command, timeout);
+                        else
+                                dev_err(&dd->pdev->dev,
+                                        "Internal command [%02X] wait returned code [%d] after %lu ms - unhandled\n",
+                                        fis->command, rv, timeout);
+
+                        if (mtip_check_surprise_removal(dd->pdev) ||
                                 test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
-                                                &port->dd->dd_flag)) {
+                                                &dd->dd_flag)) {
+                                dev_err(&dd->pdev->dev,
+                                        "Internal command [%02X] wait returned due to SR\n",
+                                        fis->command);
                                 rv = -ENXIO;
                                 goto exec_ic_exit;
                         }
+                        mtip_device_reset(dd); /* recover from timeout issue */
                         rv = -EAGAIN;
+                        goto exec_ic_exit;
                 }
         } else {
+                u32 hba_stat, port_stat;
+
                 /* Spin for <timeout> checking if command still outstanding */
                 timeout = jiffies + msecs_to_jiffies(timeout);
                 while ((readl(port->cmd_issue[MTIP_TAG_INTERNAL])
                                 & (1 << MTIP_TAG_INTERNAL))
                                 && time_before(jiffies, timeout)) {
-                        if (mtip_check_surprise_removal(port->dd->pdev)) {
+                        if (mtip_check_surprise_removal(dd->pdev)) {
                                 rv = -ENXIO;
                                 goto exec_ic_exit;
                         }
                         if ((fis->command != ATA_CMD_STANDBYNOW1) &&
                                 test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
-                                                &port->dd->dd_flag)) {
+                                                &dd->dd_flag)) {
                                 rv = -ENXIO;
                                 goto exec_ic_exit;
                         }
-                        if (readl(port->mmio + PORT_IRQ_STAT) & PORT_IRQ_ERR) {
-                                atomic_inc(&int_cmd->active); /* error */
-                                break;
+                        port_stat = readl(port->mmio + PORT_IRQ_STAT);
+                        if (!port_stat)
+                                continue;
+
+                        if (port_stat & PORT_IRQ_ERR) {
+                                dev_err(&dd->pdev->dev,
+                                        "Internal command [%02X] failed\n",
+                                        fis->command);
+                                mtip_device_reset(dd);
+                                rv = -EIO;
+                                goto exec_ic_exit;
+                        } else {
+                                writel(port_stat, port->mmio + PORT_IRQ_STAT);
+                                hba_stat = readl(dd->mmio + HOST_IRQ_STAT);
+                                if (hba_stat)
+                                        writel(hba_stat,
+                                                dd->mmio + HOST_IRQ_STAT);
                         }
+                        break;
                 }
         }
 
-        if (atomic_read(&int_cmd->active) > 1) {
-                dev_err(&port->dd->pdev->dev,
-                        "Internal command [%02X] failed\n", fis->command);
-                rv = -EIO;
-        }
         if (readl(port->cmd_issue[MTIP_TAG_INTERNAL])
                         & (1 << MTIP_TAG_INTERNAL)) {
                 rv = -ENXIO;
-                if (!test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
-                                        &port->dd->dd_flag)) {
-                        mtip_restart_port(port);
+                if (!test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag)) {
+                        mtip_device_reset(dd);
                         rv = -EAGAIN;
                 }
         }
@@ -1724,7 +1764,8 @@ static int mtip_get_smart_attr(struct mtip_port *port, unsigned int id,
  *      -EINVAL         Invalid parameters passed in, trim not supported
  *      -EIO            Error submitting trim request to hw
  */
-static int mtip_send_trim(struct driver_data *dd, unsigned int lba, unsigned int len)
+static int mtip_send_trim(struct driver_data *dd, unsigned int lba,
+                                unsigned int len)
 {
         int i, rv = 0;
         u64 tlba, tlen, sect_left;
@@ -1811,45 +1852,6 @@ static bool mtip_hw_get_capacity(struct driver_data *dd, sector_t *sectors)
 }
 
 /*
- * Reset the HBA.
- *
- * Resets the HBA by setting the HBA Reset bit in the Global
- * HBA Control register. After setting the HBA Reset bit the
- * function waits for 1 second before reading the HBA Reset
- * bit to make sure it has cleared. If HBA Reset is not clear
- * an error is returned. Cannot be used in non-blockable
- * context.
- *
- * @dd Pointer to the driver data structure.
- *
- * return value
- *      0  The reset was successful.
- *      -1 The HBA Reset bit did not clear.
- */
-static int mtip_hba_reset(struct driver_data *dd)
-{
-        mtip_deinit_port(dd->port);
-
-        /* Set the reset bit */
-        writel(HOST_RESET, dd->mmio + HOST_CTL);
-
-        /* Flush */
-        readl(dd->mmio + HOST_CTL);
-
-        /* Wait for reset to clear */
-        ssleep(1);
-
-        /* Check the bit has cleared */
-        if (readl(dd->mmio + HOST_CTL) & HOST_RESET) {
-                dev_err(&dd->pdev->dev,
-                        "Reset bit did not clear.\n");
-                return -1;
-        }
-
-        return 0;
-}
-
-/*
  * Display the identify command data.
  *
  * @port Pointer to the port data structure.
@@ -2710,6 +2712,100 @@ static ssize_t mtip_hw_show_status(struct device *dev,
 
 static DEVICE_ATTR(status, S_IRUGO, mtip_hw_show_status, NULL);
 
+/* debugsfs entries */
+
+static ssize_t show_device_status(struct device_driver *drv, char *buf)
+{
+        int size = 0;
+        struct driver_data *dd, *tmp;
+        unsigned long flags;
+        char id_buf[42];
+        u16 status = 0;
+
+        spin_lock_irqsave(&dev_lock, flags);
+        size += sprintf(&buf[size], "Devices Present:\n");
+        list_for_each_entry_safe(dd, tmp, &online_list, online_list) {
+                if (dd->pdev) {
+                        if (dd->port &&
+                            dd->port->identify &&
+                            dd->port->identify_valid) {
+                                strlcpy(id_buf,
+                                        (char *) (dd->port->identify + 10), 21);
+                                status = *(dd->port->identify + 141);
+                        } else {
+                                memset(id_buf, 0, 42);
+                                status = 0;
+                        }
+
+                        if (dd->port &&
+                            test_bit(MTIP_PF_REBUILD_BIT, &dd->port->flags)) {
+                                size += sprintf(&buf[size],
+                                        " device %s %s (ftl rebuild %d %%)\n",
+                                        dev_name(&dd->pdev->dev),
+                                        id_buf,
+                                        status);
+                        } else {
+                                size += sprintf(&buf[size],
+                                        " device %s %s\n",
+                                        dev_name(&dd->pdev->dev),
+                                        id_buf);
+                        }
+                }
+        }
+
+        size += sprintf(&buf[size], "Devices Being Removed:\n");
+        list_for_each_entry_safe(dd, tmp, &removing_list, remove_list) {
+                if (dd->pdev) {
+                        if (dd->port &&
+                            dd->port->identify &&
+                            dd->port->identify_valid) {
+                                strlcpy(id_buf,
+                                        (char *) (dd->port->identify+10), 21);
+                                status = *(dd->port->identify + 141);
+                        } else {
+                                memset(id_buf, 0, 42);
+                                status = 0;
+                        }
+
+                        if (dd->port &&
+                            test_bit(MTIP_PF_REBUILD_BIT, &dd->port->flags)) {
+                                size += sprintf(&buf[size],
+                                        " device %s %s (ftl rebuild %d %%)\n",
+                                        dev_name(&dd->pdev->dev),
+                                        id_buf,
+                                        status);
+                        } else {
+                                size += sprintf(&buf[size],
+                                        " device %s %s\n",
+                                        dev_name(&dd->pdev->dev),
+                                        id_buf);
+                        }
+                }
+        }
+        spin_unlock_irqrestore(&dev_lock, flags);
+
+        return size;
+}
+
+static ssize_t mtip_hw_read_device_status(struct file *f, char __user *ubuf,
+                                                size_t len, loff_t *offset)
+{
+        int size = *offset;
+        char buf[MTIP_DFS_MAX_BUF_SIZE];
+
+        if (!len || *offset)
+                return 0;
+
+        size += show_device_status(NULL, buf);
+
+        *offset = size <= len ? size : len;
+        size = copy_to_user(ubuf, buf, *offset);
+        if (size)
+                return -EFAULT;
+
+        return *offset;
+}
+
 static ssize_t mtip_hw_read_registers(struct file *f, char __user *ubuf,
                                   size_t len, loff_t *offset)
 {
@@ -2804,6 +2900,13 @@ static ssize_t mtip_hw_read_flags(struct file *f, char __user *ubuf,
         return *offset;
 }
 
+static const struct file_operations mtip_device_status_fops = {
+        .owner  = THIS_MODULE,
+        .open   = simple_open,
+        .read   = mtip_hw_read_device_status,
+        .llseek = no_llseek,
+};
+
 static const struct file_operations mtip_regs_fops = {
         .owner  = THIS_MODULE,
         .open   = simple_open,
@@ -4161,6 +4264,7 @@ static int mtip_pci_probe(struct pci_dev *pdev,
         const struct cpumask *node_mask;
         int cpu, i = 0, j = 0;
         int my_node = NUMA_NO_NODE;
+        unsigned long flags;
 
         /* Allocate memory for this devices private data. */
         my_node = pcibus_to_node(pdev->bus);
@@ -4218,12 +4322,16 @@ static int mtip_pci_probe(struct pci_dev *pdev,
         dd->pdev        = pdev;
         dd->numa_node   = my_node;
 
+        INIT_LIST_HEAD(&dd->online_list);
+        INIT_LIST_HEAD(&dd->remove_list);
+
         memset(dd->workq_name, 0, 32);
         snprintf(dd->workq_name, 31, "mtipq%d", dd->instance);
 
         dd->isr_workq = create_workqueue(dd->workq_name);
         if (!dd->isr_workq) {
                 dev_warn(&pdev->dev, "Can't create wq %d\n", dd->instance);
+                rv = -ENOMEM;
                 goto block_initialize_err;
         }
 
@@ -4282,7 +4390,8 @@ static int mtip_pci_probe(struct pci_dev *pdev,
         INIT_WORK(&dd->work[7].work, mtip_workq_sdbf7);
 
         pci_set_master(pdev);
-        if (pci_enable_msi(pdev)) {
+        rv = pci_enable_msi(pdev);
+        if (rv) {
                 dev_warn(&pdev->dev,
                         "Unable to enable MSI interrupt.\n");
                 goto block_initialize_err;
@@ -4303,6 +4412,14 @@ static int mtip_pci_probe(struct pci_dev *pdev,
         instance++;
         if (rv != MTIP_FTL_REBUILD_MAGIC)
                 set_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag);
+        else
+                rv = 0; /* device in rebuild state, return 0 from probe */
+
+        /* Add to online list even if in ftl rebuild */
+        spin_lock_irqsave(&dev_lock, flags);
+        list_add(&dd->online_list, &online_list);
+        spin_unlock_irqrestore(&dev_lock, flags);
+
         goto done;
 
 block_initialize_err:
@@ -4336,9 +4453,15 @@ static void mtip_pci_remove(struct pci_dev *pdev)
 {
         struct driver_data *dd = pci_get_drvdata(pdev);
         int counter = 0;
+        unsigned long flags;
 
         set_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag);
 
+        spin_lock_irqsave(&dev_lock, flags);
+        list_del_init(&dd->online_list);
+        list_add(&dd->remove_list, &removing_list);
+        spin_unlock_irqrestore(&dev_lock, flags);
+
         if (mtip_check_surprise_removal(pdev)) {
                 while (!test_bit(MTIP_DDF_CLEANUP_BIT, &dd->dd_flag)) {
                         counter++;
@@ -4364,6 +4487,10 @@ static void mtip_pci_remove(struct pci_dev *pdev)
 
         pci_disable_msi(pdev);
 
+        spin_lock_irqsave(&dev_lock, flags);
+        list_del_init(&dd->remove_list);
+        spin_unlock_irqrestore(&dev_lock, flags);
+
         kfree(dd);
         pcim_iounmap_regions(pdev, 1 << MTIP_ABAR);
 }
@@ -4511,6 +4638,11 @@ static int __init mtip_init(void)
 
         pr_info(MTIP_DRV_NAME " Version " MTIP_DRV_VERSION "\n");
 
+        spin_lock_init(&dev_lock);
+
+        INIT_LIST_HEAD(&online_list);
+        INIT_LIST_HEAD(&removing_list);
+
         /* Allocate a major block device number to use with this driver. */
         error = register_blkdev(0, MTIP_DRV_NAME);
         if (error <= 0) {
@@ -4520,11 +4652,18 @@ static int __init mtip_init(void)
         }
         mtip_major = error;
 
-        if (!dfs_parent) {
-                dfs_parent = debugfs_create_dir("rssd", NULL);
-                if (IS_ERR_OR_NULL(dfs_parent)) {
-                        pr_warn("Error creating debugfs parent\n");
-                        dfs_parent = NULL;
+        dfs_parent = debugfs_create_dir("rssd", NULL);
+        if (IS_ERR_OR_NULL(dfs_parent)) {
+                pr_warn("Error creating debugfs parent\n");
+                dfs_parent = NULL;
+        }
+        if (dfs_parent) {
+                dfs_device_status = debugfs_create_file("device_status",
+                                        S_IRUGO, dfs_parent, NULL,
+                                        &mtip_device_status_fops);
+                if (IS_ERR_OR_NULL(dfs_device_status)) {
+                        pr_err("Error creating device_status node\n");
+                        dfs_device_status = NULL;
                 }
         }
 
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index 3bffff5f670c..8e8334c9dd0f 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -129,9 +129,9 @@ enum {
         MTIP_PF_EH_ACTIVE_BIT       = 1, /* error handling */
         MTIP_PF_SE_ACTIVE_BIT       = 2, /* secure erase */
         MTIP_PF_DM_ACTIVE_BIT       = 3, /* download microcde */
-        MTIP_PF_PAUSE_IO      = ((1 << MTIP_PF_IC_ACTIVE_BIT) | \
-                                (1 << MTIP_PF_EH_ACTIVE_BIT) | \
-                                (1 << MTIP_PF_SE_ACTIVE_BIT) | \
+        MTIP_PF_PAUSE_IO      = ((1 << MTIP_PF_IC_ACTIVE_BIT) |
+                                (1 << MTIP_PF_EH_ACTIVE_BIT) |
+                                (1 << MTIP_PF_SE_ACTIVE_BIT) |
                                 (1 << MTIP_PF_DM_ACTIVE_BIT)),
 
         MTIP_PF_SVC_THD_ACTIVE_BIT  = 4,
@@ -144,9 +144,9 @@ enum {
         MTIP_DDF_REMOVE_PENDING_BIT = 1,
         MTIP_DDF_OVER_TEMP_BIT      = 2,
         MTIP_DDF_WRITE_PROTECT_BIT  = 3,
-        MTIP_DDF_STOP_IO      = ((1 << MTIP_DDF_REMOVE_PENDING_BIT) | \
-                                (1 << MTIP_DDF_SEC_LOCK_BIT) | \
-                                (1 << MTIP_DDF_OVER_TEMP_BIT) | \
+        MTIP_DDF_STOP_IO      = ((1 << MTIP_DDF_REMOVE_PENDING_BIT) |
+                                (1 << MTIP_DDF_SEC_LOCK_BIT) |
+                                (1 << MTIP_DDF_OVER_TEMP_BIT) |
                                 (1 << MTIP_DDF_WRITE_PROTECT_BIT)),
 
         MTIP_DDF_CLEANUP_BIT        = 5,
@@ -180,7 +180,7 @@ struct mtip_work {
 
 #define MTIP_TRIM_TIMEOUT_MS            240000
 #define MTIP_MAX_TRIM_ENTRIES           8
-#define MTIP_MAX_TRIM_ENTRY_LEN         0xfff8
+#define MTIP_MAX_TRIM_ENTRY_LEN         0xfff8
 
 struct mtip_trim_entry {
         u32 lba;   /* starting lba of region */
@@ -501,6 +501,10 @@ struct driver_data {
         atomic_t irq_workers_active;
 
         int isr_binding;
+
+        struct list_head online_list; /* linkage for online list */
+
+        struct list_head remove_list; /* linkage for removing list */
 };
 
 #endif
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 6c81a4c040b9..f556f8a8b3f9 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -1264,6 +1264,32 @@ static bool obj_request_done_test(struct rbd_obj_request *obj_request)
         return atomic_read(&obj_request->done) != 0;
 }
 
+static void
+rbd_img_obj_request_read_callback(struct rbd_obj_request *obj_request)
+{
+        dout("%s: obj %p img %p result %d %llu/%llu\n", __func__,
+                obj_request, obj_request->img_request, obj_request->result,
+                obj_request->xferred, obj_request->length);
+        /*
+         * ENOENT means a hole in the image.  We zero-fill the
+         * entire length of the request.  A short read also implies
+         * zero-fill to the end of the request.  Either way we
+         * update the xferred count to indicate the whole request
+         * was satisfied.
+         */
+        BUG_ON(obj_request->type != OBJ_REQUEST_BIO);
+        if (obj_request->result == -ENOENT) {
+                zero_bio_chain(obj_request->bio_list, 0);
+                obj_request->result = 0;
+                obj_request->xferred = obj_request->length;
+        } else if (obj_request->xferred < obj_request->length &&
+                        !obj_request->result) {
+                zero_bio_chain(obj_request->bio_list, obj_request->xferred);
+                obj_request->xferred = obj_request->length;
+        }
+        obj_request_done_set(obj_request);
+}
+
 static void rbd_obj_request_complete(struct rbd_obj_request *obj_request)
 {
         dout("%s: obj %p cb %p\n", __func__, obj_request,
@@ -1284,23 +1310,10 @@ static void rbd_osd_read_callback(struct rbd_obj_request *obj_request)
 {
         dout("%s: obj %p result %d %llu/%llu\n", __func__, obj_request,
                 obj_request->result, obj_request->xferred, obj_request->length);
-        /*
-         * ENOENT means a hole in the object.  We zero-fill the
-         * entire length of the request.  A short read also implies
-         * zero-fill to the end of the request.  Either way we
-         * update the xferred count to indicate the whole request
-         * was satisfied.
-         */
-        if (obj_request->result == -ENOENT) {
-                zero_bio_chain(obj_request->bio_list, 0);
-                obj_request->result = 0;
-                obj_request->xferred = obj_request->length;
-        } else if (obj_request->xferred < obj_request->length &&
-                        !obj_request->result) {
-                zero_bio_chain(obj_request->bio_list, obj_request->xferred);
-                obj_request->xferred = obj_request->length;
-        }
-        obj_request_done_set(obj_request);
+        if (obj_request->img_request)
+                rbd_img_obj_request_read_callback(obj_request);
+        else
+                obj_request_done_set(obj_request);
 }
 
 static void rbd_osd_write_callback(struct rbd_obj_request *obj_request)
diff --git a/drivers/block/rsxx/Makefile b/drivers/block/rsxx/Makefile
index f35cd0b71f7b..b1c53c0aa450 100644
--- a/drivers/block/rsxx/Makefile
+++ b/drivers/block/rsxx/Makefile
@@ -1,2 +1,2 @@
 obj-$(CONFIG_BLK_DEV_RSXX) += rsxx.o
-rsxx-y := config.o core.o cregs.o dev.o dma.o
+rsxx-objs := config.o core.o cregs.o dev.o dma.o
diff --git a/drivers/block/rsxx/config.c b/drivers/block/rsxx/config.c
index a295e7e9ee41..10cd530d3e10 100644
--- a/drivers/block/rsxx/config.c
+++ b/drivers/block/rsxx/config.c
@@ -29,15 +29,13 @@
 #include "rsxx_priv.h"
 #include "rsxx_cfg.h"
 
-static void initialize_config(void *config)
+static void initialize_config(struct rsxx_card_cfg *cfg)
 {
-        struct rsxx_card_cfg *cfg = config;
-
         cfg->hdr.version = RSXX_CFG_VERSION;
 
         cfg->data.block_size        = RSXX_HW_BLK_SIZE;
         cfg->data.stripe_size       = RSXX_HW_BLK_SIZE;
-        cfg->data.vendor_id         = RSXX_VENDOR_ID_TMS_IBM;
+        cfg->data.vendor_id         = RSXX_VENDOR_ID_IBM;
         cfg->data.cache_order       = (-1);
         cfg->data.intr_coal.mode    = RSXX_INTR_COAL_DISABLED;
         cfg->data.intr_coal.count   = 0;
@@ -181,7 +179,7 @@ int rsxx_load_config(struct rsxx_cardinfo *card)
         } else {
                 dev_info(CARD_TO_DEV(card),
                         "Initializing card configuration.\n");
-                initialize_config(card);
+                initialize_config(&card->config);
                 st = rsxx_save_config(card);
                 if (st)
                         return st;
diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c
index e5162487686a..5af21f2db29c 100644
--- a/drivers/block/rsxx/core.c
+++ b/drivers/block/rsxx/core.c
@@ -30,6 +30,7 @@
 #include <linux/reboot.h>
 #include <linux/slab.h>
 #include <linux/bitops.h>
+#include <linux/delay.h>
 
 #include <linux/genhd.h>
 #include <linux/idr.h>
@@ -39,8 +40,8 @@
 
 #define NO_LEGACY 0
 
-MODULE_DESCRIPTION("IBM RamSan PCIe Flash SSD Device Driver");
-MODULE_AUTHOR("IBM <support@ramsan.com>");
+MODULE_DESCRIPTION("IBM FlashSystem 70/80 PCIe SSD Device Driver");
+MODULE_AUTHOR("Joshua Morris/Philip Kelleher, IBM");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRIVER_VERSION);
 
@@ -52,6 +53,13 @@ static DEFINE_IDA(rsxx_disk_ida);
 static DEFINE_SPINLOCK(rsxx_ida_lock);
 
 /*----------------- Interrupt Control & Handling -------------------*/
+
+static void rsxx_mask_interrupts(struct rsxx_cardinfo *card)
+{
+        card->isr_mask = 0;
+        card->ier_mask = 0;
+}
+
 static void __enable_intr(unsigned int *mask, unsigned int intr)
 {
         *mask |= intr;
@@ -71,7 +79,8 @@ static void __disable_intr(unsigned int *mask, unsigned int intr)
  */
 void rsxx_enable_ier(struct rsxx_cardinfo *card, unsigned int intr)
 {
-        if (unlikely(card->halt))
+        if (unlikely(card->halt) ||
+            unlikely(card->eeh_state))
                 return;
 
         __enable_intr(&card->ier_mask, intr);
@@ -80,6 +89,9 @@ void rsxx_enable_ier(struct rsxx_cardinfo *card, unsigned int intr)
 
 void rsxx_disable_ier(struct rsxx_cardinfo *card, unsigned int intr)
 {
+        if (unlikely(card->eeh_state))
+                return;
+
         __disable_intr(&card->ier_mask, intr);
         iowrite32(card->ier_mask, card->regmap + IER);
 }
@@ -87,7 +99,8 @@ void rsxx_disable_ier(struct rsxx_cardinfo *card, unsigned int intr)
 void rsxx_enable_ier_and_isr(struct rsxx_cardinfo *card,
                                  unsigned int intr)
 {
-        if (unlikely(card->halt))
+        if (unlikely(card->halt) ||
+            unlikely(card->eeh_state))
                 return;
 
         __enable_intr(&card->isr_mask, intr);
@@ -97,6 +110,9 @@ void rsxx_enable_ier_and_isr(struct rsxx_cardinfo *card,
 void rsxx_disable_ier_and_isr(struct rsxx_cardinfo *card,
                                   unsigned int intr)
 {
+        if (unlikely(card->eeh_state))
+                return;
+
         __disable_intr(&card->isr_mask, intr);
         __disable_intr(&card->ier_mask, intr);
         iowrite32(card->ier_mask, card->regmap + IER);
@@ -115,6 +131,9 @@ static irqreturn_t rsxx_isr(int irq, void *pdata)
         do {
                 reread_isr = 0;
 
+                if (unlikely(card->eeh_state))
+                        break;
+
                 isr = ioread32(card->regmap + ISR);
                 if (isr == 0xffffffff) {
                         /*
@@ -161,9 +180,9 @@ static irqreturn_t rsxx_isr(int irq, void *pdata)
 }
 
 /*----------------- Card Event Handler -------------------*/
-static char *rsxx_card_state_to_str(unsigned int state)
+static const char * const rsxx_card_state_to_str(unsigned int state)
 {
-        static char *state_strings[] = {
+        static const char * const state_strings[] = {
                 "Unknown", "Shutdown", "Starting", "Formatting",
                 "Uninitialized", "Good", "Shutting Down",
                 "Fault", "Read Only Fault", "dStroying"
@@ -304,6 +323,192 @@ static int card_shutdown(struct rsxx_cardinfo *card)
         return 0;
 }
 
+static int rsxx_eeh_frozen(struct pci_dev *dev)
+{
+        struct rsxx_cardinfo *card = pci_get_drvdata(dev);
+        int i;
+        int st;
+
+        dev_warn(&dev->dev, "IBM FlashSystem PCI: preparing for slot reset.\n");
+
+        card->eeh_state = 1;
+        rsxx_mask_interrupts(card);
+
+        /*
+         * We need to guarantee that the write for eeh_state and masking
+         * interrupts does not become reordered. This will prevent a possible
+         * race condition with the EEH code.
+         */
+        wmb();
+
+        pci_disable_device(dev);
+
+        st = rsxx_eeh_save_issued_dmas(card);
+        if (st)
+                return st;
+
+        rsxx_eeh_save_issued_creg(card);
+
+        for (i = 0; i < card->n_targets; i++) {
+                if (card->ctrl[i].status.buf)
+                        pci_free_consistent(card->dev, STATUS_BUFFER_SIZE8,
+                                            card->ctrl[i].status.buf,
+                                            card->ctrl[i].status.dma_addr);
+                if (card->ctrl[i].cmd.buf)
+                        pci_free_consistent(card->dev, COMMAND_BUFFER_SIZE8,
+                                            card->ctrl[i].cmd.buf,
+                                            card->ctrl[i].cmd.dma_addr);
+        }
+
+        return 0;
+}
+
+static void rsxx_eeh_failure(struct pci_dev *dev)
+{
+        struct rsxx_cardinfo *card = pci_get_drvdata(dev);
+        int i;
+
+        dev_err(&dev->dev, "IBM FlashSystem PCI: disabling failed card.\n");
+
+        card->eeh_state = 1;
+
+        for (i = 0; i < card->n_targets; i++)
+                del_timer_sync(&card->ctrl[i].activity_timer);
+
+        rsxx_eeh_cancel_dmas(card);
+}
+
+static int rsxx_eeh_fifo_flush_poll(struct rsxx_cardinfo *card)
+{
+        unsigned int status;
+        int iter = 0;
+
+        /* We need to wait for the hardware to reset */
+        while (iter++ < 10) {
+                status = ioread32(card->regmap + PCI_RECONFIG);
+
+                if (status & RSXX_FLUSH_BUSY) {
+                        ssleep(1);
+                        continue;
+                }
+
+                if (status & RSXX_FLUSH_TIMEOUT)
+                        dev_warn(CARD_TO_DEV(card), "HW: flash controller timeout\n");
+                return 0;
+        }
+
+        /* Hardware failed resetting itself. */
+        return -1;
+}
+
+static pci_ers_result_t rsxx_error_detected(struct pci_dev *dev,
+                                            enum pci_channel_state error)
+{
+        int st;
+
+        if (dev->revision < RSXX_EEH_SUPPORT)
+                return PCI_ERS_RESULT_NONE;
+
+        if (error == pci_channel_io_perm_failure) {
+                rsxx_eeh_failure(dev);
+                return PCI_ERS_RESULT_DISCONNECT;
+        }
+
+        st = rsxx_eeh_frozen(dev);
+        if (st) {
+                dev_err(&dev->dev, "Slot reset setup failed\n");
+                rsxx_eeh_failure(dev);
+                return PCI_ERS_RESULT_DISCONNECT;
+        }
+
+        return PCI_ERS_RESULT_NEED_RESET;
+}
+
+static pci_ers_result_t rsxx_slot_reset(struct pci_dev *dev)
+{
+        struct rsxx_cardinfo *card = pci_get_drvdata(dev);
+        unsigned long flags;
+        int i;
+        int st;
+
+        dev_warn(&dev->dev,
+                "IBM FlashSystem PCI: recovering from slot reset.\n");
+
+        st = pci_enable_device(dev);
+        if (st)
+                goto failed_hw_setup;
+
+        pci_set_master(dev);
+
+        st = rsxx_eeh_fifo_flush_poll(card);
+        if (st)
+                goto failed_hw_setup;
+
+        rsxx_dma_queue_reset(card);
+
+        for (i = 0; i < card->n_targets; i++) {
+                st = rsxx_hw_buffers_init(dev, &card->ctrl[i]);
+                if (st)
+                        goto failed_hw_buffers_init;
+        }
+
+        if (card->config_valid)
+                rsxx_dma_configure(card);
+
+        /* Clears the ISR register from spurious interrupts */
+        st = ioread32(card->regmap + ISR);
+
+        card->eeh_state = 0;
+
+        st = rsxx_eeh_remap_dmas(card);
+        if (st)
+                goto failed_remap_dmas;
+
+        spin_lock_irqsave(&card->irq_lock, flags);
+        if (card->n_targets & RSXX_MAX_TARGETS)
+                rsxx_enable_ier_and_isr(card, CR_INTR_ALL_G);
+        else
+                rsxx_enable_ier_and_isr(card, CR_INTR_ALL_C);
+        spin_unlock_irqrestore(&card->irq_lock, flags);
+
+        rsxx_kick_creg_queue(card);
+
+        for (i = 0; i < card->n_targets; i++) {
+                spin_lock(&card->ctrl[i].queue_lock);
+                if (list_empty(&card->ctrl[i].queue)) {
+                        spin_unlock(&card->ctrl[i].queue_lock);
+                        continue;
+                }
+                spin_unlock(&card->ctrl[i].queue_lock);
+
+                queue_work(card->ctrl[i].issue_wq,
+                                &card->ctrl[i].issue_dma_work);
+        }
+
+        dev_info(&dev->dev, "IBM FlashSystem PCI: recovery complete.\n");
+
+        return PCI_ERS_RESULT_RECOVERED;
+
+failed_hw_buffers_init:
+failed_remap_dmas:
+        for (i = 0; i < card->n_targets; i++) {
+                if (card->ctrl[i].status.buf)
+                        pci_free_consistent(card->dev,
+                                        STATUS_BUFFER_SIZE8,
+                                        card->ctrl[i].status.buf,
+                                        card->ctrl[i].status.dma_addr);
+                if (card->ctrl[i].cmd.buf)
+                        pci_free_consistent(card->dev,
+                                        COMMAND_BUFFER_SIZE8,
+                                        card->ctrl[i].cmd.buf,
+                                        card->ctrl[i].cmd.dma_addr);
+        }
+failed_hw_setup:
+        rsxx_eeh_failure(dev);
+        return PCI_ERS_RESULT_DISCONNECT;
+
+}
+
 /*----------------- Driver Initialization & Setup -------------------*/
 /* Returns:   0 if the driver is compatible with the device
              -1 if the driver is NOT compatible with the device */
@@ -383,6 +588,7 @@ static int rsxx_pci_probe(struct pci_dev *dev,
 
         spin_lock_init(&card->irq_lock);
         card->halt = 0;
+        card->eeh_state = 0;
 
         spin_lock_irq(&card->irq_lock);
         rsxx_disable_ier_and_isr(card, CR_INTR_ALL);
@@ -538,9 +744,6 @@ static void rsxx_pci_remove(struct pci_dev *dev)
         rsxx_disable_ier_and_isr(card, CR_INTR_EVENT);
         spin_unlock_irqrestore(&card->irq_lock, flags);
 
-        /* Prevent work_structs from re-queuing themselves. */
-        card->halt = 1;
-
         cancel_work_sync(&card->event_work);
 
         rsxx_destroy_dev(card);
@@ -549,6 +752,10 @@ static void rsxx_pci_remove(struct pci_dev *dev)
         spin_lock_irqsave(&card->irq_lock, flags);
         rsxx_disable_ier_and_isr(card, CR_INTR_ALL);
         spin_unlock_irqrestore(&card->irq_lock, flags);
+
+        /* Prevent work_structs from re-queuing themselves. */
+        card->halt = 1;
+
         free_irq(dev->irq, card);
 
         if (!force_legacy)
@@ -592,11 +799,14 @@ static void rsxx_pci_shutdown(struct pci_dev *dev)
         card_shutdown(card);
 }
 
+static const struct pci_error_handlers rsxx_err_handler = {
+        .error_detected = rsxx_error_detected,
+        .slot_reset     = rsxx_slot_reset,
+};
+
 static DEFINE_PCI_DEVICE_TABLE(rsxx_pci_ids) = {
-        {PCI_DEVICE(PCI_VENDOR_ID_TMS_IBM, PCI_DEVICE_ID_RS70_FLASH)},
-        {PCI_DEVICE(PCI_VENDOR_ID_TMS_IBM, PCI_DEVICE_ID_RS70D_FLASH)},
-        {PCI_DEVICE(PCI_VENDOR_ID_TMS_IBM, PCI_DEVICE_ID_RS80_FLASH)},
-        {PCI_DEVICE(PCI_VENDOR_ID_TMS_IBM, PCI_DEVICE_ID_RS81_FLASH)},
+        {PCI_DEVICE(PCI_VENDOR_ID_IBM, PCI_DEVICE_ID_FS70_FLASH)},
+        {PCI_DEVICE(PCI_VENDOR_ID_IBM, PCI_DEVICE_ID_FS80_FLASH)},
         {0,},
 };
 
@@ -609,6 +819,7 @@ static struct pci_driver rsxx_pci_driver = {
         .remove         = rsxx_pci_remove,
         .suspend        = rsxx_pci_suspend,
         .shutdown       = rsxx_pci_shutdown,
+        .err_handler    = &rsxx_err_handler,
 };
 
 static int __init rsxx_core_init(void)
diff --git a/drivers/block/rsxx/cregs.c b/drivers/block/rsxx/cregs.c
index 80bbe639fccd..4b5c020a0a65 100644
--- a/drivers/block/rsxx/cregs.c
+++ b/drivers/block/rsxx/cregs.c
@@ -58,7 +58,7 @@ static struct kmem_cache *creg_cmd_pool;
 #error Unknown endianess!!! Aborting...
 #endif
 
-static void copy_to_creg_data(struct rsxx_cardinfo *card,
+static int copy_to_creg_data(struct rsxx_cardinfo *card,
                               int cnt8,
                               void *buf,
                               unsigned int stream)
@@ -66,6 +66,9 @@ static void copy_to_creg_data(struct rsxx_cardinfo *card,
         int i = 0;
         u32 *data = buf;
 
+        if (unlikely(card->eeh_state))
+                return -EIO;
+
         for (i = 0; cnt8 > 0; i++, cnt8 -= 4) {
                 /*
                  * Firmware implementation makes it necessary to byte swap on
@@ -76,10 +79,12 @@ static void copy_to_creg_data(struct rsxx_cardinfo *card,
                 else
                         iowrite32(data[i], card->regmap + CREG_DATA(i));
         }
+
+        return 0;
 }
 
 
-static void copy_from_creg_data(struct rsxx_cardinfo *card,
+static int copy_from_creg_data(struct rsxx_cardinfo *card,
                                 int cnt8,
                                 void *buf,
                                 unsigned int stream)
@@ -87,6 +92,9 @@ static void copy_from_creg_data(struct rsxx_cardinfo *card,
         int i = 0;
         u32 *data = buf;
 
+        if (unlikely(card->eeh_state))
+                return -EIO;
+
         for (i = 0; cnt8 > 0; i++, cnt8 -= 4) {
                 /*
                  * Firmware implementation makes it necessary to byte swap on
@@ -97,41 +105,31 @@ static void copy_from_creg_data(struct rsxx_cardinfo *card,
                 else
                         data[i] = ioread32(card->regmap + CREG_DATA(i));
         }
-}
-
-static struct creg_cmd *pop_active_cmd(struct rsxx_cardinfo *card)
-{
-        struct creg_cmd *cmd;
 
-        /*
-         * Spin lock is needed because this can be called in atomic/interrupt
-         * context.
-         */
-        spin_lock_bh(&card->creg_ctrl.lock);
-        cmd = card->creg_ctrl.active_cmd;
-        card->creg_ctrl.active_cmd = NULL;
-        spin_unlock_bh(&card->creg_ctrl.lock);
-
-        return cmd;
+        return 0;
 }
 
 static void creg_issue_cmd(struct rsxx_cardinfo *card, struct creg_cmd *cmd)
 {
+        int st;
+
+        if (unlikely(card->eeh_state))
+                return;
+
         iowrite32(cmd->addr, card->regmap + CREG_ADD);
         iowrite32(cmd->cnt8, card->regmap + CREG_CNT);
 
         if (cmd->op == CREG_OP_WRITE) {
-                if (cmd->buf)
-                        copy_to_creg_data(card, cmd->cnt8,
-                                          cmd->buf, cmd->stream);
+                if (cmd->buf) {
+                        st = copy_to_creg_data(card, cmd->cnt8,
+                                               cmd->buf, cmd->stream);
+                        if (st)
+                                return;
+                }
         }
 
-        /*
-         * Data copy must complete before initiating the command. This is
-         * needed for weakly ordered processors (i.e. PowerPC), so that all
-         * neccessary registers are written before we kick the hardware.
-         */
-        wmb();
+        if (unlikely(card->eeh_state))
+                return;
 
         /* Setting the valid bit will kick off the command. */
         iowrite32(cmd->op, card->regmap + CREG_CMD);
@@ -196,11 +194,11 @@ static int creg_queue_cmd(struct rsxx_cardinfo *card,
         cmd->cb_private = cb_private;
         cmd->status     = 0;
 
-        spin_lock(&card->creg_ctrl.lock);
+        spin_lock_bh(&card->creg_ctrl.lock);
         list_add_tail(&cmd->list, &card->creg_ctrl.queue);
         card->creg_ctrl.q_depth++;
         creg_kick_queue(card);
-        spin_unlock(&card->creg_ctrl.lock);
+        spin_unlock_bh(&card->creg_ctrl.lock);
 
         return 0;
 }
@@ -210,7 +208,11 @@ static void creg_cmd_timed_out(unsigned long data)
         struct rsxx_cardinfo *card = (struct rsxx_cardinfo *) data;
         struct creg_cmd *cmd;
 
-        cmd = pop_active_cmd(card);
+        spin_lock(&card->creg_ctrl.lock);
+        cmd = card->creg_ctrl.active_cmd;
+        card->creg_ctrl.active_cmd = NULL;
+        spin_unlock(&card->creg_ctrl.lock);
+
         if (cmd == NULL) {
                 card->creg_ctrl.creg_stats.creg_timeout++;
                 dev_warn(CARD_TO_DEV(card),
@@ -247,7 +249,11 @@ static void creg_cmd_done(struct work_struct *work)
         if (del_timer_sync(&card->creg_ctrl.cmd_timer) == 0)
                 card->creg_ctrl.creg_stats.failed_cancel_timer++;
 
-        cmd = pop_active_cmd(card);
+        spin_lock_bh(&card->creg_ctrl.lock);
+        cmd = card->creg_ctrl.active_cmd;
+        card->creg_ctrl.active_cmd = NULL;
+        spin_unlock_bh(&card->creg_ctrl.lock);
+
         if (cmd == NULL) {
                 dev_err(CARD_TO_DEV(card),
                         "Spurious creg interrupt!\n");
@@ -287,7 +293,7 @@ static void creg_cmd_done(struct work_struct *work)
                         goto creg_done;
                 }
 
-                copy_from_creg_data(card, cnt8, cmd->buf, cmd->stream);
+                st = copy_from_creg_data(card, cnt8, cmd->buf, cmd->stream);
         }
 
 creg_done:
@@ -296,10 +302,10 @@ creg_done:
 
         kmem_cache_free(creg_cmd_pool, cmd);
 
-        spin_lock(&card->creg_ctrl.lock);
+        spin_lock_bh(&card->creg_ctrl.lock);
         card->creg_ctrl.active = 0;
         creg_kick_queue(card);
-        spin_unlock(&card->creg_ctrl.lock);
+        spin_unlock_bh(&card->creg_ctrl.lock);
 }
 
 static void creg_reset(struct rsxx_cardinfo *card)
@@ -324,7 +330,7 @@ static void creg_reset(struct rsxx_cardinfo *card)
                 "Resetting creg interface for recovery\n");
 
         /* Cancel outstanding commands */
-        spin_lock(&card->creg_ctrl.lock);
+        spin_lock_bh(&card->creg_ctrl.lock);
         list_for_each_entry_safe(cmd, tmp, &card->creg_ctrl.queue, list) {
                 list_del(&cmd->list);
                 card->creg_ctrl.q_depth--;
@@ -345,7 +351,7 @@ static void creg_reset(struct rsxx_cardinfo *card)
 
                 card->creg_ctrl.active = 0;
         }
-        spin_unlock(&card->creg_ctrl.lock);
+        spin_unlock_bh(&card->creg_ctrl.lock);
 
         card->creg_ctrl.reset = 0;
         spin_lock_irqsave(&card->irq_lock, flags);
@@ -399,12 +405,12 @@ static int __issue_creg_rw(struct rsxx_cardinfo *card,
                 return st;
 
         /*
-         * This timeout is neccessary for unresponsive hardware. The additional
+         * This timeout is necessary for unresponsive hardware. The additional
          * 20 seconds to used to guarantee that each cregs requests has time to
          * complete.
          */
-        timeout = msecs_to_jiffies((CREG_TIMEOUT_MSEC *
-                                card->creg_ctrl.q_depth) + 20000);
+        timeout = msecs_to_jiffies(CREG_TIMEOUT_MSEC *
+                                   card->creg_ctrl.q_depth + 20000);
 
         /*
          * The creg interface is guaranteed to complete. It has a timeout
@@ -690,6 +696,32 @@ int rsxx_reg_access(struct rsxx_cardinfo *card,
         return 0;
 }
 
+void rsxx_eeh_save_issued_creg(struct rsxx_cardinfo *card)
+{
+        struct creg_cmd *cmd = NULL;
+
+        cmd = card->creg_ctrl.active_cmd;
+        card->creg_ctrl.active_cmd = NULL;
+
+        if (cmd) {
+                del_timer_sync(&card->creg_ctrl.cmd_timer);
+
+                spin_lock_bh(&card->creg_ctrl.lock);
+                list_add(&cmd->list, &card->creg_ctrl.queue);
+                card->creg_ctrl.q_depth++;
+                card->creg_ctrl.active = 0;
+                spin_unlock_bh(&card->creg_ctrl.lock);
+        }
+}
+
+void rsxx_kick_creg_queue(struct rsxx_cardinfo *card)
+{
+        spin_lock_bh(&card->creg_ctrl.lock);
+        if (!list_empty(&card->creg_ctrl.queue))
+                creg_kick_queue(card);
+        spin_unlock_bh(&card->creg_ctrl.lock);
+}
+
 /*------------ Initialization & Setup --------------*/
 int rsxx_creg_setup(struct rsxx_cardinfo *card)
 {
@@ -712,7 +744,7 @@ void rsxx_creg_destroy(struct rsxx_cardinfo *card)
         int cnt = 0;
 
         /* Cancel outstanding commands */
-        spin_lock(&card->creg_ctrl.lock);
+        spin_lock_bh(&card->creg_ctrl.lock);
         list_for_each_entry_safe(cmd, tmp, &card->creg_ctrl.queue, list) {
                 list_del(&cmd->list);
                 if (cmd->cb)
@@ -737,7 +769,7 @@ void rsxx_creg_destroy(struct rsxx_cardinfo *card)
                         "Canceled active creg command\n");
                 kmem_cache_free(creg_cmd_pool, cmd);
         }
-        spin_unlock(&card->creg_ctrl.lock);
+        spin_unlock_bh(&card->creg_ctrl.lock);
 
         cancel_work_sync(&card->creg_ctrl.done_work);
 }
diff --git a/drivers/block/rsxx/dma.c b/drivers/block/rsxx/dma.c
index 63176e67662f..0607513cfb41 100644
--- a/drivers/block/rsxx/dma.c
+++ b/drivers/block/rsxx/dma.c
@@ -28,7 +28,7 @@
 struct rsxx_dma {
         struct list_head         list;
         u8                       cmd;
-        unsigned int             laddr;     /* Logical address on the ramsan */
+        unsigned int             laddr;     /* Logical address */
         struct {
                 u32              off;
                 u32              cnt;
@@ -81,9 +81,6 @@ enum rsxx_hw_status {
         HW_STATUS_FAULT         = 0x08,
 };
 
-#define STATUS_BUFFER_SIZE8     4096
-#define COMMAND_BUFFER_SIZE8    4096
-
 static struct kmem_cache *rsxx_dma_pool;
 
 struct dma_tracker {
@@ -122,7 +119,7 @@ static unsigned int rsxx_get_dma_tgt(struct rsxx_cardinfo *card, u64 addr8)
         return tgt;
 }
 
-static void rsxx_dma_queue_reset(struct rsxx_cardinfo *card)
+void rsxx_dma_queue_reset(struct rsxx_cardinfo *card)
 {
         /* Reset all DMA Command/Status Queues */
         iowrite32(DMA_QUEUE_RESET, card->regmap + RESET);
@@ -210,7 +207,8 @@ static void dma_intr_coal_auto_tune(struct rsxx_cardinfo *card)
         u32 q_depth = 0;
         u32 intr_coal;
 
-        if (card->config.data.intr_coal.mode != RSXX_INTR_COAL_AUTO_TUNE)
+        if (card->config.data.intr_coal.mode != RSXX_INTR_COAL_AUTO_TUNE ||
+            unlikely(card->eeh_state))
                 return;
 
         for (i = 0; i < card->n_targets; i++)
@@ -223,31 +221,26 @@ static void dma_intr_coal_auto_tune(struct rsxx_cardinfo *card)
 }
 
 /*----------------- RSXX DMA Handling -------------------*/
-static void rsxx_complete_dma(struct rsxx_cardinfo *card,
+static void rsxx_complete_dma(struct rsxx_dma_ctrl *ctrl,
                                   struct rsxx_dma *dma,
                                   unsigned int status)
 {
         if (status & DMA_SW_ERR)
-                printk_ratelimited(KERN_ERR
-                                   "SW Error in DMA(cmd x%02x, laddr x%08x)\n",
-                                   dma->cmd, dma->laddr);
+                ctrl->stats.dma_sw_err++;
         if (status & DMA_HW_FAULT)
-                printk_ratelimited(KERN_ERR
-                                   "HW Fault in DMA(cmd x%02x, laddr x%08x)\n",
-                                   dma->cmd, dma->laddr);
+                ctrl->stats.dma_hw_fault++;
         if (status & DMA_CANCELLED)
-                printk_ratelimited(KERN_ERR
-                                   "DMA Cancelled(cmd x%02x, laddr x%08x)\n",
-                                   dma->cmd, dma->laddr);
+                ctrl->stats.dma_cancelled++;
 
         if (dma->dma_addr)
-                pci_unmap_page(card->dev, dma->dma_addr, get_dma_size(dma),
+                pci_unmap_page(ctrl->card->dev, dma->dma_addr,
+                               get_dma_size(dma),
                                dma->cmd == HW_CMD_BLK_WRITE ?
                                            PCI_DMA_TODEVICE :
                                            PCI_DMA_FROMDEVICE);
 
         if (dma->cb)
-                dma->cb(card, dma->cb_data, status ? 1 : 0);
+                dma->cb(ctrl->card, dma->cb_data, status ? 1 : 0);
 
         kmem_cache_free(rsxx_dma_pool, dma);
 }
@@ -330,14 +323,15 @@ static void rsxx_handle_dma_error(struct rsxx_dma_ctrl *ctrl,
         if (requeue_cmd)
                 rsxx_requeue_dma(ctrl, dma);
         else
-                rsxx_complete_dma(ctrl->card, dma, status);
+                rsxx_complete_dma(ctrl, dma, status);
 }
 
 static void dma_engine_stalled(unsigned long data)
 {
         struct rsxx_dma_ctrl *ctrl = (struct rsxx_dma_ctrl *)data;
 
-        if (atomic_read(&ctrl->stats.hw_q_depth) == 0)
+        if (atomic_read(&ctrl->stats.hw_q_depth) == 0 ||
+            unlikely(ctrl->card->eeh_state))
                 return;
 
         if (ctrl->cmd.idx != ioread32(ctrl->regmap + SW_CMD_IDX)) {
@@ -369,7 +363,8 @@ static void rsxx_issue_dmas(struct work_struct *work)
         ctrl = container_of(work, struct rsxx_dma_ctrl, issue_dma_work);
         hw_cmd_buf = ctrl->cmd.buf;
 
-        if (unlikely(ctrl->card->halt))
+        if (unlikely(ctrl->card->halt) ||
+            unlikely(ctrl->card->eeh_state))
                 return;
 
         while (1) {
@@ -397,7 +392,7 @@ static void rsxx_issue_dmas(struct work_struct *work)
                  */
                 if (unlikely(ctrl->card->dma_fault)) {
                         push_tracker(ctrl->trackers, tag);
-                        rsxx_complete_dma(ctrl->card, dma, DMA_CANCELLED);
+                        rsxx_complete_dma(ctrl, dma, DMA_CANCELLED);
                         continue;
                 }
 
@@ -432,19 +427,15 @@ static void rsxx_issue_dmas(struct work_struct *work)
 
         /* Let HW know we've queued commands. */
         if (cmds_pending) {
-                /*
-                 * We must guarantee that the CPU writes to 'ctrl->cmd.buf'
-                 * (which is in PCI-consistent system-memory) from the loop
-                 * above make it into the coherency domain before the
-                 * following PIO "trigger" updating the cmd.idx.  A WMB is
-                 * sufficient. We need not explicitly CPU cache-flush since
-                 * the memory is a PCI-consistent (ie; coherent) mapping.
-                 */
-                wmb();
-
                 atomic_add(cmds_pending, &ctrl->stats.hw_q_depth);
                 mod_timer(&ctrl->activity_timer,
                           jiffies + DMA_ACTIVITY_TIMEOUT);
+
+                if (unlikely(ctrl->card->eeh_state)) {
+                        del_timer_sync(&ctrl->activity_timer);
+                        return;
+                }
+
                 iowrite32(ctrl->cmd.idx, ctrl->regmap + SW_CMD_IDX);
         }
 }
@@ -463,7 +454,8 @@ static void rsxx_dma_done(struct work_struct *work)
         hw_st_buf = ctrl->status.buf;
 
         if (unlikely(ctrl->card->halt) ||
-            unlikely(ctrl->card->dma_fault))
+            unlikely(ctrl->card->dma_fault) ||
+            unlikely(ctrl->card->eeh_state))
                 return;
 
         count = le16_to_cpu(hw_st_buf[ctrl->status.idx].count);
@@ -508,7 +500,7 @@ static void rsxx_dma_done(struct work_struct *work)
                 if (status)
                         rsxx_handle_dma_error(ctrl, dma, status);
                 else
-                        rsxx_complete_dma(ctrl->card, dma, 0);
+                        rsxx_complete_dma(ctrl, dma, 0);
 
                 push_tracker(ctrl->trackers, tag);
 
@@ -727,20 +719,54 @@ bvec_err:
 
 
 /*----------------- DMA Engine Initialization & Setup -------------------*/
+int rsxx_hw_buffers_init(struct pci_dev *dev, struct rsxx_dma_ctrl *ctrl)
+{
+        ctrl->status.buf = pci_alloc_consistent(dev, STATUS_BUFFER_SIZE8,
+                                &ctrl->status.dma_addr);
+        ctrl->cmd.buf = pci_alloc_consistent(dev, COMMAND_BUFFER_SIZE8,
+                                &ctrl->cmd.dma_addr);
+        if (ctrl->status.buf == NULL || ctrl->cmd.buf == NULL)
+                return -ENOMEM;
+
+        memset(ctrl->status.buf, 0xac, STATUS_BUFFER_SIZE8);
+        iowrite32(lower_32_bits(ctrl->status.dma_addr),
+                ctrl->regmap + SB_ADD_LO);
+        iowrite32(upper_32_bits(ctrl->status.dma_addr),
+                ctrl->regmap + SB_ADD_HI);
+
+        memset(ctrl->cmd.buf, 0x83, COMMAND_BUFFER_SIZE8);
+        iowrite32(lower_32_bits(ctrl->cmd.dma_addr), ctrl->regmap + CB_ADD_LO);
+        iowrite32(upper_32_bits(ctrl->cmd.dma_addr), ctrl->regmap + CB_ADD_HI);
+
+        ctrl->status.idx = ioread32(ctrl->regmap + HW_STATUS_CNT);
+        if (ctrl->status.idx > RSXX_MAX_OUTSTANDING_CMDS) {
+                dev_crit(&dev->dev, "Failed reading status cnt x%x\n",
+                        ctrl->status.idx);
+                return -EINVAL;
+        }
+        iowrite32(ctrl->status.idx, ctrl->regmap + HW_STATUS_CNT);
+        iowrite32(ctrl->status.idx, ctrl->regmap + SW_STATUS_CNT);
+
+        ctrl->cmd.idx = ioread32(ctrl->regmap + HW_CMD_IDX);
+        if (ctrl->cmd.idx > RSXX_MAX_OUTSTANDING_CMDS) {
+                dev_crit(&dev->dev, "Failed reading cmd cnt x%x\n",
+                        ctrl->status.idx);
+                return -EINVAL;
+        }
+        iowrite32(ctrl->cmd.idx, ctrl->regmap + HW_CMD_IDX);
+        iowrite32(ctrl->cmd.idx, ctrl->regmap + SW_CMD_IDX);
+
+        return 0;
+}
+
 static int rsxx_dma_ctrl_init(struct pci_dev *dev,
                                   struct rsxx_dma_ctrl *ctrl)
 {
         int i;
+        int st;
 
         memset(&ctrl->stats, 0, sizeof(ctrl->stats));
 
-        ctrl->status.buf = pci_alloc_consistent(dev, STATUS_BUFFER_SIZE8,
-                                                &ctrl->status.dma_addr);
-        ctrl->cmd.buf = pci_alloc_consistent(dev, COMMAND_BUFFER_SIZE8,
-                                             &ctrl->cmd.dma_addr);
-        if (ctrl->status.buf == NULL || ctrl->cmd.buf == NULL)
-                return -ENOMEM;
-
         ctrl->trackers = vmalloc(DMA_TRACKER_LIST_SIZE8);
         if (!ctrl->trackers)
                 return -ENOMEM;
@@ -770,35 +796,9 @@ static int rsxx_dma_ctrl_init(struct pci_dev *dev,
         INIT_WORK(&ctrl->issue_dma_work, rsxx_issue_dmas);
         INIT_WORK(&ctrl->dma_done_work, rsxx_dma_done);
 
-        memset(ctrl->status.buf, 0xac, STATUS_BUFFER_SIZE8);
-        iowrite32(lower_32_bits(ctrl->status.dma_addr),
-                  ctrl->regmap + SB_ADD_LO);
-        iowrite32(upper_32_bits(ctrl->status.dma_addr),
-                  ctrl->regmap + SB_ADD_HI);
-
-        memset(ctrl->cmd.buf, 0x83, COMMAND_BUFFER_SIZE8);
-        iowrite32(lower_32_bits(ctrl->cmd.dma_addr), ctrl->regmap + CB_ADD_LO);
-        iowrite32(upper_32_bits(ctrl->cmd.dma_addr), ctrl->regmap + CB_ADD_HI);
-
-        ctrl->status.idx = ioread32(ctrl->regmap + HW_STATUS_CNT);
-        if (ctrl->status.idx > RSXX_MAX_OUTSTANDING_CMDS) {
-                dev_crit(&dev->dev, "Failed reading status cnt x%x\n",
-                         ctrl->status.idx);
-                return -EINVAL;
-        }
-        iowrite32(ctrl->status.idx, ctrl->regmap + HW_STATUS_CNT);
-        iowrite32(ctrl->status.idx, ctrl->regmap + SW_STATUS_CNT);
-
-        ctrl->cmd.idx = ioread32(ctrl->regmap + HW_CMD_IDX);
-        if (ctrl->cmd.idx > RSXX_MAX_OUTSTANDING_CMDS) {
-                dev_crit(&dev->dev, "Failed reading cmd cnt x%x\n",
-                         ctrl->status.idx);
-                return -EINVAL;
-        }
-        iowrite32(ctrl->cmd.idx, ctrl->regmap + HW_CMD_IDX);
-        iowrite32(ctrl->cmd.idx, ctrl->regmap + SW_CMD_IDX);
-
-        wmb();
+        st = rsxx_hw_buffers_init(dev, ctrl);
+        if (st)
+                return st;
 
         return 0;
 }
@@ -834,7 +834,7 @@ static int rsxx_dma_stripe_setup(struct rsxx_cardinfo *card,
         return 0;
 }
 
-static int rsxx_dma_configure(struct rsxx_cardinfo *card)
+int rsxx_dma_configure(struct rsxx_cardinfo *card)
 {
         u32 intr_coal;
 
@@ -980,6 +980,103 @@ void rsxx_dma_destroy(struct rsxx_cardinfo *card)
         }
 }
 
+int rsxx_eeh_save_issued_dmas(struct rsxx_cardinfo *card)
+{
+        int i;
+        int j;
+        int cnt;
+        struct rsxx_dma *dma;
+        struct list_head *issued_dmas;
+
+        issued_dmas = kzalloc(sizeof(*issued_dmas) * card->n_targets,
+                              GFP_KERNEL);
+        if (!issued_dmas)
+                return -ENOMEM;
+
+        for (i = 0; i < card->n_targets; i++) {
+                INIT_LIST_HEAD(&issued_dmas[i]);
+                cnt = 0;
+                for (j = 0; j < RSXX_MAX_OUTSTANDING_CMDS; j++) {
+                        dma = get_tracker_dma(card->ctrl[i].trackers, j);
+                        if (dma == NULL)
+                                continue;
+
+                        if (dma->cmd == HW_CMD_BLK_WRITE)
+                                card->ctrl[i].stats.writes_issued--;
+                        else if (dma->cmd == HW_CMD_BLK_DISCARD)
+                                card->ctrl[i].stats.discards_issued--;
+                        else
+                                card->ctrl[i].stats.reads_issued--;
+
+                        list_add_tail(&dma->list, &issued_dmas[i]);
+                        push_tracker(card->ctrl[i].trackers, j);
+                        cnt++;
+                }
+
+                spin_lock(&card->ctrl[i].queue_lock);
+                list_splice(&issued_dmas[i], &card->ctrl[i].queue);
+
+                atomic_sub(cnt, &card->ctrl[i].stats.hw_q_depth);
+                card->ctrl[i].stats.sw_q_depth += cnt;
+                card->ctrl[i].e_cnt = 0;
+
+                list_for_each_entry(dma, &card->ctrl[i].queue, list) {
+                        if (dma->dma_addr)
+                                pci_unmap_page(card->dev, dma->dma_addr,
+                                               get_dma_size(dma),
+                                               dma->cmd == HW_CMD_BLK_WRITE ?
+                                               PCI_DMA_TODEVICE :
+                                               PCI_DMA_FROMDEVICE);
+                }
+                spin_unlock(&card->ctrl[i].queue_lock);
+        }
+
+        kfree(issued_dmas);
+
+        return 0;
+}
+
+void rsxx_eeh_cancel_dmas(struct rsxx_cardinfo *card)
+{
+        struct rsxx_dma *dma;
+        struct rsxx_dma *tmp;
+        int i;
+
+        for (i = 0; i < card->n_targets; i++) {
+                spin_lock(&card->ctrl[i].queue_lock);
+                list_for_each_entry_safe(dma, tmp, &card->ctrl[i].queue, list) {
+                        list_del(&dma->list);
+
+                        rsxx_complete_dma(&card->ctrl[i], dma, DMA_CANCELLED);
+                }
+                spin_unlock(&card->ctrl[i].queue_lock);
+        }
+}
+
+int rsxx_eeh_remap_dmas(struct rsxx_cardinfo *card)
+{
+        struct rsxx_dma *dma;
+        int i;
+
+        for (i = 0; i < card->n_targets; i++) {
+                spin_lock(&card->ctrl[i].queue_lock);
+                list_for_each_entry(dma, &card->ctrl[i].queue, list) {
+                        dma->dma_addr = pci_map_page(card->dev, dma->page,
+                                        dma->pg_off, get_dma_size(dma),
+                                        dma->cmd == HW_CMD_BLK_WRITE ?
+                                        PCI_DMA_TODEVICE :
+                                        PCI_DMA_FROMDEVICE);
+                        if (!dma->dma_addr) {
+                                spin_unlock(&card->ctrl[i].queue_lock);
+                                kmem_cache_free(rsxx_dma_pool, dma);
+                                return -ENOMEM;
+                        }
+                }
+                spin_unlock(&card->ctrl[i].queue_lock);
+        }
+
+        return 0;
+}
 
 int rsxx_dma_init(void)
 {
diff --git a/drivers/block/rsxx/rsxx.h b/drivers/block/rsxx/rsxx.h
index 2e50b65902b7..24ba3642bd89 100644
--- a/drivers/block/rsxx/rsxx.h
+++ b/drivers/block/rsxx/rsxx.h
@@ -27,15 +27,17 @@
 
 /*----------------- IOCTL Definitions -------------------*/
 
+#define RSXX_MAX_DATA 8
+
 struct rsxx_reg_access {
         __u32 addr;
         __u32 cnt;
         __u32 stat;
         __u32 stream;
-        __u32 data[8];
+        __u32 data[RSXX_MAX_DATA];
 };
 
-#define RSXX_MAX_REG_CNT        (8 * (sizeof(__u32)))
+#define RSXX_MAX_REG_CNT        (RSXX_MAX_DATA * (sizeof(__u32)))
 
 #define RSXX_IOC_MAGIC 'r'
 
diff --git a/drivers/block/rsxx/rsxx_cfg.h b/drivers/block/rsxx/rsxx_cfg.h
index c025fe5fdb70..f384c943846d 100644
--- a/drivers/block/rsxx/rsxx_cfg.h
+++ b/drivers/block/rsxx/rsxx_cfg.h
@@ -58,7 +58,7 @@ struct rsxx_card_cfg {
 };
 
 /* Vendor ID Values */
-#define RSXX_VENDOR_ID_TMS_IBM          0
+#define RSXX_VENDOR_ID_IBM              0
 #define RSXX_VENDOR_ID_DSI              1
 #define RSXX_VENDOR_COUNT               2
 
diff --git a/drivers/block/rsxx/rsxx_priv.h b/drivers/block/rsxx/rsxx_priv.h
index a1ac907d8f4c..382e8bf5c03b 100644
--- a/drivers/block/rsxx/rsxx_priv.h
+++ b/drivers/block/rsxx/rsxx_priv.h
@@ -45,16 +45,13 @@
 
 struct proc_cmd;
 
-#define PCI_VENDOR_ID_TMS_IBM           0x15B6
-#define PCI_DEVICE_ID_RS70_FLASH        0x0019
-#define PCI_DEVICE_ID_RS70D_FLASH       0x001A
-#define PCI_DEVICE_ID_RS80_FLASH        0x001C
-#define PCI_DEVICE_ID_RS81_FLASH        0x001E
+#define PCI_DEVICE_ID_FS70_FLASH        0x04A9
+#define PCI_DEVICE_ID_FS80_FLASH        0x04AA
 
 #define RS70_PCI_REV_SUPPORTED  4
 
 #define DRIVER_NAME "rsxx"
-#define DRIVER_VERSION "3.7"
+#define DRIVER_VERSION "4.0"
 
 /* Block size is 4096 */
 #define RSXX_HW_BLK_SHIFT               12
@@ -67,6 +64,9 @@ struct proc_cmd;
 #define RSXX_MAX_OUTSTANDING_CMDS       255
 #define RSXX_CS_IDX_MASK                0xff
 
+#define STATUS_BUFFER_SIZE8     4096
+#define COMMAND_BUFFER_SIZE8    4096
+
 #define RSXX_MAX_TARGETS        8
 
 struct dma_tracker_list;
@@ -91,6 +91,9 @@ struct rsxx_dma_stats {
         u32 discards_failed;
         u32 done_rescheduled;
         u32 issue_rescheduled;
+        u32 dma_sw_err;
+        u32 dma_hw_fault;
+        u32 dma_cancelled;
         u32 sw_q_depth;         /* Number of DMAs on the SW queue. */
         atomic_t hw_q_depth;    /* Number of DMAs queued to HW. */
 };
@@ -116,6 +119,7 @@ struct rsxx_dma_ctrl {
 struct rsxx_cardinfo {
         struct pci_dev          *dev;
         unsigned int            halt;
+        unsigned int            eeh_state;
 
         void                    __iomem *regmap;
         spinlock_t              irq_lock;
@@ -224,6 +228,7 @@ enum rsxx_pci_regmap {
         PERF_RD512_HI   = 0xac,
         PERF_WR512_LO   = 0xb0,
         PERF_WR512_HI   = 0xb4,
+        PCI_RECONFIG    = 0xb8,
 };
 
 enum rsxx_intr {
@@ -237,6 +242,8 @@ enum rsxx_intr {
         CR_INTR_DMA5    = 0x00000080,
         CR_INTR_DMA6    = 0x00000100,
         CR_INTR_DMA7    = 0x00000200,
+        CR_INTR_ALL_C   = 0x0000003f,
+        CR_INTR_ALL_G   = 0x000003ff,
         CR_INTR_DMA_ALL = 0x000003f5,
         CR_INTR_ALL     = 0xffffffff,
 };
@@ -253,8 +260,14 @@ enum rsxx_pci_reset {
         DMA_QUEUE_RESET         = 0x00000001,
 };
 
+enum rsxx_hw_fifo_flush {
+        RSXX_FLUSH_BUSY         = 0x00000002,
+        RSXX_FLUSH_TIMEOUT      = 0x00000004,
+};
+
 enum rsxx_pci_revision {
         RSXX_DISCARD_SUPPORT = 2,
+        RSXX_EEH_SUPPORT     = 3,
 };
 
 enum rsxx_creg_cmd {
@@ -360,11 +373,17 @@ int rsxx_dma_setup(struct rsxx_cardinfo *card);
 void rsxx_dma_destroy(struct rsxx_cardinfo *card);
 int rsxx_dma_init(void);
 void rsxx_dma_cleanup(void);
+void rsxx_dma_queue_reset(struct rsxx_cardinfo *card);
+int rsxx_dma_configure(struct rsxx_cardinfo *card);
 int rsxx_dma_queue_bio(struct rsxx_cardinfo *card,
                            struct bio *bio,
                            atomic_t *n_dmas,
                            rsxx_dma_cb cb,
                            void *cb_data);
+int rsxx_hw_buffers_init(struct pci_dev *dev, struct rsxx_dma_ctrl *ctrl);
+int rsxx_eeh_save_issued_dmas(struct rsxx_cardinfo *card);
+void rsxx_eeh_cancel_dmas(struct rsxx_cardinfo *card);
+int rsxx_eeh_remap_dmas(struct rsxx_cardinfo *card);
 
 /***** cregs.c *****/
 int rsxx_creg_write(struct rsxx_cardinfo *card, u32 addr,
@@ -389,10 +408,11 @@ int rsxx_creg_setup(struct rsxx_cardinfo *card);
 void rsxx_creg_destroy(struct rsxx_cardinfo *card);
 int rsxx_creg_init(void);
 void rsxx_creg_cleanup(void);
-
 int rsxx_reg_access(struct rsxx_cardinfo *card,
                         struct rsxx_reg_access __user *ucmd,
                         int read);
+void rsxx_eeh_save_issued_creg(struct rsxx_cardinfo *card);
+void rsxx_kick_creg_queue(struct rsxx_cardinfo *card);
 
 
 
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index de1f319f7bd7..dd5b2fed97e9 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -164,7 +164,7 @@ static void make_response(struct xen_blkif *blkif, u64 id,
 
 #define foreach_grant_safe(pos, n, rbtree, node) \
         for ((pos) = container_of(rb_first((rbtree)), typeof(*(pos)), node), \
-             (n) = rb_next(&(pos)->node); \
+             (n) = (&(pos)->node != NULL) ? rb_next(&(pos)->node) : NULL; \
              &(pos)->node != NULL; \
              (pos) = container_of(n, typeof(*(pos)), node), \
              (n) = (&(pos)->node != NULL) ? rb_next(&(pos)->node) : NULL)
@@ -381,8 +381,8 @@ irqreturn_t xen_blkif_be_int(int irq, void *dev_id)
 
 static void print_stats(struct xen_blkif *blkif)
 {
-        pr_info("xen-blkback (%s): oo %3d  |  rd %4d  |  wr %4d  |  f %4d"
-                 "  |  ds %4d\n",
+        pr_info("xen-blkback (%s): oo %3llu  |  rd %4llu  |  wr %4llu  |  f %4llu"
+                 "  |  ds %4llu\n",
                  current->comm, blkif->st_oo_req,
                  blkif->st_rd_req, blkif->st_wr_req,
                  blkif->st_f_req, blkif->st_ds_req);
@@ -442,7 +442,7 @@ int xen_blkif_schedule(void *arg)
 }
 
 struct seg_buf {
-        unsigned long buf;
+        unsigned int offset;
         unsigned int nsec;
 };
 /*
@@ -621,30 +621,21 @@ static int xen_blkbk_map(struct blkif_request *req,
                                  * If this is a new persistent grant
                                  * save the handler
                                  */
-                                persistent_gnts[i]->handle = map[j].handle;
-                                persistent_gnts[i]->dev_bus_addr =
-                                        map[j++].dev_bus_addr;
+                                persistent_gnts[i]->handle = map[j++].handle;
                         }
                         pending_handle(pending_req, i) =
                                 persistent_gnts[i]->handle;
 
                         if (ret)
                                 continue;
-
-                        seg[i].buf = persistent_gnts[i]->dev_bus_addr |
-                                (req->u.rw.seg[i].first_sect << 9);
                 } else {
-                        pending_handle(pending_req, i) = map[j].handle;
+                        pending_handle(pending_req, i) = map[j++].handle;
                         bitmap_set(pending_req->unmap_seg, i, 1);
 
-                        if (ret) {
-                                j++;
+                        if (ret)
                                 continue;
-                        }
-
-                        seg[i].buf = map[j++].dev_bus_addr |
-                                (req->u.rw.seg[i].first_sect << 9);
                 }
+                seg[i].offset = (req->u.rw.seg[i].first_sect << 9);
         }
         return ret;
 }
@@ -679,6 +670,16 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
         return err;
 }
 
+static int dispatch_other_io(struct xen_blkif *blkif,
+                             struct blkif_request *req,
+                             struct pending_req *pending_req)
+{
+        free_req(pending_req);
+        make_response(blkif, req->u.other.id, req->operation,
+                      BLKIF_RSP_EOPNOTSUPP);
+        return -EIO;
+}
+
 static void xen_blk_drain_io(struct xen_blkif *blkif)
 {
         atomic_set(&blkif->drain, 1);
@@ -800,17 +801,30 @@ __do_block_io_op(struct xen_blkif *blkif)
 
                 /* Apply all sanity checks to /private copy/ of request. */
                 barrier();
-                if (unlikely(req.operation == BLKIF_OP_DISCARD)) {
+
+                switch (req.operation) {
+                case BLKIF_OP_READ:
+                case BLKIF_OP_WRITE:
+                case BLKIF_OP_WRITE_BARRIER:
+                case BLKIF_OP_FLUSH_DISKCACHE:
+                        if (dispatch_rw_block_io(blkif, &req, pending_req))
+                                goto done;
+                        break;
+                case BLKIF_OP_DISCARD:
                         free_req(pending_req);
                         if (dispatch_discard_io(blkif, &req))
-                                break;
-                } else if (dispatch_rw_block_io(blkif, &req, pending_req))
+                                goto done;
                         break;
+                default:
+                        if (dispatch_other_io(blkif, &req, pending_req))
+                                goto done;
+                        break;
+                }
 
                 /* Yield point for this unbounded loop. */
                 cond_resched();
         }
-
+done:
         return more_to_do;
 }
 
@@ -904,7 +918,8 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
                 pr_debug(DRV_PFX "access denied: %s of [%llu,%llu] on dev=%04x\n",
                          operation == READ ? "read" : "write",
                          preq.sector_number,
-                         preq.sector_number + preq.nr_sects, preq.dev);
+                         preq.sector_number + preq.nr_sects,
+                         blkif->vbd.pdevice);
                 goto fail_response;
         }
 
@@ -947,7 +962,7 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
                        (bio_add_page(bio,
                                      pages[i],
                                      seg[i].nsec << 9,
-                                     seg[i].buf & ~PAGE_MASK) == 0)) {
+                                     seg[i].offset) == 0)) {
 
                         bio = bio_alloc(GFP_KERNEL, nseg-i);
                         if (unlikely(bio == NULL))
@@ -977,13 +992,7 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
                 bio->bi_end_io  = end_block_io_op;
         }
 
-        /*
-         * We set it one so that the last submit_bio does not have to call
-         * atomic_inc.
-         */
         atomic_set(&pending_req->pendcnt, nbio);
-
-        /* Get a reference count for the disk queue and start sending I/O */
         blk_start_plug(&plug);
 
         for (i = 0; i < nbio; i++)
@@ -1011,6 +1020,7 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
  fail_put_bio:
         for (i = 0; i < nbio; i++)
                 bio_put(biolist[i]);
+        atomic_set(&pending_req->pendcnt, 1);
         __end_block_io_op(pending_req, -EINVAL);
         msleep(1); /* back off a bit */
         return -EIO;
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index 6072390c7f57..60103e2517ba 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -77,11 +77,18 @@ struct blkif_x86_32_request_discard {
         uint64_t       nr_sectors;
 } __attribute__((__packed__));
 
+struct blkif_x86_32_request_other {
+        uint8_t        _pad1;
+        blkif_vdev_t   _pad2;
+        uint64_t       id;           /* private guest value, echoed in resp  */
+} __attribute__((__packed__));
+
 struct blkif_x86_32_request {
         uint8_t        operation;    /* BLKIF_OP_???                         */
         union {
                 struct blkif_x86_32_request_rw rw;
                 struct blkif_x86_32_request_discard discard;
+                struct blkif_x86_32_request_other other;
         } u;
 } __attribute__((__packed__));
 
@@ -113,11 +120,19 @@ struct blkif_x86_64_request_discard {
         uint64_t       nr_sectors;
 } __attribute__((__packed__));
 
+struct blkif_x86_64_request_other {
+        uint8_t        _pad1;
+        blkif_vdev_t   _pad2;
+        uint32_t       _pad3;        /* offsetof(blkif_..,u.discard.id)==8   */
+        uint64_t       id;           /* private guest value, echoed in resp  */
+} __attribute__((__packed__));
+
 struct blkif_x86_64_request {
         uint8_t        operation;    /* BLKIF_OP_???                         */
         union {
                 struct blkif_x86_64_request_rw rw;
                 struct blkif_x86_64_request_discard discard;
+                struct blkif_x86_64_request_other other;
         } u;
 } __attribute__((__packed__));
 
@@ -172,7 +187,6 @@ struct persistent_gnt {
         struct page *page;
         grant_ref_t gnt;
         grant_handle_t handle;
-        uint64_t dev_bus_addr;
         struct rb_node node;
 };
 
@@ -208,13 +222,13 @@ struct xen_blkif {
 
         /* statistics */
         unsigned long           st_print;
-        int                     st_rd_req;
-        int                     st_wr_req;
-        int                     st_oo_req;
-        int                     st_f_req;
-        int                     st_ds_req;
-        int                     st_rd_sect;
-        int                     st_wr_sect;
+        unsigned long long                      st_rd_req;
+        unsigned long long                      st_wr_req;
+        unsigned long long                      st_oo_req;
+        unsigned long long                      st_f_req;
+        unsigned long long                      st_ds_req;
+        unsigned long long                      st_rd_sect;
+        unsigned long long                      st_wr_sect;
 
         wait_queue_head_t       waiting_to_free;
 };
@@ -278,6 +292,11 @@ static inline void blkif_get_x86_32_req(struct blkif_request *dst,
                 dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
                 break;
         default:
+                /*
+                 * Don't know how to translate this op. Only get the
+                 * ID so failure can be reported to the frontend.
+                 */
+                dst->u.other.id = src->u.other.id;
                 break;
         }
 }
@@ -309,6 +328,11 @@ static inline void blkif_get_x86_64_req(struct blkif_request *dst,
                 dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
                 break;
         default:
+                /*
+                 * Don't know how to translate this op. Only get the
+                 * ID so failure can be reported to the frontend.
+                 */
+                dst->u.other.id = src->u.other.id;
                 break;
         }
 }
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 5e237f630c47..8bfd1bcf95ec 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -230,13 +230,13 @@ int __init xen_blkif_interface_init(void)
         }                                                               \
         static DEVICE_ATTR(name, S_IRUGO, show_##name, NULL)
 
-VBD_SHOW(oo_req,  "%d\n", be->blkif->st_oo_req);
-VBD_SHOW(rd_req,  "%d\n", be->blkif->st_rd_req);
-VBD_SHOW(wr_req,  "%d\n", be->blkif->st_wr_req);
-VBD_SHOW(f_req,  "%d\n", be->blkif->st_f_req);
-VBD_SHOW(ds_req,  "%d\n", be->blkif->st_ds_req);
-VBD_SHOW(rd_sect, "%d\n", be->blkif->st_rd_sect);
-VBD_SHOW(wr_sect, "%d\n", be->blkif->st_wr_sect);
+VBD_SHOW(oo_req,  "%llu\n", be->blkif->st_oo_req);
+VBD_SHOW(rd_req,  "%llu\n", be->blkif->st_rd_req);
+VBD_SHOW(wr_req,  "%llu\n", be->blkif->st_wr_req);
+VBD_SHOW(f_req,  "%llu\n", be->blkif->st_f_req);
+VBD_SHOW(ds_req,  "%llu\n", be->blkif->st_ds_req);
+VBD_SHOW(rd_sect, "%llu\n", be->blkif->st_rd_sect);
+VBD_SHOW(wr_sect, "%llu\n", be->blkif->st_wr_sect);
 
 static struct attribute *xen_vbdstat_attrs[] = {
         &dev_attr_oo_req.attr,
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index c3dae2e0f290..a894f88762d8 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -44,7 +44,7 @@
 #include <linux/mutex.h>
 #include <linux/scatterlist.h>
 #include <linux/bitmap.h>
-#include <linux/llist.h>
+#include <linux/list.h>
 
 #include <xen/xen.h>
 #include <xen/xenbus.h>
@@ -68,13 +68,12 @@ enum blkif_state {
 struct grant {
         grant_ref_t gref;
         unsigned long pfn;
-        struct llist_node node;
+        struct list_head node;
 };
 
 struct blk_shadow {
         struct blkif_request req;
         struct request *request;
-        unsigned long frame[BLKIF_MAX_SEGMENTS_PER_REQUEST];
         struct grant *grants_used[BLKIF_MAX_SEGMENTS_PER_REQUEST];
 };
 
@@ -105,7 +104,7 @@ struct blkfront_info
         struct work_struct work;
         struct gnttab_free_callback callback;
         struct blk_shadow shadow[BLK_RING_SIZE];
-        struct llist_head persistent_gnts;
+        struct list_head persistent_gnts;
         unsigned int persistent_gnts_c;
         unsigned long shadow_free;
         unsigned int feature_flush;
@@ -165,6 +164,69 @@ static int add_id_to_freelist(struct blkfront_info *info,
         return 0;
 }
 
+static int fill_grant_buffer(struct blkfront_info *info, int num)
+{
+        struct page *granted_page;
+        struct grant *gnt_list_entry, *n;
+        int i = 0;
+
+        while(i < num) {
+                gnt_list_entry = kzalloc(sizeof(struct grant), GFP_NOIO);
+                if (!gnt_list_entry)
+                        goto out_of_memory;
+
+                granted_page = alloc_page(GFP_NOIO);
+                if (!granted_page) {
+                        kfree(gnt_list_entry);
+                        goto out_of_memory;
+                }
+
+                gnt_list_entry->pfn = page_to_pfn(granted_page);
+                gnt_list_entry->gref = GRANT_INVALID_REF;
+                list_add(&gnt_list_entry->node, &info->persistent_gnts);
+                i++;
+        }
+
+        return 0;
+
+out_of_memory:
+        list_for_each_entry_safe(gnt_list_entry, n,
+                                 &info->persistent_gnts, node) {
+                list_del(&gnt_list_entry->node);
+                __free_page(pfn_to_page(gnt_list_entry->pfn));
+                kfree(gnt_list_entry);
+                i--;
+        }
+        BUG_ON(i != 0);
+        return -ENOMEM;
+}
+
+static struct grant *get_grant(grant_ref_t *gref_head,
+                               struct blkfront_info *info)
+{
+        struct grant *gnt_list_entry;
+        unsigned long buffer_mfn;
+
+        BUG_ON(list_empty(&info->persistent_gnts));
+        gnt_list_entry = list_first_entry(&info->persistent_gnts, struct grant,
+                                          node);
+        list_del(&gnt_list_entry->node);
+
+        if (gnt_list_entry->gref != GRANT_INVALID_REF) {
+                info->persistent_gnts_c--;
+                return gnt_list_entry;
+        }
+
+        /* Assign a gref to this page */
+        gnt_list_entry->gref = gnttab_claim_grant_reference(gref_head);
+        BUG_ON(gnt_list_entry->gref == -ENOSPC);
+        buffer_mfn = pfn_to_mfn(gnt_list_entry->pfn);
+        gnttab_grant_foreign_access_ref(gnt_list_entry->gref,
+                                        info->xbdev->otherend_id,
+                                        buffer_mfn, 0);
+        return gnt_list_entry;
+}
+
 static const char *op_name(int op)
 {
         static const char *const names[] = {
@@ -293,7 +355,6 @@ static int blkif_ioctl(struct block_device *bdev, fmode_t mode,
 static int blkif_queue_request(struct request *req)
 {
         struct blkfront_info *info = req->rq_disk->private_data;
-        unsigned long buffer_mfn;
         struct blkif_request *ring_req;
         unsigned long id;
         unsigned int fsect, lsect;
@@ -306,7 +367,6 @@ static int blkif_queue_request(struct request *req)
          */
         bool new_persistent_gnts;
         grant_ref_t gref_head;
-        struct page *granted_page;
         struct grant *gnt_list_entry = NULL;
         struct scatterlist *sg;
 
@@ -370,41 +430,8 @@ static int blkif_queue_request(struct request *req)
                         fsect = sg->offset >> 9;
                         lsect = fsect + (sg->length >> 9) - 1;
 
-                        if (info->persistent_gnts_c) {
-                                BUG_ON(llist_empty(&info->persistent_gnts));
-                                gnt_list_entry = llist_entry(
-                                        llist_del_first(&info->persistent_gnts),
-                                        struct grant, node);
-
-                                ref = gnt_list_entry->gref;
-                                buffer_mfn = pfn_to_mfn(gnt_list_entry->pfn);
-                                info->persistent_gnts_c--;
-                        } else {
-                                ref = gnttab_claim_grant_reference(&gref_head);
-                                BUG_ON(ref == -ENOSPC);
-
-                                gnt_list_entry =
-                                        kmalloc(sizeof(struct grant),
-                                                         GFP_ATOMIC);
-                                if (!gnt_list_entry)
-                                        return -ENOMEM;
-
-                                granted_page = alloc_page(GFP_ATOMIC);
-                                if (!granted_page) {
-                                        kfree(gnt_list_entry);
-                                        return -ENOMEM;
-                                }
-
-                                gnt_list_entry->pfn =
-                                        page_to_pfn(granted_page);
-                                gnt_list_entry->gref = ref;
-
-                                buffer_mfn = pfn_to_mfn(page_to_pfn(
-                                                                granted_page));
-                                gnttab_grant_foreign_access_ref(ref,
-                                        info->xbdev->otherend_id,
-                                        buffer_mfn, 0);
-                        }
+                        gnt_list_entry = get_grant(&gref_head, info);
+                        ref = gnt_list_entry->gref;
 
                         info->shadow[id].grants_used[i] = gnt_list_entry;
 
@@ -435,7 +462,6 @@ static int blkif_queue_request(struct request *req)
                                 kunmap_atomic(shared_data);
                         }
 
-                        info->shadow[id].frame[i] = mfn_to_pfn(buffer_mfn);
                         ring_req->u.rw.seg[i] =
                                         (struct blkif_request_segment) {
                                                 .gref       = ref,
@@ -790,9 +816,8 @@ static void blkif_restart_queue(struct work_struct *work)
 
 static void blkif_free(struct blkfront_info *info, int suspend)
 {
-        struct llist_node *all_gnts;
-        struct grant *persistent_gnt, *tmp;
-        struct llist_node *n;
+        struct grant *persistent_gnt;
+        struct grant *n;
 
         /* Prevent new requests being issued until we fix things up. */
         spin_lock_irq(&info->io_lock);
@@ -803,22 +828,20 @@ static void blkif_free(struct blkfront_info *info, int suspend)
                 blk_stop_queue(info->rq);
 
         /* Remove all persistent grants */
-        if (info->persistent_gnts_c) {
-                all_gnts = llist_del_all(&info->persistent_gnts);
-                persistent_gnt = llist_entry(all_gnts, typeof(*(persistent_gnt)), node);
-                while (persistent_gnt) {
-                        gnttab_end_foreign_access(persistent_gnt->gref, 0, 0UL);
+        if (!list_empty(&info->persistent_gnts)) {
+                list_for_each_entry_safe(persistent_gnt, n,
+                                         &info->persistent_gnts, node) {
+                        list_del(&persistent_gnt->node);
+                        if (persistent_gnt->gref != GRANT_INVALID_REF) {
+                                gnttab_end_foreign_access(persistent_gnt->gref,
+                                                          0, 0UL);
+                                info->persistent_gnts_c--;
+                        }
                         __free_page(pfn_to_page(persistent_gnt->pfn));
-                        tmp = persistent_gnt;
-                        n = persistent_gnt->node.next;
-                        if (n)
-                                persistent_gnt = llist_entry(n, typeof(*(persistent_gnt)), node);
-                        else
-                                persistent_gnt = NULL;
-                        kfree(tmp);
+                        kfree(persistent_gnt);
                 }
-                info->persistent_gnts_c = 0;
         }
+        BUG_ON(info->persistent_gnts_c != 0);
 
         /* No more gnttab callback work. */
         gnttab_cancel_free_callback(&info->callback);
@@ -875,7 +898,7 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
         }
         /* Add the persistent grant into the list of free grants */
         for (i = 0; i < s->req.u.rw.nr_segments; i++) {
-                llist_add(&s->grants_used[i]->node, &info->persistent_gnts);
+                list_add(&s->grants_used[i]->node, &info->persistent_gnts);
                 info->persistent_gnts_c++;
         }
 }
@@ -1013,6 +1036,12 @@ static int setup_blkring(struct xenbus_device *dev,
 
         sg_init_table(info->sg, BLKIF_MAX_SEGMENTS_PER_REQUEST);
 
+        /* Allocate memory for grants */
+        err = fill_grant_buffer(info, BLK_RING_SIZE *
+                                      BLKIF_MAX_SEGMENTS_PER_REQUEST);
+        if (err)
+                goto fail;
+
         err = xenbus_grant_ring(dev, virt_to_mfn(info->ring.sring));
         if (err < 0) {
                 free_page((unsigned long)sring);
@@ -1171,7 +1200,7 @@ static int blkfront_probe(struct xenbus_device *dev,
         spin_lock_init(&info->io_lock);
         info->xbdev = dev;
         info->vdevice = vdevice;
-        init_llist_head(&info->persistent_gnts);
+        INIT_LIST_HEAD(&info->persistent_gnts);
         info->persistent_gnts_c = 0;
         info->connected = BLKIF_STATE_DISCONNECTED;
         INIT_WORK(&info->work, blkif_restart_queue);
@@ -1203,11 +1232,10 @@ static int blkif_recover(struct blkfront_info *info)
         int j;
 
         /* Stage 1: Make a safe copy of the shadow state. */
-        copy = kmalloc(sizeof(info->shadow),
+        copy = kmemdup(info->shadow, sizeof(info->shadow),
                        GFP_NOIO | __GFP_REPEAT | __GFP_HIGH);
         if (!copy)
                 return -ENOMEM;
-        memcpy(copy, info->shadow, sizeof(info->shadow));
 
         /* Stage 2: Set up free list. */
         memset(&info->shadow, 0, sizeof(info->shadow));
@@ -1236,7 +1264,7 @@ static int blkif_recover(struct blkfront_info *info)
                                 gnttab_grant_foreign_access_ref(
                                         req->u.rw.seg[j].gref,
                                         info->xbdev->otherend_id,
-                                        pfn_to_mfn(info->shadow[req->u.rw.id].frame[j]),
+                                        pfn_to_mfn(copy[i].grants_used[j]->pfn),
                                         0);
                 }
                 info->shadow[req->u.rw.id].req = *req;
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index b282af181b44..6aab00ef4379 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -73,9 +73,11 @@ static struct usb_device_id ath3k_table[] = {
         { USB_DEVICE(0x03F0, 0x311D) },
 
         /* Atheros AR3012 with sflash firmware*/
+        { USB_DEVICE(0x0CF3, 0x0036) },
         { USB_DEVICE(0x0CF3, 0x3004) },
         { USB_DEVICE(0x0CF3, 0x3008) },
         { USB_DEVICE(0x0CF3, 0x311D) },
+        { USB_DEVICE(0x0CF3, 0x817a) },
         { USB_DEVICE(0x13d3, 0x3375) },
         { USB_DEVICE(0x04CA, 0x3004) },
         { USB_DEVICE(0x04CA, 0x3005) },
@@ -107,9 +109,11 @@ MODULE_DEVICE_TABLE(usb, ath3k_table);
 static struct usb_device_id ath3k_blist_tbl[] = {
 
         /* Atheros AR3012 with sflash firmware*/
+        { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index e547851870e7..2cc5f774a29c 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -131,9 +131,11 @@ static struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
 
         /* Atheros 3012 with sflash firmware */
+        { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 69ae5972713c..a0f7724852eb 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -380,6 +380,15 @@ void hwrng_unregister(struct hwrng *rng)
 }
 EXPORT_SYMBOL_GPL(hwrng_unregister);
 
+static void __exit hwrng_exit(void)
+{
+        mutex_lock(&rng_mutex);
+        BUG_ON(current_rng);
+        kfree(rng_buffer);
+        mutex_unlock(&rng_mutex);
+}
+
+module_exit(hwrng_exit);
 
 MODULE_DESCRIPTION("H/W Random Number Generator (RNG) driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index e905d5f53051..ce5f3fc25d6d 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -149,7 +149,8 @@ struct ports_device {
         spinlock_t ports_lock;
 
         /* To protect the vq operations for the control channel */
-        spinlock_t cvq_lock;
+        spinlock_t c_ivq_lock;
+        spinlock_t c_ovq_lock;
 
         /* The current config space is stored here */
         struct virtio_console_config config;
@@ -569,11 +570,14 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id,
         vq = portdev->c_ovq;
 
         sg_init_one(sg, &cpkt, sizeof(cpkt));
+
+        spin_lock(&portdev->c_ovq_lock);
         if (virtqueue_add_buf(vq, sg, 1, 0, &cpkt, GFP_ATOMIC) == 0) {
                 virtqueue_kick(vq);
                 while (!virtqueue_get_buf(vq, &len))
                         cpu_relax();
         }
+        spin_unlock(&portdev->c_ovq_lock);
         return 0;
 }
 
@@ -1436,7 +1440,7 @@ static int add_port(struct ports_device *portdev, u32 id)
                  * rproc_serial does not want the console port, only
                  * the generic port implementation.
                  */
-                port->host_connected = port->guest_connected = true;
+                port->host_connected = true;
         else if (!use_multiport(port->portdev)) {
                 /*
                  * If we're not using multiport support,
@@ -1709,23 +1713,23 @@ static void control_work_handler(struct work_struct *work)
         portdev = container_of(work, struct ports_device, control_work);
         vq = portdev->c_ivq;
 
-        spin_lock(&portdev->cvq_lock);
+        spin_lock(&portdev->c_ivq_lock);
         while ((buf = virtqueue_get_buf(vq, &len))) {
-                spin_unlock(&portdev->cvq_lock);
+                spin_unlock(&portdev->c_ivq_lock);
 
                 buf->len = len;
                 buf->offset = 0;
 
                 handle_control_message(portdev, buf);
 
-                spin_lock(&portdev->cvq_lock);
+                spin_lock(&portdev->c_ivq_lock);
                 if (add_inbuf(portdev->c_ivq, buf) < 0) {
                         dev_warn(&portdev->vdev->dev,
                                  "Error adding buffer to queue\n");
                         free_buf(buf, false);
                 }
         }
-        spin_unlock(&portdev->cvq_lock);
+        spin_unlock(&portdev->c_ivq_lock);
 }
 
 static void out_intr(struct virtqueue *vq)
@@ -1752,13 +1756,23 @@ static void in_intr(struct virtqueue *vq)
         port->inbuf = get_inbuf(port);
 
         /*
-         * Don't queue up data when port is closed.  This condition
+         * Normally the port should not accept data when the port is
+         * closed. For generic serial ports, the host won't (shouldn't)
+         * send data till the guest is connected. But this condition
          * can be reached when a console port is not yet connected (no
-         * tty is spawned) and the host sends out data to console
-         * ports.  For generic serial ports, the host won't
-         * (shouldn't) send data till the guest is connected.
+         * tty is spawned) and the other side sends out data over the
+         * vring, or when a remote devices start sending data before
+         * the ports are opened.
+         *
+         * A generic serial port will discard data if not connected,
+         * while console ports and rproc-serial ports accepts data at
+         * any time. rproc-serial is initiated with guest_connected to
+         * false because port_fops_open expects this. Console ports are
+         * hooked up with an HVC console and is initialized with
+         * guest_connected to true.
          */
-        if (!port->guest_connected)
+
+        if (!port->guest_connected && !is_rproc_serial(port->portdev->vdev))
                 discard_port_data(port);
 
         spin_unlock_irqrestore(&port->inbuf_lock, flags);
@@ -1986,10 +2000,12 @@ static int virtcons_probe(struct virtio_device *vdev)
         if (multiport) {
                 unsigned int nr_added_bufs;
 
-                spin_lock_init(&portdev->cvq_lock);
+                spin_lock_init(&portdev->c_ivq_lock);
+                spin_lock_init(&portdev->c_ovq_lock);
                 INIT_WORK(&portdev->control_work, &control_work_handler);
 
-                nr_added_bufs = fill_queue(portdev->c_ivq, &portdev->cvq_lock);
+                nr_added_bufs = fill_queue(portdev->c_ivq,
+                                           &portdev->c_ivq_lock);
                 if (!nr_added_bufs) {
                         dev_err(&vdev->dev,
                                 "Error allocating buffers for control queue\n");
@@ -2140,7 +2156,7 @@ static int virtcons_restore(struct virtio_device *vdev)
                 return ret;
 
         if (use_multiport(portdev))
-                fill_queue(portdev->c_ivq, &portdev->cvq_lock);
+                fill_queue(portdev->c_ivq, &portdev->c_ivq_lock);
 
         list_for_each_entry(port, &portdev->ports, list) {
                 port->in_vq = portdev->in_vqs[port->id];
diff --git a/drivers/clk/tegra/clk-tegra20.c b/drivers/clk/tegra/clk-tegra20.c
index 1e2de7305362..f873dcefe0de 100644
--- a/drivers/clk/tegra/clk-tegra20.c
+++ b/drivers/clk/tegra/clk-tegra20.c
@@ -703,7 +703,7 @@ static void tegra20_pll_init(void)
         clks[pll_a_out0] = clk;
 
         /* PLLE */
-        clk = tegra_clk_register_plle("pll_e", "pll_ref", clk_base, NULL,
+        clk = tegra_clk_register_plle("pll_e", "pll_ref", clk_base, pmc_base,
                              0, 100000000, &pll_e_params,
                              0, pll_e_freq_table, NULL);
         clk_register_clkdev(clk, "pll_e", NULL);
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index 937bc286591f..57a8774f0b4e 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -730,7 +730,6 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
             policy->shared_type == CPUFREQ_SHARED_TYPE_ANY) {
                 cpumask_copy(policy->cpus, perf->shared_cpu_map);
         }
-        cpumask_copy(policy->related_cpus, perf->shared_cpu_map);
 
 #ifdef CONFIG_SMP
         dmi_check_system(sw_any_bug_dmi_table);
@@ -742,7 +741,6 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
         if (check_amd_hwpstate_cpu(cpu) && !acpi_pstate_strict) {
                 cpumask_clear(policy->cpus);
                 cpumask_set_cpu(cpu, policy->cpus);
-                cpumask_copy(policy->related_cpus, cpu_sibling_mask(cpu));
                 policy->shared_type = CPUFREQ_SHARED_TYPE_HW;
                 pr_info_once(PFX "overriding BIOS provided _PSD data\n");
         }
diff --git a/drivers/cpufreq/cpufreq-cpu0.c b/drivers/cpufreq/cpufreq-cpu0.c
index 4e5b7fb8927c..37d23a0f8c56 100644
--- a/drivers/cpufreq/cpufreq-cpu0.c
+++ b/drivers/cpufreq/cpufreq-cpu0.c
@@ -178,10 +178,16 @@ static struct cpufreq_driver cpu0_cpufreq_driver = {
 
 static int cpu0_cpufreq_probe(struct platform_device *pdev)
 {
-        struct device_node *np;
+        struct device_node *np, *parent;
         int ret;
 
-        for_each_child_of_node(of_find_node_by_path("/cpus"), np) {
+        parent = of_find_node_by_path("/cpus");
+        if (!parent) {
+                pr_err("failed to find OF /cpus\n");
+                return -ENOENT;
+        }
+
+        for_each_child_of_node(parent, np) {
                 if (of_get_property(np, "operating-points", NULL))
                         break;
         }
diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h
index 46bde01eee62..cc4bd2f6838a 100644
--- a/drivers/cpufreq/cpufreq_governor.h
+++ b/drivers/cpufreq/cpufreq_governor.h
@@ -14,8 +14,8 @@
  * published by the Free Software Foundation.
  */
 
-#ifndef _CPUFREQ_GOVERNER_H
-#define _CPUFREQ_GOVERNER_H
+#ifndef _CPUFREQ_GOVERNOR_H
+#define _CPUFREQ_GOVERNOR_H
 
 #include <linux/cpufreq.h>
 #include <linux/kobject.h>
@@ -175,4 +175,4 @@ bool need_load_eval(struct cpu_dbs_common_info *cdbs,
                 unsigned int sampling_rate);
 int cpufreq_governor_dbs(struct dbs_data *dbs_data,
                 struct cpufreq_policy *policy, unsigned int event);
-#endif /* _CPUFREQ_GOVERNER_H */
+#endif /* _CPUFREQ_GOVERNOR_H */
diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index 2fd779eb1ed1..bfd6273fd873 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -180,15 +180,19 @@ static void cpufreq_stats_free_sysfs(unsigned int cpu)
 {
         struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
 
-        if (!cpufreq_frequency_get_table(cpu))
+        if (!policy)
                 return;
 
-        if (policy && !policy_is_shared(policy)) {
+        if (!cpufreq_frequency_get_table(cpu))
+                goto put_ref;
+
+        if (!policy_is_shared(policy)) {
                 pr_debug("%s: Free sysfs stat\n", __func__);
                 sysfs_remove_group(&policy->kobj, &stats_attr_group);
         }
-        if (policy)
-                cpufreq_cpu_put(policy);
+
+put_ref:
+        cpufreq_cpu_put(policy);
 }
 
 static int cpufreq_stats_create_table(struct cpufreq_policy *policy,
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index f6dd1e761129..6133ef5cf671 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -358,14 +358,14 @@ static void intel_pstate_sysfs_expose_params(void)
 static int intel_pstate_min_pstate(void)
 {
         u64 value;
-        rdmsrl(0xCE, value);
+        rdmsrl(MSR_PLATFORM_INFO, value);
         return (value >> 40) & 0xFF;
 }
 
 static int intel_pstate_max_pstate(void)
 {
         u64 value;
-        rdmsrl(0xCE, value);
+        rdmsrl(MSR_PLATFORM_INFO, value);
         return (value >> 8) & 0xFF;
 }
 
@@ -373,7 +373,7 @@ static int intel_pstate_turbo_pstate(void)
 {
         u64 value;
         int nont, ret;
-        rdmsrl(0x1AD, value);
+        rdmsrl(MSR_NHM_TURBO_RATIO_LIMIT, value);
         nont = intel_pstate_max_pstate();
         ret = ((value) & 255);
         if (ret <= nont)
@@ -454,7 +454,7 @@ static inline void intel_pstate_calc_busy(struct cpudata *cpu,
                                         sample->idletime_us * 100,
                                         sample->duration_us);
         core_pct = div64_u64(sample->aperf * 100, sample->mperf);
-        sample->freq = cpu->pstate.turbo_pstate * core_pct * 1000;
+        sample->freq = cpu->pstate.max_pstate * core_pct * 1000;
 
         sample->core_pct_busy = div_s64((sample->pstate_pct_busy * core_pct),
                                         100);
@@ -502,7 +502,6 @@ static inline void intel_pstate_set_sample_time(struct cpudata *cpu)
 
         sample_time = cpu->pstate_policy->sample_rate_ms;
         delay = msecs_to_jiffies(sample_time);
-        delay -= jiffies % delay;
         mod_timer_pinned(&cpu->timer, jiffies + delay);
 }
 
@@ -752,6 +751,29 @@ static struct cpufreq_driver intel_pstate_driver = {
 
 static int __initdata no_load;
 
+static int intel_pstate_msrs_not_valid(void)
+{
+        /* Check that all the msr's we are using are valid. */
+        u64 aperf, mperf, tmp;
+
+        rdmsrl(MSR_IA32_APERF, aperf);
+        rdmsrl(MSR_IA32_MPERF, mperf);
+
+        if (!intel_pstate_min_pstate() ||
+                !intel_pstate_max_pstate() ||
+                !intel_pstate_turbo_pstate())
+                return -ENODEV;
+
+        rdmsrl(MSR_IA32_APERF, tmp);
+        if (!(tmp - aperf))
+                return -ENODEV;
+
+        rdmsrl(MSR_IA32_MPERF, tmp);
+        if (!(tmp - mperf))
+                return -ENODEV;
+
+        return 0;
+}
 static int __init intel_pstate_init(void)
 {
         int cpu, rc = 0;
@@ -764,6 +786,9 @@ static int __init intel_pstate_init(void)
         if (!id)
                 return -ENODEV;
 
+        if (intel_pstate_msrs_not_valid())
+                return -ENODEV;
+
         pr_info("Intel P-state driver initializing.\n");
 
         all_cpu_data = vmalloc(sizeof(void *) * num_possible_cpus());
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index b2a0a0726a54..cf268b14ae9a 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -1650,11 +1650,7 @@ struct caam_alg_template {
 };
 
 static struct caam_alg_template driver_algs[] = {
-        /*
-         * single-pass ipsec_esp descriptor
-         * authencesn(*,*) is also registered, although not present
-         * explicitly here.
-         */
+        /* single-pass ipsec_esp descriptor */
         {
                 .name = "authenc(hmac(md5),cbc(aes))",
                 .driver_name = "authenc-hmac-md5-cbc-aes-caam",
@@ -2217,9 +2213,7 @@ static int __init caam_algapi_init(void)
         for (i = 0; i < ARRAY_SIZE(driver_algs); i++) {
                 /* TODO: check if h/w supports alg */
                 struct caam_crypto_alg *t_alg;
-                bool done = false;
 
-authencesn:
                 t_alg = caam_alg_alloc(ctrldev, &driver_algs[i]);
                 if (IS_ERR(t_alg)) {
                         err = PTR_ERR(t_alg);
@@ -2233,25 +2227,8 @@ authencesn:
                         dev_warn(ctrldev, "%s alg registration failed\n",
                                 t_alg->crypto_alg.cra_driver_name);
                         kfree(t_alg);
-                } else {
+                } else
                         list_add_tail(&t_alg->entry, &priv->alg_list);
-                        if (driver_algs[i].type == CRYPTO_ALG_TYPE_AEAD &&
-                            !memcmp(driver_algs[i].name, "authenc", 7) &&
-                            !done) {
-                                char *name;
-
-                                name = driver_algs[i].name;
-                                memmove(name + 10, name + 7, strlen(name) - 7);
-                                memcpy(name + 7, "esn", 3);
-
-                                name = driver_algs[i].driver_name;
-                                memmove(name + 10, name + 7, strlen(name) - 7);
-                                memcpy(name + 7, "esn", 3);
-
-                                done = true;
-                                goto authencesn;
-                        }
-                }
         }
         if (!list_empty(&priv->alg_list))
                 dev_info(ctrldev, "%s algorithms registered in /proc/crypto\n",
diff --git a/drivers/crypto/caam/compat.h b/drivers/crypto/caam/compat.h
index cf15e7813801..762aeff626ac 100644
--- a/drivers/crypto/caam/compat.h
+++ b/drivers/crypto/caam/compat.h
@@ -23,7 +23,6 @@
 #include <linux/types.h>
 #include <linux/debugfs.h>
 #include <linux/circ_buf.h>
-#include <linux/string.h>
 #include <net/xfrm.h>
 
 #include <crypto/algapi.h>
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 09b184adf31b..5b2b5e61e4f9 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -38,7 +38,6 @@
 #include <linux/spinlock.h>
 #include <linux/rtnetlink.h>
 #include <linux/slab.h>
-#include <linux/string.h>
 
 #include <crypto/algapi.h>
 #include <crypto/aes.h>
@@ -1974,11 +1973,7 @@ struct talitos_alg_template {
 };
 
 static struct talitos_alg_template driver_algs[] = {
-        /*
-         * AEAD algorithms. These use a single-pass ipsec_esp descriptor.
-         * authencesn(*,*) is also registered, although not present
-         * explicitly here.
-         */
+        /* AEAD algorithms.  These use a single-pass ipsec_esp descriptor */
         {       .type = CRYPTO_ALG_TYPE_AEAD,
                 .alg.crypto = {
                         .cra_name = "authenc(hmac(sha1),cbc(aes))",
@@ -2820,9 +2815,7 @@ static int talitos_probe(struct platform_device *ofdev)
                 if (hw_supports(dev, driver_algs[i].desc_hdr_template)) {
                         struct talitos_crypto_alg *t_alg;
                         char *name = NULL;
-                        bool authenc = false;
 
-authencesn:
                         t_alg = talitos_alg_alloc(dev, &driver_algs[i]);
                         if (IS_ERR(t_alg)) {
                                 err = PTR_ERR(t_alg);
@@ -2837,8 +2830,6 @@ authencesn:
                                 err = crypto_register_alg(
                                                 &t_alg->algt.alg.crypto);
                                 name = t_alg->algt.alg.crypto.cra_driver_name;
-                                authenc = authenc ? !authenc :
-                                          !(bool)memcmp(name, "authenc", 7);
                                 break;
                         case CRYPTO_ALG_TYPE_AHASH:
                                 err = crypto_register_ahash(
@@ -2851,25 +2842,8 @@ authencesn:
                                 dev_err(dev, "%s alg registration failed\n",
                                         name);
                                 kfree(t_alg);
-                        } else {
+                        } else
                                 list_add_tail(&t_alg->entry, &priv->alg_list);
-                                if (authenc) {
-                                        struct crypto_alg *alg =
-                                                &driver_algs[i].alg.crypto;
-
-                                        name = alg->cra_name;
-                                        memmove(name + 10, name + 7,
-                                                strlen(name) - 7);
-                                        memcpy(name + 7, "esn", 3);
-
-                                        name = alg->cra_driver_name;
-                                        memmove(name + 10, name + 7,
-                                                strlen(name) - 7);
-                                        memcpy(name + 7, "esn", 3);
-
-                                        goto authencesn;
-                                }
-                        }
                 }
         }
         if (!list_empty(&priv->alg_list))
diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c
index 8bc5fef07e7a..22c9063e0120 100644
--- a/drivers/crypto/ux500/cryp/cryp_core.c
+++ b/drivers/crypto/ux500/cryp/cryp_core.c
@@ -1750,7 +1750,7 @@ static struct platform_driver cryp_driver = {
         .shutdown = ux500_cryp_shutdown,
         .driver = {
                 .owner = THIS_MODULE,
-                .name  = "cryp1"
+                .name  = "cryp1",
                 .pm    = &ux500_cryp_pm,
         }
 };
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 80b69971cf28..aeaea32bcfda 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -83,6 +83,7 @@ config INTEL_IOP_ADMA
 
 config DW_DMAC
         tristate "Synopsys DesignWare AHB DMA support"
+        depends on GENERIC_HARDIRQS
         select DMA_ENGINE
         default y if CPU_AT32AP7000
         help
diff --git a/drivers/dma/dw_dmac.c b/drivers/dma/dw_dmac.c
index c599558faeda..43a5329d4483 100644
--- a/drivers/dma/dw_dmac.c
+++ b/drivers/dma/dw_dmac.c
@@ -1001,6 +1001,13 @@ static inline void convert_burst(u32 *maxburst)
                 *maxburst = 0;
 }
 
+static inline void convert_slave_id(struct dw_dma_chan *dwc)
+{
+        struct dw_dma *dw = to_dw_dma(dwc->chan.device);
+
+        dwc->dma_sconfig.slave_id -= dw->request_line_base;
+}
+
 static int
 set_runtime_config(struct dma_chan *chan, struct dma_slave_config *sconfig)
 {
@@ -1015,6 +1022,7 @@ set_runtime_config(struct dma_chan *chan, struct dma_slave_config *sconfig)
 
         convert_burst(&dwc->dma_sconfig.src_maxburst);
         convert_burst(&dwc->dma_sconfig.dst_maxburst);
+        convert_slave_id(dwc);
 
         return 0;
 }
@@ -1276,9 +1284,9 @@ static struct dma_chan *dw_dma_xlate(struct of_phandle_args *dma_spec,
         if (dma_spec->args_count != 3)
                 return NULL;
 
-        fargs.req = be32_to_cpup(dma_spec->args+0);
-        fargs.src = be32_to_cpup(dma_spec->args+1);
-        fargs.dst = be32_to_cpup(dma_spec->args+2);
+        fargs.req = dma_spec->args[0];
+        fargs.src = dma_spec->args[1];
+        fargs.dst = dma_spec->args[2];
 
         if (WARN_ON(fargs.req >= DW_DMA_MAX_NR_REQUESTS ||
                     fargs.src >= dw->nr_masters ||
@@ -1628,6 +1636,7 @@ dw_dma_parse_dt(struct platform_device *pdev)
 
 static int dw_probe(struct platform_device *pdev)
 {
+        const struct platform_device_id *match;
         struct dw_dma_platform_data *pdata;
         struct resource         *io;
         struct dw_dma           *dw;
@@ -1711,6 +1720,11 @@ static int dw_probe(struct platform_device *pdev)
                 memcpy(dw->data_width, pdata->data_width, 4);
         }
 
+        /* Get the base request line if set */
+        match = platform_get_device_id(pdev);
+        if (match)
+                dw->request_line_base = (unsigned int)match->driver_data;
+
         /* Calculate all channel mask before DMA setup */
         dw->all_chan_mask = (1 << nr_channels) - 1;
 
@@ -1906,7 +1920,8 @@ MODULE_DEVICE_TABLE(of, dw_dma_id_table);
 #endif
 
 static const struct platform_device_id dw_dma_ids[] = {
-        { "INTL9C60", 0 },
+        /* Name,        Request Line Base */
+        { "INTL9C60",   (kernel_ulong_t)16 },
         { }
 };
 
diff --git a/drivers/dma/dw_dmac_regs.h b/drivers/dma/dw_dmac_regs.h
index cf0ce5c77d60..4d02c3669b75 100644
--- a/drivers/dma/dw_dmac_regs.h
+++ b/drivers/dma/dw_dmac_regs.h
@@ -247,6 +247,7 @@ struct dw_dma {
         /* hardware configuration */
         unsigned char           nr_masters;
         unsigned char           data_width[4];
+        unsigned int            request_line_base;
 
         struct dw_dma_chan      chan[0];
 };
diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c
index c4b4fd2acc42..08b43bf37158 100644
--- a/drivers/dma/omap-dma.c
+++ b/drivers/dma/omap-dma.c
@@ -276,12 +276,20 @@ static void omap_dma_issue_pending(struct dma_chan *chan)
 
         spin_lock_irqsave(&c->vc.lock, flags);
         if (vchan_issue_pending(&c->vc) && !c->desc) {
-                struct omap_dmadev *d = to_omap_dma_dev(chan->device);
-                spin_lock(&d->lock);
-                if (list_empty(&c->node))
-                        list_add_tail(&c->node, &d->pending);
-                spin_unlock(&d->lock);
-                tasklet_schedule(&d->task);
+                /*
+                 * c->cyclic is used only by audio and in this case the DMA need
+                 * to be started without delay.
+                 */
+                if (!c->cyclic) {
+                        struct omap_dmadev *d = to_omap_dma_dev(chan->device);
+                        spin_lock(&d->lock);
+                        if (list_empty(&c->node))
+                                list_add_tail(&c->node, &d->pending);
+                        spin_unlock(&d->lock);
+                        tasklet_schedule(&d->task);
+                } else {
+                        omap_dma_start_desc(c);
+                }
         }
         spin_unlock_irqrestore(&c->vc.lock, flags);
 }
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 718153122759..5dbc5946c4c3 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2882,7 +2882,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
 {
         struct dma_pl330_platdata *pdat;
         struct dma_pl330_dmac *pdmac;
-        struct dma_pl330_chan *pch;
+        struct dma_pl330_chan *pch, *_p;
         struct pl330_info *pi;
         struct dma_device *pd;
         struct resource *res;
@@ -2984,7 +2984,16 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
         ret = dma_async_device_register(pd);
         if (ret) {
                 dev_err(&adev->dev, "unable to register DMAC\n");
-                goto probe_err2;
+                goto probe_err3;
+        }
+
+        if (adev->dev.of_node) {
+                ret = of_dma_controller_register(adev->dev.of_node,
+                                         of_dma_pl330_xlate, pdmac);
+                if (ret) {
+                        dev_err(&adev->dev,
+                        "unable to register DMA to the generic DT DMA helpers\n");
+                }
         }
 
         dev_info(&adev->dev,
@@ -2995,16 +3004,21 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
                 pi->pcfg.data_bus_width / 8, pi->pcfg.num_chan,
                 pi->pcfg.num_peri, pi->pcfg.num_events);
 
-        ret = of_dma_controller_register(adev->dev.of_node,
-                                         of_dma_pl330_xlate, pdmac);
-        if (ret) {
-                dev_err(&adev->dev,
-                "unable to register DMA to the generic DT DMA helpers\n");
-                goto probe_err2;
-        }
-
         return 0;
+probe_err3:
+        amba_set_drvdata(adev, NULL);
 
+        /* Idle the DMAC */
+        list_for_each_entry_safe(pch, _p, &pdmac->ddma.channels,
+                        chan.device_node) {
+
+                /* Remove the channel */
+                list_del(&pch->chan.device_node);
+
+                /* Flush the channel */
+                pl330_control(&pch->chan, DMA_TERMINATE_ALL, 0);
+                pl330_free_chan_resources(&pch->chan);
+        }
 probe_err2:
         pl330_del(pi);
 probe_err1:
@@ -3023,8 +3037,10 @@ static int pl330_remove(struct amba_device *adev)
         if (!pdmac)
                 return 0;
 
-        of_dma_controller_free(adev->dev.of_node);
+        if (adev->dev.of_node)
+                of_dma_controller_free(adev->dev.of_node);
 
+        dma_async_device_unregister(&pdmac->ddma);
         amba_set_drvdata(adev, NULL);
 
         /* Idle the DMAC */
diff --git a/drivers/eisa/pci_eisa.c b/drivers/eisa/pci_eisa.c
index cdae207028a7..6c3fca97d346 100644
--- a/drivers/eisa/pci_eisa.c
+++ b/drivers/eisa/pci_eisa.c
@@ -19,10 +19,10 @@
 /* There is only *one* pci_eisa device per machine, right ? */
 static struct eisa_root_device pci_eisa_root;
 
-static int __init pci_eisa_init(struct pci_dev *pdev,
-                                const struct pci_device_id *ent)
+static int __init pci_eisa_init(struct pci_dev *pdev)
 {
-        int rc;
+        int rc, i;
+        struct resource *res, *bus_res = NULL;
 
         if ((rc = pci_enable_device (pdev))) {
                 printk (KERN_ERR "pci_eisa : Could not enable device %s\n",
@@ -30,9 +30,30 @@ static int __init pci_eisa_init(struct pci_dev *pdev,
                 return rc;
         }
 
+        /*
+         * The Intel 82375 PCI-EISA bridge is a subtractive-decode PCI
+         * device, so the resources available on EISA are the same as those
+         * available on the 82375 bus.  This works the same as a PCI-PCI
+         * bridge in subtractive-decode mode (see pci_read_bridge_bases()).
+         * We assume other PCI-EISA bridges are similar.
+         *
+         * eisa_root_register() can only deal with a single io port resource,
+        *  so we use the first valid io port resource.
+         */
+        pci_bus_for_each_resource(pdev->bus, res, i)
+                if (res && (res->flags & IORESOURCE_IO)) {
+                        bus_res = res;
+                        break;
+                }
+
+        if (!bus_res) {
+                dev_err(&pdev->dev, "No resources available\n");
+                return -1;
+        }
+
         pci_eisa_root.dev              = &pdev->dev;
-        pci_eisa_root.res              = pdev->bus->resource[0];
-        pci_eisa_root.bus_base_addr    = pdev->bus->resource[0]->start;
+        pci_eisa_root.res              = bus_res;
+        pci_eisa_root.bus_base_addr    = bus_res->start;
         pci_eisa_root.slots            = EISA_MAX_SLOTS;
         pci_eisa_root.dma_mask         = pdev->dma_mask;
         dev_set_drvdata(pci_eisa_root.dev, &pci_eisa_root);
@@ -45,22 +66,26 @@ static int __init pci_eisa_init(struct pci_dev *pdev,
         return 0;
 }
 
-static struct pci_device_id pci_eisa_pci_tbl[] = {
-        { PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
-          PCI_CLASS_BRIDGE_EISA << 8, 0xffff00, 0 },
-        { 0, }
-};
+/*
+ * We have to call pci_eisa_init_early() before pnpacpi_init()/isapnp_init().
+ *   Otherwise pnp resource will get enabled early and could prevent eisa
+ *   to be initialized.
+ * Also need to make sure pci_eisa_init_early() is called after
+ * x86/pci_subsys_init().
+ * So need to use subsys_initcall_sync with it.
+ */
+static int __init pci_eisa_init_early(void)
+{
+        struct pci_dev *dev = NULL;
+        int ret;
 
-static struct pci_driver __refdata pci_eisa_driver = {
-        .name           = "pci_eisa",
-        .id_table       = pci_eisa_pci_tbl,
-        .probe          = pci_eisa_init,
-};
+        for_each_pci_dev(dev)
+                if ((dev->class >> 8) == PCI_CLASS_BRIDGE_EISA) {
+                        ret = pci_eisa_init(dev);
+                        if (ret)
+                                return ret;
+                }
 
-static int __init pci_eisa_init_module (void)
-{
-        return pci_register_driver (&pci_eisa_driver);
+        return 0;
 }
-
-device_initcall(pci_eisa_init_module);
-MODULE_DEVICE_TABLE(pci, pci_eisa_pci_tbl);
+subsys_initcall_sync(pci_eisa_init_early);
diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
index b70e3815c459..8f3c947b0029 100644
--- a/drivers/extcon/extcon-max77693.c
+++ b/drivers/extcon/extcon-max77693.c
@@ -32,6 +32,38 @@
 #define DEV_NAME                        "max77693-muic"
 #define DELAY_MS_DEFAULT                20000           /* unit: millisecond */
 
+/*
+ * Default value of MAX77693 register to bring up MUIC device.
+ * If user don't set some initial value for MUIC device through platform data,
+ * extcon-max77693 driver use 'default_init_data' to bring up base operation
+ * of MAX77693 MUIC device.
+ */
+struct max77693_reg_data default_init_data[] = {
+        {
+                /* STATUS2 - [3]ChgDetRun */
+                .addr = MAX77693_MUIC_REG_STATUS2,
+                .data = STATUS2_CHGDETRUN_MASK,
+        }, {
+                /* INTMASK1 - Unmask [3]ADC1KM,[0]ADCM */
+                .addr = MAX77693_MUIC_REG_INTMASK1,
+                .data = INTMASK1_ADC1K_MASK
+                        | INTMASK1_ADC_MASK,
+        }, {
+                /* INTMASK2 - Unmask [0]ChgTypM */
+                .addr = MAX77693_MUIC_REG_INTMASK2,
+                .data = INTMASK2_CHGTYP_MASK,
+        }, {
+                /* INTMASK3 - Mask all of interrupts */
+                .addr = MAX77693_MUIC_REG_INTMASK3,
+                .data = 0x0,
+        }, {
+                /* CDETCTRL2 */
+                .addr = MAX77693_MUIC_REG_CDETCTRL2,
+                .data = CDETCTRL2_VIDRMEN_MASK
+                        | CDETCTRL2_DXOVPEN_MASK,
+        },
+};
+
 enum max77693_muic_adc_debounce_time {
         ADC_DEBOUNCE_TIME_5MS = 0,
         ADC_DEBOUNCE_TIME_10MS,
@@ -1045,8 +1077,9 @@ static int max77693_muic_probe(struct platform_device *pdev)
 {
         struct max77693_dev *max77693 = dev_get_drvdata(pdev->dev.parent);
         struct max77693_platform_data *pdata = dev_get_platdata(max77693->dev);
-        struct max77693_muic_platform_data *muic_pdata = pdata->muic_data;
         struct max77693_muic_info *info;
+        struct max77693_reg_data *init_data;
+        int num_init_data;
         int delay_jiffies;
         int ret;
         int i;
@@ -1145,15 +1178,25 @@ static int max77693_muic_probe(struct platform_device *pdev)
                 goto err_irq;
         }
 
-        /* Initialize MUIC register by using platform data */
-        for (i = 0 ; i < muic_pdata->num_init_data ; i++) {
-                enum max77693_irq_source irq_src = MAX77693_IRQ_GROUP_NR;
+
+        /* Initialize MUIC register by using platform data or default data */
+        if (pdata->muic_data) {
+                init_data = pdata->muic_data->init_data;
+                num_init_data = pdata->muic_data->num_init_data;
+        } else {
+                init_data = default_init_data;
+                num_init_data = ARRAY_SIZE(default_init_data);
+        }
+
+        for (i = 0 ; i < num_init_data ; i++) {
+                enum max77693_irq_source irq_src
+                                = MAX77693_IRQ_GROUP_NR;
 
                 max77693_write_reg(info->max77693->regmap_muic,
-                                muic_pdata->init_data[i].addr,
-                                muic_pdata->init_data[i].data);
+                                init_data[i].addr,
+                                init_data[i].data);
 
-                switch (muic_pdata->init_data[i].addr) {
+                switch (init_data[i].addr) {
                 case MAX77693_MUIC_REG_INTMASK1:
                         irq_src = MUIC_INT1;
                         break;
@@ -1167,22 +1210,40 @@ static int max77693_muic_probe(struct platform_device *pdev)
 
                 if (irq_src < MAX77693_IRQ_GROUP_NR)
                         info->max77693->irq_masks_cur[irq_src]
-                                = muic_pdata->init_data[i].data;
+                                = init_data[i].data;
         }
 
-        /*
-         * Default usb/uart path whether UART/USB or AUX_UART/AUX_USB
-         * h/w path of COMP2/COMN1 on CONTROL1 register.
-         */
-        if (muic_pdata->path_uart)
-                info->path_uart = muic_pdata->path_uart;
-        else
-                info->path_uart = CONTROL1_SW_UART;
+        if (pdata->muic_data) {
+                struct max77693_muic_platform_data *muic_pdata = pdata->muic_data;
 
-        if (muic_pdata->path_usb)
-                info->path_usb = muic_pdata->path_usb;
-        else
+                /*
+                 * Default usb/uart path whether UART/USB or AUX_UART/AUX_USB
+                 * h/w path of COMP2/COMN1 on CONTROL1 register.
+                 */
+                if (muic_pdata->path_uart)
+                        info->path_uart = muic_pdata->path_uart;
+                else
+                        info->path_uart = CONTROL1_SW_UART;
+
+                if (muic_pdata->path_usb)
+                        info->path_usb = muic_pdata->path_usb;
+                else
+                        info->path_usb = CONTROL1_SW_USB;
+
+                /*
+                 * Default delay time for detecting cable state
+                 * after certain time.
+                 */
+                if (muic_pdata->detcable_delay_ms)
+                        delay_jiffies =
+                                msecs_to_jiffies(muic_pdata->detcable_delay_ms);
+                else
+                        delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
+        } else {
                 info->path_usb = CONTROL1_SW_USB;
+                info->path_uart = CONTROL1_SW_UART;
+                delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
+        }
 
         /* Set initial path for UART */
          max77693_muic_set_path(info, info->path_uart, true);
@@ -1208,10 +1269,6 @@ static int max77693_muic_probe(struct platform_device *pdev)
          * driver should notify cable state to upper layer.
          */
         INIT_DELAYED_WORK(&info->wq_detcable, max77693_muic_detect_cable_wq);
-        if (muic_pdata->detcable_delay_ms)
-                delay_jiffies = msecs_to_jiffies(muic_pdata->detcable_delay_ms);
-        else
-                delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
         schedule_delayed_work(&info->wq_detcable, delay_jiffies);
 
         return ret;
diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c
index e636d950ad6c..69641bcae325 100644
--- a/drivers/extcon/extcon-max8997.c
+++ b/drivers/extcon/extcon-max8997.c
@@ -712,29 +712,45 @@ static int max8997_muic_probe(struct platform_device *pdev)
                 goto err_irq;
         }
 
-        /* Initialize registers according to platform data */
         if (pdata->muic_pdata) {
-                struct max8997_muic_platform_data *mdata = info->muic_pdata;
-
-                for (i = 0; i < mdata->num_init_data; i++) {
-                        max8997_write_reg(info->muic, mdata->init_data[i].addr,
-                                        mdata->init_data[i].data);
+                struct max8997_muic_platform_data *muic_pdata
+                        = pdata->muic_pdata;
+
+                /* Initialize registers according to platform data */
+                for (i = 0; i < muic_pdata->num_init_data; i++) {
+                        max8997_write_reg(info->muic,
+                                        muic_pdata->init_data[i].addr,
+                                        muic_pdata->init_data[i].data);
                 }
-        }
 
-        /*
-         * Default usb/uart path whether UART/USB or AUX_UART/AUX_USB
-         * h/w path of COMP2/COMN1 on CONTROL1 register.
-         */
-        if (pdata->muic_pdata->path_uart)
-                info->path_uart = pdata->muic_pdata->path_uart;
-        else
-                info->path_uart = CONTROL1_SW_UART;
+                /*
+                 * Default usb/uart path whether UART/USB or AUX_UART/AUX_USB
+                 * h/w path of COMP2/COMN1 on CONTROL1 register.
+                 */
+                if (muic_pdata->path_uart)
+                        info->path_uart = muic_pdata->path_uart;
+                else
+                        info->path_uart = CONTROL1_SW_UART;
 
-        if (pdata->muic_pdata->path_usb)
-                info->path_usb = pdata->muic_pdata->path_usb;
-        else
+                if (muic_pdata->path_usb)
+                        info->path_usb = muic_pdata->path_usb;
+                else
+                        info->path_usb = CONTROL1_SW_USB;
+
+                /*
+                 * Default delay time for detecting cable state
+                 * after certain time.
+                 */
+                if (muic_pdata->detcable_delay_ms)
+                        delay_jiffies =
+                                msecs_to_jiffies(muic_pdata->detcable_delay_ms);
+                else
+                        delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
+        } else {
+                info->path_uart = CONTROL1_SW_UART;
                 info->path_usb = CONTROL1_SW_USB;
+                delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
+        }
 
         /* Set initial path for UART */
          max8997_muic_set_path(info, info->path_uart, true);
@@ -751,10 +767,6 @@ static int max8997_muic_probe(struct platform_device *pdev)
          * driver should notify cable state to upper layer.
          */
         INIT_DELAYED_WORK(&info->wq_detcable, max8997_muic_detect_cable_wq);
-        if (pdata->muic_pdata->detcable_delay_ms)
-                delay_jiffies = msecs_to_jiffies(pdata->muic_pdata->detcable_delay_ms);
-        else
-                delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
         schedule_delayed_work(&info->wq_detcable, delay_jiffies);
 
         return 0;
diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index 9b00072a020f..42c759a4d047 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -53,6 +53,24 @@ config EFI_VARS
           Subsequent efibootmgr releases may be found at:
           <http://linux.dell.com/efibootmgr>
 
+config EFI_VARS_PSTORE
+        bool "Register efivars backend for pstore"
+        depends on EFI_VARS && PSTORE
+        default y
+        help
+          Say Y here to enable use efivars as a backend to pstore. This
+          will allow writing console messages, crash dumps, or anything
+          else supported by pstore to EFI variables.
+
+config EFI_VARS_PSTORE_DEFAULT_DISABLE
+        bool "Disable using efivars as a pstore backend by default"
+        depends on EFI_VARS_PSTORE
+        default n
+        help
+          Saying Y here will disable the use of efivars as a storage
+          backend for pstore by default. This setting can be overridden
+          using the efivars module's pstore_disable parameter.
+
 config EFI_PCDP
         bool "Console device selection via EFI PCDP or HCDP table"
         depends on ACPI && EFI && IA64
diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
index fe62aa392239..7acafb80fd4c 100644
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -103,6 +103,11 @@ MODULE_VERSION(EFIVARS_VERSION);
  */
 #define GUID_LEN 36
 
+static bool efivars_pstore_disable =
+        IS_ENABLED(CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE);
+
+module_param_named(pstore_disable, efivars_pstore_disable, bool, 0644);
+
 /*
  * The maximum size of VariableName + Data = 1024
  * Therefore, it's reasonable to save that much
@@ -165,6 +170,7 @@ efivar_create_sysfs_entry(struct efivars *efivars,
 
 static void efivar_update_sysfs_entries(struct work_struct *);
 static DECLARE_WORK(efivar_work, efivar_update_sysfs_entries);
+static bool efivar_wq_enabled = true;
 
 /* Return the number of unicode characters in data */
 static unsigned long
@@ -1309,9 +1315,7 @@ static const struct inode_operations efivarfs_dir_inode_operations = {
         .create = efivarfs_create,
 };
 
-static struct pstore_info efi_pstore_info;
-
-#ifdef CONFIG_PSTORE
+#ifdef CONFIG_EFI_VARS_PSTORE
 
 static int efi_pstore_open(struct pstore_info *psi)
 {
@@ -1441,7 +1445,7 @@ static int efi_pstore_write(enum pstore_type_id type,
 
         spin_unlock_irqrestore(&efivars->lock, flags);
 
-        if (reason == KMSG_DUMP_OOPS)
+        if (reason == KMSG_DUMP_OOPS && efivar_wq_enabled)
                 schedule_work(&efivar_work);
 
         *id = part;
@@ -1514,38 +1518,6 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
 
         return 0;
 }
-#else
-static int efi_pstore_open(struct pstore_info *psi)
-{
-        return 0;
-}
-
-static int efi_pstore_close(struct pstore_info *psi)
-{
-        return 0;
-}
-
-static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type, int *count,
-                               struct timespec *timespec,
-                               char **buf, struct pstore_info *psi)
-{
-        return -1;
-}
-
-static int efi_pstore_write(enum pstore_type_id type,
-                enum kmsg_dump_reason reason, u64 *id,
-                unsigned int part, int count, size_t size,
-                struct pstore_info *psi)
-{
-        return 0;
-}
-
-static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
-                            struct timespec time, struct pstore_info *psi)
-{
-        return 0;
-}
-#endif
 
 static struct pstore_info efi_pstore_info = {
         .owner          = THIS_MODULE,
@@ -1557,6 +1529,24 @@ static struct pstore_info efi_pstore_info = {
         .erase          = efi_pstore_erase,
 };
 
+static void efivar_pstore_register(struct efivars *efivars)
+{
+        efivars->efi_pstore_info = efi_pstore_info;
+        efivars->efi_pstore_info.buf = kmalloc(4096, GFP_KERNEL);
+        if (efivars->efi_pstore_info.buf) {
+                efivars->efi_pstore_info.bufsize = 1024;
+                efivars->efi_pstore_info.data = efivars;
+                spin_lock_init(&efivars->efi_pstore_info.buf_lock);
+                pstore_register(&efivars->efi_pstore_info);
+        }
+}
+#else
+static void efivar_pstore_register(struct efivars *efivars)
+{
+        return;
+}
+#endif
+
 static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
                              struct bin_attribute *bin_attr,
                              char *buf, loff_t pos, size_t count)
@@ -1716,6 +1706,31 @@ static bool variable_is_present(efi_char16_t *variable_name, efi_guid_t *vendor)
         return found;
 }
 
+/*
+ * Returns the size of variable_name, in bytes, including the
+ * terminating NULL character, or variable_name_size if no NULL
+ * character is found among the first variable_name_size bytes.
+ */
+static unsigned long var_name_strnsize(efi_char16_t *variable_name,
+                                       unsigned long variable_name_size)
+{
+        unsigned long len;
+        efi_char16_t c;
+
+        /*
+         * The variable name is, by definition, a NULL-terminated
+         * string, so make absolutely sure that variable_name_size is
+         * the value we expect it to be. If not, return the real size.
+         */
+        for (len = 2; len <= variable_name_size; len += sizeof(c)) {
+                c = variable_name[(len / sizeof(c)) - 1];
+                if (!c)
+                        break;
+        }
+
+        return min(len, variable_name_size);
+}
+
 static void efivar_update_sysfs_entries(struct work_struct *work)
 {
         struct efivars *efivars = &__efivars;
@@ -1756,10 +1771,13 @@ static void efivar_update_sysfs_entries(struct work_struct *work)
                 if (!found) {
                         kfree(variable_name);
                         break;
-                } else
+                } else {
+                        variable_name_size = var_name_strnsize(variable_name,
+                                                               variable_name_size);
                         efivar_create_sysfs_entry(efivars,
                                                   variable_name_size,
                                                   variable_name, &vendor);
+                }
         }
 }
 
@@ -1958,6 +1976,35 @@ void unregister_efivars(struct efivars *efivars)
 }
 EXPORT_SYMBOL_GPL(unregister_efivars);
 
+/*
+ * Print a warning when duplicate EFI variables are encountered and
+ * disable the sysfs workqueue since the firmware is buggy.
+ */
+static void dup_variable_bug(efi_char16_t *s16, efi_guid_t *vendor_guid,
+                             unsigned long len16)
+{
+        size_t i, len8 = len16 / sizeof(efi_char16_t);
+        char *s8;
+
+        /*
+         * Disable the workqueue since the algorithm it uses for
+         * detecting new variables won't work with this buggy
+         * implementation of GetNextVariableName().
+         */
+        efivar_wq_enabled = false;
+
+        s8 = kzalloc(len8, GFP_KERNEL);
+        if (!s8)
+                return;
+
+        for (i = 0; i < len8; i++)
+                s8[i] = s16[i];
+
+        printk(KERN_WARNING "efivars: duplicate variable: %s-%pUl\n",
+               s8, vendor_guid);
+        kfree(s8);
+}
+
 int register_efivars(struct efivars *efivars,
                      const struct efivar_operations *ops,
                      struct kobject *parent_kobj)
@@ -2006,6 +2053,24 @@ int register_efivars(struct efivars *efivars,
                                                 &vendor_guid);
                 switch (status) {
                 case EFI_SUCCESS:
+                        variable_name_size = var_name_strnsize(variable_name,
+                                                               variable_name_size);
+
+                        /*
+                         * Some firmware implementations return the
+                         * same variable name on multiple calls to
+                         * get_next_variable(). Terminate the loop
+                         * immediately as there is no guarantee that
+                         * we'll ever see a different variable name,
+                         * and may end up looping here forever.
+                         */
+                        if (variable_is_present(variable_name, &vendor_guid)) {
+                                dup_variable_bug(variable_name, &vendor_guid,
+                                                 variable_name_size);
+                                status = EFI_NOT_FOUND;
+                                break;
+                        }
+
                         efivar_create_sysfs_entry(efivars,
                                                   variable_name_size,
                                                   variable_name,
@@ -2025,15 +2090,8 @@ int register_efivars(struct efivars *efivars,
         if (error)
                 unregister_efivars(efivars);
 
-        efivars->efi_pstore_info = efi_pstore_info;
-
-        efivars->efi_pstore_info.buf = kmalloc(4096, GFP_KERNEL);
-        if (efivars->efi_pstore_info.buf) {
-                efivars->efi_pstore_info.bufsize = 1024;
-                efivars->efi_pstore_info.data = efivars;
-                spin_lock_init(&efivars->efi_pstore_info.buf_lock);
-                pstore_register(&efivars->efi_pstore_info);
-        }
+        if (!efivars_pstore_disable)
+                efivar_pstore_register(efivars);
 
         register_filesystem(&efivarfs_type);
 
diff --git a/drivers/gpio/gpio-ich.c b/drivers/gpio/gpio-ich.c
index f9dbd503fc40..de3c317bd3e2 100644
--- a/drivers/gpio/gpio-ich.c
+++ b/drivers/gpio/gpio-ich.c
@@ -214,7 +214,7 @@ static int ichx_gpio_request(struct gpio_chip *chip, unsigned nr)
          * If it can't be trusted, assume that the pin can be used as a GPIO.
          */
         if (ichx_priv.desc->use_sel_ignore[nr / 32] & (1 << (nr & 0x1f)))
-                return 1;
+                return 0;
 
         return ichx_read_bit(GPIO_USE_SEL, nr) ? 0 : -ENODEV;
 }
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index 24059462c87f..9391cf16e990 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -575,7 +575,7 @@ static int pca953x_irq_setup(struct pca953x_chip *chip,
                                                 chip->gpio_chip.ngpio,
                                                 irq_base,
                                                 &pca953x_irq_simple_ops,
-                                                NULL);
+                                                chip);
                 if (!chip->domain)
                         return -ENODEV;
 
diff --git a/drivers/gpio/gpio-stmpe.c b/drivers/gpio/gpio-stmpe.c
index 770476a9da87..3ce5bc38ac31 100644
--- a/drivers/gpio/gpio-stmpe.c
+++ b/drivers/gpio/gpio-stmpe.c
@@ -307,11 +307,15 @@ static const struct irq_domain_ops stmpe_gpio_irq_simple_ops = {
         .xlate = irq_domain_xlate_twocell,
 };
 
-static int stmpe_gpio_irq_init(struct stmpe_gpio *stmpe_gpio)
+static int stmpe_gpio_irq_init(struct stmpe_gpio *stmpe_gpio,
+                struct device_node *np)
 {
-        int base = stmpe_gpio->irq_base;
+        int base = 0;
 
-        stmpe_gpio->domain = irq_domain_add_simple(NULL,
+        if (!np)
+                base = stmpe_gpio->irq_base;
+
+        stmpe_gpio->domain = irq_domain_add_simple(np,
                                 stmpe_gpio->chip.ngpio, base,
                                 &stmpe_gpio_irq_simple_ops, stmpe_gpio);
         if (!stmpe_gpio->domain) {
@@ -346,6 +350,9 @@ static int stmpe_gpio_probe(struct platform_device *pdev)
         stmpe_gpio->chip = template_chip;
         stmpe_gpio->chip.ngpio = stmpe->num_gpios;
         stmpe_gpio->chip.dev = &pdev->dev;
+#ifdef CONFIG_OF
+        stmpe_gpio->chip.of_node = np;
+#endif
         stmpe_gpio->chip.base = pdata ? pdata->gpio_base : -1;
 
         if (pdata)
@@ -366,7 +373,7 @@ static int stmpe_gpio_probe(struct platform_device *pdev)
                 goto out_free;
 
         if (irq >= 0) {
-                ret = stmpe_gpio_irq_init(stmpe_gpio);
+                ret = stmpe_gpio_irq_init(stmpe_gpio, np);
                 if (ret)
                         goto out_disable;
 
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index a71a54a3e3f7..5150df6cba08 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -193,7 +193,7 @@ static void of_gpiochip_add_pin_range(struct gpio_chip *chip)
         if (!np)
                 return;
 
-        do {
+        for (;; index++) {
                 ret = of_parse_phandle_with_args(np, "gpio-ranges",
                                 "#gpio-range-cells", index, &pinspec);
                 if (ret)
@@ -222,8 +222,7 @@ static void of_gpiochip_add_pin_range(struct gpio_chip *chip)
 
                 if (ret)
                         break;
-
-        } while (index++);
+        }
 }
 
 #else
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 792c3e3795ca..dd64a06dc5b4 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -2326,7 +2326,6 @@ int drm_mode_addfb(struct drm_device *dev,
         fb = dev->mode_config.funcs->fb_create(dev, file_priv, &r);
         if (IS_ERR(fb)) {
                 DRM_DEBUG_KMS("could not create framebuffer\n");
-                drm_modeset_unlock_all(dev);
                 return PTR_ERR(fb);
         }
 
@@ -2506,7 +2505,6 @@ int drm_mode_addfb2(struct drm_device *dev,
         fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
         if (IS_ERR(fb)) {
                 DRM_DEBUG_KMS("could not create framebuffer\n");
-                drm_modeset_unlock_all(dev);
                 return PTR_ERR(fb);
         }
 
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 59d6b9bf204b..892ff9f95975 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1544,10 +1544,10 @@ int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
         if (!fb_helper->fb)
                 return 0;
 
-        drm_modeset_lock_all(dev);
+        mutex_lock(&fb_helper->dev->mode_config.mutex);
         if (!drm_fb_helper_is_bound(fb_helper)) {
                 fb_helper->delayed_hotplug = true;
-                drm_modeset_unlock_all(dev);
+                mutex_unlock(&fb_helper->dev->mode_config.mutex);
                 return 0;
         }
         DRM_DEBUG_KMS("\n");
@@ -1558,9 +1558,11 @@ int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
 
         count = drm_fb_helper_probe_connector_modes(fb_helper, max_width,
                                                     max_height);
+        mutex_unlock(&fb_helper->dev->mode_config.mutex);
+
+        drm_modeset_lock_all(dev);
         drm_setup_crtcs(fb_helper);
         drm_modeset_unlock_all(dev);
-
         drm_fb_helper_set_par(fb_helper->fbdev);
 
         return 0;
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
index 13fdcd10a605..429e07d0b0f1 100644
--- a/drivers/gpu/drm/drm_fops.c
+++ b/drivers/gpu/drm/drm_fops.c
@@ -123,6 +123,7 @@ int drm_open(struct inode *inode, struct file *filp)
         int retcode = 0;
         int need_setup = 0;
         struct address_space *old_mapping;
+        struct address_space *old_imapping;
 
         minor = idr_find(&drm_minors_idr, minor_id);
         if (!minor)
@@ -137,6 +138,7 @@ int drm_open(struct inode *inode, struct file *filp)
         if (!dev->open_count++)
                 need_setup = 1;
         mutex_lock(&dev->struct_mutex);
+        old_imapping = inode->i_mapping;
         old_mapping = dev->dev_mapping;
         if (old_mapping == NULL)
                 dev->dev_mapping = &inode->i_data;
@@ -159,8 +161,8 @@ int drm_open(struct inode *inode, struct file *filp)
 
 err_undo:
         mutex_lock(&dev->struct_mutex);
-        filp->f_mapping = old_mapping;
-        inode->i_mapping = old_mapping;
+        filp->f_mapping = old_imapping;
+        inode->i_mapping = old_imapping;
         iput(container_of(dev->dev_mapping, struct inode, i_data));
         dev->dev_mapping = old_mapping;
         mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 36493ce71f9a..98cc14725ba9 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -38,11 +38,12 @@
 /* position control register for hardware window 0, 2 ~ 4.*/
 #define VIDOSD_A(win)           (VIDOSD_BASE + 0x00 + (win) * 16)
 #define VIDOSD_B(win)           (VIDOSD_BASE + 0x04 + (win) * 16)
-/* size control register for hardware window 0. */
-#define VIDOSD_C_SIZE_W0        (VIDOSD_BASE + 0x08)
-/* alpha control register for hardware window 1 ~ 4. */
-#define VIDOSD_C(win)           (VIDOSD_BASE + 0x18 + (win) * 16)
-/* size control register for hardware window 1 ~ 4. */
+/*
+ * size control register for hardware windows 0 and alpha control register
+ * for hardware windows 1 ~ 4
+ */
+#define VIDOSD_C(win)           (VIDOSD_BASE + 0x08 + (win) * 16)
+/* size control register for hardware windows 1 ~ 2. */
 #define VIDOSD_D(win)           (VIDOSD_BASE + 0x0C + (win) * 16)
 
 #define VIDWx_BUF_START(win, buf)       (VIDW_BUF_START(buf) + (win) * 8)
@@ -50,9 +51,9 @@
 #define VIDWx_BUF_SIZE(win, buf)        (VIDW_BUF_SIZE(buf) + (win) * 4)
 
 /* color key control register for hardware window 1 ~ 4. */
-#define WKEYCON0_BASE(x)                ((WKEYCON0 + 0x140) + (x * 8))
+#define WKEYCON0_BASE(x)                ((WKEYCON0 + 0x140) + ((x - 1) * 8))
 /* color key value register for hardware window 1 ~ 4. */
-#define WKEYCON1_BASE(x)                ((WKEYCON1 + 0x140) + (x * 8))
+#define WKEYCON1_BASE(x)                ((WKEYCON1 + 0x140) + ((x - 1) * 8))
 
 /* FIMD has totally five hardware windows. */
 #define WINDOWS_NR      5
@@ -109,9 +110,9 @@ struct fimd_context {
 
 #ifdef CONFIG_OF
 static const struct of_device_id fimd_driver_dt_match[] = {
-        { .compatible = "samsung,exynos4-fimd",
+        { .compatible = "samsung,exynos4210-fimd",
           .data = &exynos4_fimd_driver_data },
-        { .compatible = "samsung,exynos5-fimd",
+        { .compatible = "samsung,exynos5250-fimd",
           .data = &exynos5_fimd_driver_data },
         {},
 };
@@ -581,7 +582,7 @@ static void fimd_win_commit(struct device *dev, int zpos)
         if (win != 3 && win != 4) {
                 u32 offset = VIDOSD_D(win);
                 if (win == 0)
-                        offset = VIDOSD_C_SIZE_W0;
+                        offset = VIDOSD_C(win);
                 val = win_data->ovl_width * win_data->ovl_height;
                 writel(val, ctx->regs + offset);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 3b0da0378acf..47a493c8a71f 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -48,8 +48,14 @@
 
 /* registers for base address */
 #define G2D_SRC_BASE_ADDR               0x0304
+#define G2D_SRC_COLOR_MODE              0x030C
+#define G2D_SRC_LEFT_TOP                0x0310
+#define G2D_SRC_RIGHT_BOTTOM            0x0314
 #define G2D_SRC_PLANE2_BASE_ADDR        0x0318
 #define G2D_DST_BASE_ADDR               0x0404
+#define G2D_DST_COLOR_MODE              0x040C
+#define G2D_DST_LEFT_TOP                0x0410
+#define G2D_DST_RIGHT_BOTTOM            0x0414
 #define G2D_DST_PLANE2_BASE_ADDR        0x0418
 #define G2D_PAT_BASE_ADDR               0x0500
 #define G2D_MSK_BASE_ADDR               0x0520
@@ -82,7 +88,7 @@
 #define G2D_DMA_LIST_DONE_COUNT_OFFSET  17
 
 /* G2D_DMA_HOLD_CMD */
-#define G2D_USET_HOLD                   (1 << 2)
+#define G2D_USER_HOLD                   (1 << 2)
 #define G2D_LIST_HOLD                   (1 << 1)
 #define G2D_BITBLT_HOLD                 (1 << 0)
 
@@ -91,13 +97,27 @@
 #define G2D_START_NHOLT                 (1 << 1)
 #define G2D_START_BITBLT                (1 << 0)
 
+/* buffer color format */
+#define G2D_FMT_XRGB8888                0
+#define G2D_FMT_ARGB8888                1
+#define G2D_FMT_RGB565                  2
+#define G2D_FMT_XRGB1555                3
+#define G2D_FMT_ARGB1555                4
+#define G2D_FMT_XRGB4444                5
+#define G2D_FMT_ARGB4444                6
+#define G2D_FMT_PACKED_RGB888           7
+#define G2D_FMT_A8                      11
+#define G2D_FMT_L8                      12
+
+/* buffer valid length */
+#define G2D_LEN_MIN                     1
+#define G2D_LEN_MAX                     8000
+
 #define G2D_CMDLIST_SIZE                (PAGE_SIZE / 4)
 #define G2D_CMDLIST_NUM                 64
 #define G2D_CMDLIST_POOL_SIZE           (G2D_CMDLIST_SIZE * G2D_CMDLIST_NUM)
 #define G2D_CMDLIST_DATA_NUM            (G2D_CMDLIST_SIZE / sizeof(u32) - 2)
 
-#define MAX_BUF_ADDR_NR                 6
-
 /* maximum buffer pool size of userptr is 64MB as default */
 #define MAX_POOL                (64 * 1024 * 1024)
 
@@ -106,6 +126,17 @@ enum {
         BUF_TYPE_USERPTR,
 };
 
+enum g2d_reg_type {
+        REG_TYPE_NONE = -1,
+        REG_TYPE_SRC,
+        REG_TYPE_SRC_PLANE2,
+        REG_TYPE_DST,
+        REG_TYPE_DST_PLANE2,
+        REG_TYPE_PAT,
+        REG_TYPE_MSK,
+        MAX_REG_TYPE_NR
+};
+
 /* cmdlist data structure */
 struct g2d_cmdlist {
         u32             head;
@@ -113,6 +144,42 @@ struct g2d_cmdlist {
         u32             last;   /* last data offset */
 };
 
+/*
+ * A structure of buffer description
+ *
+ * @format: color format
+ * @left_x: the x coordinates of left top corner
+ * @top_y: the y coordinates of left top corner
+ * @right_x: the x coordinates of right bottom corner
+ * @bottom_y: the y coordinates of right bottom corner
+ *
+ */
+struct g2d_buf_desc {
+        unsigned int    format;
+        unsigned int    left_x;
+        unsigned int    top_y;
+        unsigned int    right_x;
+        unsigned int    bottom_y;
+};
+
+/*
+ * A structure of buffer information
+ *
+ * @map_nr: manages the number of mapped buffers
+ * @reg_types: stores regitster type in the order of requested command
+ * @handles: stores buffer handle in its reg_type position
+ * @types: stores buffer type in its reg_type position
+ * @descs: stores buffer description in its reg_type position
+ *
+ */
+struct g2d_buf_info {
+        unsigned int            map_nr;
+        enum g2d_reg_type       reg_types[MAX_REG_TYPE_NR];
+        unsigned long           handles[MAX_REG_TYPE_NR];
+        unsigned int            types[MAX_REG_TYPE_NR];
+        struct g2d_buf_desc     descs[MAX_REG_TYPE_NR];
+};
+
 struct drm_exynos_pending_g2d_event {
         struct drm_pending_event        base;
         struct drm_exynos_g2d_event     event;
@@ -131,14 +198,11 @@ struct g2d_cmdlist_userptr {
         bool                    in_pool;
         bool                    out_of_list;
 };
-
 struct g2d_cmdlist_node {
         struct list_head        list;
         struct g2d_cmdlist      *cmdlist;
-        unsigned int            map_nr;
-        unsigned long           handles[MAX_BUF_ADDR_NR];
-        unsigned int            obj_type[MAX_BUF_ADDR_NR];
         dma_addr_t              dma_addr;
+        struct g2d_buf_info     buf_info;
 
         struct drm_exynos_pending_g2d_event     *event;
 };
@@ -188,6 +252,7 @@ static int g2d_init_cmdlist(struct g2d_data *g2d)
         struct exynos_drm_subdrv *subdrv = &g2d->subdrv;
         int nr;
         int ret;
+        struct g2d_buf_info *buf_info;
 
         init_dma_attrs(&g2d->cmdlist_dma_attrs);
         dma_set_attr(DMA_ATTR_WRITE_COMBINE, &g2d->cmdlist_dma_attrs);
@@ -209,11 +274,17 @@ static int g2d_init_cmdlist(struct g2d_data *g2d)
         }
 
         for (nr = 0; nr < G2D_CMDLIST_NUM; nr++) {
+                unsigned int i;
+
                 node[nr].cmdlist =
                         g2d->cmdlist_pool_virt + nr * G2D_CMDLIST_SIZE;
                 node[nr].dma_addr =
                         g2d->cmdlist_pool + nr * G2D_CMDLIST_SIZE;
 
+                buf_info = &node[nr].buf_info;
+                for (i = 0; i < MAX_REG_TYPE_NR; i++)
+                        buf_info->reg_types[i] = REG_TYPE_NONE;
+
                 list_add_tail(&node[nr].list, &g2d->free_cmdlist);
         }
 
@@ -450,7 +521,7 @@ static dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
                                                 DMA_BIDIRECTIONAL);
         if (ret < 0) {
                 DRM_ERROR("failed to map sgt with dma region.\n");
-                goto err_free_sgt;
+                goto err_sg_free_table;
         }
 
         g2d_userptr->dma_addr = sgt->sgl[0].dma_address;
@@ -467,8 +538,10 @@ static dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
 
         return &g2d_userptr->dma_addr;
 
-err_free_sgt:
+err_sg_free_table:
         sg_free_table(sgt);
+
+err_free_sgt:
         kfree(sgt);
         sgt = NULL;
 
@@ -506,36 +579,172 @@ static void g2d_userptr_free_all(struct drm_device *drm_dev,
         g2d->current_pool = 0;
 }
 
+static enum g2d_reg_type g2d_get_reg_type(int reg_offset)
+{
+        enum g2d_reg_type reg_type;
+
+        switch (reg_offset) {
+        case G2D_SRC_BASE_ADDR:
+        case G2D_SRC_COLOR_MODE:
+        case G2D_SRC_LEFT_TOP:
+        case G2D_SRC_RIGHT_BOTTOM:
+                reg_type = REG_TYPE_SRC;
+                break;
+        case G2D_SRC_PLANE2_BASE_ADDR:
+                reg_type = REG_TYPE_SRC_PLANE2;
+                break;
+        case G2D_DST_BASE_ADDR:
+        case G2D_DST_COLOR_MODE:
+        case G2D_DST_LEFT_TOP:
+        case G2D_DST_RIGHT_BOTTOM:
+                reg_type = REG_TYPE_DST;
+                break;
+        case G2D_DST_PLANE2_BASE_ADDR:
+                reg_type = REG_TYPE_DST_PLANE2;
+                break;
+        case G2D_PAT_BASE_ADDR:
+                reg_type = REG_TYPE_PAT;
+                break;
+        case G2D_MSK_BASE_ADDR:
+                reg_type = REG_TYPE_MSK;
+                break;
+        default:
+                reg_type = REG_TYPE_NONE;
+                DRM_ERROR("Unknown register offset![%d]\n", reg_offset);
+                break;
+        };
+
+        return reg_type;
+}
+
+static unsigned long g2d_get_buf_bpp(unsigned int format)
+{
+        unsigned long bpp;
+
+        switch (format) {
+        case G2D_FMT_XRGB8888:
+        case G2D_FMT_ARGB8888:
+                bpp = 4;
+                break;
+        case G2D_FMT_RGB565:
+        case G2D_FMT_XRGB1555:
+        case G2D_FMT_ARGB1555:
+        case G2D_FMT_XRGB4444:
+        case G2D_FMT_ARGB4444:
+                bpp = 2;
+                break;
+        case G2D_FMT_PACKED_RGB888:
+                bpp = 3;
+                break;
+        default:
+                bpp = 1;
+                break;
+        }
+
+        return bpp;
+}
+
+static bool g2d_check_buf_desc_is_valid(struct g2d_buf_desc *buf_desc,
+                                                enum g2d_reg_type reg_type,
+                                                unsigned long size)
+{
+        unsigned int width, height;
+        unsigned long area;
+
+        /*
+         * check source and destination buffers only.
+         * so the others are always valid.
+         */
+        if (reg_type != REG_TYPE_SRC && reg_type != REG_TYPE_DST)
+                return true;
+
+        width = buf_desc->right_x - buf_desc->left_x;
+        if (width < G2D_LEN_MIN || width > G2D_LEN_MAX) {
+                DRM_ERROR("width[%u] is out of range!\n", width);
+                return false;
+        }
+
+        height = buf_desc->bottom_y - buf_desc->top_y;
+        if (height < G2D_LEN_MIN || height > G2D_LEN_MAX) {
+                DRM_ERROR("height[%u] is out of range!\n", height);
+                return false;
+        }
+
+        area = (unsigned long)width * (unsigned long)height *
+                                        g2d_get_buf_bpp(buf_desc->format);
+        if (area > size) {
+                DRM_ERROR("area[%lu] is out of range[%lu]!\n", area, size);
+                return false;
+        }
+
+        return true;
+}
+
 static int g2d_map_cmdlist_gem(struct g2d_data *g2d,
                                 struct g2d_cmdlist_node *node,
                                 struct drm_device *drm_dev,
                                 struct drm_file *file)
 {
         struct g2d_cmdlist *cmdlist = node->cmdlist;
+        struct g2d_buf_info *buf_info = &node->buf_info;
         int offset;
+        int ret;
         int i;
 
-        for (i = 0; i < node->map_nr; i++) {
+        for (i = 0; i < buf_info->map_nr; i++) {
+                struct g2d_buf_desc *buf_desc;
+                enum g2d_reg_type reg_type;
+                int reg_pos;
                 unsigned long handle;
                 dma_addr_t *addr;
 
-                offset = cmdlist->last - (i * 2 + 1);
-                handle = cmdlist->data[offset];
+                reg_pos = cmdlist->last - 2 * (i + 1);
+
+                offset = cmdlist->data[reg_pos];
+                handle = cmdlist->data[reg_pos + 1];
+
+                reg_type = g2d_get_reg_type(offset);
+                if (reg_type == REG_TYPE_NONE) {
+                        ret = -EFAULT;
+                        goto err;
+                }
+
+                buf_desc = &buf_info->descs[reg_type];
+
+                if (buf_info->types[reg_type] == BUF_TYPE_GEM) {
+                        unsigned long size;
+
+                        size = exynos_drm_gem_get_size(drm_dev, handle, file);
+                        if (!size) {
+                                ret = -EFAULT;
+                                goto err;
+                        }
+
+                        if (!g2d_check_buf_desc_is_valid(buf_desc, reg_type,
+                                                                        size)) {
+                                ret = -EFAULT;
+                                goto err;
+                        }
 
-                if (node->obj_type[i] == BUF_TYPE_GEM) {
                         addr = exynos_drm_gem_get_dma_addr(drm_dev, handle,
                                                                 file);
                         if (IS_ERR(addr)) {
-                                node->map_nr = i;
-                                return -EFAULT;
+                                ret = -EFAULT;
+                                goto err;
                         }
                 } else {
                         struct drm_exynos_g2d_userptr g2d_userptr;
 
                         if (copy_from_user(&g2d_userptr, (void __user *)handle,
                                 sizeof(struct drm_exynos_g2d_userptr))) {
-                                node->map_nr = i;
-                                return -EFAULT;
+                                ret = -EFAULT;
+                                goto err;
+                        }
+
+                        if (!g2d_check_buf_desc_is_valid(buf_desc, reg_type,
+                                                        g2d_userptr.size)) {
+                                ret = -EFAULT;
+                                goto err;
                         }
 
                         addr = g2d_userptr_get_dma_addr(drm_dev,
@@ -544,16 +753,21 @@ static int g2d_map_cmdlist_gem(struct g2d_data *g2d,
                                                         file,
                                                         &handle);
                         if (IS_ERR(addr)) {
-                                node->map_nr = i;
-                                return -EFAULT;
+                                ret = -EFAULT;
+                                goto err;
                         }
                 }
 
-                cmdlist->data[offset] = *addr;
-                node->handles[i] = handle;
+                cmdlist->data[reg_pos + 1] = *addr;
+                buf_info->reg_types[i] = reg_type;
+                buf_info->handles[reg_type] = handle;
         }
 
         return 0;
+
+err:
+        buf_info->map_nr = i;
+        return ret;
 }
 
 static void g2d_unmap_cmdlist_gem(struct g2d_data *g2d,
@@ -561,22 +775,33 @@ static void g2d_unmap_cmdlist_gem(struct g2d_data *g2d,
                                   struct drm_file *filp)
 {
         struct exynos_drm_subdrv *subdrv = &g2d->subdrv;
+        struct g2d_buf_info *buf_info = &node->buf_info;
         int i;
 
-        for (i = 0; i < node->map_nr; i++) {
-                unsigned long handle = node->handles[i];
+        for (i = 0; i < buf_info->map_nr; i++) {
+                struct g2d_buf_desc *buf_desc;
+                enum g2d_reg_type reg_type;
+                unsigned long handle;
+
+                reg_type = buf_info->reg_types[i];
+
+                buf_desc = &buf_info->descs[reg_type];
+                handle = buf_info->handles[reg_type];
 
-                if (node->obj_type[i] == BUF_TYPE_GEM)
+                if (buf_info->types[reg_type] == BUF_TYPE_GEM)
                         exynos_drm_gem_put_dma_addr(subdrv->drm_dev, handle,
                                                         filp);
                 else
                         g2d_userptr_put_dma_addr(subdrv->drm_dev, handle,
                                                         false);
 
-                node->handles[i] = 0;
+                buf_info->reg_types[i] = REG_TYPE_NONE;
+                buf_info->handles[reg_type] = 0;
+                buf_info->types[reg_type] = 0;
+                memset(buf_desc, 0x00, sizeof(*buf_desc));
         }
 
-        node->map_nr = 0;
+        buf_info->map_nr = 0;
 }
 
 static void g2d_dma_start(struct g2d_data *g2d,
@@ -589,10 +814,6 @@ static void g2d_dma_start(struct g2d_data *g2d,
         pm_runtime_get_sync(g2d->dev);
         clk_enable(g2d->gate_clk);
 
-        /* interrupt enable */
-        writel_relaxed(G2D_INTEN_ACF | G2D_INTEN_UCF | G2D_INTEN_GCF,
-                        g2d->regs + G2D_INTEN);
-
         writel_relaxed(node->dma_addr, g2d->regs + G2D_DMA_SFR_BASE_ADDR);
         writel_relaxed(G2D_DMA_START, g2d->regs + G2D_DMA_COMMAND);
 }
@@ -643,7 +864,6 @@ static void g2d_runqueue_worker(struct work_struct *work)
         struct g2d_data *g2d = container_of(work, struct g2d_data,
                                             runqueue_work);
 
-
         mutex_lock(&g2d->runqueue_mutex);
         clk_disable(g2d->gate_clk);
         pm_runtime_put_sync(g2d->dev);
@@ -724,20 +944,14 @@ static int g2d_check_reg_offset(struct device *dev,
         int i;
 
         for (i = 0; i < nr; i++) {
-                index = cmdlist->last - 2 * (i + 1);
+                struct g2d_buf_info *buf_info = &node->buf_info;
+                struct g2d_buf_desc *buf_desc;
+                enum g2d_reg_type reg_type;
+                unsigned long value;
 
-                if (for_addr) {
-                        /* check userptr buffer type. */
-                        reg_offset = (cmdlist->data[index] &
-                                        ~0x7fffffff) >> 31;
-                        if (reg_offset) {
-                                node->obj_type[i] = BUF_TYPE_USERPTR;
-                                cmdlist->data[index] &= ~G2D_BUF_USERPTR;
-                        }
-                }
+                index = cmdlist->last - 2 * (i + 1);
 
                 reg_offset = cmdlist->data[index] & ~0xfffff000;
-
                 if (reg_offset < G2D_VALID_START || reg_offset > G2D_VALID_END)
                         goto err;
                 if (reg_offset % 4)
@@ -753,8 +967,60 @@ static int g2d_check_reg_offset(struct device *dev,
                         if (!for_addr)
                                 goto err;
 
-                        if (node->obj_type[i] != BUF_TYPE_USERPTR)
-                                node->obj_type[i] = BUF_TYPE_GEM;
+                        reg_type = g2d_get_reg_type(reg_offset);
+                        if (reg_type == REG_TYPE_NONE)
+                                goto err;
+
+                        /* check userptr buffer type. */
+                        if ((cmdlist->data[index] & ~0x7fffffff) >> 31) {
+                                buf_info->types[reg_type] = BUF_TYPE_USERPTR;
+                                cmdlist->data[index] &= ~G2D_BUF_USERPTR;
+                        } else
+                                buf_info->types[reg_type] = BUF_TYPE_GEM;
+                        break;
+                case G2D_SRC_COLOR_MODE:
+                case G2D_DST_COLOR_MODE:
+                        if (for_addr)
+                                goto err;
+
+                        reg_type = g2d_get_reg_type(reg_offset);
+                        if (reg_type == REG_TYPE_NONE)
+                                goto err;
+
+                        buf_desc = &buf_info->descs[reg_type];
+                        value = cmdlist->data[index + 1];
+
+                        buf_desc->format = value & 0xf;
+                        break;
+                case G2D_SRC_LEFT_TOP:
+                case G2D_DST_LEFT_TOP:
+                        if (for_addr)
+                                goto err;
+
+                        reg_type = g2d_get_reg_type(reg_offset);
+                        if (reg_type == REG_TYPE_NONE)
+                                goto err;
+
+                        buf_desc = &buf_info->descs[reg_type];
+                        value = cmdlist->data[index + 1];
+
+                        buf_desc->left_x = value & 0x1fff;
+                        buf_desc->top_y = (value & 0x1fff0000) >> 16;
+                        break;
+                case G2D_SRC_RIGHT_BOTTOM:
+                case G2D_DST_RIGHT_BOTTOM:
+                        if (for_addr)
+                                goto err;
+
+                        reg_type = g2d_get_reg_type(reg_offset);
+                        if (reg_type == REG_TYPE_NONE)
+                                goto err;
+
+                        buf_desc = &buf_info->descs[reg_type];
+                        value = cmdlist->data[index + 1];
+
+                        buf_desc->right_x = value & 0x1fff;
+                        buf_desc->bottom_y = (value & 0x1fff0000) >> 16;
                         break;
                 default:
                         if (for_addr)
@@ -860,9 +1126,23 @@ int exynos_g2d_set_cmdlist_ioctl(struct drm_device *drm_dev, void *data,
         cmdlist->data[cmdlist->last++] = G2D_SRC_BASE_ADDR;
         cmdlist->data[cmdlist->last++] = 0;
 
+        /*
+         * 'LIST_HOLD' command should be set to the DMA_HOLD_CMD_REG
+         * and GCF bit should be set to INTEN register if user wants
+         * G2D interrupt event once current command list execution is
+         * finished.
+         * Otherwise only ACF bit should be set to INTEN register so
+         * that one interrupt is occured after all command lists
+         * have been completed.
+         */
         if (node->event) {
+                cmdlist->data[cmdlist->last++] = G2D_INTEN;
+                cmdlist->data[cmdlist->last++] = G2D_INTEN_ACF | G2D_INTEN_GCF;
                 cmdlist->data[cmdlist->last++] = G2D_DMA_HOLD_CMD;
                 cmdlist->data[cmdlist->last++] = G2D_LIST_HOLD;
+        } else {
+                cmdlist->data[cmdlist->last++] = G2D_INTEN;
+                cmdlist->data[cmdlist->last++] = G2D_INTEN_ACF;
         }
 
         /* Check size of cmdlist: last 2 is about G2D_BITBLT_START */
@@ -887,7 +1167,7 @@ int exynos_g2d_set_cmdlist_ioctl(struct drm_device *drm_dev, void *data,
         if (ret < 0)
                 goto err_free_event;
 
-        node->map_nr = req->cmd_buf_nr;
+        node->buf_info.map_nr = req->cmd_buf_nr;
         if (req->cmd_buf_nr) {
                 struct drm_exynos_g2d_cmd *cmd_buf;
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index 67e17ce112b6..0e6fe000578c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -164,6 +164,27 @@ out:
         exynos_gem_obj = NULL;
 }
 
+unsigned long exynos_drm_gem_get_size(struct drm_device *dev,
+                                                unsigned int gem_handle,
+                                                struct drm_file *file_priv)
+{
+        struct exynos_drm_gem_obj *exynos_gem_obj;
+        struct drm_gem_object *obj;
+
+        obj = drm_gem_object_lookup(dev, file_priv, gem_handle);
+        if (!obj) {
+                DRM_ERROR("failed to lookup gem object.\n");
+                return 0;
+        }
+
+        exynos_gem_obj = to_exynos_gem_obj(obj);
+
+        drm_gem_object_unreference_unlocked(obj);
+
+        return exynos_gem_obj->buffer->size;
+}
+
+
 struct exynos_drm_gem_obj *exynos_drm_gem_init(struct drm_device *dev,
                                                       unsigned long size)
 {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.h b/drivers/gpu/drm/exynos/exynos_drm_gem.h
index 35ebac47dc2b..468766bee450 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.h
@@ -130,6 +130,11 @@ int exynos_drm_gem_userptr_ioctl(struct drm_device *dev, void *data,
 int exynos_drm_gem_get_ioctl(struct drm_device *dev, void *data,
                                       struct drm_file *file_priv);
 
+/* get buffer size to gem handle. */
+unsigned long exynos_drm_gem_get_size(struct drm_device *dev,
+                                                unsigned int gem_handle,
+                                                struct drm_file *file_priv);
+
 /* initialize gem object. */
 int exynos_drm_gem_init_object(struct drm_gem_object *obj);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 13ccbd4bcfaa..9504b0cd825a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -117,13 +117,12 @@ static struct edid *vidi_get_edid(struct device *dev,
         }
 
         edid_len = (1 + ctx->raw_edid->extensions) * EDID_LENGTH;
-        edid = kzalloc(edid_len, GFP_KERNEL);
+        edid = kmemdup(ctx->raw_edid, edid_len, GFP_KERNEL);
         if (!edid) {
                 DRM_DEBUG_KMS("failed to allocate edid\n");
                 return ERR_PTR(-ENOMEM);
         }
 
-        memcpy(edid, ctx->raw_edid, edid_len);
         return edid;
 }
 
@@ -563,12 +562,11 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
                         return -EINVAL;
                 }
                 edid_len = (1 + raw_edid->extensions) * EDID_LENGTH;
-                ctx->raw_edid = kzalloc(edid_len, GFP_KERNEL);
+                ctx->raw_edid = kmemdup(raw_edid, edid_len, GFP_KERNEL);
                 if (!ctx->raw_edid) {
                         DRM_DEBUG_KMS("failed to allocate raw_edid.\n");
                         return -ENOMEM;
                 }
-                memcpy(ctx->raw_edid, raw_edid, edid_len);
         } else {
                 /*
                  * with connection = 0, free raw_edid
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index e919aba29b3d..2f4f72f07047 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -818,7 +818,7 @@ static void mixer_win_disable(void *ctx, int win)
         mixer_ctx->win_data[win].enabled = false;
 }
 
-int mixer_check_timing(void *ctx, struct fb_videomode *timing)
+static int mixer_check_timing(void *ctx, struct fb_videomode *timing)
 {
         struct mixer_context *mixer_ctx = ctx;
         u32 w, h;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 0a8eceb75902..e9b57893db2b 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -125,6 +125,11 @@ MODULE_PARM_DESC(preliminary_hw_support,
                 "Enable Haswell and ValleyView Support. "
                 "(default: false)");
 
+int i915_disable_power_well __read_mostly = 0;
+module_param_named(disable_power_well, i915_disable_power_well, int, 0600);
+MODULE_PARM_DESC(disable_power_well,
+                 "Disable the power well when possible (default: false)");
+
 static struct drm_driver driver;
 extern int intel_agp_enabled;
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index e95337c97459..01769e2a9953 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1398,6 +1398,7 @@ extern int i915_enable_fbc __read_mostly;
 extern bool i915_enable_hangcheck __read_mostly;
 extern int i915_enable_ppgtt __read_mostly;
 extern unsigned int i915_preliminary_hw_support __read_mostly;
+extern int i915_disable_power_well __read_mostly;
 
 extern int i915_suspend(struct drm_device *dev, pm_message_t state);
 extern int i915_resume(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 3b11ab0fbc96..9a48e1a2d417 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -57,7 +57,7 @@ eb_create(struct drm_i915_gem_execbuffer2 *args)
         if (eb == NULL) {
                 int size = args->buffer_count;
                 int count = PAGE_SIZE / sizeof(struct hlist_head) / 2;
-                BUILD_BUG_ON(!is_power_of_2(PAGE_SIZE / sizeof(struct hlist_head)));
+                BUILD_BUG_ON_NOT_POWER_OF_2(PAGE_SIZE / sizeof(struct hlist_head));
                 while (count > 2*size)
                         count >>= 1;
                 eb = kzalloc(count*sizeof(struct hlist_head) +
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 32a3693905ec..1ce45a0a2d3e 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -45,6 +45,9 @@
 
 struct intel_crt {
         struct intel_encoder base;
+        /* DPMS state is stored in the connector, which we need in the
+         * encoder's enable/disable callbacks */
+        struct intel_connector *connector;
         bool force_hotplug_required;
         u32 adpa_reg;
 };
@@ -81,29 +84,6 @@ static bool intel_crt_get_hw_state(struct intel_encoder *encoder,
         return true;
 }
 
-static void intel_disable_crt(struct intel_encoder *encoder)
-{
-        struct drm_i915_private *dev_priv = encoder->base.dev->dev_private;
-        struct intel_crt *crt = intel_encoder_to_crt(encoder);
-        u32 temp;
-
-        temp = I915_READ(crt->adpa_reg);
-        temp |= ADPA_HSYNC_CNTL_DISABLE | ADPA_VSYNC_CNTL_DISABLE;
-        temp &= ~ADPA_DAC_ENABLE;
-        I915_WRITE(crt->adpa_reg, temp);
-}
-
-static void intel_enable_crt(struct intel_encoder *encoder)
-{
-        struct drm_i915_private *dev_priv = encoder->base.dev->dev_private;
-        struct intel_crt *crt = intel_encoder_to_crt(encoder);
-        u32 temp;
-
-        temp = I915_READ(crt->adpa_reg);
-        temp |= ADPA_DAC_ENABLE;
-        I915_WRITE(crt->adpa_reg, temp);
-}
-
 /* Note: The caller is required to filter out dpms modes not supported by the
  * platform. */
 static void intel_crt_set_dpms(struct intel_encoder *encoder, int mode)
@@ -135,6 +115,19 @@ static void intel_crt_set_dpms(struct intel_encoder *encoder, int mode)
         I915_WRITE(crt->adpa_reg, temp);
 }
 
+static void intel_disable_crt(struct intel_encoder *encoder)
+{
+        intel_crt_set_dpms(encoder, DRM_MODE_DPMS_OFF);
+}
+
+static void intel_enable_crt(struct intel_encoder *encoder)
+{
+        struct intel_crt *crt = intel_encoder_to_crt(encoder);
+
+        intel_crt_set_dpms(encoder, crt->connector->base.dpms);
+}
+
+
 static void intel_crt_dpms(struct drm_connector *connector, int mode)
 {
         struct drm_device *dev = connector->dev;
@@ -746,6 +739,7 @@ void intel_crt_init(struct drm_device *dev)
         }
 
         connector = &intel_connector->base;
+        crt->connector = intel_connector;
         drm_connector_init(dev, &intel_connector->base,
                            &intel_crt_connector_funcs, DRM_MODE_CONNECTOR_VGA);
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 287b42c9d1a8..b20d50192fcc 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5771,6 +5771,11 @@ static int haswell_crtc_mode_set(struct drm_crtc *crtc,
                 num_connectors++;
         }
 
+        if (is_cpu_edp)
+                intel_crtc->cpu_transcoder = TRANSCODER_EDP;
+        else
+                intel_crtc->cpu_transcoder = pipe;
+
         /* We are not sure yet this won't happen. */
         WARN(!HAS_PCH_LPT(dev), "Unexpected PCH type %d\n",
              INTEL_PCH_TYPE(dev));
@@ -5837,11 +5842,6 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
         int pipe = intel_crtc->pipe;
         int ret;
 
-        if (IS_HASWELL(dev) && intel_pipe_has_type(crtc, INTEL_OUTPUT_EDP))
-                intel_crtc->cpu_transcoder = TRANSCODER_EDP;
-        else
-                intel_crtc->cpu_transcoder = pipe;
-
         drm_vblank_pre_modeset(dev, pipe);
 
         ret = dev_priv->display.crtc_mode_set(crtc, mode, adjusted_mode,
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index d7d4afe01341..8fc93f90a7cd 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -2559,12 +2559,15 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder)
 {
         struct intel_digital_port *intel_dig_port = enc_to_dig_port(encoder);
         struct intel_dp *intel_dp = &intel_dig_port->dp;
+        struct drm_device *dev = intel_dp_to_dev(intel_dp);
 
         i2c_del_adapter(&intel_dp->adapter);
         drm_encoder_cleanup(encoder);
         if (is_edp(intel_dp)) {
                 cancel_delayed_work_sync(&intel_dp->panel_vdd_work);
+                mutex_lock(&dev->mode_config.mutex);
                 ironlake_panel_vdd_off_sync(intel_dp);
+                mutex_unlock(&dev->mode_config.mutex);
         }
         kfree(intel_dig_port);
 }
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index a3730e0289e5..bee8cb6108a7 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -321,9 +321,6 @@ void intel_panel_enable_backlight(struct drm_device *dev,
         if (dev_priv->backlight_level == 0)
                 dev_priv->backlight_level = intel_panel_get_max_backlight(dev);
 
-        dev_priv->backlight_enabled = true;
-        intel_panel_actually_set_backlight(dev, dev_priv->backlight_level);
-
         if (INTEL_INFO(dev)->gen >= 4) {
                 uint32_t reg, tmp;
 
@@ -359,12 +356,12 @@ void intel_panel_enable_backlight(struct drm_device *dev,
         }
 
 set_level:
-        /* Check the current backlight level and try to set again if it's zero.
-         * On some machines, BLC_PWM_CPU_CTL is cleared to zero automatically
-         * when BLC_PWM_CPU_CTL2 and BLC_PWM_PCH_CTL1 are written.
+        /* Call below after setting BLC_PWM_CPU_CTL2 and BLC_PWM_PCH_CTL1.
+         * BLC_PWM_CPU_CTL may be cleared to zero automatically when these
+         * registers are set.
          */
-        if (!intel_panel_get_backlight(dev))
-                intel_panel_actually_set_backlight(dev, dev_priv->backlight_level);
+        dev_priv->backlight_enabled = true;
+        intel_panel_actually_set_backlight(dev, dev_priv->backlight_level);
 }
 
 static void intel_panel_init_backlight(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index a1794c6df1bf..adca00783e61 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4079,6 +4079,9 @@ void intel_set_power_well(struct drm_device *dev, bool enable)
         if (!IS_HASWELL(dev))
                 return;
 
+        if (!i915_disable_power_well && !enable)
+                return;
+
         tmp = I915_READ(HSW_PWR_WELL_DRIVER);
         is_enabled = tmp & HSW_PWR_WELL_STATE;
         enable_requested = tmp & HSW_PWR_WELL_ENABLE;
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index fe22bb780e1d..78d8e919509f 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -751,8 +751,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
         int i;
         unsigned char misc = 0;
         unsigned char ext_vga[6];
-        unsigned char ext_vga_index24;
-        unsigned char dac_index90 = 0;
         u8 bppshift;
 
         static unsigned char dacvalue[] = {
@@ -803,7 +801,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
                 option2 = 0x0000b000;
                 break;
         case G200_ER:
-                dac_index90 = 0;
                 break;
         }
 
@@ -852,10 +849,8 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
                 WREG_DAC(i, dacvalue[i]);
         }
 
-        if (mdev->type == G200_ER) {
-                WREG_DAC(0x90, dac_index90);
-        }
-
+        if (mdev->type == G200_ER)
+                WREG_DAC(0x90, 0);
 
         if (option)
                 pci_write_config_dword(dev->pdev, PCI_MGA_OPTION, option);
@@ -952,8 +947,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
         if (mdev->type == G200_WB)
                 ext_vga[1] |= 0x88;
 
-        ext_vga_index24 = 0x05;
-
         /* Set pixel clocks */
         misc = 0x2d;
         WREG8(MGA_MISC_OUT, misc);
@@ -965,7 +958,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
         }
 
         if (mdev->type == G200_ER)
-                WREG_ECRT(24, ext_vga_index24);
+                WREG_ECRT(0x24, 0x5);
 
         if (mdev->type == G200_EV) {
                 WREG_ECRT(6, 0);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
index e816f06637a7..0e2c1a4f1659 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
@@ -248,6 +248,22 @@ nouveau_bios_shadow_pci(struct nouveau_bios *bios)
         }
 }
 
+static void
+nouveau_bios_shadow_platform(struct nouveau_bios *bios)
+{
+        struct pci_dev *pdev = nv_device(bios)->pdev;
+        size_t size;
+
+        void __iomem *rom = pci_platform_rom(pdev, &size);
+        if (rom && size) {
+                bios->data = kmalloc(size, GFP_KERNEL);
+                if (bios->data) {
+                        memcpy_fromio(bios->data, rom, size);
+                        bios->size = size;
+                }
+        }
+}
+
 static int
 nouveau_bios_score(struct nouveau_bios *bios, const bool writeable)
 {
@@ -288,6 +304,7 @@ nouveau_bios_shadow(struct nouveau_bios *bios)
                 { "PROM", nouveau_bios_shadow_prom, false, 0, 0, NULL },
                 { "ACPI", nouveau_bios_shadow_acpi, true, 0, 0, NULL },
                 { "PCIROM", nouveau_bios_shadow_pci, true, 0, 0, NULL },
+                { "PLATFORM", nouveau_bios_shadow_platform, true, 0, 0, NULL },
                 {}
         };
         struct methods *mthd, *best;
diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index 3b6dc883e150..5eb3e0da7c6e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -391,7 +391,7 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct nouveau_device *device = nv_device(drm->device);
         struct nouveau_abi16 *abi16 = nouveau_abi16_get(file_priv, dev);
-        struct nouveau_abi16_chan *chan, *temp;
+        struct nouveau_abi16_chan *chan = NULL, *temp;
         struct nouveau_abi16_ntfy *ntfy;
         struct nouveau_object *object;
         struct nv_dma_class args = {};
@@ -404,10 +404,11 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
         if (unlikely(nv_device(abi16->device)->card_type >= NV_C0))
                 return nouveau_abi16_put(abi16, -EINVAL);
 
-        list_for_each_entry_safe(chan, temp, &abi16->channels, head) {
-                if (chan->chan->handle == (NVDRM_CHAN | info->channel))
+        list_for_each_entry(temp, &abi16->channels, head) {
+                if (temp->chan->handle == (NVDRM_CHAN | info->channel)) {
+                        chan = temp;
                         break;
-                chan = NULL;
+                }
         }
 
         if (!chan)
@@ -459,17 +460,18 @@ nouveau_abi16_ioctl_gpuobj_free(ABI16_IOCTL_ARGS)
 {
         struct drm_nouveau_gpuobj_free *fini = data;
         struct nouveau_abi16 *abi16 = nouveau_abi16_get(file_priv, dev);
-        struct nouveau_abi16_chan *chan, *temp;
+        struct nouveau_abi16_chan *chan = NULL, *temp;
         struct nouveau_abi16_ntfy *ntfy;
         int ret;
 
         if (unlikely(!abi16))
                 return -ENOMEM;
 
-        list_for_each_entry_safe(chan, temp, &abi16->channels, head) {
-                if (chan->chan->handle == (NVDRM_CHAN | fini->channel))
+        list_for_each_entry(temp, &abi16->channels, head) {
+                if (temp->chan->handle == (NVDRM_CHAN | fini->channel)) {
+                        chan = temp;
                         break;
-                chan = NULL;
+                }
         }
 
         if (!chan)
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index d1099365bfc1..c95decf543e9 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -72,11 +72,25 @@ module_param_named(modeset, nouveau_modeset, int, 0400);
 static struct drm_driver driver;
 
 static int
+nouveau_drm_vblank_handler(struct nouveau_eventh *event, int head)
+{
+        struct nouveau_drm *drm =
+                container_of(event, struct nouveau_drm, vblank[head]);
+        drm_handle_vblank(drm->dev, head);
+        return NVKM_EVENT_KEEP;
+}
+
+static int
 nouveau_drm_vblank_enable(struct drm_device *dev, int head)
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct nouveau_disp *pdisp = nouveau_disp(drm->device);
-        nouveau_event_get(pdisp->vblank, head, &drm->vblank);
+
+        if (WARN_ON_ONCE(head > ARRAY_SIZE(drm->vblank)))
+                return -EIO;
+        WARN_ON_ONCE(drm->vblank[head].func);
+        drm->vblank[head].func = nouveau_drm_vblank_handler;
+        nouveau_event_get(pdisp->vblank, head, &drm->vblank[head]);
         return 0;
 }
 
@@ -85,16 +99,11 @@ nouveau_drm_vblank_disable(struct drm_device *dev, int head)
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct nouveau_disp *pdisp = nouveau_disp(drm->device);
-        nouveau_event_put(pdisp->vblank, head, &drm->vblank);
-}
-
-static int
-nouveau_drm_vblank_handler(struct nouveau_eventh *event, int head)
-{
-        struct nouveau_drm *drm =
-                container_of(event, struct nouveau_drm, vblank);
-        drm_handle_vblank(drm->dev, head);
-        return NVKM_EVENT_KEEP;
+        if (drm->vblank[head].func)
+                nouveau_event_put(pdisp->vblank, head, &drm->vblank[head]);
+        else
+                WARN_ON_ONCE(1);
+        drm->vblank[head].func = NULL;
 }
 
 static u64
@@ -292,7 +301,6 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
 
         dev->dev_private = drm;
         drm->dev = dev;
-        drm->vblank.func = nouveau_drm_vblank_handler;
 
         INIT_LIST_HEAD(&drm->clients);
         spin_lock_init(&drm->tile.lock);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.h b/drivers/gpu/drm/nouveau/nouveau_drm.h
index b25df374c901..9c39bafbef2c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.h
@@ -113,7 +113,7 @@ struct nouveau_drm {
         struct nvbios vbios;
         struct nouveau_display *display;
         struct backlight_device *backlight;
-        struct nouveau_eventh vblank;
+        struct nouveau_eventh vblank[4];
 
         /* power management */
         struct nouveau_pm *pm;
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 7f0e6c3f37d1..1ddc03e51bf4 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -479,7 +479,7 @@ nv50_display_flip_wait(void *data)
 {
         struct nv50_display_flip *flip = data;
         if (nouveau_bo_rd32(flip->disp->sync, flip->chan->addr / 4) ==
-                                              flip->chan->data);
+                                              flip->chan->data)
                 return true;
         usleep_range(1, 2);
         return false;
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index b8015913d382..fa3c56fba294 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -99,6 +99,29 @@ static bool radeon_read_bios(struct radeon_device *rdev)
         return true;
 }
 
+static bool radeon_read_platform_bios(struct radeon_device *rdev)
+{
+        uint8_t __iomem *bios;
+        size_t size;
+
+        rdev->bios = NULL;
+
+        bios = pci_platform_rom(rdev->pdev, &size);
+        if (!bios) {
+                return false;
+        }
+
+        if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) {
+                return false;
+        }
+        rdev->bios = kmemdup(bios, size, GFP_KERNEL);
+        if (rdev->bios == NULL) {
+                return false;
+        }
+
+        return true;
+}
+
 #ifdef CONFIG_ACPI
 /* ATRM is used to get the BIOS on the discrete cards in
  * dual-gpu systems.
@@ -620,6 +643,9 @@ bool radeon_get_bios(struct radeon_device *rdev)
         if (r == false) {
                 r = radeon_read_disabled_bios(rdev);
         }
+        if (r == false) {
+                r = radeon_read_platform_bios(rdev);
+        }
         if (r == false || rdev->bios == NULL) {
                 DRM_ERROR("Unable to locate a BIOS ROM\n");
                 rdev->bios = NULL;
diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c
index fe5cdbcf2636..b44d548c56f8 100644
--- a/drivers/gpu/drm/udl/udl_connector.c
+++ b/drivers/gpu/drm/udl/udl_connector.c
@@ -61,6 +61,10 @@ static int udl_get_modes(struct drm_connector *connector)
         int ret;
 
         edid = (struct edid *)udl_get_edid(udl);
+        if (!edid) {
+                drm_mode_connector_update_edid_property(connector, NULL);
+                return 0;
+        }
 
         /*
          * We only read the main block, but if the monitor reports extension
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 512b01c04ea7..aa341d135867 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2077,7 +2077,6 @@ static const struct hid_device_id hid_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_HYBRID) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_HEATCONTROL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_BEATPAD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MASTERKIT, USB_DEVICE_ID_MASTERKIT_MA901RADIO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MCC, USB_DEVICE_ID_MCC_PMD1024LS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MCC, USB_DEVICE_ID_MCC_PMD1208LS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICKIT1) },
@@ -2244,6 +2243,18 @@ bool hid_ignore(struct hid_device *hdev)
                      hdev->product <= USB_DEVICE_ID_VELLEMAN_K8061_LAST))
                         return true;
                 break;
+        case USB_VENDOR_ID_ATMEL_V_USB:
+                /* Masterkit MA901 usb radio based on Atmel tiny85 chip and
+                 * it has the same USB ID as many Atmel V-USB devices. This
+                 * usb radio is handled by radio-ma901.c driver so we want
+                 * ignore the hid. Check the name, bus, product and ignore
+                 * if we have MA901 usb radio.
+                 */
+                if (hdev->product == USB_DEVICE_ID_ATMEL_V_USB &&
+                        hdev->bus == BUS_USB &&
+                        strncmp(hdev->name, "www.masterkit.ru MA901", 22) == 0)
+                        return true;
+                break;
         }
 
         if (hdev->type == HID_TYPE_USBMOUSE &&
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 92e47e5c9564..5309fd5eb0eb 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -158,6 +158,8 @@
 #define USB_VENDOR_ID_ATMEL             0x03eb
 #define USB_DEVICE_ID_ATMEL_MULTITOUCH  0x211c
 #define USB_DEVICE_ID_ATMEL_MXT_DIGITIZER       0x2118
+#define USB_VENDOR_ID_ATMEL_V_USB       0x16c0
+#define USB_DEVICE_ID_ATMEL_V_USB       0x05df
 
 #define USB_VENDOR_ID_AUREAL            0x0755
 #define USB_DEVICE_ID_AUREAL_W01RN      0x2626
@@ -557,9 +559,6 @@
 #define USB_VENDOR_ID_MADCATZ           0x0738
 #define USB_DEVICE_ID_MADCATZ_BEATPAD   0x4540
 
-#define USB_VENDOR_ID_MASTERKIT                 0x16c0
-#define USB_DEVICE_ID_MASTERKIT_MA901RADIO      0x05df
-
 #define USB_VENDOR_ID_MCC               0x09db
 #define USB_DEVICE_ID_MCC_PMD1024LS     0x0076
 #define USB_DEVICE_ID_MCC_PMD1208LS     0x007a
@@ -590,6 +589,9 @@
 #define USB_VENDOR_ID_MONTEREY          0x0566
 #define USB_DEVICE_ID_GENIUS_KB29E      0x3004
 
+#define USB_VENDOR_ID_MSI               0x1770
+#define USB_DEVICE_ID_MSI_GX680R_LED_PANEL      0xff00
+
 #define USB_VENDOR_ID_NATIONAL_SEMICONDUCTOR 0x0400
 #define USB_DEVICE_ID_N_S_HARMONY       0xc359
 
@@ -684,6 +686,9 @@
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001         0x3001
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008         0x3008
 
+#define USB_VENDOR_ID_REALTEK           0x0bda
+#define USB_DEVICE_ID_REALTEK_READER    0x0152
+
 #define USB_VENDOR_ID_ROCCAT            0x1e7d
 #define USB_DEVICE_ID_ROCCAT_ARVO       0x30d4
 #define USB_DEVICE_ID_ROCCAT_ISKU       0x319c
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index f7f113ba083e..a8ce44296cfd 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -462,6 +462,21 @@ static int magicmouse_input_mapping(struct hid_device *hdev,
         return 0;
 }
 
+static void magicmouse_input_configured(struct hid_device *hdev,
+                struct hid_input *hi)
+
+{
+        struct magicmouse_sc *msc = hid_get_drvdata(hdev);
+
+        int ret = magicmouse_setup_input(msc->input, hdev);
+        if (ret) {
+                hid_err(hdev, "magicmouse setup input failed (%d)\n", ret);
+                /* clean msc->input to notify probe() of the failure */
+                msc->input = NULL;
+        }
+}
+
+
 static int magicmouse_probe(struct hid_device *hdev,
         const struct hid_device_id *id)
 {
@@ -493,15 +508,10 @@ static int magicmouse_probe(struct hid_device *hdev,
                 goto err_free;
         }
 
-        /* We do this after hid-input is done parsing reports so that
-         * hid-input uses the most natural button and axis IDs.
-         */
-        if (msc->input) {
-                ret = magicmouse_setup_input(msc->input, hdev);
-                if (ret) {
-                        hid_err(hdev, "magicmouse setup input failed (%d)\n", ret);
-                        goto err_stop_hw;
-                }
+        if (!msc->input) {
+                hid_err(hdev, "magicmouse input not registered\n");
+                ret = -ENOMEM;
+                goto err_stop_hw;
         }
 
         if (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE)
@@ -568,6 +578,7 @@ static struct hid_driver magicmouse_driver = {
         .remove = magicmouse_remove,
         .raw_event = magicmouse_raw_event,
         .input_mapping = magicmouse_input_mapping,
+        .input_configured = magicmouse_input_configured,
 };
 module_hid_driver(magicmouse_driver);
 
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 7a1ebb867cf4..82e9211b3ca9 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -621,6 +621,7 @@ static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field,
 {
         struct mt_device *td = hid_get_drvdata(hid);
         __s32 quirks = td->mtclass.quirks;
+        struct input_dev *input = field->hidinput->input;
 
         if (hid->claimed & HID_CLAIMED_INPUT) {
                 switch (usage->hid) {
@@ -670,13 +671,16 @@ static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field,
                         break;
 
                 default:
+                        if (usage->type)
+                                input_event(input, usage->type, usage->code,
+                                                value);
                         return;
                 }
 
                 if (usage->usage_index + 1 == field->report_count) {
                         /* we only take into account the last report. */
                         if (usage->hid == td->last_slot_field)
-                                mt_complete_slot(td, field->hidinput->input);
+                                mt_complete_slot(td, input);
 
                         if (field->index == td->last_field_index
                                 && td->num_received >= td->num_expected)
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index e0e6abf1cd3b..19b8360f2330 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -73,6 +73,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
@@ -80,6 +81,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_REALTEK, USB_DEVICE_ID_REALTEK_READER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_SIGMATEL, USB_DEVICE_ID_SIGMATEL_STMP3780, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c
index db713c0dfba4..461a0d739d75 100644
--- a/drivers/hwspinlock/hwspinlock_core.c
+++ b/drivers/hwspinlock/hwspinlock_core.c
@@ -416,6 +416,8 @@ static int __hwspin_lock_request(struct hwspinlock *hwlock)
         ret = pm_runtime_get_sync(dev);
         if (ret < 0) {
                 dev_err(dev, "%s: can't power on device\n", __func__);
+                pm_runtime_put_noidle(dev);
+                module_put(dev->driver->owner);
                 return ret;
         }
 
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 0ceb6e1b0f65..e3085c487ace 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -182,7 +182,6 @@ static int dw_i2c_probe(struct platform_device *pdev)
         adap->algo = &i2c_dw_algo;
         adap->dev.parent = &pdev->dev;
         adap->dev.of_node = pdev->dev.of_node;
-        ACPI_HANDLE_SET(&adap->dev, ACPI_HANDLE(&pdev->dev));
 
         r = i2c_add_numbered_adapter(adap);
         if (r) {
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 17ba4f8bc12d..70b1808a08f4 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -186,8 +186,10 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
         wq->rq.queue = dma_alloc_coherent(&(rdev->lldi.pdev->dev),
                                           wq->rq.memsize, &(wq->rq.dma_addr),
                                           GFP_KERNEL);
-        if (!wq->rq.queue)
+        if (!wq->rq.queue) {
+                ret = -ENOMEM;
                 goto free_sq;
+        }
         PDBG("%s sq base va 0x%p pa 0x%llx rq base va 0x%p pa 0x%llx\n",
                 __func__, wq->sq.queue,
                 (unsigned long long)virt_to_phys(wq->sq.queue),
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index 439c35d4a669..ea93870266eb 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -620,7 +620,7 @@ void ipath_ib_rcv(struct ipath_ibdev *dev, void *rhdr, void *data,
                 goto bail;
         }
 
-        opcode = be32_to_cpu(ohdr->bth[0]) >> 24;
+        opcode = (be32_to_cpu(ohdr->bth[0]) >> 24) & 0x7f;
         dev->opstats[opcode].n_bytes += tlen;
         dev->opstats[opcode].n_packets++;
 
diff --git a/drivers/infiniband/hw/qib/Kconfig b/drivers/infiniband/hw/qib/Kconfig
index 8349f9c5064c..1e603a375069 100644
--- a/drivers/infiniband/hw/qib/Kconfig
+++ b/drivers/infiniband/hw/qib/Kconfig
@@ -1,7 +1,7 @@
 config INFINIBAND_QIB
-        tristate "QLogic PCIe HCA support"
+        tristate "Intel PCIe HCA support"
         depends on 64BIT
         ---help---
-        This is a low-level driver for QLogic PCIe QLE InfiniBand host
-        channel adapters.  This driver does not support the QLogic
+        This is a low-level driver for Intel PCIe QLE InfiniBand host
+        channel adapters.  This driver does not support the Intel
         HyperTransport card (model QHT7140).
diff --git a/drivers/infiniband/hw/qib/qib_driver.c b/drivers/infiniband/hw/qib/qib_driver.c
index 5423edcab51f..216092477dfc 100644
--- a/drivers/infiniband/hw/qib/qib_driver.c
+++ b/drivers/infiniband/hw/qib/qib_driver.c
@@ -1,4 +1,5 @@
 /*
+ * Copyright (c) 2013 Intel Corporation. All rights reserved.
  * Copyright (c) 2006, 2007, 2008, 2009 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
@@ -63,8 +64,8 @@ MODULE_PARM_DESC(compat_ddr_negotiate,
                  "Attempt pre-IBTA 1.2 DDR speed negotiation");
 
 MODULE_LICENSE("Dual BSD/GPL");
-MODULE_AUTHOR("QLogic <support@qlogic.com>");
-MODULE_DESCRIPTION("QLogic IB driver");
+MODULE_AUTHOR("Intel <ibsupport@intel.com>");
+MODULE_DESCRIPTION("Intel IB driver");
 MODULE_VERSION(QIB_DRIVER_VERSION);
 
 /*
diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
index a099ac171e22..0232ae56b1fa 100644
--- a/drivers/infiniband/hw/qib/qib_iba6120.c
+++ b/drivers/infiniband/hw/qib/qib_iba6120.c
@@ -1,4 +1,5 @@
 /*
+ * Copyright (c) 2013 Intel Corporation. All rights reserved.
  * Copyright (c) 2006, 2007, 2008, 2009, 2010 QLogic Corporation.
  * All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
@@ -51,7 +52,7 @@ static u32 qib_6120_iblink_state(u64);
 
 /*
  * This file contains all the chip-specific register information and
- * access functions for the QLogic QLogic_IB PCI-Express chip.
+ * access functions for the Intel Intel_IB PCI-Express chip.
  *
  */
 
diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c
index 50e33aa0b4e3..173f805790da 100644
--- a/drivers/infiniband/hw/qib/qib_init.c
+++ b/drivers/infiniband/hw/qib/qib_init.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012 Intel Corporation.  All rights reserved.
+ * Copyright (c) 2012, 2013 Intel Corporation.  All rights reserved.
  * Copyright (c) 2006 - 2012 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
@@ -1138,7 +1138,7 @@ void qib_disable_after_error(struct qib_devdata *dd)
 static void qib_remove_one(struct pci_dev *);
 static int qib_init_one(struct pci_dev *, const struct pci_device_id *);
 
-#define DRIVER_LOAD_MSG "QLogic " QIB_DRV_NAME " loaded: "
+#define DRIVER_LOAD_MSG "Intel " QIB_DRV_NAME " loaded: "
 #define PFX QIB_DRV_NAME ": "
 
 static DEFINE_PCI_DEVICE_TABLE(qib_pci_tbl) = {
@@ -1355,7 +1355,7 @@ static int qib_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 dd = qib_init_iba6120_funcs(pdev, ent);
 #else
                 qib_early_err(&pdev->dev,
-                        "QLogic PCIE device 0x%x cannot work if CONFIG_PCI_MSI is not enabled\n",
+                        "Intel PCIE device 0x%x cannot work if CONFIG_PCI_MSI is not enabled\n",
                         ent->device);
                 dd = ERR_PTR(-ENODEV);
 #endif
@@ -1371,7 +1371,7 @@ static int qib_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         default:
                 qib_early_err(&pdev->dev,
-                        "Failing on unknown QLogic deviceid 0x%x\n",
+                        "Failing on unknown Intel deviceid 0x%x\n",
                         ent->device);
                 ret = -ENODEV;
         }
diff --git a/drivers/infiniband/hw/qib/qib_sd7220.c b/drivers/infiniband/hw/qib/qib_sd7220.c
index 50a8a0d4fe67..911205d3d5a0 100644
--- a/drivers/infiniband/hw/qib/qib_sd7220.c
+++ b/drivers/infiniband/hw/qib/qib_sd7220.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012 Intel Corporation. All rights reserved.
+ * Copyright (c) 2013 Intel Corporation. All rights reserved.
  * Copyright (c) 2006 - 2012 QLogic Corporation. All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
diff --git a/drivers/infiniband/hw/qib/qib_verbs.c b/drivers/infiniband/hw/qib/qib_verbs.c
index ba51a4715a1d..7c0ab16a2fe2 100644
--- a/drivers/infiniband/hw/qib/qib_verbs.c
+++ b/drivers/infiniband/hw/qib/qib_verbs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012 Intel Corporation.  All rights reserved.
+ * Copyright (c) 2012, 2013 Intel Corporation.  All rights reserved.
  * Copyright (c) 2006 - 2012 QLogic Corporation. All rights reserved.
  * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
  *
@@ -2224,7 +2224,7 @@ int qib_register_ib_device(struct qib_devdata *dd)
         ibdev->dma_ops = &qib_dma_mapping_ops;
 
         snprintf(ibdev->node_desc, sizeof(ibdev->node_desc),
-                 "QLogic Infiniband HCA %s", init_utsname()->nodename);
+                 "Intel Infiniband HCA %s", init_utsname()->nodename);
 
         ret = ib_register_device(ibdev, qib_create_port_files);
         if (ret)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 67b0c1d23678..1ef880de3a41 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -758,9 +758,13 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
                 if (++priv->tx_outstanding == ipoib_sendq_size) {
                         ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n",
                                   tx->qp->qp_num);
-                        if (ib_req_notify_cq(priv->send_cq, IB_CQ_NEXT_COMP))
-                                ipoib_warn(priv, "request notify on send CQ failed\n");
                         netif_stop_queue(dev);
+                        rc = ib_req_notify_cq(priv->send_cq,
+                                IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS);
+                        if (rc < 0)
+                                ipoib_warn(priv, "request notify on send CQ failed\n");
+                        else if (rc)
+                                ipoib_send_comp_handler(priv->send_cq, dev);
                 }
         }
 }
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index 5c514d0711d1..c332fb98480d 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -130,7 +130,7 @@ config IRQ_REMAP
 # OMAP IOMMU support
 config OMAP_IOMMU
         bool "OMAP IOMMU Support"
-        depends on ARCH_OMAP
+        depends on ARCH_OMAP2PLUS
         select IOMMU_API
 
 config OMAP_IOVMM
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 98f555dafb55..b287ca33833d 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -2466,18 +2466,16 @@ static int device_change_notifier(struct notifier_block *nb,
 
                 /* allocate a protection domain if a device is added */
                 dma_domain = find_protection_domain(devid);
-                if (dma_domain)
-                        goto out;
-                dma_domain = dma_ops_domain_alloc();
-                if (!dma_domain)
-                        goto out;
-                dma_domain->target_dev = devid;
-
-                spin_lock_irqsave(&iommu_pd_list_lock, flags);
-                list_add_tail(&dma_domain->list, &iommu_pd_list);
-                spin_unlock_irqrestore(&iommu_pd_list_lock, flags);
-
-                dev_data = get_dev_data(dev);
+                if (!dma_domain) {
+                        dma_domain = dma_ops_domain_alloc();
+                        if (!dma_domain)
+                                goto out;
+                        dma_domain->target_dev = devid;
+
+                        spin_lock_irqsave(&iommu_pd_list_lock, flags);
+                        list_add_tail(&dma_domain->list, &iommu_pd_list);
+                        spin_unlock_irqrestore(&iommu_pd_list_lock, flags);
+                }
 
                 dev->archdata.dma_ops = &amd_iommu_dma_ops;
 
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index b6ecddb63cd0..e3c2d74b7684 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -980,7 +980,7 @@ static void __init free_iommu_all(void)
  *     BIOS should disable L2B micellaneous clock gating by setting
  *     L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b
  */
-static void __init amd_iommu_erratum_746_workaround(struct amd_iommu *iommu)
+static void amd_iommu_erratum_746_workaround(struct amd_iommu *iommu)
 {
         u32 value;
 
diff --git a/drivers/iommu/irq_remapping.c b/drivers/iommu/irq_remapping.c
index d56f8c17c5fe..7c11ff368d07 100644
--- a/drivers/iommu/irq_remapping.c
+++ b/drivers/iommu/irq_remapping.c
@@ -2,7 +2,6 @@
 #include <linux/cpumask.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
-#include <linux/cpumask.h>
 #include <linux/errno.h>
 #include <linux/msi.h>
 #include <linux/irq.h>
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 66120bd46d15..10744091e6ca 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -6,6 +6,7 @@
 
 #include "dm.h"
 #include "dm-bio-prison.h"
+#include "dm-bio-record.h"
 #include "dm-cache-metadata.h"
 
 #include <linux/dm-io.h>
@@ -201,10 +202,15 @@ struct per_bio_data {
         unsigned req_nr:2;
         struct dm_deferred_entry *all_io_entry;
 
-        /* writethrough fields */
+        /*
+         * writethrough fields.  These MUST remain at the end of this
+         * structure and the 'cache' member must be the first as it
+         * is used to determine the offsetof the writethrough fields.
+         */
         struct cache *cache;
         dm_cblock_t cblock;
         bio_end_io_t *saved_bi_end_io;
+        struct dm_bio_details bio_details;
 };
 
 struct dm_cache_migration {
@@ -513,16 +519,28 @@ static void save_stats(struct cache *cache)
 /*----------------------------------------------------------------
  * Per bio data
  *--------------------------------------------------------------*/
-static struct per_bio_data *get_per_bio_data(struct bio *bio)
+
+/*
+ * If using writeback, leave out struct per_bio_data's writethrough fields.
+ */
+#define PB_DATA_SIZE_WB (offsetof(struct per_bio_data, cache))
+#define PB_DATA_SIZE_WT (sizeof(struct per_bio_data))
+
+static size_t get_per_bio_data_size(struct cache *cache)
+{
+        return cache->features.write_through ? PB_DATA_SIZE_WT : PB_DATA_SIZE_WB;
+}
+
+static struct per_bio_data *get_per_bio_data(struct bio *bio, size_t data_size)
 {
-        struct per_bio_data *pb = dm_per_bio_data(bio, sizeof(struct per_bio_data));
+        struct per_bio_data *pb = dm_per_bio_data(bio, data_size);
         BUG_ON(!pb);
         return pb;
 }
 
-static struct per_bio_data *init_per_bio_data(struct bio *bio)
+static struct per_bio_data *init_per_bio_data(struct bio *bio, size_t data_size)
 {
-        struct per_bio_data *pb = get_per_bio_data(bio);
+        struct per_bio_data *pb = get_per_bio_data(bio, data_size);
 
         pb->tick = false;
         pb->req_nr = dm_bio_get_target_bio_nr(bio);
@@ -556,7 +574,8 @@ static void remap_to_cache(struct cache *cache, struct bio *bio,
 static void check_if_tick_bio_needed(struct cache *cache, struct bio *bio)
 {
         unsigned long flags;
-        struct per_bio_data *pb = get_per_bio_data(bio);
+        size_t pb_data_size = get_per_bio_data_size(cache);
+        struct per_bio_data *pb = get_per_bio_data(bio, pb_data_size);
 
         spin_lock_irqsave(&cache->lock, flags);
         if (cache->need_tick_bio &&
@@ -635,7 +654,7 @@ static void defer_writethrough_bio(struct cache *cache, struct bio *bio)
 
 static void writethrough_endio(struct bio *bio, int err)
 {
-        struct per_bio_data *pb = get_per_bio_data(bio);
+        struct per_bio_data *pb = get_per_bio_data(bio, PB_DATA_SIZE_WT);
         bio->bi_end_io = pb->saved_bi_end_io;
 
         if (err) {
@@ -643,6 +662,7 @@ static void writethrough_endio(struct bio *bio, int err)
                 return;
         }
 
+        dm_bio_restore(&pb->bio_details, bio);
         remap_to_cache(pb->cache, bio, pb->cblock);
 
         /*
@@ -662,11 +682,12 @@ static void writethrough_endio(struct bio *bio, int err)
 static void remap_to_origin_then_cache(struct cache *cache, struct bio *bio,
                                        dm_oblock_t oblock, dm_cblock_t cblock)
 {
-        struct per_bio_data *pb = get_per_bio_data(bio);
+        struct per_bio_data *pb = get_per_bio_data(bio, PB_DATA_SIZE_WT);
 
         pb->cache = cache;
         pb->cblock = cblock;
         pb->saved_bi_end_io = bio->bi_end_io;
+        dm_bio_record(&pb->bio_details, bio);
         bio->bi_end_io = writethrough_endio;
 
         remap_to_origin_clear_discard(pb->cache, bio, oblock);
@@ -1035,7 +1056,8 @@ static void defer_bio(struct cache *cache, struct bio *bio)
 
 static void process_flush_bio(struct cache *cache, struct bio *bio)
 {
-        struct per_bio_data *pb = get_per_bio_data(bio);
+        size_t pb_data_size = get_per_bio_data_size(cache);
+        struct per_bio_data *pb = get_per_bio_data(bio, pb_data_size);
 
         BUG_ON(bio->bi_size);
         if (!pb->req_nr)
@@ -1107,7 +1129,8 @@ static void process_bio(struct cache *cache, struct prealloc *structs,
         dm_oblock_t block = get_bio_block(cache, bio);
         struct dm_bio_prison_cell *cell_prealloc, *old_ocell, *new_ocell;
         struct policy_result lookup_result;
-        struct per_bio_data *pb = get_per_bio_data(bio);
+        size_t pb_data_size = get_per_bio_data_size(cache);
+        struct per_bio_data *pb = get_per_bio_data(bio, pb_data_size);
         bool discarded_block = is_discarded_oblock(cache, block);
         bool can_migrate = discarded_block || spare_migration_bandwidth(cache);
 
@@ -1881,7 +1904,6 @@ static int cache_create(struct cache_args *ca, struct cache **result)
 
         cache->ti = ca->ti;
         ti->private = cache;
-        ti->per_bio_data_size = sizeof(struct per_bio_data);
         ti->num_flush_bios = 2;
         ti->flush_supported = true;
 
@@ -1890,6 +1912,7 @@ static int cache_create(struct cache_args *ca, struct cache **result)
         ti->discard_zeroes_data_unsupported = true;
 
         memcpy(&cache->features, &ca->features, sizeof(cache->features));
+        ti->per_bio_data_size = get_per_bio_data_size(cache);
 
         cache->callbacks.congested_fn = cache_is_congested;
         dm_table_add_target_callbacks(ti->table, &cache->callbacks);
@@ -2092,6 +2115,7 @@ static int cache_map(struct dm_target *ti, struct bio *bio)
 
         int r;
         dm_oblock_t block = get_bio_block(cache, bio);
+        size_t pb_data_size = get_per_bio_data_size(cache);
         bool can_migrate = false;
         bool discarded_block;
         struct dm_bio_prison_cell *cell;
@@ -2108,7 +2132,7 @@ static int cache_map(struct dm_target *ti, struct bio *bio)
                 return DM_MAPIO_REMAPPED;
         }
 
-        pb = init_per_bio_data(bio);
+        pb = init_per_bio_data(bio, pb_data_size);
 
         if (bio->bi_rw & (REQ_FLUSH | REQ_FUA | REQ_DISCARD)) {
                 defer_bio(cache, bio);
@@ -2193,7 +2217,8 @@ static int cache_end_io(struct dm_target *ti, struct bio *bio, int error)
 {
         struct cache *cache = ti->private;
         unsigned long flags;
-        struct per_bio_data *pb = get_per_bio_data(bio);
+        size_t pb_data_size = get_per_bio_data_size(cache);
+        struct per_bio_data *pb = get_per_bio_data(bio, pb_data_size);
 
         if (pb->tick) {
                 policy_tick(cache->policy);
diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c
index d4e7567b367c..0b899cb6cda1 100644
--- a/drivers/media/i2c/m5mols/m5mols_core.c
+++ b/drivers/media/i2c/m5mols/m5mols_core.c
@@ -724,7 +724,7 @@ static int m5mols_s_stream(struct v4l2_subdev *sd, int enable)
         if (enable) {
                 if (is_code(code, M5MOLS_RESTYPE_MONITOR))
                         ret = m5mols_start_monitor(info);
-                if (is_code(code, M5MOLS_RESTYPE_CAPTURE))
+                else if (is_code(code, M5MOLS_RESTYPE_CAPTURE))
                         ret = m5mols_start_capture(info);
                 else
                         ret = -EINVAL;
diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
index ccd18e4ee789..54579e4c740b 100644
--- a/drivers/media/pci/bt8xx/bttv-driver.c
+++ b/drivers/media/pci/bt8xx/bttv-driver.c
@@ -250,17 +250,19 @@ static u8 SRAM_Table[][60] =
    vdelay       start of active video in 2 * field lines relative to
                 trailing edge of /VRESET pulse (VDELAY register).
    sheight      height of active video in 2 * field lines.
+   extraheight  Added to sheight for cropcap.bounds.height only
    videostart0  ITU-R frame line number of the line corresponding
                 to vdelay in the first field. */
 #define CROPCAP(minhdelayx1, hdelayx1, swidth, totalwidth, sqwidth,      \
-                vdelay, sheight, videostart0)                            \
+                vdelay, sheight, extraheight, videostart0)               \
         .cropcap.bounds.left = minhdelayx1,                              \
         /* * 2 because vertically we count field lines times two, */     \
         /* e.g. 23 * 2 to 23 * 2 + 576 in PAL-BGHI defrect. */           \
         .cropcap.bounds.top = (videostart0) * 2 - (vdelay) + MIN_VDELAY, \
         /* 4 is a safety margin at the end of the line. */               \
         .cropcap.bounds.width = (totalwidth) - (minhdelayx1) - 4,        \
-        .cropcap.bounds.height = (sheight) + (vdelay) - MIN_VDELAY,      \
+        .cropcap.bounds.height = (sheight) + (extraheight) + (vdelay) -  \
+                                 MIN_VDELAY,                             \
         .cropcap.defrect.left = hdelayx1,                                \
         .cropcap.defrect.top = (videostart0) * 2,                        \
         .cropcap.defrect.width = swidth,                                 \
@@ -301,9 +303,10 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* totalwidth */ 1135,
                         /* sqwidth */ 944,
                         /* vdelay */ 0x20,
-                /* bt878 (and bt848?) can capture another
-                   line below active video. */
-                        /* sheight */ (576 + 2) + 0x20 - 2,
+                        /* sheight */ 576,
+                        /* bt878 (and bt848?) can capture another
+                           line below active video. */
+                        /* extraheight */ 2,
                         /* videostart0 */ 23)
         },{
                 .v4l2_id        = V4L2_STD_NTSC_M | V4L2_STD_NTSC_M_KR,
@@ -330,6 +333,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 780,
                         /* vdelay */ 0x1a,
                         /* sheight */ 480,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         },{
                 .v4l2_id        = V4L2_STD_SECAM,
@@ -355,6 +359,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 944,
                         /* vdelay */ 0x20,
                         /* sheight */ 576,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         },{
                 .v4l2_id        = V4L2_STD_PAL_Nc,
@@ -380,6 +385,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 780,
                         /* vdelay */ 0x1a,
                         /* sheight */ 576,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         },{
                 .v4l2_id        = V4L2_STD_PAL_M,
@@ -405,6 +411,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 780,
                         /* vdelay */ 0x1a,
                         /* sheight */ 480,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         },{
                 .v4l2_id        = V4L2_STD_PAL_N,
@@ -430,6 +437,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 944,
                         /* vdelay */ 0x20,
                         /* sheight */ 576,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         },{
                 .v4l2_id        = V4L2_STD_NTSC_M_JP,
@@ -455,6 +463,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 780,
                         /* vdelay */ 0x16,
                         /* sheight */ 480,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         },{
                 /* that one hopefully works with the strange timing
@@ -484,6 +493,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                         /* sqwidth */ 944,
                         /* vdelay */ 0x1a,
                         /* sheight */ 480,
+                        /* extraheight */ 0,
                         /* videostart0 */ 23)
         }
 };
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index 05d7b6333461..a0639e779973 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -204,7 +204,7 @@ config VIDEO_SAMSUNG_EXYNOS_GSC
 
 config VIDEO_SH_VEU
         tristate "SuperH VEU mem2mem video processing driver"
-        depends on VIDEO_DEV && VIDEO_V4L2
+        depends on VIDEO_DEV && VIDEO_V4L2 && GENERIC_HARDIRQS
         select VIDEOBUF2_DMA_CONTIG
         select V4L2_MEM2MEM_DEV
         help
diff --git a/drivers/media/platform/exynos-gsc/gsc-core.c b/drivers/media/platform/exynos-gsc/gsc-core.c
index 82d9f6ac12f3..33b5ffc8d66d 100644
--- a/drivers/media/platform/exynos-gsc/gsc-core.c
+++ b/drivers/media/platform/exynos-gsc/gsc-core.c
@@ -1054,16 +1054,18 @@ static int gsc_m2m_suspend(struct gsc_dev *gsc)
 
 static int gsc_m2m_resume(struct gsc_dev *gsc)
 {
+        struct gsc_ctx *ctx;
         unsigned long flags;
 
         spin_lock_irqsave(&gsc->slock, flags);
         /* Clear for full H/W setup in first run after resume */
+        ctx = gsc->m2m.ctx;
         gsc->m2m.ctx = NULL;
         spin_unlock_irqrestore(&gsc->slock, flags);
 
         if (test_and_clear_bit(ST_M2M_SUSPENDED, &gsc->state))
-                gsc_m2m_job_finish(gsc->m2m.ctx,
-                                    VB2_BUF_STATE_ERROR);
+                gsc_m2m_job_finish(ctx, VB2_BUF_STATE_ERROR);
+
         return 0;
 }
 
@@ -1204,7 +1206,7 @@ static int gsc_resume(struct device *dev)
         /* Do not resume if the device was idle before system suspend */
         spin_lock_irqsave(&gsc->slock, flags);
         if (!test_and_clear_bit(ST_SUSPEND, &gsc->state) ||
-            !gsc_m2m_active(gsc)) {
+            !gsc_m2m_opened(gsc)) {
                 spin_unlock_irqrestore(&gsc->slock, flags);
                 return 0;
         }
diff --git a/drivers/media/platform/s5p-fimc/fimc-core.c b/drivers/media/platform/s5p-fimc/fimc-core.c
index e3916bde45cf..0f513dd19f86 100644
--- a/drivers/media/platform/s5p-fimc/fimc-core.c
+++ b/drivers/media/platform/s5p-fimc/fimc-core.c
@@ -850,16 +850,18 @@ static int fimc_m2m_suspend(struct fimc_dev *fimc)
 
 static int fimc_m2m_resume(struct fimc_dev *fimc)
 {
+        struct fimc_ctx *ctx;
         unsigned long flags;
 
         spin_lock_irqsave(&fimc->slock, flags);
         /* Clear for full H/W setup in first run after resume */
+        ctx = fimc->m2m.ctx;
         fimc->m2m.ctx = NULL;
         spin_unlock_irqrestore(&fimc->slock, flags);
 
         if (test_and_clear_bit(ST_M2M_SUSPENDED, &fimc->state))
-                fimc_m2m_job_finish(fimc->m2m.ctx,
-                                    VB2_BUF_STATE_ERROR);
+                fimc_m2m_job_finish(ctx, VB2_BUF_STATE_ERROR);
+
         return 0;
 }
 
diff --git a/drivers/media/platform/s5p-fimc/fimc-lite-reg.c b/drivers/media/platform/s5p-fimc/fimc-lite-reg.c
index f0af0754a7b4..ac9663ce2a49 100644
--- a/drivers/media/platform/s5p-fimc/fimc-lite-reg.c
+++ b/drivers/media/platform/s5p-fimc/fimc-lite-reg.c
@@ -128,10 +128,10 @@ static const u32 src_pixfmt_map[8][3] = {
 void flite_hw_set_source_format(struct fimc_lite *dev, struct flite_frame *f)
 {
         enum v4l2_mbus_pixelcode pixelcode = dev->fmt->mbus_code;
-        unsigned int i = ARRAY_SIZE(src_pixfmt_map);
+        int i = ARRAY_SIZE(src_pixfmt_map);
         u32 cfg;
 
-        while (i-- >= 0) {
+        while (--i >= 0) {
                 if (src_pixfmt_map[i][0] == pixelcode)
                         break;
         }
@@ -224,9 +224,9 @@ static void flite_hw_set_out_order(struct fimc_lite *dev, struct flite_frame *f)
                 { V4L2_MBUS_FMT_VYUY8_2X8, FLITE_REG_CIODMAFMT_CRYCBY },
         };
         u32 cfg = readl(dev->regs + FLITE_REG_CIODMAFMT);
-        unsigned int i = ARRAY_SIZE(pixcode);
+        int i = ARRAY_SIZE(pixcode);
 
-        while (i-- >= 0)
+        while (--i >= 0)
                 if (pixcode[i][0] == dev->fmt->mbus_code)
                         break;
         cfg &= ~FLITE_REG_CIODMAFMT_YCBCR_ORDER_MASK;
diff --git a/drivers/media/platform/s5p-fimc/fimc-lite.c b/drivers/media/platform/s5p-fimc/fimc-lite.c
index bfc4206935c8..bbc35de7db27 100644
--- a/drivers/media/platform/s5p-fimc/fimc-lite.c
+++ b/drivers/media/platform/s5p-fimc/fimc-lite.c
@@ -1408,6 +1408,7 @@ static const struct v4l2_ctrl_config fimc_lite_ctrl = {
         .id     = V4L2_CTRL_CLASS_USER | 0x1001,
         .type   = V4L2_CTRL_TYPE_BOOLEAN,
         .name   = "Test Pattern 640x480",
+        .step   = 1,
 };
 
 static int fimc_lite_create_capture_subdev(struct fimc_lite *fimc)
diff --git a/drivers/media/platform/s5p-fimc/fimc-mdevice.c b/drivers/media/platform/s5p-fimc/fimc-mdevice.c
index a17fcb2d5d41..cd38d708ab58 100644
--- a/drivers/media/platform/s5p-fimc/fimc-mdevice.c
+++ b/drivers/media/platform/s5p-fimc/fimc-mdevice.c
@@ -827,7 +827,7 @@ static int fimc_md_link_notify(struct media_pad *source,
         struct fimc_pipeline *pipeline;
         struct v4l2_subdev *sd;
         struct mutex *lock;
-        int ret = 0;
+        int i, ret = 0;
         int ref_count;
 
         if (media_entity_type(sink->entity) != MEDIA_ENT_T_V4L2_SUBDEV)
@@ -854,29 +854,28 @@ static int fimc_md_link_notify(struct media_pad *source,
                 return 0;
         }
 
+        mutex_lock(lock);
+        ref_count = fimc ? fimc->vid_cap.refcnt : fimc_lite->ref_count;
+
         if (!(flags & MEDIA_LNK_FL_ENABLED)) {
-                int i;
-                mutex_lock(lock);
-                ret = __fimc_pipeline_close(pipeline);
+                if (ref_count > 0) {
+                        ret = __fimc_pipeline_close(pipeline);
+                        if (!ret && fimc)
+                                fimc_ctrls_delete(fimc->vid_cap.ctx);
+                }
                 for (i = 0; i < IDX_MAX; i++)
                         pipeline->subdevs[i] = NULL;
-                if (fimc)
-                        fimc_ctrls_delete(fimc->vid_cap.ctx);
-                mutex_unlock(lock);
-                return ret;
+        } else if (ref_count > 0) {
+                /*
+                 * Link activation. Enable power of pipeline elements only if
+                 * the pipeline is already in use, i.e. its video node is open.
+                 * Recreate the controls destroyed during the link deactivation.
+                 */
+                ret = __fimc_pipeline_open(pipeline,
+                                           source->entity, true);
+                if (!ret && fimc)
+                        ret = fimc_capture_ctrls_create(fimc);
         }
-        /*
-         * Link activation. Enable power of pipeline elements only if the
-         * pipeline is already in use, i.e. its video node is opened.
-         * Recreate the controls destroyed during the link deactivation.
-         */
-        mutex_lock(lock);
-
-        ref_count = fimc ? fimc->vid_cap.refcnt : fimc_lite->ref_count;
-        if (ref_count > 0)
-                ret = __fimc_pipeline_open(pipeline, source->entity, true);
-        if (!ret && fimc)
-                ret = fimc_capture_ctrls_create(fimc);
 
         mutex_unlock(lock);
         return ret ? -EPIPE : ret;
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index e84703c314ce..1cb6d57987c6 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -276,7 +276,7 @@ static void s5p_mfc_handle_frame_new(struct s5p_mfc_ctx *ctx, unsigned int err)
         unsigned int frame_type;
 
         dspl_y_addr = s5p_mfc_hw_call(dev->mfc_ops, get_dspl_y_adr, dev);
-        frame_type = s5p_mfc_hw_call(dev->mfc_ops, get_dec_frame_type, dev);
+        frame_type = s5p_mfc_hw_call(dev->mfc_ops, get_disp_frame_type, ctx);
 
         /* If frame is same as previous then skip and do not dequeue */
         if (frame_type == S5P_FIMV_DECODE_FRAME_SKIPPED) {
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
index 2356fd52a169..4f6b553c4b2d 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
@@ -232,6 +232,7 @@ static struct mfc_control controls[] = {
                 .minimum = 0,
                 .maximum = 1,
                 .default_value = 0,
+                .step = 1,
                 .menu_skip_mask = 0,
         },
         {
diff --git a/drivers/media/radio/radio-ma901.c b/drivers/media/radio/radio-ma901.c
index c61f590029ad..348dafc0318a 100644
--- a/drivers/media/radio/radio-ma901.c
+++ b/drivers/media/radio/radio-ma901.c
@@ -347,9 +347,20 @@ static void usb_ma901radio_release(struct v4l2_device *v4l2_dev)
 static int usb_ma901radio_probe(struct usb_interface *intf,
                                 const struct usb_device_id *id)
 {
+        struct usb_device *dev = interface_to_usbdev(intf);
         struct ma901radio_device *radio;
         int retval = 0;
 
+        /* Masterkit MA901 usb radio has the same USB ID as many others
+         * Atmel V-USB devices. Let's make additional checks to be sure
+         * that this is our device.
+         */
+
+        if (dev->product && dev->manufacturer &&
+                (strncmp(dev->product, "MA901", 5) != 0
+                || strncmp(dev->manufacturer, "www.masterkit.ru", 16) != 0))
+                return -ENODEV;
+
         radio = kzalloc(sizeof(struct ma901radio_device), GFP_KERNEL);
         if (!radio) {
                 dev_err(&intf->dev, "kzalloc for ma901radio_device failed\n");
diff --git a/drivers/media/rc/Kconfig b/drivers/media/rc/Kconfig
index 19f3563c61da..5a79c333d45e 100644
--- a/drivers/media/rc/Kconfig
+++ b/drivers/media/rc/Kconfig
@@ -291,7 +291,7 @@ config IR_TTUSBIR
 
 config IR_RX51
         tristate "Nokia N900 IR transmitter diode"
-        depends on OMAP_DM_TIMER && LIRC && !ARCH_MULTIPLATFORM
+        depends on OMAP_DM_TIMER && ARCH_OMAP2PLUS && LIRC && !ARCH_MULTIPLATFORM
         ---help---
            Say Y or M here if you want to enable support for the IR
            transmitter diode built in the Nokia N900 (RX51) device.
diff --git a/drivers/media/v4l2-core/Makefile b/drivers/media/v4l2-core/Makefile
index a9d355230e8e..768aaf62d5dc 100644
--- a/drivers/media/v4l2-core/Makefile
+++ b/drivers/media/v4l2-core/Makefile
@@ -10,7 +10,7 @@ ifeq ($(CONFIG_COMPAT),y)
   videodev-objs += v4l2-compat-ioctl32.o
 endif
 
-obj-$(CONFIG_VIDEO_DEV) += videodev.o
+obj-$(CONFIG_VIDEO_V4L2) += videodev.o
 obj-$(CONFIG_VIDEO_V4L2_INT_DEVICE) += v4l2-int-device.o
 obj-$(CONFIG_VIDEO_V4L2) += v4l2-common.o
 
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index 45ea7185c003..642c6223fa6c 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -152,6 +152,20 @@ static void mei_me_intr_disable(struct mei_device *dev)
 }
 
 /**
+ * mei_me_hw_reset_release - release device from the reset
+ *
+ * @dev: the device structure
+ */
+static void mei_me_hw_reset_release(struct mei_device *dev)
+{
+        struct mei_me_hw *hw = to_me_hw(dev);
+        u32 hcsr = mei_hcsr_read(hw);
+
+        hcsr |= H_IG;
+        hcsr &= ~H_RST;
+        mei_hcsr_set(hw, hcsr);
+}
+/**
  * mei_me_hw_reset - resets fw via mei csr register.
  *
  * @dev: the device structure
@@ -169,18 +183,14 @@ static void mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
         if (intr_enable)
                 hcsr |= H_IE;
         else
-                hcsr &= ~H_IE;
-
-        mei_hcsr_set(hw, hcsr);
-
-        hcsr = mei_hcsr_read(hw) | H_IG;
-        hcsr &= ~H_RST;
+                hcsr |= ~H_IE;
 
         mei_hcsr_set(hw, hcsr);
 
-        hcsr = mei_hcsr_read(hw);
+        if (dev->dev_state == MEI_DEV_POWER_DOWN)
+                mei_me_hw_reset_release(dev);
 
-        dev_dbg(&dev->pdev->dev, "current HCSR = 0x%08x.\n", hcsr);
+        dev_dbg(&dev->pdev->dev, "current HCSR = 0x%08x.\n", mei_hcsr_read(hw));
 }
 
 /**
@@ -466,7 +476,8 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id)
                         mutex_unlock(&dev->device_lock);
                         return IRQ_HANDLED;
                 } else {
-                        dev_dbg(&dev->pdev->dev, "FW not ready.\n");
+                        dev_dbg(&dev->pdev->dev, "Reset Completed.\n");
+                        mei_me_hw_reset_release(dev);
                         mutex_unlock(&dev->device_lock);
                         return IRQ_HANDLED;
                 }
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index 6ec530168afb..356179991a2e 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -183,6 +183,24 @@ void mei_reset(struct mei_device *dev, int interrupts_enabled)
         mei_cl_all_write_clear(dev);
 }
 
+void mei_stop(struct mei_device *dev)
+{
+        dev_dbg(&dev->pdev->dev, "stopping the device.\n");
+
+        mutex_lock(&dev->device_lock);
+
+        cancel_delayed_work(&dev->timer_work);
+
+        mei_wd_stop(dev);
+
+        dev->dev_state = MEI_DEV_POWER_DOWN;
+        mei_reset(dev, 0);
+
+        mutex_unlock(&dev->device_lock);
+
+        flush_scheduled_work();
+}
+
 
 
 
diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
index cb80166161f0..97873812e33b 100644
--- a/drivers/misc/mei/mei_dev.h
+++ b/drivers/misc/mei/mei_dev.h
@@ -381,6 +381,7 @@ static inline unsigned long mei_secs_to_jiffies(unsigned long sec)
 void mei_device_init(struct mei_device *dev);
 void mei_reset(struct mei_device *dev, int interrupts);
 int mei_hw_init(struct mei_device *dev);
+void mei_stop(struct mei_device *dev);
 
 /*
  *  MEI interrupt functions prototype
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index b40ec0601ab0..b8b5c9c3ad03 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -247,44 +247,14 @@ static void mei_remove(struct pci_dev *pdev)
 
         hw = to_me_hw(dev);
 
-        mutex_lock(&dev->device_lock);
-
-        cancel_delayed_work(&dev->timer_work);
 
-        mei_wd_stop(dev);
+        dev_err(&pdev->dev, "stop\n");
+        mei_stop(dev);
 
         mei_pdev = NULL;
 
-        if (dev->iamthif_cl.state == MEI_FILE_CONNECTED) {
-                dev->iamthif_cl.state = MEI_FILE_DISCONNECTING;
-                mei_cl_disconnect(&dev->iamthif_cl);
-        }
-        if (dev->wd_cl.state == MEI_FILE_CONNECTED) {
-                dev->wd_cl.state = MEI_FILE_DISCONNECTING;
-                mei_cl_disconnect(&dev->wd_cl);
-        }
-
-        /* Unregistering watchdog device */
         mei_watchdog_unregister(dev);
 
-        /* remove entry if already in list */
-        dev_dbg(&pdev->dev, "list del iamthif and wd file list.\n");
-
-        if (dev->open_handle_count > 0)
-                dev->open_handle_count--;
-        mei_cl_unlink(&dev->wd_cl);
-
-        if (dev->open_handle_count > 0)
-                dev->open_handle_count--;
-        mei_cl_unlink(&dev->iamthif_cl);
-
-        dev->iamthif_current_cb = NULL;
-        dev->me_clients_num = 0;
-
-        mutex_unlock(&dev->device_lock);
-
-        flush_scheduled_work();
-
         /* disable interrupts */
         mei_disable_interrupts(dev);
 
@@ -308,28 +278,20 @@ static int mei_pci_suspend(struct device *device)
 {
         struct pci_dev *pdev = to_pci_dev(device);
         struct mei_device *dev = pci_get_drvdata(pdev);
-        int err;
 
         if (!dev)
                 return -ENODEV;
-        mutex_lock(&dev->device_lock);
 
-        cancel_delayed_work(&dev->timer_work);
+        dev_err(&pdev->dev, "suspend\n");
 
-        /* Stop watchdog if exists */
-        err = mei_wd_stop(dev);
-        /* Set new mei state */
-        if (dev->dev_state == MEI_DEV_ENABLED ||
-            dev->dev_state == MEI_DEV_RECOVERING_FROM_RESET) {
-                dev->dev_state = MEI_DEV_POWER_DOWN;
-                mei_reset(dev, 0);
-        }
-        mutex_unlock(&dev->device_lock);
+        mei_stop(dev);
+
+        mei_disable_interrupts(dev);
 
         free_irq(pdev->irq, dev);
         pci_disable_msi(pdev);
 
-        return err;
+        return 0;
 }
 
 static int mei_pci_resume(struct device *device)
diff --git a/drivers/misc/vmw_vmci/Kconfig b/drivers/misc/vmw_vmci/Kconfig
index 39c2ecadb273..ea98f7e9ccd1 100644
--- a/drivers/misc/vmw_vmci/Kconfig
+++ b/drivers/misc/vmw_vmci/Kconfig
@@ -4,7 +4,7 @@
 
 config VMWARE_VMCI
         tristate "VMware VMCI Driver"
-        depends on X86 && PCI
+        depends on X86 && PCI && NET
         help
           This is VMware's Virtual Machine Communication Interface.  It enables
           high-speed communication between host and guest in a virtual
diff --git a/drivers/misc/vmw_vmci/vmci_datagram.c b/drivers/misc/vmw_vmci/vmci_datagram.c
index ed5c433cd493..f3cdd904fe4d 100644
--- a/drivers/misc/vmw_vmci/vmci_datagram.c
+++ b/drivers/misc/vmw_vmci/vmci_datagram.c
@@ -42,9 +42,11 @@ struct datagram_entry {
 
 struct delayed_datagram_info {
         struct datagram_entry *entry;
-        struct vmci_datagram msg;
         struct work_struct work;
         bool in_dg_host_queue;
+        /* msg and msg_payload must be together. */
+        struct vmci_datagram msg;
+        u8 msg_payload[];
 };
 
 /* Number of in-flight host->host datagrams */
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 6bbd90e1123c..07401a3e256b 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1976,12 +1976,11 @@ static int __bond_release_one(struct net_device *bond_dev,
                 return -EINVAL;
         }
 
+        write_unlock_bh(&bond->lock);
         /* unregister rx_handler early so bond_handle_frame wouldn't be called
          * for this slave anymore.
          */
         netdev_rx_handler_unregister(slave_dev);
-        write_unlock_bh(&bond->lock);
-        synchronize_net();
         write_lock_bh(&bond->lock);
 
         if (!all && !bond->params.fail_over_mac) {
@@ -4847,9 +4846,18 @@ static int __net_init bond_net_init(struct net *net)
 static void __net_exit bond_net_exit(struct net *net)
 {
         struct bond_net *bn = net_generic(net, bond_net_id);
+        struct bonding *bond, *tmp_bond;
+        LIST_HEAD(list);
 
         bond_destroy_sysfs(bn);
         bond_destroy_proc_dir(bn);
+
+        /* Kill off any bonds created after unregistering bond rtnl ops */
+        rtnl_lock();
+        list_for_each_entry_safe(bond, tmp_bond, &bn->dev_list, bond_list)
+                unregister_netdevice_queue(bond->dev, &list);
+        unregister_netdevice_many(&list);
+        rtnl_unlock();
 }
 
 static struct pernet_operations bond_net_ops = {
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 1c9e09fbdff8..ea7a388f4843 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -183,6 +183,11 @@ int bond_create_slave_symlinks(struct net_device *master,
         sprintf(linkname, "slave_%s", slave->name);
         ret = sysfs_create_link(&(master->dev.kobj), &(slave->dev.kobj),
                                 linkname);
+
+        /* free the master link created earlier in case of error */
+        if (ret)
+                sysfs_remove_link(&(slave->dev.kobj), "master");
+
         return ret;
 
 }
@@ -522,7 +527,7 @@ static ssize_t bonding_store_arp_interval(struct device *d,
                 goto out;
         }
         if (new_value < 0) {
-                pr_err("%s: Invalid arp_interval value %d not in range 1-%d; rejected.\n",
+                pr_err("%s: Invalid arp_interval value %d not in range 0-%d; rejected.\n",
                        bond->dev->name, new_value, INT_MAX);
                 ret = -EINVAL;
                 goto out;
@@ -537,14 +542,15 @@ static ssize_t bonding_store_arp_interval(struct device *d,
         pr_info("%s: Setting ARP monitoring interval to %d.\n",
                 bond->dev->name, new_value);
         bond->params.arp_interval = new_value;
-        if (bond->params.miimon) {
-                pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n",
-                        bond->dev->name, bond->dev->name);
-                bond->params.miimon = 0;
-        }
-        if (!bond->params.arp_targets[0]) {
-                pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n",
-                        bond->dev->name);
+        if (new_value) {
+                if (bond->params.miimon) {
+                        pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n",
+                                bond->dev->name, bond->dev->name);
+                        bond->params.miimon = 0;
+                }
+                if (!bond->params.arp_targets[0])
+                        pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n",
+                                bond->dev->name);
         }
         if (bond->dev->flags & IFF_UP) {
                 /* If the interface is up, we may need to fire off
@@ -552,10 +558,13 @@ static ssize_t bonding_store_arp_interval(struct device *d,
                  * timer will get fired off when the open function
                  * is called.
                  */
-                cancel_delayed_work_sync(&bond->mii_work);
-                queue_delayed_work(bond->wq, &bond->arp_work, 0);
+                if (!new_value) {
+                        cancel_delayed_work_sync(&bond->arp_work);
+                } else {
+                        cancel_delayed_work_sync(&bond->mii_work);
+                        queue_delayed_work(bond->wq, &bond->arp_work, 0);
+                }
         }
-
 out:
         rtnl_unlock();
         return ret;
@@ -697,7 +706,7 @@ static ssize_t bonding_store_downdelay(struct device *d,
         }
         if (new_value < 0) {
                 pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n",
-                       bond->dev->name, new_value, 1, INT_MAX);
+                       bond->dev->name, new_value, 0, INT_MAX);
                 ret = -EINVAL;
                 goto out;
         } else {
@@ -752,8 +761,8 @@ static ssize_t bonding_store_updelay(struct device *d,
                 goto out;
         }
         if (new_value < 0) {
-                pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n",
-                       bond->dev->name, new_value, 1, INT_MAX);
+                pr_err("%s: Invalid up delay value %d not in range %d-%d; rejected.\n",
+                       bond->dev->name, new_value, 0, INT_MAX);
                 ret = -EINVAL;
                 goto out;
         } else {
@@ -963,37 +972,37 @@ static ssize_t bonding_store_miimon(struct device *d,
         }
         if (new_value < 0) {
                 pr_err("%s: Invalid miimon value %d not in range %d-%d; rejected.\n",
-                       bond->dev->name, new_value, 1, INT_MAX);
+                       bond->dev->name, new_value, 0, INT_MAX);
                 ret = -EINVAL;
                 goto out;
-        } else {
-                pr_info("%s: Setting MII monitoring interval to %d.\n",
-                        bond->dev->name, new_value);
-                bond->params.miimon = new_value;
-                if (bond->params.updelay)
-                        pr_info("%s: Note: Updating updelay (to %d) since it is a multiple of the miimon value.\n",
-                                bond->dev->name,
-                                bond->params.updelay * bond->params.miimon);
-                if (bond->params.downdelay)
-                        pr_info("%s: Note: Updating downdelay (to %d) since it is a multiple of the miimon value.\n",
-                                bond->dev->name,
-                                bond->params.downdelay * bond->params.miimon);
-                if (bond->params.arp_interval) {
-                        pr_info("%s: MII monitoring cannot be used with ARP monitoring. Disabling ARP monitoring...\n",
-                                bond->dev->name);
-                        bond->params.arp_interval = 0;
-                        if (bond->params.arp_validate) {
-                                bond->params.arp_validate =
-                                        BOND_ARP_VALIDATE_NONE;
-                        }
-                }
-
-                if (bond->dev->flags & IFF_UP) {
-                        /* If the interface is up, we may need to fire off
-                         * the MII timer. If the interface is down, the
-                         * timer will get fired off when the open function
-                         * is called.
-                         */
+        }
+        pr_info("%s: Setting MII monitoring interval to %d.\n",
+                bond->dev->name, new_value);
+        bond->params.miimon = new_value;
+        if (bond->params.updelay)
+                pr_info("%s: Note: Updating updelay (to %d) since it is a multiple of the miimon value.\n",
+                        bond->dev->name,
+                        bond->params.updelay * bond->params.miimon);
+        if (bond->params.downdelay)
+                pr_info("%s: Note: Updating downdelay (to %d) since it is a multiple of the miimon value.\n",
+                        bond->dev->name,
+                        bond->params.downdelay * bond->params.miimon);
+        if (new_value && bond->params.arp_interval) {
+                pr_info("%s: MII monitoring cannot be used with ARP monitoring. Disabling ARP monitoring...\n",
+                        bond->dev->name);
+                bond->params.arp_interval = 0;
+                if (bond->params.arp_validate)
+                        bond->params.arp_validate = BOND_ARP_VALIDATE_NONE;
+        }
+        if (bond->dev->flags & IFF_UP) {
+                /* If the interface is up, we may need to fire off
+                 * the MII timer. If the interface is down, the
+                 * timer will get fired off when the open function
+                 * is called.
+                 */
+                if (!new_value) {
+                        cancel_delayed_work_sync(&bond->mii_work);
+                } else {
                         cancel_delayed_work_sync(&bond->arp_work);
                         queue_delayed_work(bond->wq, &bond->mii_work, 0);
                 }
diff --git a/drivers/net/can/sja1000/Kconfig b/drivers/net/can/sja1000/Kconfig
index b39ca5b3ea7f..ff2ba86cd4a4 100644
--- a/drivers/net/can/sja1000/Kconfig
+++ b/drivers/net/can/sja1000/Kconfig
@@ -46,6 +46,7 @@ config CAN_EMS_PCI
 config CAN_PEAK_PCMCIA
         tristate "PEAK PCAN-PC Card"
         depends on PCMCIA
+        depends on HAS_IOPORT
         ---help---
           This driver is for the PCAN-PC Card PCMCIA adapter (1 or 2 channels)
           from PEAK-System (http://www.peak-system.com). To compile this
diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
index a042cdc260dc..3c18d7d000ed 100644
--- a/drivers/net/can/sja1000/plx_pci.c
+++ b/drivers/net/can/sja1000/plx_pci.c
@@ -348,7 +348,7 @@ static inline int plx_pci_check_sja1000(const struct sja1000_priv *priv)
          */
         if ((priv->read_reg(priv, REG_CR) & REG_CR_BASICCAN_INITIAL_MASK) ==
             REG_CR_BASICCAN_INITIAL &&
-            (priv->read_reg(priv, REG_SR) == REG_SR_BASICCAN_INITIAL) &&
+            (priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_BASICCAN_INITIAL) &&
             (priv->read_reg(priv, REG_IR) == REG_IR_BASICCAN_INITIAL))
                 flag = 1;
 
@@ -360,7 +360,7 @@ static inline int plx_pci_check_sja1000(const struct sja1000_priv *priv)
          * See states on p. 23 of the Datasheet.
          */
         if (priv->read_reg(priv, REG_MOD) == REG_MOD_PELICAN_INITIAL &&
-            priv->read_reg(priv, REG_SR) == REG_SR_PELICAN_INITIAL &&
+            priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_PELICAN_INITIAL &&
             priv->read_reg(priv, REG_IR) == REG_IR_PELICAN_INITIAL)
                 return flag;
 
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index daf4013a8fc7..e4df307eaa90 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -92,7 +92,7 @@ static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val)
          */
         spin_lock_irqsave(&priv->cmdreg_lock, flags);
         priv->write_reg(priv, REG_CMR, val);
-        priv->read_reg(priv, REG_SR);
+        priv->read_reg(priv, SJA1000_REG_SR);
         spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
 }
 
@@ -502,7 +502,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
 
         while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
                 n++;
-                status = priv->read_reg(priv, REG_SR);
+                status = priv->read_reg(priv, SJA1000_REG_SR);
                 /* check for absent controller due to hw unplug */
                 if (status == 0xFF && sja1000_is_absent(priv))
                         return IRQ_NONE;
@@ -530,7 +530,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                         /* receive interrupt */
                         while (status & SR_RBS) {
                                 sja1000_rx(dev);
-                                status = priv->read_reg(priv, REG_SR);
+                                status = priv->read_reg(priv, SJA1000_REG_SR);
                                 /* check for absent controller */
                                 if (status == 0xFF && sja1000_is_absent(priv))
                                         return IRQ_NONE;
diff --git a/drivers/net/can/sja1000/sja1000.h b/drivers/net/can/sja1000/sja1000.h
index afa99847a510..aa48e053da27 100644
--- a/drivers/net/can/sja1000/sja1000.h
+++ b/drivers/net/can/sja1000/sja1000.h
@@ -56,7 +56,7 @@
 /* SJA1000 registers - manual section 6.4 (Pelican Mode) */
 #define REG_MOD         0x00
 #define REG_CMR         0x01
-#define REG_SR          0x02
+#define SJA1000_REG_SR          0x02
 #define REG_IR          0x03
 #define REG_IER         0x04
 #define REG_ALC         0x0B
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e.h b/drivers/net/ethernet/atheros/atl1e/atl1e.h
index 829b5ad71d0d..b5fd934585e9 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e.h
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e.h
@@ -186,7 +186,7 @@ struct atl1e_tpd_desc {
 /* how about 0x2000 */
 #define MAX_TX_BUF_LEN      0x2000
 #define MAX_TX_BUF_SHIFT    13
-/*#define MAX_TX_BUF_LEN  0x3000 */
+#define MAX_TSO_SEG_SIZE    0x3c00
 
 /* rrs word 1 bit 0:31 */
 #define RRS_RX_CSUM_MASK        0xFFFF
@@ -438,7 +438,6 @@ struct atl1e_adapter {
         struct atl1e_hw        hw;
         struct atl1e_hw_stats  hw_stats;
 
-        bool have_msi;
         u32 wol;
         u16 link_speed;
         u16 link_duplex;
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
index 92f4734f860d..ac25f05ff68f 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
@@ -1849,34 +1849,19 @@ static void atl1e_free_irq(struct atl1e_adapter *adapter)
         struct net_device *netdev = adapter->netdev;
 
         free_irq(adapter->pdev->irq, netdev);
-
-        if (adapter->have_msi)
-                pci_disable_msi(adapter->pdev);
 }
 
 static int atl1e_request_irq(struct atl1e_adapter *adapter)
 {
         struct pci_dev    *pdev   = adapter->pdev;
         struct net_device *netdev = adapter->netdev;
-        int flags = 0;
         int err = 0;
 
-        adapter->have_msi = true;
-        err = pci_enable_msi(pdev);
-        if (err) {
-                netdev_dbg(netdev,
-                           "Unable to allocate MSI interrupt Error: %d\n", err);
-                adapter->have_msi = false;
-        }
-
-        if (!adapter->have_msi)
-                flags |= IRQF_SHARED;
-        err = request_irq(pdev->irq, atl1e_intr, flags, netdev->name, netdev);
+        err = request_irq(pdev->irq, atl1e_intr, IRQF_SHARED, netdev->name,
+                          netdev);
         if (err) {
                 netdev_dbg(adapter->netdev,
                            "Unable to allocate interrupt Error: %d\n", err);
-                if (adapter->have_msi)
-                        pci_disable_msi(pdev);
                 return err;
         }
         netdev_dbg(netdev, "atl1e_request_irq OK\n");
@@ -2344,6 +2329,7 @@ static int atl1e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         INIT_WORK(&adapter->reset_task, atl1e_reset_task);
         INIT_WORK(&adapter->link_chg_task, atl1e_link_chg_task);
+        netif_set_gso_max_size(netdev, MAX_TSO_SEG_SIZE);
         err = register_netdev(netdev);
         if (err) {
                 netdev_err(netdev, "register netdevice failed\n");
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
index 568205436a15..91ecd6a00d05 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
@@ -2139,12 +2139,12 @@ static u8 bnx2x_dcbnl_get_cap(struct net_device *netdev, int capid, u8 *cap)
                         break;
                 default:
                         BNX2X_ERR("Non valid capability ID\n");
-                        rval = -EINVAL;
+                        rval = 1;
                         break;
                 }
         } else {
                 DP(BNX2X_MSG_DCB, "DCB disabled\n");
-                rval = -EINVAL;
+                rval = 1;
         }
 
         DP(BNX2X_MSG_DCB, "capid %d:%x\n", capid, *cap);
@@ -2170,12 +2170,12 @@ static int bnx2x_dcbnl_get_numtcs(struct net_device *netdev, int tcid, u8 *num)
                         break;
                 default:
                         BNX2X_ERR("Non valid TC-ID\n");
-                        rval = -EINVAL;
+                        rval = 1;
                         break;
                 }
         } else {
                 DP(BNX2X_MSG_DCB, "DCB disabled\n");
-                rval = -EINVAL;
+                rval = 1;
         }
 
         return rval;
@@ -2188,7 +2188,7 @@ static int bnx2x_dcbnl_set_numtcs(struct net_device *netdev, int tcid, u8 num)
         return -EINVAL;
 }
 
-static u8  bnx2x_dcbnl_get_pfc_state(struct net_device *netdev)
+static u8 bnx2x_dcbnl_get_pfc_state(struct net_device *netdev)
 {
         struct bnx2x *bp = netdev_priv(netdev);
         DP(BNX2X_MSG_DCB, "state = %d\n", bp->dcbx_local_feat.pfc.enabled);
@@ -2390,12 +2390,12 @@ static u8 bnx2x_dcbnl_get_featcfg(struct net_device *netdev, int featid,
                         break;
                 default:
                         BNX2X_ERR("Non valid featrue-ID\n");
-                        rval = -EINVAL;
+                        rval = 1;
                         break;
                 }
         } else {
                 DP(BNX2X_MSG_DCB, "DCB disabled\n");
-                rval = -EINVAL;
+                rval = 1;
         }
 
         return rval;
@@ -2431,12 +2431,12 @@ static u8 bnx2x_dcbnl_set_featcfg(struct net_device *netdev, int featid,
                         break;
                 default:
                         BNX2X_ERR("Non valid featrue-ID\n");
-                        rval = -EINVAL;
+                        rval = 1;
                         break;
                 }
         } else {
                 DP(BNX2X_MSG_DCB, "dcbnl call not valid\n");
-                rval = -EINVAL;
+                rval = 1;
         }
 
         return rval;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index 77ebae0ac64a..0283f343b0d1 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -13437,13 +13437,7 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
 {
         struct bnx2x *bp = params->bp;
         u16 base_page, next_page, not_kr2_device, lane;
-        int sigdet = bnx2x_warpcore_get_sigdet(phy, params);
-
-        if (!sigdet) {
-                if (!(vars->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE))
-                        bnx2x_kr2_recovery(params, vars, phy);
-                return;
-        }
+        int sigdet;
 
         /* Once KR2 was disabled, wait 5 seconds before checking KR2 recovery
          * since some switches tend to reinit the AN process and clear the
@@ -13454,6 +13448,16 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
                 vars->check_kr2_recovery_cnt--;
                 return;
         }
+
+        sigdet = bnx2x_warpcore_get_sigdet(phy, params);
+        if (!sigdet) {
+                if (!(vars->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE)) {
+                        bnx2x_kr2_recovery(params, vars, phy);
+                        DP(NETIF_MSG_LINK, "No sigdet\n");
+                }
+                return;
+        }
+
         lane = bnx2x_get_warpcore_lane(phy, params);
         CL22_WR_OVER_CL45(bp, phy, MDIO_REG_BANK_AER_BLOCK,
                           MDIO_AER_BLOCK_AER_REG, lane);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index e81a747ea8ce..8e58da909f5c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -4947,7 +4947,7 @@ static void bnx2x_after_function_update(struct bnx2x *bp)
                                   q);
         }
 
-        if (!NO_FCOE(bp)) {
+        if (!NO_FCOE(bp) && CNIC_ENABLED(bp)) {
                 fp = &bp->fp[FCOE_IDX(bp)];
                 queue_params.q_obj = &bnx2x_sp_obj(bp, fp).q_obj;
 
@@ -13354,6 +13354,7 @@ static int bnx2x_unregister_cnic(struct net_device *dev)
         RCU_INIT_POINTER(bp->cnic_ops, NULL);
         mutex_unlock(&bp->cnic_mutex);
         synchronize_rcu();
+        bp->cnic_enabled = false;
         kfree(bp->cnic_kwq);
         bp->cnic_kwq = NULL;
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 67d2663b3974..17a972734ba7 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -14604,8 +14604,11 @@ static void tg3_read_vpd(struct tg3 *tp)
                 if (j + len > block_end)
                         goto partno;
 
-                memcpy(tp->fw_ver, &vpd_data[j], len);
-                strncat(tp->fw_ver, " bc ", vpdlen - len - 1);
+                if (len >= sizeof(tp->fw_ver))
+                        len = sizeof(tp->fw_ver) - 1;
+                memset(tp->fw_ver, 0, sizeof(tp->fw_ver));
+                snprintf(tp->fw_ver, sizeof(tp->fw_ver), "%.*s bc ", len,
+                         &vpd_data[j]);
         }
 
 partno:
diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c
index a170065b5973..b0ebc9f6d55e 100644
--- a/drivers/net/ethernet/calxeda/xgmac.c
+++ b/drivers/net/ethernet/calxeda/xgmac.c
@@ -163,6 +163,7 @@
 #define XGMAC_FLOW_CTRL_FCB_BPA 0x00000001      /* Flow Control Busy ... */
 
 /* XGMAC_INT_STAT reg */
+#define XGMAC_INT_STAT_PMTIM    0x00800000      /* PMT Interrupt Mask */
 #define XGMAC_INT_STAT_PMT      0x0080          /* PMT Interrupt Status */
 #define XGMAC_INT_STAT_LPI      0x0040          /* LPI Interrupt Status */
 
@@ -960,6 +961,9 @@ static int xgmac_hw_init(struct net_device *dev)
         writel(DMA_INTR_DEFAULT_MASK, ioaddr + XGMAC_DMA_STATUS);
         writel(DMA_INTR_DEFAULT_MASK, ioaddr + XGMAC_DMA_INTR_ENA);
 
+        /* Mask power mgt interrupt */
+        writel(XGMAC_INT_STAT_PMTIM, ioaddr + XGMAC_INT_STAT);
+
         /* XGMAC requires AXI bus init. This is a 'magic number' for now */
         writel(0x0077000E, ioaddr + XGMAC_DMA_AXI_BUS);
 
@@ -1141,6 +1145,9 @@ static int xgmac_rx(struct xgmac_priv *priv, int limit)
                 struct sk_buff *skb;
                 int frame_len;
 
+                if (!dma_ring_cnt(priv->rx_head, priv->rx_tail, DMA_RX_RING_SZ))
+                        break;
+
                 entry = priv->rx_tail;
                 p = priv->dma_rx + entry;
                 if (desc_get_owner(p))
@@ -1825,7 +1832,7 @@ static void xgmac_pmt(void __iomem *ioaddr, unsigned long mode)
         unsigned int pmt = 0;
 
         if (mode & WAKE_MAGIC)
-                pmt |= XGMAC_PMT_POWERDOWN | XGMAC_PMT_MAGIC_PKT;
+                pmt |= XGMAC_PMT_POWERDOWN | XGMAC_PMT_MAGIC_PKT_EN;
         if (mode & WAKE_UCAST)
                 pmt |= XGMAC_PMT_POWERDOWN | XGMAC_PMT_GLBL_UNICAST;
 
diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index 8cdf02503d13..9eada8e86078 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -257,6 +257,107 @@ static void dm9000_dumpblk_32bit(void __iomem *reg, int count)
                 tmp = readl(reg);
 }
 
+/*
+ * Sleep, either by using msleep() or if we are suspending, then
+ * use mdelay() to sleep.
+ */
+static void dm9000_msleep(board_info_t *db, unsigned int ms)
+{
+        if (db->in_suspend)
+                mdelay(ms);
+        else
+                msleep(ms);
+}
+
+/* Read a word from phyxcer */
+static int
+dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg)
+{
+        board_info_t *db = netdev_priv(dev);
+        unsigned long flags;
+        unsigned int reg_save;
+        int ret;
+
+        mutex_lock(&db->addr_lock);
+
+        spin_lock_irqsave(&db->lock, flags);
+
+        /* Save previous register address */
+        reg_save = readb(db->io_addr);
+
+        /* Fill the phyxcer register into REG_0C */
+        iow(db, DM9000_EPAR, DM9000_PHY | reg);
+
+        /* Issue phyxcer read command */
+        iow(db, DM9000_EPCR, EPCR_ERPRR | EPCR_EPOS);
+
+        writeb(reg_save, db->io_addr);
+        spin_unlock_irqrestore(&db->lock, flags);
+
+        dm9000_msleep(db, 1);           /* Wait read complete */
+
+        spin_lock_irqsave(&db->lock, flags);
+        reg_save = readb(db->io_addr);
+
+        iow(db, DM9000_EPCR, 0x0);      /* Clear phyxcer read command */
+
+        /* The read data keeps on REG_0D & REG_0E */
+        ret = (ior(db, DM9000_EPDRH) << 8) | ior(db, DM9000_EPDRL);
+
+        /* restore the previous address */
+        writeb(reg_save, db->io_addr);
+        spin_unlock_irqrestore(&db->lock, flags);
+
+        mutex_unlock(&db->addr_lock);
+
+        dm9000_dbg(db, 5, "phy_read[%02x] -> %04x\n", reg, ret);
+        return ret;
+}
+
+/* Write a word to phyxcer */
+static void
+dm9000_phy_write(struct net_device *dev,
+                 int phyaddr_unused, int reg, int value)
+{
+        board_info_t *db = netdev_priv(dev);
+        unsigned long flags;
+        unsigned long reg_save;
+
+        dm9000_dbg(db, 5, "phy_write[%02x] = %04x\n", reg, value);
+        mutex_lock(&db->addr_lock);
+
+        spin_lock_irqsave(&db->lock, flags);
+
+        /* Save previous register address */
+        reg_save = readb(db->io_addr);
+
+        /* Fill the phyxcer register into REG_0C */
+        iow(db, DM9000_EPAR, DM9000_PHY | reg);
+
+        /* Fill the written data into REG_0D & REG_0E */
+        iow(db, DM9000_EPDRL, value);
+        iow(db, DM9000_EPDRH, value >> 8);
+
+        /* Issue phyxcer write command */
+        iow(db, DM9000_EPCR, EPCR_EPOS | EPCR_ERPRW);
+
+        writeb(reg_save, db->io_addr);
+        spin_unlock_irqrestore(&db->lock, flags);
+
+        dm9000_msleep(db, 1);           /* Wait write complete */
+
+        spin_lock_irqsave(&db->lock, flags);
+        reg_save = readb(db->io_addr);
+
+        iow(db, DM9000_EPCR, 0x0);      /* Clear phyxcer write command */
+
+        /* restore the previous address */
+        writeb(reg_save, db->io_addr);
+
+        spin_unlock_irqrestore(&db->lock, flags);
+        mutex_unlock(&db->addr_lock);
+}
+
 /* dm9000_set_io
  *
  * select the specified set of io routines to use with the
@@ -795,6 +896,9 @@ dm9000_init_dm9000(struct net_device *dev)
 
         iow(db, DM9000_GPCR, GPCR_GEP_CNTL);    /* Let GPIO0 output */
 
+        dm9000_phy_write(dev, 0, MII_BMCR, BMCR_RESET); /* PHY RESET */
+        dm9000_phy_write(dev, 0, MII_DM_DSPCR, DSPCR_INIT_PARAM); /* Init */
+
         ncr = (db->flags & DM9000_PLATF_EXT_PHY) ? NCR_EXT_PHY : 0;
 
         /* if wol is needed, then always set NCR_WAKEEN otherwise we end
@@ -1201,109 +1305,6 @@ dm9000_open(struct net_device *dev)
         return 0;
 }
 
-/*
- * Sleep, either by using msleep() or if we are suspending, then
- * use mdelay() to sleep.
- */
-static void dm9000_msleep(board_info_t *db, unsigned int ms)
-{
-        if (db->in_suspend)
-                mdelay(ms);
-        else
-                msleep(ms);
-}
-
-/*
- *   Read a word from phyxcer
- */
-static int
-dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg)
-{
-        board_info_t *db = netdev_priv(dev);
-        unsigned long flags;
-        unsigned int reg_save;
-        int ret;
-
-        mutex_lock(&db->addr_lock);
-
-        spin_lock_irqsave(&db->lock,flags);
-
-        /* Save previous register address */
-        reg_save = readb(db->io_addr);
-
-        /* Fill the phyxcer register into REG_0C */
-        iow(db, DM9000_EPAR, DM9000_PHY | reg);
-
-        iow(db, DM9000_EPCR, EPCR_ERPRR | EPCR_EPOS);   /* Issue phyxcer read command */
-
-        writeb(reg_save, db->io_addr);
-        spin_unlock_irqrestore(&db->lock,flags);
-
-        dm9000_msleep(db, 1);           /* Wait read complete */
-
-        spin_lock_irqsave(&db->lock,flags);
-        reg_save = readb(db->io_addr);
-
-        iow(db, DM9000_EPCR, 0x0);      /* Clear phyxcer read command */
-
-        /* The read data keeps on REG_0D & REG_0E */
-        ret = (ior(db, DM9000_EPDRH) << 8) | ior(db, DM9000_EPDRL);
-
-        /* restore the previous address */
-        writeb(reg_save, db->io_addr);
-        spin_unlock_irqrestore(&db->lock,flags);
-
-        mutex_unlock(&db->addr_lock);
-
-        dm9000_dbg(db, 5, "phy_read[%02x] -> %04x\n", reg, ret);
-        return ret;
-}
-
-/*
- *   Write a word to phyxcer
- */
-static void
-dm9000_phy_write(struct net_device *dev,
-                 int phyaddr_unused, int reg, int value)
-{
-        board_info_t *db = netdev_priv(dev);
-        unsigned long flags;
-        unsigned long reg_save;
-
-        dm9000_dbg(db, 5, "phy_write[%02x] = %04x\n", reg, value);
-        mutex_lock(&db->addr_lock);
-
-        spin_lock_irqsave(&db->lock,flags);
-
-        /* Save previous register address */
-        reg_save = readb(db->io_addr);
-
-        /* Fill the phyxcer register into REG_0C */
-        iow(db, DM9000_EPAR, DM9000_PHY | reg);
-
-        /* Fill the written data into REG_0D & REG_0E */
-        iow(db, DM9000_EPDRL, value);
-        iow(db, DM9000_EPDRH, value >> 8);
-
-        iow(db, DM9000_EPCR, EPCR_EPOS | EPCR_ERPRW);   /* Issue phyxcer write command */
-
-        writeb(reg_save, db->io_addr);
-        spin_unlock_irqrestore(&db->lock, flags);
-
-        dm9000_msleep(db, 1);           /* Wait write complete */
-
-        spin_lock_irqsave(&db->lock,flags);
-        reg_save = readb(db->io_addr);
-
-        iow(db, DM9000_EPCR, 0x0);      /* Clear phyxcer write command */
-
-        /* restore the previous address */
-        writeb(reg_save, db->io_addr);
-
-        spin_unlock_irqrestore(&db->lock, flags);
-        mutex_unlock(&db->addr_lock);
-}
-
 static void
 dm9000_shutdown(struct net_device *dev)
 {
@@ -1502,7 +1503,12 @@ dm9000_probe(struct platform_device *pdev)
         db->flags |= DM9000_PLATF_SIMPLE_PHY;
 #endif
 
-        dm9000_reset(db);
+        /* Fixing bug on dm9000_probe, takeover dm9000_reset(db),
+         * Need 'NCR_MAC_LBK' bit to indeed stable our DM9000 fifo
+         * while probe stage.
+         */
+
+        iow(db, DM9000_NCR, NCR_MAC_LBK | NCR_RST);
 
         /* try multiple times, DM9000 sometimes gets the read wrong */
         for (i = 0; i < 8; i++) {
diff --git a/drivers/net/ethernet/davicom/dm9000.h b/drivers/net/ethernet/davicom/dm9000.h
index 55688bd1a3ef..9ce058adabab 100644
--- a/drivers/net/ethernet/davicom/dm9000.h
+++ b/drivers/net/ethernet/davicom/dm9000.h
@@ -69,7 +69,9 @@
 #define NCR_WAKEEN          (1<<6)
 #define NCR_FCOL            (1<<4)
 #define NCR_FDX             (1<<3)
-#define NCR_LBK             (3<<1)
+
+#define NCR_RESERVED        (3<<1)
+#define NCR_MAC_LBK         (1<<1)
 #define NCR_RST             (1<<0)
 
 #define NSR_SPEED           (1<<7)
@@ -167,5 +169,12 @@
 #define ISR_LNKCHNG             (1<<5)
 #define ISR_UNDERRUN            (1<<4)
 
+/* Davicom MII registers.
+ */
+
+#define MII_DM_DSPCR            0x1b    /* DSP Control Register */
+
+#define DSPCR_INIT_PARAM        0xE100  /* DSP init parameter */
+
 #endif /* _DM9000X_H_ */
 
diff --git a/drivers/net/ethernet/freescale/fec.c b/drivers/net/ethernet/freescale/fec.c
index e3f39372ce25..f292c3aa423f 100644
--- a/drivers/net/ethernet/freescale/fec.c
+++ b/drivers/net/ethernet/freescale/fec.c
@@ -345,6 +345,53 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         return NETDEV_TX_OK;
 }
 
+/* Init RX & TX buffer descriptors
+ */
+static void fec_enet_bd_init(struct net_device *dev)
+{
+        struct fec_enet_private *fep = netdev_priv(dev);
+        struct bufdesc *bdp;
+        unsigned int i;
+
+        /* Initialize the receive buffer descriptors. */
+        bdp = fep->rx_bd_base;
+        for (i = 0; i < RX_RING_SIZE; i++) {
+
+                /* Initialize the BD for every fragment in the page. */
+                if (bdp->cbd_bufaddr)
+                        bdp->cbd_sc = BD_ENET_RX_EMPTY;
+                else
+                        bdp->cbd_sc = 0;
+                bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
+        }
+
+        /* Set the last buffer to wrap */
+        bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
+        bdp->cbd_sc |= BD_SC_WRAP;
+
+        fep->cur_rx = fep->rx_bd_base;
+
+        /* ...and the same for transmit */
+        bdp = fep->tx_bd_base;
+        fep->cur_tx = bdp;
+        for (i = 0; i < TX_RING_SIZE; i++) {
+
+                /* Initialize the BD for every fragment in the page. */
+                bdp->cbd_sc = 0;
+                if (bdp->cbd_bufaddr && fep->tx_skbuff[i]) {
+                        dev_kfree_skb_any(fep->tx_skbuff[i]);
+                        fep->tx_skbuff[i] = NULL;
+                }
+                bdp->cbd_bufaddr = 0;
+                bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
+        }
+
+        /* Set the last buffer to wrap */
+        bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
+        bdp->cbd_sc |= BD_SC_WRAP;
+        fep->dirty_tx = bdp;
+}
+
 /* This function is called to start or restart the FEC during a link
  * change.  This only happens when switching between half and full
  * duplex.
@@ -388,6 +435,8 @@ fec_restart(struct net_device *ndev, int duplex)
         /* Set maximum receive buffer size. */
         writel(PKT_MAXBLR_SIZE, fep->hwp + FEC_R_BUFF_SIZE);
 
+        fec_enet_bd_init(ndev);
+
         /* Set receive and transmit descriptor base. */
         writel(fep->bd_dma, fep->hwp + FEC_R_DES_START);
         if (fep->bufdesc_ex)
@@ -397,7 +446,6 @@ fec_restart(struct net_device *ndev, int duplex)
                 writel((unsigned long)fep->bd_dma + sizeof(struct bufdesc)
                         * RX_RING_SIZE, fep->hwp + FEC_X_DES_START);
 
-        fep->cur_rx = fep->rx_bd_base;
 
         for (i = 0; i <= TX_RING_MOD_MASK; i++) {
                 if (fep->tx_skbuff[i]) {
@@ -1332,7 +1380,7 @@ static int fec_enet_ioctl(struct net_device *ndev, struct ifreq *rq, int cmd)
 static void fec_enet_free_buffers(struct net_device *ndev)
 {
         struct fec_enet_private *fep = netdev_priv(ndev);
-        int i;
+        unsigned int i;
         struct sk_buff *skb;
         struct bufdesc  *bdp;
 
@@ -1356,7 +1404,7 @@ static void fec_enet_free_buffers(struct net_device *ndev)
 static int fec_enet_alloc_buffers(struct net_device *ndev)
 {
         struct fec_enet_private *fep = netdev_priv(ndev);
-        int i;
+        unsigned int i;
         struct sk_buff *skb;
         struct bufdesc  *bdp;
 
@@ -1597,8 +1645,6 @@ static int fec_enet_init(struct net_device *ndev)
 {
         struct fec_enet_private *fep = netdev_priv(ndev);
         struct bufdesc *cbd_base;
-        struct bufdesc *bdp;
-        int i;
 
         /* Allocate memory for buffer descriptors. */
         cbd_base = dma_alloc_coherent(NULL, PAGE_SIZE, &fep->bd_dma,
@@ -1608,6 +1654,7 @@ static int fec_enet_init(struct net_device *ndev)
                 return -ENOMEM;
         }
 
+        memset(cbd_base, 0, PAGE_SIZE);
         spin_lock_init(&fep->hw_lock);
 
         fep->netdev = ndev;
@@ -1631,35 +1678,6 @@ static int fec_enet_init(struct net_device *ndev)
         writel(FEC_RX_DISABLED_IMASK, fep->hwp + FEC_IMASK);
         netif_napi_add(ndev, &fep->napi, fec_enet_rx_napi, FEC_NAPI_WEIGHT);
 
-        /* Initialize the receive buffer descriptors. */
-        bdp = fep->rx_bd_base;
-        for (i = 0; i < RX_RING_SIZE; i++) {
-
-                /* Initialize the BD for every fragment in the page. */
-                bdp->cbd_sc = 0;
-                bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
-        }
-
-        /* Set the last buffer to wrap */
-        bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
-        bdp->cbd_sc |= BD_SC_WRAP;
-
-        /* ...and the same for transmit */
-        bdp = fep->tx_bd_base;
-        fep->cur_tx = bdp;
-        for (i = 0; i < TX_RING_SIZE; i++) {
-
-                /* Initialize the BD for every fragment in the page. */
-                bdp->cbd_sc = 0;
-                bdp->cbd_bufaddr = 0;
-                bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
-        }
-
-        /* Set the last buffer to wrap */
-        bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
-        bdp->cbd_sc |= BD_SC_WRAP;
-        fep->dirty_tx = bdp;
-
         fec_restart(ndev, 0);
 
         return 0;
diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
index 1f17ca0f2201..0d8df400a479 100644
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -128,6 +128,7 @@ void fec_ptp_start_cyclecounter(struct net_device *ndev)
 
         spin_unlock_irqrestore(&fep->tmreg_lock, flags);
 }
+EXPORT_SYMBOL(fec_ptp_start_cyclecounter);
 
 /**
  * fec_ptp_adjfreq - adjust ptp cycle frequency
@@ -318,6 +319,7 @@ int fec_ptp_ioctl(struct net_device *ndev, struct ifreq *ifr, int cmd)
         return copy_to_user(ifr->ifr_data, &config, sizeof(config)) ?
             -EFAULT : 0;
 }
+EXPORT_SYMBOL(fec_ptp_ioctl);
 
 /**
  * fec_time_keep - call timecounter_read every second to avoid timer overrun
@@ -383,3 +385,4 @@ void fec_ptp_init(struct net_device *ndev, struct platform_device *pdev)
                 pr_info("registered PHC device on %s\n", ndev->name);
         }
 }
+EXPORT_SYMBOL(fec_ptp_init);
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index ec800b093e7e..d2bea3f07c73 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -870,7 +870,7 @@ err_unlock:
 }
 
 static int e100_exec_cb(struct nic *nic, struct sk_buff *skb,
-        void (*cb_prepare)(struct nic *, struct cb *, struct sk_buff *))
+        int (*cb_prepare)(struct nic *, struct cb *, struct sk_buff *))
 {
         struct cb *cb;
         unsigned long flags;
@@ -888,10 +888,13 @@ static int e100_exec_cb(struct nic *nic, struct sk_buff *skb,
         nic->cbs_avail--;
         cb->skb = skb;
 
+        err = cb_prepare(nic, cb, skb);
+        if (err)
+                goto err_unlock;
+
         if (unlikely(!nic->cbs_avail))
                 err = -ENOSPC;
 
-        cb_prepare(nic, cb, skb);
 
         /* Order is important otherwise we'll be in a race with h/w:
          * set S-bit in current first, then clear S-bit in previous. */
@@ -1091,7 +1094,7 @@ static void e100_get_defaults(struct nic *nic)
         nic->mii.mdio_write = mdio_write;
 }
 
-static void e100_configure(struct nic *nic, struct cb *cb, struct sk_buff *skb)
+static int e100_configure(struct nic *nic, struct cb *cb, struct sk_buff *skb)
 {
         struct config *config = &cb->u.config;
         u8 *c = (u8 *)config;
@@ -1181,6 +1184,7 @@ static void e100_configure(struct nic *nic, struct cb *cb, struct sk_buff *skb)
         netif_printk(nic, hw, KERN_DEBUG, nic->netdev,
                      "[16-23]=%02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X\n",
                      c[16], c[17], c[18], c[19], c[20], c[21], c[22], c[23]);
+        return 0;
 }
 
 /*************************************************************************
@@ -1331,7 +1335,7 @@ static const struct firmware *e100_request_firmware(struct nic *nic)
         return fw;
 }
 
-static void e100_setup_ucode(struct nic *nic, struct cb *cb,
+static int e100_setup_ucode(struct nic *nic, struct cb *cb,
                              struct sk_buff *skb)
 {
         const struct firmware *fw = (void *)skb;
@@ -1358,6 +1362,7 @@ static void e100_setup_ucode(struct nic *nic, struct cb *cb,
         cb->u.ucode[min_size] |= cpu_to_le32((BUNDLESMALL) ? 0xFFFF : 0xFF80);
 
         cb->command = cpu_to_le16(cb_ucode | cb_el);
+        return 0;
 }
 
 static inline int e100_load_ucode_wait(struct nic *nic)
@@ -1400,18 +1405,20 @@ static inline int e100_load_ucode_wait(struct nic *nic)
         return err;
 }
 
-static void e100_setup_iaaddr(struct nic *nic, struct cb *cb,
+static int e100_setup_iaaddr(struct nic *nic, struct cb *cb,
         struct sk_buff *skb)
 {
         cb->command = cpu_to_le16(cb_iaaddr);
         memcpy(cb->u.iaaddr, nic->netdev->dev_addr, ETH_ALEN);
+        return 0;
 }
 
-static void e100_dump(struct nic *nic, struct cb *cb, struct sk_buff *skb)
+static int e100_dump(struct nic *nic, struct cb *cb, struct sk_buff *skb)
 {
         cb->command = cpu_to_le16(cb_dump);
         cb->u.dump_buffer_addr = cpu_to_le32(nic->dma_addr +
                 offsetof(struct mem, dump_buf));
+        return 0;
 }
 
 static int e100_phy_check_without_mii(struct nic *nic)
@@ -1581,7 +1588,7 @@ static int e100_hw_init(struct nic *nic)
         return 0;
 }
 
-static void e100_multi(struct nic *nic, struct cb *cb, struct sk_buff *skb)
+static int e100_multi(struct nic *nic, struct cb *cb, struct sk_buff *skb)
 {
         struct net_device *netdev = nic->netdev;
         struct netdev_hw_addr *ha;
@@ -1596,6 +1603,7 @@ static void e100_multi(struct nic *nic, struct cb *cb, struct sk_buff *skb)
                 memcpy(&cb->u.multi.addr[i++ * ETH_ALEN], &ha->addr,
                         ETH_ALEN);
         }
+        return 0;
 }
 
 static void e100_set_multicast_list(struct net_device *netdev)
@@ -1756,11 +1764,18 @@ static void e100_watchdog(unsigned long data)
                   round_jiffies(jiffies + E100_WATCHDOG_PERIOD));
 }
 
-static void e100_xmit_prepare(struct nic *nic, struct cb *cb,
+static int e100_xmit_prepare(struct nic *nic, struct cb *cb,
         struct sk_buff *skb)
 {
+        dma_addr_t dma_addr;
         cb->command = nic->tx_command;
 
+        dma_addr = pci_map_single(nic->pdev,
+                                  skb->data, skb->len, PCI_DMA_TODEVICE);
+        /* If we can't map the skb, have the upper layer try later */
+        if (pci_dma_mapping_error(nic->pdev, dma_addr))
+                return -ENOMEM;
+
         /*
          * Use the last 4 bytes of the SKB payload packet as the CRC, used for
          * testing, ie sending frames with bad CRC.
@@ -1777,11 +1792,10 @@ static void e100_xmit_prepare(struct nic *nic, struct cb *cb,
         cb->u.tcb.tcb_byte_count = 0;
         cb->u.tcb.threshold = nic->tx_threshold;
         cb->u.tcb.tbd_count = 1;
-        cb->u.tcb.tbd.buf_addr = cpu_to_le32(pci_map_single(nic->pdev,
-                skb->data, skb->len, PCI_DMA_TODEVICE));
-        /* check for mapping failure? */
+        cb->u.tcb.tbd.buf_addr = cpu_to_le32(dma_addr);
         cb->u.tcb.tbd.size = cpu_to_le16(skb->len);
         skb_tx_timestamp(skb);
+        return 0;
 }
 
 static netdev_tx_t e100_xmit_frame(struct sk_buff *skb,
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index 43462d596a4e..ffd287196bf8 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -1053,6 +1053,10 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
                 txdr->buffer_info[i].dma =
                         dma_map_single(&pdev->dev, skb->data, skb->len,
                                        DMA_TO_DEVICE);
+                if (dma_mapping_error(&pdev->dev, txdr->buffer_info[i].dma)) {
+                        ret_val = 4;
+                        goto err_nomem;
+                }
                 tx_desc->buffer_addr = cpu_to_le64(txdr->buffer_info[i].dma);
                 tx_desc->lower.data = cpu_to_le32(skb->len);
                 tx_desc->lower.data |= cpu_to_le32(E1000_TXD_CMD_EOP |
@@ -1069,7 +1073,7 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
         rxdr->buffer_info = kcalloc(rxdr->count, sizeof(struct e1000_buffer),
                                     GFP_KERNEL);
         if (!rxdr->buffer_info) {
-                ret_val = 4;
+                ret_val = 5;
                 goto err_nomem;
         }
 
@@ -1077,7 +1081,7 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
         rxdr->desc = dma_alloc_coherent(&pdev->dev, rxdr->size, &rxdr->dma,
                                         GFP_KERNEL);
         if (!rxdr->desc) {
-                ret_val = 5;
+                ret_val = 6;
                 goto err_nomem;
         }
         memset(rxdr->desc, 0, rxdr->size);
@@ -1101,7 +1105,7 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
 
                 skb = alloc_skb(E1000_RXBUFFER_2048 + NET_IP_ALIGN, GFP_KERNEL);
                 if (!skb) {
-                        ret_val = 6;
+                        ret_val = 7;
                         goto err_nomem;
                 }
                 skb_reserve(skb, NET_IP_ALIGN);
@@ -1110,6 +1114,10 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
                 rxdr->buffer_info[i].dma =
                         dma_map_single(&pdev->dev, skb->data,
                                        E1000_RXBUFFER_2048, DMA_FROM_DEVICE);
+                if (dma_mapping_error(&pdev->dev, rxdr->buffer_info[i].dma)) {
+                        ret_val = 8;
+                        goto err_nomem;
+                }
                 rx_desc->buffer_addr = cpu_to_le64(rxdr->buffer_info[i].dma);
                 memset(skb->data, 0x00, skb->len);
         }
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 948b86ffa4f0..7e615e2bf7e6 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -848,11 +848,16 @@ check_page:
                         }
                 }
 
-                if (!buffer_info->dma)
+                if (!buffer_info->dma) {
                         buffer_info->dma = dma_map_page(&pdev->dev,
                                                         buffer_info->page, 0,
                                                         PAGE_SIZE,
                                                         DMA_FROM_DEVICE);
+                        if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
+                                adapter->alloc_rx_buff_failed++;
+                                break;
+                        }
+                }
 
                 rx_desc = E1000_RX_DESC_EXT(*rx_ring, i);
                 rx_desc->read.buffer_addr = cpu_to_le64(buffer_info->dma);
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index b64542acfa34..12b1d8480808 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -1818,27 +1818,32 @@ out:
  **/
 void igb_vmdq_set_anti_spoofing_pf(struct e1000_hw *hw, bool enable, int pf)
 {
-        u32 dtxswc;
+        u32 reg_val, reg_offset;
 
         switch (hw->mac.type) {
         case e1000_82576:
+                reg_offset = E1000_DTXSWC;
+                break;
         case e1000_i350:
-                dtxswc = rd32(E1000_DTXSWC);
-                if (enable) {
-                        dtxswc |= (E1000_DTXSWC_MAC_SPOOF_MASK |
-                                   E1000_DTXSWC_VLAN_SPOOF_MASK);
-                        /* The PF can spoof - it has to in order to
-                         * support emulation mode NICs */
-                        dtxswc ^= (1 << pf | 1 << (pf + MAX_NUM_VFS));
-                } else {
-                        dtxswc &= ~(E1000_DTXSWC_MAC_SPOOF_MASK |
-                                    E1000_DTXSWC_VLAN_SPOOF_MASK);
-                }
-                wr32(E1000_DTXSWC, dtxswc);
+                reg_offset = E1000_TXSWC;
                 break;
         default:
-                break;
+                return;
+        }
+
+        reg_val = rd32(reg_offset);
+        if (enable) {
+                reg_val |= (E1000_DTXSWC_MAC_SPOOF_MASK |
+                             E1000_DTXSWC_VLAN_SPOOF_MASK);
+                /* The PF can spoof - it has to in order to
+                 * support emulation mode NICs
+                 */
+                reg_val ^= (1 << pf | 1 << (pf + MAX_NUM_VFS));
+        } else {
+                reg_val &= ~(E1000_DTXSWC_MAC_SPOOF_MASK |
+                             E1000_DTXSWC_VLAN_SPOOF_MASK);
         }
+        wr32(reg_offset, reg_val);
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/igb/igb_hwmon.c b/drivers/net/ethernet/intel/igb/igb_hwmon.c
index 4623502054d5..0478a1abe541 100644
--- a/drivers/net/ethernet/intel/igb/igb_hwmon.c
+++ b/drivers/net/ethernet/intel/igb/igb_hwmon.c
@@ -39,7 +39,7 @@
 #include <linux/pci.h>
 
 #ifdef CONFIG_IGB_HWMON
-struct i2c_board_info i350_sensor_info = {
+static struct i2c_board_info i350_sensor_info = {
         I2C_BOARD_INFO("i350bb", (0Xf8 >> 1)),
 };
 
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 4dbd62968c7a..8496adfc6a68 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -2542,8 +2542,8 @@ static void igb_probe_vfs(struct igb_adapter *adapter)
         if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211))
                 return;
 
-        igb_enable_sriov(pdev, max_vfs);
         pci_sriov_set_totalvfs(pdev, 7);
+        igb_enable_sriov(pdev, max_vfs);
 
 #endif /* CONFIG_PCI_IOV */
 }
@@ -2652,7 +2652,7 @@ static int igb_sw_init(struct igb_adapter *adapter)
                 if (max_vfs > 7) {
                         dev_warn(&pdev->dev,
                                  "Maximum of 7 VFs per PF, using max\n");
-                        adapter->vfs_allocated_count = 7;
+                        max_vfs = adapter->vfs_allocated_count = 7;
                 } else
                         adapter->vfs_allocated_count = max_vfs;
                 if (adapter->vfs_allocated_count)
diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
index 0987822359f0..0a237507ee85 100644
--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
+++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
@@ -740,7 +740,7 @@ void igb_ptp_init(struct igb_adapter *adapter)
         case e1000_82576:
                 snprintf(adapter->ptp_caps.name, 16, "%pm", netdev->dev_addr);
                 adapter->ptp_caps.owner = THIS_MODULE;
-                adapter->ptp_caps.max_adj = 1000000000;
+                adapter->ptp_caps.max_adj = 999999881;
                 adapter->ptp_caps.n_ext_ts = 0;
                 adapter->ptp_caps.pps = 0;
                 adapter->ptp_caps.adjfreq = igb_ptp_adjfreq_82576;
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_main.c b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
index ea4808373435..b5f94abe3cff 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
@@ -2159,6 +2159,10 @@ map_skb:
                                                   skb->data,
                                                   adapter->rx_buffer_len,
                                                   DMA_FROM_DEVICE);
+                if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
+                        adapter->alloc_rx_buff_failed++;
+                        break;
+                }
 
                 rx_desc = IXGB_RX_DESC(*rx_ring, i);
                 rx_desc->buff_addr = cpu_to_le64(buffer_info->dma);
@@ -2168,7 +2172,8 @@ map_skb:
                 rx_desc->status = 0;
 
 
-                if (++i == rx_ring->count) i = 0;
+                if (++i == rx_ring->count)
+                        i = 0;
                 buffer_info = &rx_ring->buffer_info[i];
         }
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index db5611ae407e..79f4a26ea6cc 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -7922,12 +7922,19 @@ static int __init ixgbe_init_module(void)
         ixgbe_dbg_init();
 #endif /* CONFIG_DEBUG_FS */
 
+        ret = pci_register_driver(&ixgbe_driver);
+        if (ret) {
+#ifdef CONFIG_DEBUG_FS
+                ixgbe_dbg_exit();
+#endif /* CONFIG_DEBUG_FS */
+                return ret;
+        }
+
 #ifdef CONFIG_IXGBE_DCA
         dca_register_notify(&dca_notifier);
 #endif
 
-        ret = pci_register_driver(&ixgbe_driver);
-        return ret;
+        return 0;
 }
 
 module_init(ixgbe_init_module);
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index c3db6cd69b68..2b6cb5ca48ee 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -944,9 +944,17 @@ free_queue_irqs:
                 free_irq(adapter->msix_entries[vector].vector,
                          adapter->q_vector[vector]);
         }
-        pci_disable_msix(adapter->pdev);
-        kfree(adapter->msix_entries);
-        adapter->msix_entries = NULL;
+        /* This failure is non-recoverable - it indicates the system is
+         * out of MSIX vector resources and the VF driver cannot run
+         * without them.  Set the number of msix vectors to zero
+         * indicating that not enough can be allocated.  The error
+         * will be returned to the user indicating device open failed.
+         * Any further attempts to force the driver to open will also
+         * fail.  The only way to recover is to unload the driver and
+         * reload it again.  If the system has recovered some MSIX
+         * vectors then it may succeed.
+         */
+        adapter->num_msix_vectors = 0;
         return err;
 }
 
@@ -2572,6 +2580,15 @@ static int ixgbevf_open(struct net_device *netdev)
         struct ixgbe_hw *hw = &adapter->hw;
         int err;
 
+        /* A previous failure to open the device because of a lack of
+         * available MSIX vector resources may have reset the number
+         * of msix vectors variable to zero.  The only way to recover
+         * is to unload/reload the driver and hope that the system has
+         * been able to recover some MSIX vector resources.
+         */
+        if (!adapter->num_msix_vectors)
+                return -ENOMEM;
+
         /* disallow open during test */
         if (test_bit(__IXGBEVF_TESTING, &adapter->state))
                 return -EBUSY;
@@ -2628,7 +2645,6 @@ static int ixgbevf_open(struct net_device *netdev)
 
 err_req_irq:
         ixgbevf_down(adapter);
-        ixgbevf_free_irq(adapter);
 err_setup_rx:
         ixgbevf_free_all_rx_resources(adapter);
 err_setup_tx:
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 6a2127489af7..bfdb06860397 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -769,7 +769,7 @@ ltq_etop_probe(struct platform_device *pdev)
         return 0;
 
 err_free:
-        kfree(dev);
+        free_netdev(dev);
 err_out:
         return err;
 }
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index cd345b8969bc..1e628ce57201 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -2771,16 +2771,17 @@ static int mvneta_probe(struct platform_device *pdev)
 
         netif_napi_add(dev, &pp->napi, mvneta_poll, pp->weight);
 
+        dev->features = NETIF_F_SG | NETIF_F_IP_CSUM;
+        dev->hw_features |= NETIF_F_SG | NETIF_F_IP_CSUM;
+        dev->vlan_features |= NETIF_F_SG | NETIF_F_IP_CSUM;
+        dev->priv_flags |= IFF_UNICAST_FLT;
+
         err = register_netdev(dev);
         if (err < 0) {
                 dev_err(&pdev->dev, "failed to register\n");
                 goto err_deinit;
         }
 
-        dev->features = NETIF_F_SG | NETIF_F_IP_CSUM;
-        dev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM;
-        dev->priv_flags |= IFF_UNICAST_FLT;
-
         netdev_info(dev, "mac: %pM\n", dev->dev_addr);
 
         platform_set_drvdata(pdev, pp->dev);
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index fc07ca35721b..6a0e671fcecd 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -1067,7 +1067,7 @@ static void sky2_ramset(struct sky2_hw *hw, u16 q, u32 start, u32 space)
                 sky2_write32(hw, RB_ADDR(q, RB_RX_UTHP), tp);
                 sky2_write32(hw, RB_ADDR(q, RB_RX_LTHP), space/2);
 
-                tp = space - 2048/8;
+                tp = space - 8192/8;
                 sky2_write32(hw, RB_ADDR(q, RB_RX_UTPP), tp);
                 sky2_write32(hw, RB_ADDR(q, RB_RX_LTPP), space/4);
         } else {
diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h
index 615ac63ea860..ec6dcd80152b 100644
--- a/drivers/net/ethernet/marvell/sky2.h
+++ b/drivers/net/ethernet/marvell/sky2.h
@@ -2074,7 +2074,7 @@ enum {
         GM_IS_RX_FF_OR  = 1<<1, /* Receive FIFO Overrun */
         GM_IS_RX_COMPL  = 1<<0, /* Frame Reception Complete */
 
-#define GMAC_DEF_MSK     GM_IS_TX_FF_UR
+#define GMAC_DEF_MSK     (GM_IS_TX_FF_UR | GM_IS_RX_FF_OR)
 };
 
 /*      GMAC_LINK_CTRL  16 bit  GMAC Link Control Reg (YUKON only) */
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 995d4b6d5c1e..30d78f806dc3 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -411,8 +411,8 @@ static int mlx4_en_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
 
 static void mlx4_en_u64_to_mac(unsigned char dst_mac[ETH_ALEN + 2], u64 src_mac)
 {
-        unsigned int i;
-        for (i = ETH_ALEN - 1; i; --i) {
+        int i;
+        for (i = ETH_ALEN - 1; i >= 0; --i) {
                 dst_mac[i] = src_mac & 0xff;
                 src_mac >>= 8;
         }
@@ -1637,6 +1637,17 @@ void mlx4_en_stop_port(struct net_device *dev, int detach)
         /* Flush multicast filter */
         mlx4_SET_MCAST_FLTR(mdev->dev, priv->port, 0, 1, MLX4_MCAST_CONFIG);
 
+        /* Remove flow steering rules for the port*/
+        if (mdev->dev->caps.steering_mode ==
+            MLX4_STEERING_MODE_DEVICE_MANAGED) {
+                ASSERT_RTNL();
+                list_for_each_entry_safe(flow, tmp_flow,
+                                         &priv->ethtool_list, list) {
+                        mlx4_flow_detach(mdev->dev, flow->id);
+                        list_del(&flow->list);
+                }
+        }
+
         mlx4_en_destroy_drop_qp(priv);
 
         /* Free TX Rings */
@@ -1657,17 +1668,6 @@ void mlx4_en_stop_port(struct net_device *dev, int detach)
         if (!(mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAGS2_REASSIGN_MAC_EN))
                 mdev->mac_removed[priv->port] = 1;
 
-        /* Remove flow steering rules for the port*/
-        if (mdev->dev->caps.steering_mode ==
-            MLX4_STEERING_MODE_DEVICE_MANAGED) {
-                ASSERT_RTNL();
-                list_for_each_entry_safe(flow, tmp_flow,
-                                         &priv->ethtool_list, list) {
-                        mlx4_flow_detach(mdev->dev, flow->id);
-                        list_del(&flow->list);
-                }
-        }
-
         /* Free RX Rings */
         for (i = 0; i < priv->rx_ring_num; i++) {
                 mlx4_en_deactivate_rx_ring(priv, &priv->rx_ring[i]);
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 251ae2f93116..8e3123a1df88 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -771,7 +771,7 @@ int mlx4_MAP_EQ_wrapper(struct mlx4_dev *dev, int slave,
         struct mlx4_slave_event_eq_info *event_eq =
                 priv->mfunc.master.slave_state[slave].event_eq;
         u32 in_modifier = vhcr->in_modifier;
-        u32 eqn = in_modifier & 0x1FF;
+        u32 eqn = in_modifier & 0x3FF;
         u64 in_param =  vhcr->in_param;
         int err = 0;
         int i;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 2995687f1aee..1391b52f443a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -99,6 +99,7 @@ struct res_qp {
         struct list_head        mcg_list;
         spinlock_t              mcg_spl;
         int                     local_qpn;
+        atomic_t                ref_count;
 };
 
 enum res_mtt_states {
@@ -197,6 +198,7 @@ enum res_fs_rule_states {
 
 struct res_fs_rule {
         struct res_common       com;
+        int                     qpn;
 };
 
 static void *res_tracker_lookup(struct rb_root *root, u64 res_id)
@@ -355,7 +357,7 @@ static int mpt_mask(struct mlx4_dev *dev)
         return dev->caps.num_mpts - 1;
 }
 
-static void *find_res(struct mlx4_dev *dev, int res_id,
+static void *find_res(struct mlx4_dev *dev, u64 res_id,
                       enum mlx4_resource type)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
@@ -447,6 +449,7 @@ static struct res_common *alloc_qp_tr(int id)
         ret->local_qpn = id;
         INIT_LIST_HEAD(&ret->mcg_list);
         spin_lock_init(&ret->mcg_spl);
+        atomic_set(&ret->ref_count, 0);
 
         return &ret->com;
 }
@@ -554,7 +557,7 @@ static struct res_common *alloc_xrcdn_tr(int id)
         return &ret->com;
 }
 
-static struct res_common *alloc_fs_rule_tr(u64 id)
+static struct res_common *alloc_fs_rule_tr(u64 id, int qpn)
 {
         struct res_fs_rule *ret;
 
@@ -564,7 +567,7 @@ static struct res_common *alloc_fs_rule_tr(u64 id)
 
         ret->com.res_id = id;
         ret->com.state = RES_FS_RULE_ALLOCATED;
-
+        ret->qpn = qpn;
         return &ret->com;
 }
 
@@ -602,7 +605,7 @@ static struct res_common *alloc_tr(u64 id, enum mlx4_resource type, int slave,
                 ret = alloc_xrcdn_tr(id);
                 break;
         case RES_FS_RULE:
-                ret = alloc_fs_rule_tr(id);
+                ret = alloc_fs_rule_tr(id, extra);
                 break;
         default:
                 return NULL;
@@ -671,10 +674,14 @@ undo:
 
 static int remove_qp_ok(struct res_qp *res)
 {
-        if (res->com.state == RES_QP_BUSY)
+        if (res->com.state == RES_QP_BUSY || atomic_read(&res->ref_count) ||
+            !list_empty(&res->mcg_list)) {
+                pr_err("resource tracker: fail to remove qp, state %d, ref_count %d\n",
+                       res->com.state, atomic_read(&res->ref_count));
                 return -EBUSY;
-        else if (res->com.state != RES_QP_RESERVED)
+        } else if (res->com.state != RES_QP_RESERVED) {
                 return -EPERM;
+        }
 
         return 0;
 }
@@ -3124,6 +3131,7 @@ int mlx4_QP_FLOW_STEERING_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
         struct list_head *rlist = &tracker->slave_list[slave].res_list[RES_MAC];
         int err;
         int qpn;
+        struct res_qp *rqp;
         struct mlx4_net_trans_rule_hw_ctrl *ctrl;
         struct _rule_hw  *rule_header;
         int header_id;
@@ -3134,7 +3142,7 @@ int mlx4_QP_FLOW_STEERING_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
 
         ctrl = (struct mlx4_net_trans_rule_hw_ctrl *)inbox->buf;
         qpn = be32_to_cpu(ctrl->qpn) & 0xffffff;
-        err = get_res(dev, slave, qpn, RES_QP, NULL);
+        err = get_res(dev, slave, qpn, RES_QP, &rqp);
         if (err) {
                 pr_err("Steering rule with qpn 0x%x rejected.\n", qpn);
                 return err;
@@ -3175,14 +3183,16 @@ int mlx4_QP_FLOW_STEERING_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
         if (err)
                 goto err_put;
 
-        err = add_res_range(dev, slave, vhcr->out_param, 1, RES_FS_RULE, 0);
+        err = add_res_range(dev, slave, vhcr->out_param, 1, RES_FS_RULE, qpn);
         if (err) {
                 mlx4_err(dev, "Fail to add flow steering resources.\n ");
                 /* detach rule*/
                 mlx4_cmd(dev, vhcr->out_param, 0, 0,
                          MLX4_QP_FLOW_STEERING_DETACH, MLX4_CMD_TIME_CLASS_A,
                          MLX4_CMD_NATIVE);
+                goto err_put;
         }
+        atomic_inc(&rqp->ref_count);
 err_put:
         put_res(dev, slave, qpn, RES_QP);
         return err;
@@ -3195,20 +3205,35 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave,
                                          struct mlx4_cmd_info *cmd)
 {
         int err;
+        struct res_qp *rqp;
+        struct res_fs_rule *rrule;
 
         if (dev->caps.steering_mode !=
             MLX4_STEERING_MODE_DEVICE_MANAGED)
                 return -EOPNOTSUPP;
 
+        err = get_res(dev, slave, vhcr->in_param, RES_FS_RULE, &rrule);
+        if (err)
+                return err;
+        /* Release the rule form busy state before removal */
+        put_res(dev, slave, vhcr->in_param, RES_FS_RULE);
+        err = get_res(dev, slave, rrule->qpn, RES_QP, &rqp);
+        if (err)
+                return err;
+
         err = rem_res_range(dev, slave, vhcr->in_param, 1, RES_FS_RULE, 0);
         if (err) {
                 mlx4_err(dev, "Fail to remove flow steering resources.\n ");
-                return err;
+                goto out;
         }
 
         err = mlx4_cmd(dev, vhcr->in_param, 0, 0,
                        MLX4_QP_FLOW_STEERING_DETACH, MLX4_CMD_TIME_CLASS_A,
                        MLX4_CMD_NATIVE);
+        if (!err)
+                atomic_dec(&rqp->ref_count);
+out:
+        put_res(dev, slave, rrule->qpn, RES_QP);
         return err;
 }
 
@@ -3806,6 +3831,7 @@ void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave)
         mutex_lock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
         /*VLAN*/
         rem_slave_macs(dev, slave);
+        rem_slave_fs_rule(dev, slave);
         rem_slave_qps(dev, slave);
         rem_slave_srqs(dev, slave);
         rem_slave_cqs(dev, slave);
@@ -3814,6 +3840,5 @@ void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave)
         rem_slave_mtts(dev, slave);
         rem_slave_counters(dev, slave);
         rem_slave_xrcdns(dev, slave);
-        rem_slave_fs_rule(dev, slave);
         mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
 }
diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c
index 33bcb63d56a2..8fb481252e2c 100644
--- a/drivers/net/ethernet/micrel/ks8851.c
+++ b/drivers/net/ethernet/micrel/ks8851.c
@@ -528,7 +528,7 @@ static void ks8851_rx_pkts(struct ks8851_net *ks)
         for (; rxfc != 0; rxfc--) {
                 rxh = ks8851_rdreg32(ks, KS_RXFHSR);
                 rxstat = rxh & 0xffff;
-                rxlen = rxh >> 16;
+                rxlen = (rxh >> 16) & 0xfff;
 
                 netif_dbg(ks, rx_status, ks->netdev,
                           "rx: stat 0x%04x, len 0x%04x\n", rxstat, rxlen);
diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index c4122c86f829..efa29b712d5f 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -1472,7 +1472,8 @@ static int lpc_eth_drv_probe(struct platform_device *pdev)
         }
         platform_set_drvdata(pdev, ndev);
 
-        if (lpc_mii_init(pldat) != 0)
+        ret = lpc_mii_init(pldat);
+        if (ret)
                 goto err_out_unregister_netdev;
 
         netdev_info(ndev, "LPC mac at 0x%08x irq %d\n",
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index 39ab4d09faaa..73ce7dd6b954 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -1726,9 +1726,9 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
 
                         skb->protocol = eth_type_trans(skb, netdev);
                         if (tcp_ip_status & PCH_GBE_RXD_ACC_STAT_TCPIPOK)
-                                skb->ip_summed = CHECKSUM_NONE;
-                        else
                                 skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        else
+                                skb->ip_summed = CHECKSUM_NONE;
 
                         napi_gro_receive(&adapter->napi, skb);
                         (*work_done)++;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 28fb50a1e9c3..4ecbe64a758d 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3818,6 +3818,30 @@ static void rtl_init_mdio_ops(struct rtl8169_private *tp)
         }
 }
 
+static void rtl_speed_down(struct rtl8169_private *tp)
+{
+        u32 adv;
+        int lpa;
+
+        rtl_writephy(tp, 0x1f, 0x0000);
+        lpa = rtl_readphy(tp, MII_LPA);
+
+        if (lpa & (LPA_10HALF | LPA_10FULL))
+                adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full;
+        else if (lpa & (LPA_100HALF | LPA_100FULL))
+                adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full |
+                      ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full;
+        else
+                adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full |
+                      ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full |
+                      (tp->mii.supports_gmii ?
+                       ADVERTISED_1000baseT_Half |
+                       ADVERTISED_1000baseT_Full : 0);
+
+        rtl8169_set_speed(tp->dev, AUTONEG_ENABLE, SPEED_1000, DUPLEX_FULL,
+                          adv);
+}
+
 static void rtl_wol_suspend_quirk(struct rtl8169_private *tp)
 {
         void __iomem *ioaddr = tp->mmio_addr;
@@ -3848,9 +3872,7 @@ static bool rtl_wol_pll_power_down(struct rtl8169_private *tp)
         if (!(__rtl8169_get_wol(tp) & WAKE_ANY))
                 return false;
 
-        rtl_writephy(tp, 0x1f, 0x0000);
-        rtl_writephy(tp, MII_BMCR, 0x0000);
-
+        rtl_speed_down(tp);
         rtl_wol_suspend_quirk(tp);
 
         return true;
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 33e96176e4d8..6ed333fe5c04 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1216,10 +1216,7 @@ static void sh_eth_error(struct net_device *ndev, int intr_status)
                 if (felic_stat & ECSR_LCHNG) {
                         /* Link Changed */
                         if (mdp->cd->no_psr || mdp->no_ether_link) {
-                                if (mdp->link == PHY_DOWN)
-                                        link_stat = 0;
-                                else
-                                        link_stat = PHY_ST_LINK;
+                                goto ignore_link;
                         } else {
                                 link_stat = (sh_eth_read(ndev, PSR));
                                 if (mdp->ether_link_active_low)
@@ -1242,6 +1239,7 @@ static void sh_eth_error(struct net_device *ndev, int intr_status)
                 }
         }
 
+ignore_link:
         if (intr_status & EESR_TWB) {
                 /* Write buck end. unused write back interrupt */
                 if (intr_status & EESR_TABT)    /* Transmit Abort int */
@@ -1326,12 +1324,18 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
         struct sh_eth_private *mdp = netdev_priv(ndev);
         struct sh_eth_cpu_data *cd = mdp->cd;
         irqreturn_t ret = IRQ_NONE;
-        u32 intr_status = 0;
+        unsigned long intr_status;
 
         spin_lock(&mdp->lock);
 
-        /* Get interrpt stat */
+        /* Get interrupt status */
         intr_status = sh_eth_read(ndev, EESR);
+        /* Mask it with the interrupt mask, forcing ECI interrupt to be always
+         * enabled since it's the one that  comes thru regardless of the mask,
+         * and we need to fully handle it in sh_eth_error() in order to quench
+         * it as it doesn't get cleared by just writing 1 to the ECI bit...
+         */
+        intr_status &= sh_eth_read(ndev, EESIPR) | DMAC_M_ECI;
         /* Clear interrupt */
         if (intr_status & (EESR_FRC | EESR_RMAF | EESR_RRF |
                         EESR_RTLF | EESR_RTSF | EESR_PRE | EESR_CERF |
@@ -1373,7 +1377,7 @@ static void sh_eth_adjust_link(struct net_device *ndev)
         struct phy_device *phydev = mdp->phydev;
         int new_state = 0;
 
-        if (phydev->link != PHY_DOWN) {
+        if (phydev->link) {
                 if (phydev->duplex != mdp->duplex) {
                         new_state = 1;
                         mdp->duplex = phydev->duplex;
@@ -1387,17 +1391,21 @@ static void sh_eth_adjust_link(struct net_device *ndev)
                         if (mdp->cd->set_rate)
                                 mdp->cd->set_rate(ndev);
                 }
-                if (mdp->link == PHY_DOWN) {
+                if (!mdp->link) {
                         sh_eth_write(ndev,
                                 (sh_eth_read(ndev, ECMR) & ~ECMR_TXF), ECMR);
                         new_state = 1;
                         mdp->link = phydev->link;
+                        if (mdp->cd->no_psr || mdp->no_ether_link)
+                                sh_eth_rcv_snd_enable(ndev);
                 }
         } else if (mdp->link) {
                 new_state = 1;
-                mdp->link = PHY_DOWN;
+                mdp->link = 0;
                 mdp->speed = 0;
                 mdp->duplex = -1;
+                if (mdp->cd->no_psr || mdp->no_ether_link)
+                        sh_eth_rcv_snd_disable(ndev);
         }
 
         if (new_state && netif_msg_link(mdp))
@@ -1414,7 +1422,7 @@ static int sh_eth_phy_init(struct net_device *ndev)
         snprintf(phy_id, sizeof(phy_id), PHY_ID_FMT,
                 mdp->mii_bus->id , mdp->phy_id);
 
-        mdp->link = PHY_DOWN;
+        mdp->link = 0;
         mdp->speed = 0;
         mdp->duplex = -1;
 
@@ -2220,6 +2228,7 @@ static void sh_eth_tsu_init(struct sh_eth_private *mdp)
 /* MDIO bus release function */
 static int sh_mdio_release(struct net_device *ndev)
 {
+        struct sh_eth_private *mdp = netdev_priv(ndev);
         struct mii_bus *bus = dev_get_drvdata(&ndev->dev);
 
         /* unregister mdio bus */
@@ -2234,6 +2243,9 @@ static int sh_mdio_release(struct net_device *ndev)
         /* free bitbang info */
         free_mdio_bitbang(bus);
 
+        /* free bitbang memory */
+        kfree(mdp->bitbang);
+
         return 0;
 }
 
@@ -2262,6 +2274,7 @@ static int sh_mdio_init(struct net_device *ndev, int id,
         bitbang->ctrl.ops = &bb_ops;
 
         /* MII controller setting */
+        mdp->bitbang = bitbang;
         mdp->mii_bus = alloc_mdio_bitbang(&bitbang->ctrl);
         if (!mdp->mii_bus) {
                 ret = -ENOMEM;
@@ -2441,6 +2454,11 @@ static int sh_eth_drv_probe(struct platform_device *pdev)
                 }
                 mdp->tsu_addr = ioremap(rtsu->start,
                                         resource_size(rtsu));
+                if (mdp->tsu_addr == NULL) {
+                        ret = -ENOMEM;
+                        dev_err(&pdev->dev, "TSU ioremap failed.\n");
+                        goto out_release;
+                }
                 mdp->port = devno % 2;
                 ndev->features = NETIF_F_HW_VLAN_FILTER;
         }
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index bae84fd2e73a..828be4515008 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -705,6 +705,7 @@ struct sh_eth_private {
         const u16 *reg_offset;
         void __iomem *addr;
         void __iomem *tsu_addr;
+        struct bb_info *bitbang;
         u32 num_rx_ring;
         u32 num_tx_ring;
         dma_addr_t rx_desc_dma;
@@ -722,7 +723,7 @@ struct sh_eth_private {
         u32 phy_id;                                     /* PHY ID */
         struct mii_bus *mii_bus;        /* MDIO bus control */
         struct phy_device *phydev;      /* PHY device control */
-        enum phy_state link;
+        int link;
         phy_interface_t phy_interface;
         int msg_enable;
         int speed;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 75c48558e6fd..80cad06e5eb2 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -436,7 +436,7 @@ void cpsw_tx_handler(void *token, int len, int status)
          * queue is stopped then start the queue as we have free desc for tx
          */
         if (unlikely(netif_queue_stopped(ndev)))
-                netif_start_queue(ndev);
+                netif_wake_queue(ndev);
         cpts_tx_timestamp(priv->cpts, skb);
         priv->stats.tx_packets++;
         priv->stats.tx_bytes += len;
@@ -1364,7 +1364,7 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                 struct platform_device *mdio;
 
                 parp = of_get_property(slave_node, "phy_id", &lenp);
-                if ((parp == NULL) && (lenp != (sizeof(void *) * 2))) {
+                if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) {
                         pr_err("Missing slave[%d] phy_id property\n", i);
                         ret = -EINVAL;
                         goto error_ret;
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index ae1b77aa199f..72300bc9e378 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1053,7 +1053,7 @@ static void emac_tx_handler(void *token, int len, int status)
          * queue is stopped then start the queue as we have free desc for tx
          */
         if (unlikely(netif_queue_stopped(ndev)))
-                netif_start_queue(ndev);
+                netif_wake_queue(ndev);
         ndev->stats.tx_packets++;
         ndev->stats.tx_bytes += len;
         dev_kfree_skb_any(skb);
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 1cd77483da50..f5f0f09e4cc5 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -470,8 +470,10 @@ static void netvsc_send_completion(struct hv_device *device,
                         packet->trans_id;
 
                 /* Notify the layer above us */
-                nvsc_packet->completion.send.send_completion(
-                        nvsc_packet->completion.send.send_completion_ctx);
+                if (nvsc_packet)
+                        nvsc_packet->completion.send.send_completion(
+                                nvsc_packet->completion.send.
+                                send_completion_ctx);
 
                 num_outstanding_sends =
                         atomic_dec_return(&net_device->num_outstanding_sends);
@@ -498,6 +500,7 @@ int netvsc_send(struct hv_device *device,
         int ret = 0;
         struct nvsp_message sendMessage;
         struct net_device *ndev;
+        u64 req_id;
 
         net_device = get_outbound_net_device(device);
         if (!net_device)
@@ -518,20 +521,24 @@ int netvsc_send(struct hv_device *device,
                 0xFFFFFFFF;
         sendMessage.msg.v1_msg.send_rndis_pkt.send_buf_section_size = 0;
 
+        if (packet->completion.send.send_completion)
+                req_id = (u64)packet;
+        else
+                req_id = 0;
+
         if (packet->page_buf_cnt) {
                 ret = vmbus_sendpacket_pagebuffer(device->channel,
                                                   packet->page_buf,
                                                   packet->page_buf_cnt,
                                                   &sendMessage,
                                                   sizeof(struct nvsp_message),
-                                                  (unsigned long)packet);
+                                                  req_id);
         } else {
                 ret = vmbus_sendpacket(device->channel, &sendMessage,
                                 sizeof(struct nvsp_message),
-                                (unsigned long)packet,
+                                req_id,
                                 VM_PKT_DATA_INBAND,
                                 VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
-
         }
 
         if (ret == 0) {
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 5f85205cd12b..8341b62e5521 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -241,13 +241,11 @@ void netvsc_linkstatus_callback(struct hv_device *device_obj,
 
         if (status == 1) {
                 netif_carrier_on(net);
-                netif_wake_queue(net);
                 ndev_ctx = netdev_priv(net);
                 schedule_delayed_work(&ndev_ctx->dwork, 0);
                 schedule_delayed_work(&ndev_ctx->dwork, msecs_to_jiffies(20));
         } else {
                 netif_carrier_off(net);
-                netif_tx_disable(net);
         }
 }
 
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 2b657d4d63a8..0775f0aefd1e 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -61,9 +61,6 @@ struct rndis_request {
 
 static void rndis_filter_send_completion(void *ctx);
 
-static void rndis_filter_send_request_completion(void *ctx);
-
-
 
 static struct rndis_device *get_rndis_device(void)
 {
@@ -241,10 +238,7 @@ static int rndis_filter_send_request(struct rndis_device *dev,
                         packet->page_buf[0].len;
         }
 
-        packet->completion.send.send_completion_ctx = req;/* packet; */
-        packet->completion.send.send_completion =
-                rndis_filter_send_request_completion;
-        packet->completion.send.send_completion_tid = (unsigned long)dev;
+        packet->completion.send.send_completion = NULL;
 
         ret = netvsc_send(dev->net_dev->dev, packet);
         return ret;
@@ -999,9 +993,3 @@ static void rndis_filter_send_completion(void *ctx)
         /* Pass it back to the original handler */
         filter_pkt->completion(filter_pkt->completion_ctx);
 }
-
-
-static void rndis_filter_send_request_completion(void *ctx)
-{
-        /* Noop */
-}
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 9abe51710f22..1a15ec14c386 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -914,8 +914,12 @@ static int smsc75xx_set_rx_max_frame_length(struct usbnet *dev, int size)
 static int smsc75xx_change_mtu(struct net_device *netdev, int new_mtu)
 {
         struct usbnet *dev = netdev_priv(netdev);
+        int ret;
+
+        if (new_mtu > MAX_SINGLE_PACKET_SIZE)
+                return -EINVAL;
 
-        int ret = smsc75xx_set_rx_max_frame_length(dev, new_mtu);
+        ret = smsc75xx_set_rx_max_frame_length(dev, new_mtu + ETH_HLEN);
         if (ret < 0) {
                 netdev_warn(dev->net, "Failed to set mac rx frame length\n");
                 return ret;
@@ -1324,7 +1328,7 @@ static int smsc75xx_reset(struct usbnet *dev)
 
         netif_dbg(dev, ifup, dev->net, "FCT_TX_CTL set to 0x%08x\n", buf);
 
-        ret = smsc75xx_set_rx_max_frame_length(dev, 1514);
+        ret = smsc75xx_set_rx_max_frame_length(dev, dev->net->mtu + ETH_HLEN);
         if (ret < 0) {
                 netdev_warn(dev->net, "Failed to set max rx frame length\n");
                 return ret;
@@ -2134,8 +2138,8 @@ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                         else if (rx_cmd_a & (RX_CMD_A_LONG | RX_CMD_A_RUNT))
                                 dev->net->stats.rx_frame_errors++;
                 } else {
-                        /* ETH_FRAME_LEN + 4(CRC) + 2(COE) + 4(Vlan) */
-                        if (unlikely(size > (ETH_FRAME_LEN + 12))) {
+                        /* MAX_SINGLE_PACKET_SIZE + 4(CRC) + 2(COE) + 4(Vlan) */
+                        if (unlikely(size > (MAX_SINGLE_PACKET_SIZE + ETH_HLEN + 12))) {
                                 netif_dbg(dev, rx_err, dev->net,
                                           "size err rx_cmd_a=0x%08x\n",
                                           rx_cmd_a);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 4cc13940c895..f76c3ca07a45 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -1023,6 +1023,7 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
                                           AR_PHY_AGC_CONTROL_FLTR_CAL   |
                                           AR_PHY_AGC_CONTROL_PKDET_CAL;
 
+        /* Use chip chainmask only for calibration */
         ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
 
         if (rtt) {
@@ -1150,6 +1151,9 @@ skip_tx_iqcal:
                 ar9003_hw_rtt_disable(ah);
         }
 
+        /* Revert chainmask to runtime parameters */
+        ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
+
         /* Initialize list pointers */
         ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
 
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index ade3afb21f91..7fdac6c7b3ea 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -28,21 +28,21 @@ void ath_tx_complete_poll_work(struct work_struct *work)
         int i;
         bool needreset = false;
 
-        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
-                if (ATH_TXQ_SETUP(sc, i)) {
-                        txq = &sc->tx.txq[i];
-                        ath_txq_lock(sc, txq);
-                        if (txq->axq_depth) {
-                                if (txq->axq_tx_inprogress) {
-                                        needreset = true;
-                                        ath_txq_unlock(sc, txq);
-                                        break;
-                                } else {
-                                        txq->axq_tx_inprogress = true;
-                                }
+        for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+                txq = sc->tx.txq_map[i];
+
+                ath_txq_lock(sc, txq);
+                if (txq->axq_depth) {
+                        if (txq->axq_tx_inprogress) {
+                                needreset = true;
+                                ath_txq_unlock(sc, txq);
+                                break;
+                        } else {
+                                txq->axq_tx_inprogress = true;
                         }
-                        ath_txq_unlock_complete(sc, txq);
                 }
+                ath_txq_unlock_complete(sc, txq);
+        }
 
         if (needreset) {
                 ath_dbg(ath9k_hw_common(sc->sc_ah), RESET,
@@ -170,7 +170,8 @@ void ath_rx_poll(unsigned long data)
 {
         struct ath_softc *sc = (struct ath_softc *)data;
 
-        ieee80211_queue_work(sc->hw, &sc->hw_check_work);
+        if (!test_bit(SC_OP_INVALID, &sc->sc_flags))
+                ieee80211_queue_work(sc->hw, &sc->hw_check_work);
 }
 
 /*
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 6e66f9c6782b..988372d218a4 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -280,6 +280,10 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
         if (r) {
                 ath_err(common,
                         "Unable to reset channel, reset status %d\n", r);
+
+                ath9k_hw_enable_interrupts(ah);
+                ath9k_queue_reset(sc, RESET_TYPE_BB_HANG);
+
                 goto out;
         }
 
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 38bc5a7997ff..122146943bf2 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1487,8 +1487,12 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
         const struct b43_dma_ops *ops;
         struct b43_dmaring *ring;
         struct b43_dmadesc_meta *meta;
+        static const struct b43_txstatus fake; /* filled with 0 */
+        const struct b43_txstatus *txstat;
         int slot, firstused;
         bool frame_succeed;
+        int skip;
+        static u8 err_out1, err_out2;
 
         ring = parse_cookie(dev, status->cookie, &slot);
         if (unlikely(!ring))
@@ -1501,13 +1505,36 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
         firstused = ring->current_slot - ring->used_slots + 1;
         if (firstused < 0)
                 firstused = ring->nr_slots + firstused;
+
+        skip = 0;
         if (unlikely(slot != firstused)) {
                 /* This possibly is a firmware bug and will result in
-                 * malfunction, memory leaks and/or stall of DMA functionality. */
-                b43dbg(dev->wl, "Out of order TX status report on DMA ring %d. "
-                       "Expected %d, but got %d\n",
-                       ring->index, firstused, slot);
-                return;
+                 * malfunction, memory leaks and/or stall of DMA functionality.
+                 */
+                if (slot == next_slot(ring, next_slot(ring, firstused))) {
+                        /* If a single header/data pair was missed, skip over
+                         * the first two slots in an attempt to recover.
+                         */
+                        slot = firstused;
+                        skip = 2;
+                        if (!err_out1) {
+                                /* Report the error once. */
+                                b43dbg(dev->wl,
+                                       "Skip on DMA ring %d slot %d.\n",
+                                       ring->index, slot);
+                                err_out1 = 1;
+                        }
+                } else {
+                        /* More than a single header/data pair were missed.
+                         * Report this error once.
+                         */
+                        if (!err_out2)
+                                b43dbg(dev->wl,
+                                       "Out of order TX status report on DMA ring %d. Expected %d, but got %d\n",
+                                       ring->index, firstused, slot);
+                        err_out2 = 1;
+                        return;
+                }
         }
 
         ops = ring->ops;
@@ -1522,11 +1549,13 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
                                slot, firstused, ring->index);
                         break;
                 }
+
                 if (meta->skb) {
                         struct b43_private_tx_info *priv_info =
-                                b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb));
+                             b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb));
 
-                        unmap_descbuffer(ring, meta->dmaaddr, meta->skb->len, 1);
+                        unmap_descbuffer(ring, meta->dmaaddr,
+                                         meta->skb->len, 1);
                         kfree(priv_info->bouncebuffer);
                         priv_info->bouncebuffer = NULL;
                 } else {
@@ -1538,8 +1567,9 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
                         struct ieee80211_tx_info *info;
 
                         if (unlikely(!meta->skb)) {
-                                /* This is a scatter-gather fragment of a frame, so
-                                 * the skb pointer must not be NULL. */
+                                /* This is a scatter-gather fragment of a frame,
+                                 * so the skb pointer must not be NULL.
+                                 */
                                 b43dbg(dev->wl, "TX status unexpected NULL skb "
                                        "at slot %d (first=%d) on ring %d\n",
                                        slot, firstused, ring->index);
@@ -1550,9 +1580,18 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
 
                         /*
                          * Call back to inform the ieee80211 subsystem about
-                         * the status of the transmission.
+                         * the status of the transmission. When skipping over
+                         * a missed TX status report, use a status structure
+                         * filled with zeros to indicate that the frame was not
+                         * sent (frame_count 0) and not acknowledged
                          */
-                        frame_succeed = b43_fill_txstatus_report(dev, info, status);
+                        if (unlikely(skip))
+                                txstat = &fake;
+                        else
+                                txstat = status;
+
+                        frame_succeed = b43_fill_txstatus_report(dev, info,
+                                                                 txstat);
 #ifdef CONFIG_B43_DEBUG
                         if (frame_succeed)
                                 ring->nr_succeed_tx_packets++;
@@ -1580,12 +1619,14 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
                 /* Everything unmapped and free'd. So it's not used anymore. */
                 ring->used_slots--;
 
-                if (meta->is_last_fragment) {
+                if (meta->is_last_fragment && !skip) {
                         /* This is the last scatter-gather
                          * fragment of the frame. We are done. */
                         break;
                 }
                 slot = next_slot(ring, slot);
+                if (skip > 0)
+                        --skip;
         }
         if (ring->stopped) {
                 B43_WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME);
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 3c35382ee6c2..e8486c1e091a 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -1564,7 +1564,7 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
         u16 clip_off[2] = { 0xFFFF, 0xFFFF };
 
         u8 vcm_final = 0;
-        s8 offset[4];
+        s32 offset[4];
         s32 results[8][4] = { };
         s32 results_min[4] = { };
         s32 poll_results[4] = { };
@@ -1615,7 +1615,7 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
                 }
                 for (i = 0; i < 4; i += 2) {
                         s32 curr;
-                        s32 mind = 40;
+                        s32 mind = 0x100000;
                         s32 minpoll = 249;
                         u8 minvcm = 0;
                         if (2 * core != i)
@@ -1732,7 +1732,7 @@ static void b43_nphy_rev2_rssi_cal(struct b43_wldev *dev, u8 type)
         u8 regs_save_radio[2];
         u16 regs_save_phy[2];
 
-        s8 offset[4];
+        s32 offset[4];
         u8 core;
         u8 rail;
 
@@ -1799,7 +1799,7 @@ static void b43_nphy_rev2_rssi_cal(struct b43_wldev *dev, u8 type)
         }
 
         for (i = 0; i < 4; i++) {
-                s32 mind = 40;
+                s32 mind = 0x100000;
                 u8 minvcm = 0;
                 s32 minpoll = 249;
                 s32 curr;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 4469321c0eb3..35fc68be158d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -3317,15 +3317,15 @@ static int _brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
                 goto err;
         }
 
-        /* External image takes precedence if specified */
         if (brcmf_sdbrcm_download_code_file(bus)) {
                 brcmf_err("dongle image file download failed\n");
                 goto err;
         }
 
-        /* External nvram takes precedence if specified */
-        if (brcmf_sdbrcm_download_nvram(bus))
+        if (brcmf_sdbrcm_download_nvram(bus)) {
                 brcmf_err("dongle nvram file download failed\n");
+                goto err;
+        }
 
         /* Take arm out of reset */
         if (brcmf_sdbrcm_download_state(bus, false)) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 2af9c0f0798d..ec46ffff5409 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -1891,8 +1891,10 @@ static s32
 brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
               u8 key_idx, const u8 *mac_addr, struct key_params *params)
 {
+        struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_wsec_key key;
         s32 err = 0;
+        u8 keybuf[8];
 
         memset(&key, 0, sizeof(key));
         key.index = (u32) key_idx;
@@ -1916,8 +1918,9 @@ brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
                 brcmf_dbg(CONN, "Setting the key index %d\n", key.index);
                 memcpy(key.data, params->key, key.len);
 
-                if (params->cipher == WLAN_CIPHER_SUITE_TKIP) {
-                        u8 keybuf[8];
+                if ((ifp->vif->mode != WL_MODE_AP) &&
+                    (params->cipher == WLAN_CIPHER_SUITE_TKIP)) {
+                        brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
                         memcpy(keybuf, &key.data[24], sizeof(keybuf));
                         memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
                         memcpy(&key.data[16], keybuf, sizeof(keybuf));
@@ -2013,7 +2016,7 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
                 if (ifp->vif->mode != WL_MODE_AP) {
-                        brcmf_dbg(CONN, "Swapping key\n");
+                        brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
                         memcpy(keybuf, &key.data[24], sizeof(keybuf));
                         memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
                         memcpy(&key.data[16], keybuf, sizeof(keybuf));
@@ -2118,8 +2121,7 @@ brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
                 err = -EAGAIN;
                 goto done;
         }
-        switch (wsec & ~SES_OW_ENABLED) {
-        case WEP_ENABLED:
+        if (wsec & WEP_ENABLED) {
                 sec = &profile->sec;
                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
@@ -2128,16 +2130,13 @@ brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
                 }
-                break;
-        case TKIP_ENABLED:
+        } else if (wsec & TKIP_ENABLED) {
                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
-                break;
-        case AES_ENABLED:
+        } else if (wsec & AES_ENABLED) {
                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
-                break;
-        default:
+        } else  {
                 brcmf_err("Invalid algo (0x%x)\n", wsec);
                 err = -EINVAL;
                 goto done;
@@ -3824,8 +3823,9 @@ exit:
 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
-        s32 err = -EPERM;
+        s32 err;
         struct brcmf_fil_bss_enable_le bss_enable;
+        struct brcmf_join_params join_params;
 
         brcmf_dbg(TRACE, "Enter\n");
 
@@ -3833,16 +3833,21 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
                 /* Due to most likely deauths outstanding we sleep */
                 /* first to make sure they get processed by fw. */
                 msleep(400);
-                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
-                if (err < 0) {
-                        brcmf_err("setting AP mode failed %d\n", err);
-                        goto exit;
-                }
+
+                memset(&join_params, 0, sizeof(join_params));
+                err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
+                                             &join_params, sizeof(join_params));
+                if (err < 0)
+                        brcmf_err("SET SSID error (%d)\n", err);
                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
-                if (err < 0) {
+                if (err < 0)
                         brcmf_err("BRCMF_C_UP error %d\n", err);
-                        goto exit;
-                }
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
+                if (err < 0)
+                        brcmf_err("setting AP mode failed %d\n", err);
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 0);
+                if (err < 0)
+                        brcmf_err("setting INFRA mode failed %d\n", err);
         } else {
                 bss_enable.bsscfg_idx = cpu_to_le32(ifp->bssidx);
                 bss_enable.enable = cpu_to_le32(0);
@@ -3855,7 +3860,6 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
         set_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
 
-exit:
         return err;
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
index 21a824232478..18d37645e2cd 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -1137,9 +1137,8 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
         gain0_15 = ((biq1 & 0xf) << 12) |
                    ((tia & 0xf) << 8) |
                    ((lna2 & 0x3) << 6) |
-                   ((lna2 & 0x3) << 4) |
-                   ((lna1 & 0x3) << 2) |
-                   ((lna1 & 0x3) << 0);
+                   ((lna2 &
+                     0x3) << 4) | ((lna1 & 0x3) << 2) | ((lna1 & 0x3) << 0);
 
         mod_phy_reg(pi, 0x4b6, (0xffff << 0), gain0_15 << 0);
         mod_phy_reg(pi, 0x4b7, (0xf << 0), gain16_19 << 0);
@@ -1157,8 +1156,6 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
         }
 
         mod_phy_reg(pi, 0x44d, (0x1 << 0), (!trsw) << 0);
-        mod_phy_reg(pi, 0x4b1, (0x3 << 11), lna1 << 11);
-        mod_phy_reg(pi, 0x4e6, (0x3 << 3), lna1 << 3);
 
 }
 
@@ -1331,43 +1328,6 @@ static u32 wlc_lcnphy_measure_digital_power(struct brcms_phy *pi, u16 nsamples)
         return (iq_est.i_pwr + iq_est.q_pwr) / nsamples;
 }
 
-static bool wlc_lcnphy_rx_iq_cal_gain(struct brcms_phy *pi, u16 biq1_gain,
-                                      u16 tia_gain, u16 lna2_gain)
-{
-        u32 i_thresh_l, q_thresh_l;
-        u32 i_thresh_h, q_thresh_h;
-        struct lcnphy_iq_est iq_est_h, iq_est_l;
-
-        wlc_lcnphy_set_rx_gain_by_distribution(pi, 0, 0, 0, biq1_gain, tia_gain,
-                                               lna2_gain, 0);
-
-        wlc_lcnphy_rx_gain_override_enable(pi, true);
-        wlc_lcnphy_start_tx_tone(pi, 2000, (40 >> 1), 0);
-        udelay(500);
-        write_radio_reg(pi, RADIO_2064_REG112, 0);
-        if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_l))
-                return false;
-
-        wlc_lcnphy_start_tx_tone(pi, 2000, 40, 0);
-        udelay(500);
-        write_radio_reg(pi, RADIO_2064_REG112, 0);
-        if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_h))
-                return false;
-
-        i_thresh_l = (iq_est_l.i_pwr << 1);
-        i_thresh_h = (iq_est_l.i_pwr << 2) + iq_est_l.i_pwr;
-
-        q_thresh_l = (iq_est_l.q_pwr << 1);
-        q_thresh_h = (iq_est_l.q_pwr << 2) + iq_est_l.q_pwr;
-        if ((iq_est_h.i_pwr > i_thresh_l) &&
-            (iq_est_h.i_pwr < i_thresh_h) &&
-            (iq_est_h.q_pwr > q_thresh_l) &&
-            (iq_est_h.q_pwr < q_thresh_h))
-                return true;
-
-        return false;
-}
-
 static bool
 wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
                      const struct lcnphy_rx_iqcomp *iqcomp,
@@ -1382,8 +1342,8 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
             RFOverrideVal0_old, rfoverride2_old, rfoverride2val_old,
             rfoverride3_old, rfoverride3val_old, rfoverride4_old,
             rfoverride4val_old, afectrlovr_old, afectrlovrval_old;
-        int tia_gain, lna2_gain, biq1_gain;
-        bool set_gain;
+        int tia_gain;
+        u32 received_power, rx_pwr_threshold;
         u16 old_sslpnCalibClkEnCtrl, old_sslpnRxFeClkEnCtrl;
         u16 values_to_save[11];
         s16 *ptr;
@@ -1408,134 +1368,126 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
                 goto cal_done;
         }
 
-        WARN_ON(module != 1);
-        tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
-        wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
-
-        for (i = 0; i < 11; i++)
-                values_to_save[i] =
-                        read_radio_reg(pi, rxiq_cal_rf_reg[i]);
-        Core1TxControl_old = read_phy_reg(pi, 0x631);
-
-        or_phy_reg(pi, 0x631, 0x0015);
-
-        RFOverride0_old = read_phy_reg(pi, 0x44c);
-        RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
-        rfoverride2_old = read_phy_reg(pi, 0x4b0);
-        rfoverride2val_old = read_phy_reg(pi, 0x4b1);
-        rfoverride3_old = read_phy_reg(pi, 0x4f9);
-        rfoverride3val_old = read_phy_reg(pi, 0x4fa);
-        rfoverride4_old = read_phy_reg(pi, 0x938);
-        rfoverride4val_old = read_phy_reg(pi, 0x939);
-        afectrlovr_old = read_phy_reg(pi, 0x43b);
-        afectrlovrval_old = read_phy_reg(pi, 0x43c);
-        old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
-        old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
-
-        tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
-        if (tx_gain_override_old) {
-                wlc_lcnphy_get_tx_gain(pi, &old_gains);
-                tx_gain_index_old = pi_lcn->lcnphy_current_index;
-        }
-
-        wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
+        if (module == 1) {
 
-        mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
-        mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
+                tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
+                wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
 
-        mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
-        mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
+                for (i = 0; i < 11; i++)
+                        values_to_save[i] =
+                                read_radio_reg(pi, rxiq_cal_rf_reg[i]);
+                Core1TxControl_old = read_phy_reg(pi, 0x631);
+
+                or_phy_reg(pi, 0x631, 0x0015);
+
+                RFOverride0_old = read_phy_reg(pi, 0x44c);
+                RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
+                rfoverride2_old = read_phy_reg(pi, 0x4b0);
+                rfoverride2val_old = read_phy_reg(pi, 0x4b1);
+                rfoverride3_old = read_phy_reg(pi, 0x4f9);
+                rfoverride3val_old = read_phy_reg(pi, 0x4fa);
+                rfoverride4_old = read_phy_reg(pi, 0x938);
+                rfoverride4val_old = read_phy_reg(pi, 0x939);
+                afectrlovr_old = read_phy_reg(pi, 0x43b);
+                afectrlovrval_old = read_phy_reg(pi, 0x43c);
+                old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
+                old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
+
+                tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
+                if (tx_gain_override_old) {
+                        wlc_lcnphy_get_tx_gain(pi, &old_gains);
+                        tx_gain_index_old = pi_lcn->lcnphy_current_index;
+                }
 
-        write_radio_reg(pi, RADIO_2064_REG116, 0x06);
-        write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
-        write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
-        write_radio_reg(pi, RADIO_2064_REG098, 0x03);
-        write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
-        mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
-        write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
-        write_radio_reg(pi, RADIO_2064_REG114, 0x01);
-        write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
-        write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
-
-        mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
-        mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
-        mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
-        mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
-        mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
-        mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
-        mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
-        mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
-        mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
-        mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
+                wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
 
-        mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
-        mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
+                mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
+                mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
 
-        write_phy_reg(pi, 0x6da, 0xffff);
-        or_phy_reg(pi, 0x6db, 0x3);
+                mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
+                mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
 
-        wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
-        set_gain = false;
-
-        lna2_gain = 3;
-        while ((lna2_gain >= 0) && !set_gain) {
-                tia_gain = 4;
-
-                while ((tia_gain >= 0) && !set_gain) {
-                        biq1_gain = 6;
-
-                        while ((biq1_gain >= 0) && !set_gain) {
-                                set_gain = wlc_lcnphy_rx_iq_cal_gain(pi,
-                                                                     (u16)
-                                                                     biq1_gain,
-                                                                     (u16)
-                                                                     tia_gain,
-                                                                     (u16)
-                                                                     lna2_gain);
-                                biq1_gain -= 1;
-                        }
+                write_radio_reg(pi, RADIO_2064_REG116, 0x06);
+                write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
+                write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
+                write_radio_reg(pi, RADIO_2064_REG098, 0x03);
+                write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
+                mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
+                write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
+                write_radio_reg(pi, RADIO_2064_REG114, 0x01);
+                write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
+                write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
+
+                mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
+                mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
+                mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
+                mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
+                mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
+                mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
+                mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
+                mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
+                mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
+                mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
+
+                mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
+                mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
+
+                wlc_lcnphy_start_tx_tone(pi, 2000, 120, 0);
+                write_phy_reg(pi, 0x6da, 0xffff);
+                or_phy_reg(pi, 0x6db, 0x3);
+                wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
+                wlc_lcnphy_rx_gain_override_enable(pi, true);
+
+                tia_gain = 8;
+                rx_pwr_threshold = 950;
+                while (tia_gain > 0) {
                         tia_gain -= 1;
+                        wlc_lcnphy_set_rx_gain_by_distribution(pi,
+                                                               0, 0, 2, 2,
+                                                               (u16)
+                                                               tia_gain, 1, 0);
+                        udelay(500);
+
+                        received_power =
+                                wlc_lcnphy_measure_digital_power(pi, 2000);
+                        if (received_power < rx_pwr_threshold)
+                                break;
                 }
-                lna2_gain -= 1;
-        }
+                result = wlc_lcnphy_calc_rx_iq_comp(pi, 0xffff);
 
-        if (set_gain)
-                result = wlc_lcnphy_calc_rx_iq_comp(pi, 1024);
-        else
-                result = false;
+                wlc_lcnphy_stop_tx_tone(pi);
 
-        wlc_lcnphy_stop_tx_tone(pi);
+                write_phy_reg(pi, 0x631, Core1TxControl_old);
 
-        write_phy_reg(pi, 0x631, Core1TxControl_old);
-
-        write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
-        write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
-        write_phy_reg(pi, 0x4b0, rfoverride2_old);
-        write_phy_reg(pi, 0x4b1, rfoverride2val_old);
-        write_phy_reg(pi, 0x4f9, rfoverride3_old);
-        write_phy_reg(pi, 0x4fa, rfoverride3val_old);
-        write_phy_reg(pi, 0x938, rfoverride4_old);
-        write_phy_reg(pi, 0x939, rfoverride4val_old);
-        write_phy_reg(pi, 0x43b, afectrlovr_old);
-        write_phy_reg(pi, 0x43c, afectrlovrval_old);
-        write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
-        write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
+                write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
+                write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
+                write_phy_reg(pi, 0x4b0, rfoverride2_old);
+                write_phy_reg(pi, 0x4b1, rfoverride2val_old);
+                write_phy_reg(pi, 0x4f9, rfoverride3_old);
+                write_phy_reg(pi, 0x4fa, rfoverride3val_old);
+                write_phy_reg(pi, 0x938, rfoverride4_old);
+                write_phy_reg(pi, 0x939, rfoverride4val_old);
+                write_phy_reg(pi, 0x43b, afectrlovr_old);
+                write_phy_reg(pi, 0x43c, afectrlovrval_old);
+                write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
+                write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
 
-        wlc_lcnphy_clear_trsw_override(pi);
+                wlc_lcnphy_clear_trsw_override(pi);
 
-        mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
+                mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
 
-        for (i = 0; i < 11; i++)
-                write_radio_reg(pi, rxiq_cal_rf_reg[i],
-                                values_to_save[i]);
+                for (i = 0; i < 11; i++)
+                        write_radio_reg(pi, rxiq_cal_rf_reg[i],
+                                        values_to_save[i]);
 
-        if (tx_gain_override_old)
-                wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
-        else
-                wlc_lcnphy_disable_tx_gain_override(pi);
+                if (tx_gain_override_old)
+                        wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
+                else
+                        wlc_lcnphy_disable_tx_gain_override(pi);
 
-        wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
-        wlc_lcnphy_rx_gain_override_enable(pi, false);
+                wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
+                wlc_lcnphy_rx_gain_override_enable(pi, false);
+        }
 
 cal_done:
         kfree(ptr);
@@ -1829,17 +1781,6 @@ wlc_lcnphy_radio_2064_channel_tune_4313(struct brcms_phy *pi, u8 channel)
                 write_radio_reg(pi, RADIO_2064_REG038, 3);
                 write_radio_reg(pi, RADIO_2064_REG091, 7);
         }
-
-        if (!(pi->sh->boardflags & BFL_FEM)) {
-                u8 reg038[14] = {0xd, 0xe, 0xd, 0xd, 0xd, 0xc,
-                        0xa, 0xb, 0xb, 0x3, 0x3, 0x2, 0x0, 0x0};
-
-                write_radio_reg(pi, RADIO_2064_REG02A, 0xf);
-                write_radio_reg(pi, RADIO_2064_REG091, 0x3);
-                write_radio_reg(pi, RADIO_2064_REG038, 0x3);
-
-                write_radio_reg(pi, RADIO_2064_REG038, reg038[channel - 1]);
-        }
 }
 
 static int
@@ -2034,16 +1975,6 @@ wlc_lcnphy_set_tssi_mux(struct brcms_phy *pi, enum lcnphy_tssi_mode pos)
                 } else {
                         mod_radio_reg(pi, RADIO_2064_REG03A, 1, 0x1);
                         mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
-                        mod_radio_reg(pi, RADIO_2064_REG028, 0x1, 0x0);
-                        mod_radio_reg(pi, RADIO_2064_REG11A, 0x4, 1<<2);
-                        mod_radio_reg(pi, RADIO_2064_REG036, 0x10, 0x0);
-                        mod_radio_reg(pi, RADIO_2064_REG11A, 0x10, 1<<4);
-                        mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
-                        mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x77);
-                        mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, 0xe<<1);
-                        mod_radio_reg(pi, RADIO_2064_REG112, 0x80, 1<<7);
-                        mod_radio_reg(pi, RADIO_2064_REG005, 0x7, 1<<1);
-                        mod_radio_reg(pi, RADIO_2064_REG029, 0xf0, 0<<4);
                 }
         } else {
                 mod_phy_reg(pi, 0x4d9, (0x1 << 2), (0x1) << 2);
@@ -2130,14 +2061,12 @@ static void wlc_lcnphy_pwrctrl_rssiparams(struct brcms_phy *pi)
                     (auxpga_vmid_temp << 0) | (auxpga_gain_temp << 12));
 
         mod_radio_reg(pi, RADIO_2064_REG082, (1 << 5), (1 << 5));
-        mod_radio_reg(pi, RADIO_2064_REG07C, (1 << 0), (1 << 0));
 }
 
 static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
 {
         struct phytbl_info tab;
         u32 rfseq, ind;
-        u8 tssi_sel;
 
         tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
         tab.tbl_width = 32;
@@ -2159,13 +2088,7 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
 
         mod_phy_reg(pi, 0x503, (0x1 << 4), (1) << 4);
 
-        if (pi->sh->boardflags & BFL_FEM) {
-                tssi_sel = 0x1;
-                wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
-        } else {
-                tssi_sel = 0xe;
-                wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_POST_PA);
-        }
+        wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
         mod_phy_reg(pi, 0x4a4, (0x1 << 14), (0) << 14);
 
         mod_phy_reg(pi, 0x4a4, (0x1 << 15), (1) << 15);
@@ -2201,10 +2124,9 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
         mod_phy_reg(pi, 0x49a, (0x1ff << 0), (0xff) << 0);
 
         if (LCNREV_IS(pi->pubpi.phy_rev, 2)) {
-                mod_radio_reg(pi, RADIO_2064_REG028, 0xf, tssi_sel);
+                mod_radio_reg(pi, RADIO_2064_REG028, 0xf, 0xe);
                 mod_radio_reg(pi, RADIO_2064_REG086, 0x4, 0x4);
         } else {
-                mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, tssi_sel << 1);
                 mod_radio_reg(pi, RADIO_2064_REG03A, 0x1, 1);
                 mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 1 << 3);
         }
@@ -2251,10 +2173,6 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
 
         mod_phy_reg(pi, 0x4d7, (0xf << 8), (0) << 8);
 
-        mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x0);
-        mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
-        mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
-
         wlc_lcnphy_pwrctrl_rssiparams(pi);
 }
 
@@ -2873,8 +2791,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
                 read_radio_reg(pi, RADIO_2064_REG007) & 1;
         u16 SAVE_jtag_auxpga = read_radio_reg(pi, RADIO_2064_REG0FF) & 0x10;
         u16 SAVE_iqadc_aux_en = read_radio_reg(pi, RADIO_2064_REG11F) & 4;
-        u8 SAVE_bbmult = wlc_lcnphy_get_bbmult(pi);
-
         idleTssi = read_phy_reg(pi, 0x4ab);
         suspend = (0 == (bcma_read32(pi->d11core, D11REGOFFS(maccontrol)) &
                          MCTL_EN_MAC));
@@ -2892,12 +2808,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
         mod_radio_reg(pi, RADIO_2064_REG0FF, 0x10, 1 << 4);
         mod_radio_reg(pi, RADIO_2064_REG11F, 0x4, 1 << 2);
         wlc_lcnphy_tssi_setup(pi);
-
-        mod_phy_reg(pi, 0x4d7, (0x1 << 0), (1 << 0));
-        mod_phy_reg(pi, 0x4d7, (0x1 << 6), (1 << 6));
-
-        wlc_lcnphy_set_bbmult(pi, 0x0);
-
         wlc_phy_do_dummy_tx(pi, true, OFF);
         idleTssi = ((read_phy_reg(pi, 0x4ab) & (0x1ff << 0))
                     >> 0);
@@ -2919,7 +2829,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
 
         mod_phy_reg(pi, 0x44c, (0x1 << 12), (0) << 12);
 
-        wlc_lcnphy_set_bbmult(pi, SAVE_bbmult);
         wlc_lcnphy_set_tx_gain_override(pi, tx_gain_override_old);
         wlc_lcnphy_set_tx_gain(pi, &old_gains);
         wlc_lcnphy_set_tx_pwr_ctrl(pi, SAVE_txpwrctrl);
@@ -3133,11 +3042,6 @@ static void wlc_lcnphy_tx_pwr_ctrl_init(struct brcms_phy_pub *ppi)
                         wlc_lcnphy_write_table(pi, &tab);
                         tab.tbl_offset++;
                 }
-                mod_phy_reg(pi, 0x4d0, (0x1 << 0), (0) << 0);
-                mod_phy_reg(pi, 0x4d3, (0xff << 0), (0) << 0);
-                mod_phy_reg(pi, 0x4d3, (0xff << 8), (0) << 8);
-                mod_phy_reg(pi, 0x4d0, (0x1 << 4), (0) << 4);
-                mod_phy_reg(pi, 0x4d0, (0x1 << 2), (0) << 2);
 
                 mod_phy_reg(pi, 0x410, (0x1 << 7), (0) << 7);
 
@@ -3939,6 +3843,7 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
         target_gains.pad_gain = 21;
         target_gains.dac_gain = 0;
         wlc_lcnphy_set_tx_gain(pi, &target_gains);
+        wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
 
         if (LCNREV_IS(pi->pubpi.phy_rev, 1) || pi_lcn->lcnphy_hw_iqcal_en) {
 
@@ -3949,7 +3854,6 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
                                         lcnphy_recal ? LCNPHY_CAL_RECAL :
                                         LCNPHY_CAL_FULL), false);
         } else {
-                wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
                 wlc_lcnphy_tx_iqlo_soft_cal_full(pi);
         }
 
@@ -4374,22 +4278,17 @@ wlc_lcnphy_load_tx_gain_table(struct brcms_phy *pi,
         if (CHSPEC_IS5G(pi->radio_chanspec))
                 pa_gain = 0x70;
         else
-                pa_gain = 0x60;
+                pa_gain = 0x70;
 
         if (pi->sh->boardflags & BFL_FEM)
                 pa_gain = 0x10;
-
         tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
         tab.tbl_width = 32;
         tab.tbl_len = 1;
         tab.tbl_ptr = &val;
 
         for (j = 0; j < 128; j++) {
-                if (pi->sh->boardflags & BFL_FEM)
-                        gm_gain = gain_table[j].gm;
-                else
-                        gm_gain = 15;
-
+                gm_gain = gain_table[j].gm;
                 val = (((u32) pa_gain << 24) |
                        (gain_table[j].pad << 16) |
                        (gain_table[j].pga << 8) | gm_gain);
@@ -4600,10 +4499,7 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
 
         write_phy_reg(pi, 0x4ea, 0x4688);
 
-        if (pi->sh->boardflags & BFL_FEM)
-                mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
-        else
-                mod_phy_reg(pi, 0x4eb, (0x7 << 0), 3 << 0);
+        mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
 
         mod_phy_reg(pi, 0x4eb, (0x7 << 6), 0 << 6);
 
@@ -4614,13 +4510,6 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
         wlc_lcnphy_rcal(pi);
 
         wlc_lcnphy_rc_cal(pi);
-
-        if (!(pi->sh->boardflags & BFL_FEM)) {
-                write_radio_reg(pi, RADIO_2064_REG032, 0x6f);
-                write_radio_reg(pi, RADIO_2064_REG033, 0x19);
-                write_radio_reg(pi, RADIO_2064_REG039, 0xe);
-        }
-
 }
 
 static void wlc_lcnphy_radio_init(struct brcms_phy *pi)
@@ -4650,20 +4539,22 @@ static void wlc_lcnphy_tbl_init(struct brcms_phy *pi)
                 wlc_lcnphy_write_table(pi, &tab);
         }
 
-        if (!(pi->sh->boardflags & BFL_FEM)) {
-                tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
-                tab.tbl_width = 16;
-                tab.tbl_ptr = &val;
-                tab.tbl_len = 1;
+        tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
+        tab.tbl_width = 16;
+        tab.tbl_ptr = &val;
+        tab.tbl_len = 1;
 
-                val = 150;
-                tab.tbl_offset = 0;
-                wlc_lcnphy_write_table(pi, &tab);
+        val = 114;
+        tab.tbl_offset = 0;
+        wlc_lcnphy_write_table(pi, &tab);
 
-                val = 220;
-                tab.tbl_offset = 1;
-                wlc_lcnphy_write_table(pi, &tab);
-        }
+        val = 130;
+        tab.tbl_offset = 1;
+        wlc_lcnphy_write_table(pi, &tab);
+
+        val = 6;
+        tab.tbl_offset = 8;
+        wlc_lcnphy_write_table(pi, &tab);
 
         if (CHSPEC_IS2G(pi->radio_chanspec)) {
                 if (pi->sh->boardflags & BFL_FEM)
@@ -5055,7 +4946,6 @@ void wlc_phy_chanspec_set_lcnphy(struct brcms_phy *pi, u16 chanspec)
                 wlc_lcnphy_load_tx_iir_filter(pi, true, 3);
 
         mod_phy_reg(pi, 0x4eb, (0x7 << 3), (1) << 3);
-        wlc_lcnphy_tssi_setup(pi);
 }
 
 void wlc_phy_detach_lcnphy(struct brcms_phy *pi)
@@ -5094,7 +4984,8 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
         if (!wlc_phy_txpwr_srom_read_lcnphy(pi))
                 return false;
 
-        if (LCNREV_IS(pi->pubpi.phy_rev, 1)) {
+        if ((pi->sh->boardflags & BFL_FEM) &&
+            (LCNREV_IS(pi->pubpi.phy_rev, 1))) {
                 if (pi_lcn->lcnphy_tempsense_option == 3) {
                         pi->hwpwrctrl = true;
                         pi->hwpwrctrl_capable = true;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
index b7e95acc2084..622c01ca72c5 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
@@ -1992,70 +1992,70 @@ static const u16 dot11lcn_sw_ctrl_tbl_4313_epa_rev0[] = {
 };
 
 static const u16 dot11lcn_sw_ctrl_tbl_4313_rev0[] = {
-        0x0009,
         0x000a,
-        0x0005,
-        0x0006,
         0x0009,
-        0x000a,
-        0x0005,
         0x0006,
-        0x0009,
-        0x000a,
         0x0005,
-        0x0006,
-        0x0009,
         0x000a,
-        0x0005,
-        0x0006,
         0x0009,
-        0x000a,
-        0x0005,
         0x0006,
-        0x0009,
-        0x000a,
         0x0005,
-        0x0006,
-        0x0009,
         0x000a,
-        0x0005,
-        0x0006,
         0x0009,
-        0x000a,
-        0x0005,
         0x0006,
-        0x0009,
-        0x000a,
         0x0005,
-        0x0006,
-        0x0009,
         0x000a,
-        0x0005,
-        0x0006,
         0x0009,
-        0x000a,
-        0x0005,
         0x0006,
-        0x0009,
-        0x000a,
         0x0005,
-        0x0006,
+        0x000a,
         0x0009,
+        0x0006,
+        0x0005,
         0x000a,
+        0x0009,
+        0x0006,
         0x0005,
+        0x000a,
+        0x0009,
         0x0006,
+        0x0005,
+        0x000a,
         0x0009,
+        0x0006,
+        0x0005,
         0x000a,
+        0x0009,
+        0x0006,
         0x0005,
+        0x000a,
+        0x0009,
         0x0006,
+        0x0005,
+        0x000a,
         0x0009,
+        0x0006,
+        0x0005,
         0x000a,
+        0x0009,
+        0x0006,
         0x0005,
+        0x000a,
+        0x0009,
         0x0006,
+        0x0005,
+        0x000a,
         0x0009,
+        0x0006,
+        0x0005,
         0x000a,
+        0x0009,
+        0x0006,
         0x0005,
+        0x000a,
+        0x0009,
         0x0006,
+        0x0005,
 };
 
 static const u16 dot11lcn_sw_ctrl_tbl_rev0[] = {
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index 3630a41df50d..c353b5f19c8c 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -475,6 +475,7 @@ il3945_tx_skb(struct il_priv *il,
         dma_addr_t txcmd_phys;
         int txq_id = skb_get_queue_mapping(skb);
         u16 len, idx, hdr_len;
+        u16 firstlen, secondlen;
         u8 id;
         u8 unicast;
         u8 sta_id;
@@ -589,21 +590,22 @@ il3945_tx_skb(struct il_priv *il,
         len =
             sizeof(struct il3945_tx_cmd) + sizeof(struct il_cmd_header) +
             hdr_len;
-        len = (len + 3) & ~3;
+        firstlen = (len + 3) & ~3;
 
         /* Physical address of this Tx command's header (not MAC header!),
          * within command buffer array. */
         txcmd_phys =
-            pci_map_single(il->pci_dev, &out_cmd->hdr, len, PCI_DMA_TODEVICE);
+            pci_map_single(il->pci_dev, &out_cmd->hdr, firstlen,
+                           PCI_DMA_TODEVICE);
         if (unlikely(pci_dma_mapping_error(il->pci_dev, txcmd_phys)))
                 goto drop_unlock;
 
         /* Set up TFD's 2nd entry to point directly to remainder of skb,
          * if any (802.11 null frames have no payload). */
-        len = skb->len - hdr_len;
-        if (len) {
+        secondlen = skb->len - hdr_len;
+        if (secondlen > 0) {
                 phys_addr =
-                    pci_map_single(il->pci_dev, skb->data + hdr_len, len,
+                    pci_map_single(il->pci_dev, skb->data + hdr_len, secondlen,
                                    PCI_DMA_TODEVICE);
                 if (unlikely(pci_dma_mapping_error(il->pci_dev, phys_addr)))
                         goto drop_unlock;
@@ -611,12 +613,12 @@ il3945_tx_skb(struct il_priv *il,
 
         /* Add buffer containing Tx command and MAC(!) header to TFD's
          * first entry */
-        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, len, 1, 0);
+        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, firstlen, 1, 0);
         dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        dma_unmap_len_set(out_meta, len, len);
-        if (len)
-                il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, len, 0,
-                                               U32_PAD(len));
+        dma_unmap_len_set(out_meta, len, firstlen);
+        if (secondlen > 0)
+                il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, secondlen, 0,
+                                               U32_PAD(secondlen));
 
         if (!ieee80211_has_morefrags(hdr->frame_control)) {
                 txq->need_update = 1;
diff --git a/drivers/net/wireless/iwlegacy/4965-rs.c b/drivers/net/wireless/iwlegacy/4965-rs.c
index e8324b5e5bfe..6c7493c2d698 100644
--- a/drivers/net/wireless/iwlegacy/4965-rs.c
+++ b/drivers/net/wireless/iwlegacy/4965-rs.c
@@ -2152,7 +2152,7 @@ il4965_rs_initialize_lq(struct il_priv *il, struct ieee80211_conf *conf,
         int rate_idx;
         int i;
         u32 rate;
-        u8 use_green = il4965_rs_use_green(il, sta);
+        u8 use_green;
         u8 active_tbl = 0;
         u8 valid_tx_ant;
         struct il_station_priv *sta_priv;
@@ -2160,6 +2160,7 @@ il4965_rs_initialize_lq(struct il_priv *il, struct ieee80211_conf *conf,
         if (!sta || !lq_sta)
                 return;
 
+        use_green = il4965_rs_use_green(il, sta);
         sta_priv = (void *)sta->drv_priv;
 
         i = lq_sta->last_txrate_idx;
diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
index 86ea5f4c3939..44ca0e57f9f7 100644
--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -1262,6 +1262,15 @@ int iwl_dvm_send_cmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
         }
 
         /*
+         * This can happen upon FW ASSERT: we clear the STATUS_FW_ERROR flag
+         * in iwl_down but cancel the workers only later.
+         */
+        if (!priv->ucode_loaded) {
+                IWL_ERR(priv, "Fw not loaded - dropping CMD: %x\n", cmd->id);
+                return -EIO;
+        }
+
+        /*
          * Synchronous commands from this op-mode must hold
          * the mutex, this ensures we don't try to send two
          * (or more) synchronous commands at a time.
diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index 23be948cf162..a82b6b39d4ff 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -1419,6 +1419,14 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
 
         mutex_lock(&priv->mutex);
 
+        if (changes & BSS_CHANGED_IDLE && bss_conf->idle) {
+                /*
+                 * If we go idle, then clearly no "passive-no-rx"
+                 * workaround is needed any more, this is a reset.
+                 */
+                iwlagn_lift_passive_no_rx(priv);
+        }
+
         if (unlikely(!iwl_is_ready(priv))) {
                 IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
                 mutex_unlock(&priv->mutex);
@@ -1450,16 +1458,6 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
                         priv->timestamp = bss_conf->sync_tsf;
                         ctx->staging.filter_flags |= RXON_FILTER_ASSOC_MSK;
                 } else {
-                        /*
-                         * If we disassociate while there are pending
-                         * frames, just wake up the queues and let the
-                         * frames "escape" ... This shouldn't really
-                         * be happening to start with, but we should
-                         * not get stuck in this case either since it
-                         * can happen if userspace gets confused.
-                         */
-                        iwlagn_lift_passive_no_rx(priv);
-
                         ctx->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
 
                         if (ctx->ctxid == IWL_RXON_CTX_BSS)
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 6aec2df3bb27..d1a670d7b10c 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1192,7 +1192,7 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         memset(&info->status, 0, sizeof(info->status));
 
                         if (status == TX_STATUS_FAIL_PASSIVE_NO_RX &&
-                            iwl_is_associated_ctx(ctx) && ctx->vif &&
+                            ctx->vif &&
                             ctx->vif->type == NL80211_IFTYPE_STATION) {
                                 /* block and stop all queues */
                                 priv->passive_no_rx = true;
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index 736fe9bb140e..1a4ac9236a44 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -367,6 +367,8 @@ int iwl_load_ucode_wait_alive(struct iwl_priv *priv,
                 return -EIO;
         }
 
+        priv->ucode_loaded = true;
+
         if (ucode_type != IWL_UCODE_WOWLAN) {
                 /* delay a bit to give rfkill time to run */
                 msleep(5);
@@ -380,8 +382,6 @@ int iwl_load_ucode_wait_alive(struct iwl_priv *priv,
                 return ret;
         }
 
-        priv->ucode_loaded = true;
-
         return 0;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 17bedc50e753..12c4f31ca8fb 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -475,6 +475,10 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
 
         /* If platform's RF_KILL switch is NOT set to KILL */
         hw_rfkill = iwl_is_rfkill_set(trans);
+        if (hw_rfkill)
+                set_bit(STATUS_RFKILL, &trans_pcie->status);
+        else
+                clear_bit(STATUS_RFKILL, &trans_pcie->status);
         iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
         if (hw_rfkill && !run_in_rfkill)
                 return -ERFKILL;
@@ -641,6 +645,7 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
 
 static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         bool hw_rfkill;
         int err;
 
@@ -656,6 +661,10 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
         iwl_enable_rfkill_int(trans);
 
         hw_rfkill = iwl_is_rfkill_set(trans);
+        if (hw_rfkill)
+                set_bit(STATUS_RFKILL, &trans_pcie->status);
+        else
+                clear_bit(STATUS_RFKILL, &trans_pcie->status);
         iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
 
         return 0;
@@ -694,6 +703,10 @@ static void iwl_trans_pcie_stop_hw(struct iwl_trans *trans,
                  * op_mode.
                  */
                 hw_rfkill = iwl_is_rfkill_set(trans);
+                if (hw_rfkill)
+                        set_bit(STATUS_RFKILL, &trans_pcie->status);
+                else
+                        clear_bit(STATUS_RFKILL, &trans_pcie->status);
                 iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
         }
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 8595c16f74de..cb5c6792e3a8 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1264,7 +1264,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
                 int copy = 0;
 
-                if (!cmd->len)
+                if (!cmd->len[i])
                         continue;
 
                 /* need at least IWL_HCMD_SCRATCHBUF_SIZE copied */
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index a44023a7bd57..8aaf56ade4d9 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1892,7 +1892,8 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
                 }
         }
 
-        for (i = 0; i < request->n_channels; i++) {
+        for (i = 0; i < min_t(u32, request->n_channels,
+                              MWIFIEX_USER_SCAN_CHAN_MAX); i++) {
                 chan = request->channels[i];
                 priv->user_scan_cfg->chan_list[i].chan_number = chan->hw_value;
                 priv->user_scan_cfg->chan_list[i].radio_type = chan->band;
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 20a6c5555873..b5c8b962ce12 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -157,6 +157,20 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
                 return -1;
         }
 
+        cmd_code = le16_to_cpu(host_cmd->command);
+        cmd_size = le16_to_cpu(host_cmd->size);
+
+        if (adapter->hw_status == MWIFIEX_HW_STATUS_RESET &&
+            cmd_code != HostCmd_CMD_FUNC_SHUTDOWN &&
+            cmd_code != HostCmd_CMD_FUNC_INIT) {
+                dev_err(adapter->dev,
+                        "DNLD_CMD: FW in reset state, ignore cmd %#x\n",
+                        cmd_code);
+                mwifiex_complete_cmd(adapter, cmd_node);
+                mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
+                return -1;
+        }
+
         /* Set command sequence number */
         adapter->seq_num++;
         host_cmd->seq_num = cpu_to_le16(HostCmd_SET_SEQ_NO_BSS_INFO
@@ -168,9 +182,6 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
         adapter->curr_cmd = cmd_node;
         spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
 
-        cmd_code = le16_to_cpu(host_cmd->command);
-        cmd_size = le16_to_cpu(host_cmd->size);
-
         /* Adjust skb length */
         if (cmd_node->cmd_skb->len > cmd_size)
                 /*
@@ -484,8 +495,6 @@ int mwifiex_send_cmd_sync(struct mwifiex_private *priv, uint16_t cmd_no,
 
         ret = mwifiex_send_cmd_async(priv, cmd_no, cmd_action, cmd_oid,
                                      data_buf);
-        if (!ret)
-                ret = mwifiex_wait_queue_complete(adapter);
 
         return ret;
 }
@@ -588,9 +597,10 @@ int mwifiex_send_cmd_async(struct mwifiex_private *priv, uint16_t cmd_no,
         if (cmd_no == HostCmd_CMD_802_11_SCAN) {
                 mwifiex_queue_scan_cmd(priv, cmd_node);
         } else {
-                adapter->cmd_queued = cmd_node;
                 mwifiex_insert_cmd_to_pending_q(adapter, cmd_node, true);
                 queue_work(adapter->workqueue, &adapter->main_work);
+                if (cmd_node->wait_q_enabled)
+                        ret = mwifiex_wait_queue_complete(adapter, cmd_node);
         }
 
         return ret;
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index e38aa9b3663d..0ff4c37ab42a 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -709,6 +709,14 @@ mwifiex_shutdown_drv(struct mwifiex_adapter *adapter)
                 return ret;
         }
 
+        /* cancel current command */
+        if (adapter->curr_cmd) {
+                dev_warn(adapter->dev, "curr_cmd is still in processing\n");
+                del_timer(&adapter->cmd_timer);
+                mwifiex_insert_cmd_to_free_q(adapter, adapter->curr_cmd);
+                adapter->curr_cmd = NULL;
+        }
+
         /* shut down mwifiex */
         dev_dbg(adapter->dev, "info: shutdown mwifiex...\n");
 
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 553adfb0aa81..7035ade9af74 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -723,7 +723,6 @@ struct mwifiex_adapter {
         u16 cmd_wait_q_required;
         struct mwifiex_wait_queue cmd_wait_q;
         u8 scan_wait_q_woken;
-        struct cmd_ctrl_node *cmd_queued;
         spinlock_t queue_lock;          /* lock for tx queues */
         struct completion fw_load;
         u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
@@ -1018,7 +1017,8 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
                         struct mwifiex_multicast_list *mcast_list);
 int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
                             struct net_device *dev);
-int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter);
+int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter,
+                                struct cmd_ctrl_node *cmd_queued);
 int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                       struct cfg80211_ssid *req_ssid);
 int mwifiex_cancel_hs(struct mwifiex_private *priv, int cmd_type);
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 5c395e2e6a2b..feb204613397 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -1508,6 +1508,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
                 }
                 memcpy(adapter->upld_buf, skb->data,
                        min_t(u32, MWIFIEX_SIZE_OF_CMD_BUFFER, skb->len));
+                skb_push(skb, INTF_HEADER_LEN);
                 if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
                                            PCI_DMA_FROMDEVICE))
                         return -1;
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index bb60c2754a97..e7f6deaf715e 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1388,10 +1388,15 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
                         list_del(&cmd_node->list);
                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
                                                flags);
-                        adapter->cmd_queued = cmd_node;
                         mwifiex_insert_cmd_to_pending_q(adapter, cmd_node,
                                                         true);
                         queue_work(adapter->workqueue, &adapter->main_work);
+
+                        /* Perform internal scan synchronously */
+                        if (!priv->scan_request) {
+                                dev_dbg(adapter->dev, "wait internal scan\n");
+                                mwifiex_wait_queue_complete(adapter, cmd_node);
+                        }
                 } else {
                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
                                                flags);
@@ -1790,7 +1795,12 @@ check_next_scan:
                 /* Need to indicate IOCTL complete */
                 if (adapter->curr_cmd->wait_q_enabled) {
                         adapter->cmd_wait_q.status = 0;
-                        mwifiex_complete_cmd(adapter, adapter->curr_cmd);
+                        if (!priv->scan_request) {
+                                dev_dbg(adapter->dev,
+                                        "complete internal scan\n");
+                                mwifiex_complete_cmd(adapter,
+                                                     adapter->curr_cmd);
+                        }
                 }
                 if (priv->report_scan_result)
                         priv->report_scan_result = false;
@@ -1946,9 +1956,6 @@ int mwifiex_request_scan(struct mwifiex_private *priv,
                 /* Normal scan */
                 ret = mwifiex_scan_networks(priv, NULL);
 
-        if (!ret)
-                ret = mwifiex_wait_queue_complete(priv->adapter);
-
         up(&priv->async_sem);
 
         return ret;
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 9f33c92c90f5..13100f8de3db 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -54,16 +54,10 @@ int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
  * This function waits on a cmd wait queue. It also cancels the pending
  * request after waking up, in case of errors.
  */
-int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
+int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter,
+                                struct cmd_ctrl_node *cmd_queued)
 {
         int status;
-        struct cmd_ctrl_node *cmd_queued;
-
-        if (!adapter->cmd_queued)
-                return 0;
-
-        cmd_queued = adapter->cmd_queued;
-        adapter->cmd_queued = NULL;
 
         dev_dbg(adapter->dev, "cmd pending\n");
         atomic_inc(&adapter->cmd_pending);
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 2bf4efa33186..76cd47eb901e 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -20,6 +20,7 @@ if RT2X00
 config RT2400PCI
         tristate "Ralink rt2400 (PCI/PCMCIA) support"
         depends on PCI
+        select RT2X00_LIB_MMIO
         select RT2X00_LIB_PCI
         select EEPROM_93CX6
         ---help---
@@ -31,6 +32,7 @@ config RT2400PCI
 config RT2500PCI
         tristate "Ralink rt2500 (PCI/PCMCIA) support"
         depends on PCI
+        select RT2X00_LIB_MMIO
         select RT2X00_LIB_PCI
         select EEPROM_93CX6
         ---help---
@@ -43,6 +45,7 @@ config RT61PCI
         tristate "Ralink rt2501/rt61 (PCI/PCMCIA) support"
         depends on PCI
         select RT2X00_LIB_PCI
+        select RT2X00_LIB_MMIO
         select RT2X00_LIB_FIRMWARE
         select RT2X00_LIB_CRYPTO
         select CRC_ITU_T
@@ -57,6 +60,7 @@ config RT2800PCI
         tristate "Ralink rt27xx/rt28xx/rt30xx (PCI/PCIe/PCMCIA) support"
         depends on PCI || SOC_RT288X || SOC_RT305X
         select RT2800_LIB
+        select RT2X00_LIB_MMIO
         select RT2X00_LIB_PCI if PCI
         select RT2X00_LIB_SOC if SOC_RT288X || SOC_RT305X
         select RT2X00_LIB_FIRMWARE
@@ -185,6 +189,9 @@ endif
 config RT2800_LIB
         tristate
 
+config RT2X00_LIB_MMIO
+        tristate
+
 config RT2X00_LIB_PCI
         tristate
         select RT2X00_LIB
diff --git a/drivers/net/wireless/rt2x00/Makefile b/drivers/net/wireless/rt2x00/Makefile
index 349d5b8284a4..f069d8bc5b67 100644
--- a/drivers/net/wireless/rt2x00/Makefile
+++ b/drivers/net/wireless/rt2x00/Makefile
@@ -9,6 +9,7 @@ rt2x00lib-$(CONFIG_RT2X00_LIB_FIRMWARE)	+= rt2x00firmware.o
 rt2x00lib-$(CONFIG_RT2X00_LIB_LEDS)     += rt2x00leds.o
 
 obj-$(CONFIG_RT2X00_LIB)                += rt2x00lib.o
+obj-$(CONFIG_RT2X00_LIB_MMIO)           += rt2x00mmio.o
 obj-$(CONFIG_RT2X00_LIB_PCI)            += rt2x00pci.o
 obj-$(CONFIG_RT2X00_LIB_SOC)            += rt2x00soc.o
 obj-$(CONFIG_RT2X00_LIB_USB)            += rt2x00usb.o
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 221beaaa83f1..dcfb54e0c516 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -34,6 +34,7 @@
 #include <linux/slab.h>
 
 #include "rt2x00.h"
+#include "rt2x00mmio.h"
 #include "rt2x00pci.h"
 #include "rt2400pci.h"
 
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 39edc59e8d03..e1d2dc9ed28a 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -34,6 +34,7 @@
 #include <linux/slab.h>
 
 #include "rt2x00.h"
+#include "rt2x00mmio.h"
 #include "rt2x00pci.h"
 #include "rt2500pci.h"
 
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index ded73da4de0b..ba5a05625aaa 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -41,6 +41,7 @@
 #include <linux/eeprom_93cx6.h>
 
 #include "rt2x00.h"
+#include "rt2x00mmio.h"
 #include "rt2x00pci.h"
 #include "rt2x00soc.h"
 #include "rt2800lib.h"
diff --git a/drivers/net/wireless/rt2x00/rt2x00mmio.c b/drivers/net/wireless/rt2x00/rt2x00mmio.c
new file mode 100644
index 000000000000..d84a680ba0c9
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00mmio.c
@@ -0,0 +1,216 @@
+/*
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2x00mmio
+        Abstract: rt2x00 generic mmio device routines.
+ */
+
+#include <linux/dma-mapping.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+
+#include "rt2x00.h"
+#include "rt2x00mmio.h"
+
+/*
+ * Register access.
+ */
+int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
+                           const unsigned int offset,
+                           const struct rt2x00_field32 field,
+                           u32 *reg)
+{
+        unsigned int i;
+
+        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
+                return 0;
+
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2x00pci_register_read(rt2x00dev, offset, reg);
+                if (!rt2x00_get_field32(*reg, field))
+                        return 1;
+                udelay(REGISTER_BUSY_DELAY);
+        }
+
+        printk_once(KERN_ERR "%s() Indirect register access failed: "
+              "offset=0x%.08x, value=0x%.08x\n", __func__, offset, *reg);
+        *reg = ~0;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2x00pci_regbusy_read);
+
+bool rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue = rt2x00dev->rx;
+        struct queue_entry *entry;
+        struct queue_entry_priv_pci *entry_priv;
+        struct skb_frame_desc *skbdesc;
+        int max_rx = 16;
+
+        while (--max_rx) {
+                entry = rt2x00queue_get_entry(queue, Q_INDEX);
+                entry_priv = entry->priv_data;
+
+                if (rt2x00dev->ops->lib->get_entry_state(entry))
+                        break;
+
+                /*
+                 * Fill in desc fields of the skb descriptor
+                 */
+                skbdesc = get_skb_frame_desc(entry->skb);
+                skbdesc->desc = entry_priv->desc;
+                skbdesc->desc_len = entry->queue->desc_size;
+
+                /*
+                 * DMA is already done, notify rt2x00lib that
+                 * it finished successfully.
+                 */
+                rt2x00lib_dmastart(entry);
+                rt2x00lib_dmadone(entry);
+
+                /*
+                 * Send the frame to rt2x00lib for further processing.
+                 */
+                rt2x00lib_rxdone(entry, GFP_ATOMIC);
+        }
+
+        return !max_rx;
+}
+EXPORT_SYMBOL_GPL(rt2x00pci_rxdone);
+
+void rt2x00pci_flush_queue(struct data_queue *queue, bool drop)
+{
+        unsigned int i;
+
+        for (i = 0; !rt2x00queue_empty(queue) && i < 10; i++)
+                msleep(10);
+}
+EXPORT_SYMBOL_GPL(rt2x00pci_flush_queue);
+
+/*
+ * Device initialization handlers.
+ */
+static int rt2x00pci_alloc_queue_dma(struct rt2x00_dev *rt2x00dev,
+                                     struct data_queue *queue)
+{
+        struct queue_entry_priv_pci *entry_priv;
+        void *addr;
+        dma_addr_t dma;
+        unsigned int i;
+
+        /*
+         * Allocate DMA memory for descriptor and buffer.
+         */
+        addr = dma_alloc_coherent(rt2x00dev->dev,
+                                  queue->limit * queue->desc_size,
+                                  &dma, GFP_KERNEL);
+        if (!addr)
+                return -ENOMEM;
+
+        memset(addr, 0, queue->limit * queue->desc_size);
+
+        /*
+         * Initialize all queue entries to contain valid addresses.
+         */
+        for (i = 0; i < queue->limit; i++) {
+                entry_priv = queue->entries[i].priv_data;
+                entry_priv->desc = addr + i * queue->desc_size;
+                entry_priv->desc_dma = dma + i * queue->desc_size;
+        }
+
+        return 0;
+}
+
+static void rt2x00pci_free_queue_dma(struct rt2x00_dev *rt2x00dev,
+                                     struct data_queue *queue)
+{
+        struct queue_entry_priv_pci *entry_priv =
+            queue->entries[0].priv_data;
+
+        if (entry_priv->desc)
+                dma_free_coherent(rt2x00dev->dev,
+                                  queue->limit * queue->desc_size,
+                                  entry_priv->desc, entry_priv->desc_dma);
+        entry_priv->desc = NULL;
+}
+
+int rt2x00pci_initialize(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+        int status;
+
+        /*
+         * Allocate DMA
+         */
+        queue_for_each(rt2x00dev, queue) {
+                status = rt2x00pci_alloc_queue_dma(rt2x00dev, queue);
+                if (status)
+                        goto exit;
+        }
+
+        /*
+         * Register interrupt handler.
+         */
+        status = request_irq(rt2x00dev->irq,
+                             rt2x00dev->ops->lib->irq_handler,
+                             IRQF_SHARED, rt2x00dev->name, rt2x00dev);
+        if (status) {
+                ERROR(rt2x00dev, "IRQ %d allocation failed (error %d).\n",
+                      rt2x00dev->irq, status);
+                goto exit;
+        }
+
+        return 0;
+
+exit:
+        queue_for_each(rt2x00dev, queue)
+                rt2x00pci_free_queue_dma(rt2x00dev, queue);
+
+        return status;
+}
+EXPORT_SYMBOL_GPL(rt2x00pci_initialize);
+
+void rt2x00pci_uninitialize(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+
+        /*
+         * Free irq line.
+         */
+        free_irq(rt2x00dev->irq, rt2x00dev);
+
+        /*
+         * Free DMA
+         */
+        queue_for_each(rt2x00dev, queue)
+                rt2x00pci_free_queue_dma(rt2x00dev, queue);
+}
+EXPORT_SYMBOL_GPL(rt2x00pci_uninitialize);
+
+/*
+ * rt2x00mmio module information.
+ */
+MODULE_AUTHOR(DRV_PROJECT);
+MODULE_VERSION(DRV_VERSION);
+MODULE_DESCRIPTION("rt2x00 mmio library");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/rt2x00/rt2x00mmio.h b/drivers/net/wireless/rt2x00/rt2x00mmio.h
new file mode 100644
index 000000000000..4ecaf60175bf
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00mmio.h
@@ -0,0 +1,119 @@
+/*
+        Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2x00mmio
+        Abstract: Data structures for the rt2x00mmio module.
+ */
+
+#ifndef RT2X00MMIO_H
+#define RT2X00MMIO_H
+
+#include <linux/io.h>
+
+/*
+ * Register access.
+ */
+static inline void rt2x00pci_register_read(struct rt2x00_dev *rt2x00dev,
+                                           const unsigned int offset,
+                                           u32 *value)
+{
+        *value = readl(rt2x00dev->csr.base + offset);
+}
+
+static inline void rt2x00pci_register_multiread(struct rt2x00_dev *rt2x00dev,
+                                                const unsigned int offset,
+                                                void *value, const u32 length)
+{
+        memcpy_fromio(value, rt2x00dev->csr.base + offset, length);
+}
+
+static inline void rt2x00pci_register_write(struct rt2x00_dev *rt2x00dev,
+                                            const unsigned int offset,
+                                            u32 value)
+{
+        writel(value, rt2x00dev->csr.base + offset);
+}
+
+static inline void rt2x00pci_register_multiwrite(struct rt2x00_dev *rt2x00dev,
+                                                 const unsigned int offset,
+                                                 const void *value,
+                                                 const u32 length)
+{
+        __iowrite32_copy(rt2x00dev->csr.base + offset, value, length >> 2);
+}
+
+/**
+ * rt2x00pci_regbusy_read - Read from register with busy check
+ * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
+ * @offset: Register offset
+ * @field: Field to check if register is busy
+ * @reg: Pointer to where register contents should be stored
+ *
+ * This function will read the given register, and checks if the
+ * register is busy. If it is, it will sleep for a couple of
+ * microseconds before reading the register again. If the register
+ * is not read after a certain timeout, this function will return
+ * FALSE.
+ */
+int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
+                           const unsigned int offset,
+                           const struct rt2x00_field32 field,
+                           u32 *reg);
+
+/**
+ * struct queue_entry_priv_pci: Per entry PCI specific information
+ *
+ * @desc: Pointer to device descriptor
+ * @desc_dma: DMA pointer to &desc.
+ * @data: Pointer to device's entry memory.
+ * @data_dma: DMA pointer to &data.
+ */
+struct queue_entry_priv_pci {
+        __le32 *desc;
+        dma_addr_t desc_dma;
+};
+
+/**
+ * rt2x00pci_rxdone - Handle RX done events
+ * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
+ *
+ * Returns true if there are still rx frames pending and false if all
+ * pending rx frames were processed.
+ */
+bool rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev);
+
+/**
+ * rt2x00pci_flush_queue - Flush data queue
+ * @queue: Data queue to stop
+ * @drop: True to drop all pending frames.
+ *
+ * This will wait for a maximum of 100ms, waiting for the queues
+ * to become empty.
+ */
+void rt2x00pci_flush_queue(struct data_queue *queue, bool drop);
+
+/*
+ * Device initialization handlers.
+ */
+int rt2x00pci_initialize(struct rt2x00_dev *rt2x00dev);
+void rt2x00pci_uninitialize(struct rt2x00_dev *rt2x00dev);
+
+#endif /* RT2X00MMIO_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index a0c8caef3b0a..e87865e33113 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -33,182 +33,6 @@
 #include "rt2x00pci.h"
 
 /*
- * Register access.
- */
-int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
-                           const unsigned int offset,
-                           const struct rt2x00_field32 field,
-                           u32 *reg)
-{
-        unsigned int i;
-
-        if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
-                return 0;
-
-        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00pci_register_read(rt2x00dev, offset, reg);
-                if (!rt2x00_get_field32(*reg, field))
-                        return 1;
-                udelay(REGISTER_BUSY_DELAY);
-        }
-
-        ERROR(rt2x00dev, "Indirect register access failed: "
-              "offset=0x%.08x, value=0x%.08x\n", offset, *reg);
-        *reg = ~0;
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_regbusy_read);
-
-bool rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_queue *queue = rt2x00dev->rx;
-        struct queue_entry *entry;
-        struct queue_entry_priv_pci *entry_priv;
-        struct skb_frame_desc *skbdesc;
-        int max_rx = 16;
-
-        while (--max_rx) {
-                entry = rt2x00queue_get_entry(queue, Q_INDEX);
-                entry_priv = entry->priv_data;
-
-                if (rt2x00dev->ops->lib->get_entry_state(entry))
-                        break;
-
-                /*
-                 * Fill in desc fields of the skb descriptor
-                 */
-                skbdesc = get_skb_frame_desc(entry->skb);
-                skbdesc->desc = entry_priv->desc;
-                skbdesc->desc_len = entry->queue->desc_size;
-
-                /*
-                 * DMA is already done, notify rt2x00lib that
-                 * it finished successfully.
-                 */
-                rt2x00lib_dmastart(entry);
-                rt2x00lib_dmadone(entry);
-
-                /*
-                 * Send the frame to rt2x00lib for further processing.
-                 */
-                rt2x00lib_rxdone(entry, GFP_ATOMIC);
-        }
-
-        return !max_rx;
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_rxdone);
-
-void rt2x00pci_flush_queue(struct data_queue *queue, bool drop)
-{
-        unsigned int i;
-
-        for (i = 0; !rt2x00queue_empty(queue) && i < 10; i++)
-                msleep(10);
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_flush_queue);
-
-/*
- * Device initialization handlers.
- */
-static int rt2x00pci_alloc_queue_dma(struct rt2x00_dev *rt2x00dev,
-                                     struct data_queue *queue)
-{
-        struct queue_entry_priv_pci *entry_priv;
-        void *addr;
-        dma_addr_t dma;
-        unsigned int i;
-
-        /*
-         * Allocate DMA memory for descriptor and buffer.
-         */
-        addr = dma_alloc_coherent(rt2x00dev->dev,
-                                  queue->limit * queue->desc_size,
-                                  &dma, GFP_KERNEL);
-        if (!addr)
-                return -ENOMEM;
-
-        memset(addr, 0, queue->limit * queue->desc_size);
-
-        /*
-         * Initialize all queue entries to contain valid addresses.
-         */
-        for (i = 0; i < queue->limit; i++) {
-                entry_priv = queue->entries[i].priv_data;
-                entry_priv->desc = addr + i * queue->desc_size;
-                entry_priv->desc_dma = dma + i * queue->desc_size;
-        }
-
-        return 0;
-}
-
-static void rt2x00pci_free_queue_dma(struct rt2x00_dev *rt2x00dev,
-                                     struct data_queue *queue)
-{
-        struct queue_entry_priv_pci *entry_priv =
-            queue->entries[0].priv_data;
-
-        if (entry_priv->desc)
-                dma_free_coherent(rt2x00dev->dev,
-                                  queue->limit * queue->desc_size,
-                                  entry_priv->desc, entry_priv->desc_dma);
-        entry_priv->desc = NULL;
-}
-
-int rt2x00pci_initialize(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_queue *queue;
-        int status;
-
-        /*
-         * Allocate DMA
-         */
-        queue_for_each(rt2x00dev, queue) {
-                status = rt2x00pci_alloc_queue_dma(rt2x00dev, queue);
-                if (status)
-                        goto exit;
-        }
-
-        /*
-         * Register interrupt handler.
-         */
-        status = request_irq(rt2x00dev->irq,
-                             rt2x00dev->ops->lib->irq_handler,
-                             IRQF_SHARED, rt2x00dev->name, rt2x00dev);
-        if (status) {
-                ERROR(rt2x00dev, "IRQ %d allocation failed (error %d).\n",
-                      rt2x00dev->irq, status);
-                goto exit;
-        }
-
-        return 0;
-
-exit:
-        queue_for_each(rt2x00dev, queue)
-                rt2x00pci_free_queue_dma(rt2x00dev, queue);
-
-        return status;
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_initialize);
-
-void rt2x00pci_uninitialize(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_queue *queue;
-
-        /*
-         * Free irq line.
-         */
-        free_irq(rt2x00dev->irq, rt2x00dev);
-
-        /*
-         * Free DMA
-         */
-        queue_for_each(rt2x00dev, queue)
-                rt2x00pci_free_queue_dma(rt2x00dev, queue);
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_uninitialize);
-
-/*
  * PCI driver handlers.
  */
 static void rt2x00pci_free_reg(struct rt2x00_dev *rt2x00dev)
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.h b/drivers/net/wireless/rt2x00/rt2x00pci.h
index e2c99f2b9a14..60d90b20f8b9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.h
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.h
@@ -36,94 +36,6 @@
 #define PCI_DEVICE_DATA(__ops)  .driver_data = (kernel_ulong_t)(__ops)
 
 /*
- * Register access.
- */
-static inline void rt2x00pci_register_read(struct rt2x00_dev *rt2x00dev,
-                                           const unsigned int offset,
-                                           u32 *value)
-{
-        *value = readl(rt2x00dev->csr.base + offset);
-}
-
-static inline void rt2x00pci_register_multiread(struct rt2x00_dev *rt2x00dev,
-                                                const unsigned int offset,
-                                                void *value, const u32 length)
-{
-        memcpy_fromio(value, rt2x00dev->csr.base + offset, length);
-}
-
-static inline void rt2x00pci_register_write(struct rt2x00_dev *rt2x00dev,
-                                            const unsigned int offset,
-                                            u32 value)
-{
-        writel(value, rt2x00dev->csr.base + offset);
-}
-
-static inline void rt2x00pci_register_multiwrite(struct rt2x00_dev *rt2x00dev,
-                                                 const unsigned int offset,
-                                                 const void *value,
-                                                 const u32 length)
-{
-        __iowrite32_copy(rt2x00dev->csr.base + offset, value, length >> 2);
-}
-
-/**
- * rt2x00pci_regbusy_read - Read from register with busy check
- * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
- * @offset: Register offset
- * @field: Field to check if register is busy
- * @reg: Pointer to where register contents should be stored
- *
- * This function will read the given register, and checks if the
- * register is busy. If it is, it will sleep for a couple of
- * microseconds before reading the register again. If the register
- * is not read after a certain timeout, this function will return
- * FALSE.
- */
-int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
-                           const unsigned int offset,
-                           const struct rt2x00_field32 field,
-                           u32 *reg);
-
-/**
- * struct queue_entry_priv_pci: Per entry PCI specific information
- *
- * @desc: Pointer to device descriptor
- * @desc_dma: DMA pointer to &desc.
- * @data: Pointer to device's entry memory.
- * @data_dma: DMA pointer to &data.
- */
-struct queue_entry_priv_pci {
-        __le32 *desc;
-        dma_addr_t desc_dma;
-};
-
-/**
- * rt2x00pci_rxdone - Handle RX done events
- * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
- *
- * Returns true if there are still rx frames pending and false if all
- * pending rx frames were processed.
- */
-bool rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev);
-
-/**
- * rt2x00pci_flush_queue - Flush data queue
- * @queue: Data queue to stop
- * @drop: True to drop all pending frames.
- *
- * This will wait for a maximum of 100ms, waiting for the queues
- * to become empty.
- */
-void rt2x00pci_flush_queue(struct data_queue *queue, bool drop);
-
-/*
- * Device initialization handlers.
- */
-int rt2x00pci_initialize(struct rt2x00_dev *rt2x00dev);
-void rt2x00pci_uninitialize(struct rt2x00_dev *rt2x00dev);
-
-/*
  * PCI driver handlers.
  */
 int rt2x00pci_probe(struct pci_dev *pci_dev, const struct rt2x00_ops *ops);
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index f95792cfcf89..9e3c8ff53e3f 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -35,6 +35,7 @@
 #include <linux/eeprom_93cx6.h>
 
 #include "rt2x00.h"
+#include "rt2x00mmio.h"
 #include "rt2x00pci.h"
 #include "rt61pci.h"
 
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 156b52732f3d..5847d6d0881e 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -851,6 +851,7 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb,
         if (unlikely(!_urb)) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          "Can't allocate urb. Drop skb!\n");
+                kfree_skb(skb);
                 return;
         }
         _rtl_submit_tx_urb(hw, _urb);
diff --git a/drivers/nfc/microread/mei.c b/drivers/nfc/microread/mei.c
index eef38cfd812e..ca33ae193935 100644
--- a/drivers/nfc/microread/mei.c
+++ b/drivers/nfc/microread/mei.c
@@ -22,7 +22,7 @@
 #include <linux/slab.h>
 #include <linux/interrupt.h>
 #include <linux/gpio.h>
-#include <linux/mei_bus.h>
+#include <linux/mei_cl_bus.h>
 
 #include <linux/nfc.h>
 #include <net/nfc/hci.h>
@@ -32,9 +32,6 @@
 
 #define MICROREAD_DRIVER_NAME "microread"
 
-#define MICROREAD_UUID UUID_LE(0x0bb17a78, 0x2a8e, 0x4c50, 0x94, \
-                               0xd4, 0x50, 0x26, 0x67, 0x23, 0x77, 0x5c)
-
 struct mei_nfc_hdr {
         u8 cmd;
         u8 status;
@@ -48,7 +45,7 @@ struct mei_nfc_hdr {
 #define MEI_NFC_MAX_READ (MEI_NFC_HEADER_SIZE + MEI_NFC_MAX_HCI_PAYLOAD)
 
 struct microread_mei_phy {
-        struct mei_device *mei_device;
+        struct mei_cl_device *device;
         struct nfc_hci_dev *hdev;
 
         int powered;
@@ -105,14 +102,14 @@ static int microread_mei_write(void *phy_id, struct sk_buff *skb)
 
         MEI_DUMP_SKB_OUT("mei frame sent", skb);
 
-        r = mei_send(phy->device, skb->data, skb->len);
+        r = mei_cl_send(phy->device, skb->data, skb->len);
         if (r > 0)
                 r = 0;
 
         return r;
 }
 
-static void microread_event_cb(struct mei_device *device, u32 events,
+static void microread_event_cb(struct mei_cl_device *device, u32 events,
                                void *context)
 {
         struct microread_mei_phy *phy = context;
@@ -120,7 +117,7 @@ static void microread_event_cb(struct mei_device *device, u32 events,
         if (phy->hard_fault != 0)
                 return;
 
-        if (events & BIT(MEI_EVENT_RX)) {
+        if (events & BIT(MEI_CL_EVENT_RX)) {
                 struct sk_buff *skb;
                 int reply_size;
 
@@ -128,7 +125,7 @@ static void microread_event_cb(struct mei_device *device, u32 events,
                 if (!skb)
                         return;
 
-                reply_size = mei_recv(device, skb->data, MEI_NFC_MAX_READ);
+                reply_size = mei_cl_recv(device, skb->data, MEI_NFC_MAX_READ);
                 if (reply_size < MEI_NFC_HEADER_SIZE) {
                         kfree(skb);
                         return;
@@ -149,8 +146,8 @@ static struct nfc_phy_ops mei_phy_ops = {
         .disable = microread_mei_disable,
 };
 
-static int microread_mei_probe(struct mei_device *device,
-                               const struct mei_id *id)
+static int microread_mei_probe(struct mei_cl_device *device,
+                               const struct mei_cl_device_id *id)
 {
         struct microread_mei_phy *phy;
         int r;
@@ -164,9 +161,9 @@ static int microread_mei_probe(struct mei_device *device,
         }
 
         phy->device = device;
-        mei_set_clientdata(device, phy);
+        mei_cl_set_drvdata(device, phy);
 
-        r = mei_register_event_cb(device, microread_event_cb, phy);
+        r = mei_cl_register_event_cb(device, microread_event_cb, phy);
         if (r) {
                 pr_err(MICROREAD_DRIVER_NAME ": event cb registration failed\n");
                 goto err_out;
@@ -186,9 +183,9 @@ err_out:
         return r;
 }
 
-static int microread_mei_remove(struct mei_device *device)
+static int microread_mei_remove(struct mei_cl_device *device)
 {
-        struct microread_mei_phy *phy = mei_get_clientdata(device);
+        struct microread_mei_phy *phy = mei_cl_get_drvdata(device);
 
         pr_info("Removing microread\n");
 
@@ -202,16 +199,15 @@ static int microread_mei_remove(struct mei_device *device)
         return 0;
 }
 
-static struct mei_id microread_mei_tbl[] = {
-        { MICROREAD_DRIVER_NAME, MICROREAD_UUID },
+static struct mei_cl_device_id microread_mei_tbl[] = {
+        { MICROREAD_DRIVER_NAME },
 
         /* required last entry */
         { }
 };
-
 MODULE_DEVICE_TABLE(mei, microread_mei_tbl);
 
-static struct mei_driver microread_driver = {
+static struct mei_cl_driver microread_driver = {
         .id_table = microread_mei_tbl,
         .name = MICROREAD_DRIVER_NAME,
 
@@ -225,7 +221,7 @@ static int microread_mei_init(void)
 
         pr_debug(DRIVER_DESC ": %s\n", __func__);
 
-        r = mei_driver_register(&microread_driver);
+        r = mei_cl_driver_register(&microread_driver);
         if (r) {
                 pr_err(MICROREAD_DRIVER_NAME ": driver registration failed\n");
                 return r;
@@ -236,7 +232,7 @@ static int microread_mei_init(void)
 
 static void microread_mei_exit(void)
 {
-        mei_driver_unregister(&microread_driver);
+        mei_cl_driver_unregister(&microread_driver);
 }
 
 module_init(microread_mei_init);
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index dee5dddaa292..5147c210df52 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -53,14 +53,15 @@ static void pci_acpi_wake_dev(acpi_handle handle, u32 event, void *context)
                 return;
         }
 
-        if (!pci_dev->pm_cap || !pci_dev->pme_support
-             || pci_check_pme_status(pci_dev)) {
-                if (pci_dev->pme_poll)
-                        pci_dev->pme_poll = false;
+        /* Clear PME Status if set. */
+        if (pci_dev->pme_support)
+                pci_check_pme_status(pci_dev);
 
-                pci_wakeup_event(pci_dev);
-                pm_runtime_resume(&pci_dev->dev);
-        }
+        if (pci_dev->pme_poll)
+                pci_dev->pme_poll = false;
+
+        pci_wakeup_event(pci_dev);
+        pm_runtime_resume(&pci_dev->dev);
 
         if (pci_dev->subordinate)
                 pci_pme_wakeup_bus(pci_dev->subordinate);
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 1fa1e482a999..79277fb36c6b 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -390,9 +390,10 @@ static void pci_device_shutdown(struct device *dev)
 
         /*
          * Turn off Bus Master bit on the device to tell it to not
-         * continue to do DMA
+         * continue to do DMA. Don't touch devices in D3cold or unknown states.
          */
-        pci_clear_master(pci_dev);
+        if (pci_dev->current_state <= PCI_D3hot)
+                pci_clear_master(pci_dev);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index 08c243ab034e..ed4d09498337 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -185,14 +185,6 @@ static const struct dev_pm_ops pcie_portdrv_pm_ops = {
 #endif /* !PM */
 
 /*
- * PCIe port runtime suspend is broken for some chipsets, so use a
- * black list to disable runtime PM for these chipsets.
- */
-static const struct pci_device_id port_runtime_pm_black_list[] = {
-        { /* end: all zeroes */ }
-};
-
-/*
  * pcie_portdrv_probe - Probe PCI-Express port devices
  * @dev: PCI-Express port device being probed
  *
@@ -225,16 +217,11 @@ static int pcie_portdrv_probe(struct pci_dev *dev,
          * it by default.
          */
         dev->d3cold_allowed = false;
-        if (!pci_match_id(port_runtime_pm_black_list, dev))
-                pm_runtime_put_noidle(&dev->dev);
-
         return 0;
 }
 
 static void pcie_portdrv_remove(struct pci_dev *dev)
 {
-        if (!pci_match_id(port_runtime_pm_black_list, dev))
-                pm_runtime_get_noresume(&dev->dev);
         pcie_port_device_remove(dev);
         pci_disable_device(dev);
 }
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index b41ac7756a4b..c5d0a08a8747 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -100,27 +100,6 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
         return min((size_t)(image - rom), size);
 }
 
-static loff_t pci_find_rom(struct pci_dev *pdev, size_t *size)
-{
-        struct resource *res = &pdev->resource[PCI_ROM_RESOURCE];
-        loff_t start;
-
-        /* assign the ROM an address if it doesn't have one */
-        if (res->parent == NULL && pci_assign_resource(pdev, PCI_ROM_RESOURCE))
-                return 0;
-        start = pci_resource_start(pdev, PCI_ROM_RESOURCE);
-        *size = pci_resource_len(pdev, PCI_ROM_RESOURCE);
-
-        if (*size == 0)
-                return 0;
-
-        /* Enable ROM space decodes */
-        if (pci_enable_rom(pdev))
-                return 0;
-
-        return start;
-}
-
 /**
  * pci_map_rom - map a PCI ROM to kernel space
  * @pdev: pointer to pci device struct
@@ -135,7 +114,7 @@ static loff_t pci_find_rom(struct pci_dev *pdev, size_t *size)
 void __iomem *pci_map_rom(struct pci_dev *pdev, size_t *size)
 {
         struct resource *res = &pdev->resource[PCI_ROM_RESOURCE];
-        loff_t start = 0;
+        loff_t start;
         void __iomem *rom;
 
         /*
@@ -154,21 +133,21 @@ void __iomem *pci_map_rom(struct pci_dev *pdev, size_t *size)
                         return (void __iomem *)(unsigned long)
                                 pci_resource_start(pdev, PCI_ROM_RESOURCE);
                 } else {
-                        start = pci_find_rom(pdev, size);
-                }
-        }
+                        /* assign the ROM an address if it doesn't have one */
+                        if (res->parent == NULL &&
+                            pci_assign_resource(pdev,PCI_ROM_RESOURCE))
+                                return NULL;
+                        start = pci_resource_start(pdev, PCI_ROM_RESOURCE);
+                        *size = pci_resource_len(pdev, PCI_ROM_RESOURCE);
+                        if (*size == 0)
+                                return NULL;
 
-        /*
-         * Some devices may provide ROMs via a source other than the BAR
-         */
-        if (!start && pdev->rom && pdev->romlen) {
-                *size = pdev->romlen;
-                return phys_to_virt(pdev->rom);
+                        /* Enable ROM space decodes */
+                        if (pci_enable_rom(pdev))
+                                return NULL;
+                }
         }
 
-        if (!start)
-                return NULL;
-
         rom = ioremap(start, *size);
         if (!rom) {
                 /* restore enable if ioremap fails */
@@ -202,8 +181,7 @@ void pci_unmap_rom(struct pci_dev *pdev, void __iomem *rom)
         if (res->flags & (IORESOURCE_ROM_COPY | IORESOURCE_ROM_BIOS_COPY))
                 return;
 
-        if (!pdev->rom || !pdev->romlen)
-                iounmap(rom);
+        iounmap(rom);
 
         /* Disable again before continuing, leave enabled if pci=rom */
         if (!(res->flags & (IORESOURCE_ROM_ENABLE | IORESOURCE_ROM_SHADOW)))
@@ -227,7 +205,24 @@ void pci_cleanup_rom(struct pci_dev *pdev)
         }
 }
 
+/**
+ * pci_platform_rom - provides a pointer to any ROM image provided by the
+ * platform
+ * @pdev: pointer to pci device struct
+ * @size: pointer to receive size of pci window over ROM
+ */
+void __iomem *pci_platform_rom(struct pci_dev *pdev, size_t *size)
+{
+        if (pdev->rom && pdev->romlen) {
+                *size = pdev->romlen;
+                return phys_to_virt((phys_addr_t)pdev->rom);
+        }
+
+        return NULL;
+}
+
 EXPORT_SYMBOL(pci_map_rom);
 EXPORT_SYMBOL(pci_unmap_rom);
 EXPORT_SYMBOL_GPL(pci_enable_rom);
 EXPORT_SYMBOL_GPL(pci_disable_rom);
+EXPORT_SYMBOL(pci_platform_rom);
diff --git a/drivers/pinctrl/mvebu/pinctrl-mvebu.c b/drivers/pinctrl/mvebu/pinctrl-mvebu.c
index c689c04a4f52..2d2f0a43d36b 100644
--- a/drivers/pinctrl/mvebu/pinctrl-mvebu.c
+++ b/drivers/pinctrl/mvebu/pinctrl-mvebu.c
@@ -620,7 +620,7 @@ int mvebu_pinctrl_probe(struct platform_device *pdev)
 
                 /* special soc specific control */
                 if (ctrl->mpp_get || ctrl->mpp_set) {
-                        if (!ctrl->name || !ctrl->mpp_set || !ctrl->mpp_set) {
+                        if (!ctrl->name || !ctrl->mpp_get || !ctrl->mpp_set) {
                                 dev_err(&pdev->dev, "wrong soc control info\n");
                                 return -EINVAL;
                         }
diff --git a/drivers/pinctrl/pinconf.c b/drivers/pinctrl/pinconf.c
index ac8d382a79bb..d611ecfcbf70 100644
--- a/drivers/pinctrl/pinconf.c
+++ b/drivers/pinctrl/pinconf.c
@@ -622,7 +622,7 @@ static const struct file_operations pinconf_dbg_pinname_fops = {
 static int pinconf_dbg_state_print(struct seq_file *s, void *d)
 {
         if (strlen(dbg_state_name))
-                seq_printf(s, "%s\n", dbg_pinname);
+                seq_printf(s, "%s\n", dbg_state_name);
         else
                 seq_printf(s, "No pin state set\n");
         return 0;
diff --git a/drivers/pinctrl/pinconf.h b/drivers/pinctrl/pinconf.h
index e3ed8cb072a5..bfda73d64eed 100644
--- a/drivers/pinctrl/pinconf.h
+++ b/drivers/pinctrl/pinconf.h
@@ -90,7 +90,7 @@ static inline void pinconf_init_device_debugfs(struct dentry *devroot,
  * pin config.
  */
 
-#ifdef CONFIG_GENERIC_PINCONF
+#if defined(CONFIG_GENERIC_PINCONF) && defined(CONFIG_DEBUG_FS)
 
 void pinconf_generic_dump_pin(struct pinctrl_dev *pctldev,
                               struct seq_file *s, unsigned pin);
diff --git a/drivers/pinctrl/pinctrl-abx500.c b/drivers/pinctrl/pinctrl-abx500.c
index caecdd373061..c542a97c82f3 100644
--- a/drivers/pinctrl/pinctrl-abx500.c
+++ b/drivers/pinctrl/pinctrl-abx500.c
@@ -422,7 +422,7 @@ static u8 abx500_get_mode(struct pinctrl_dev *pctldev, struct gpio_chip *chip,
         }
 
         /* check if pin use AlternateFunction register */
-        if ((af.alt_bit1 == UNUSED) && (af.alt_bit1 == UNUSED))
+        if ((af.alt_bit1 == UNUSED) && (af.alt_bit2 == UNUSED))
                 return mode;
         /*
          * if pin GPIOSEL bit is set and pin supports alternate function,
diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c
index 1a00658b3ea0..bd83c8b01cd1 100644
--- a/drivers/pinctrl/pinmux.c
+++ b/drivers/pinctrl/pinmux.c
@@ -194,6 +194,11 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin,
         }
 
         if (!gpio_range) {
+                /*
+                 * A pin should not be freed more times than allocated.
+                 */
+                if (WARN_ON(!desc->mux_usecount))
+                        return NULL;
                 desc->mux_usecount--;
                 if (desc->mux_usecount)
                         return NULL;
diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
index cc1f7bf53fd0..c6d77e20622c 100644
--- a/drivers/remoteproc/Kconfig
+++ b/drivers/remoteproc/Kconfig
@@ -4,7 +4,7 @@ menu "Remoteproc drivers"
 config REMOTEPROC
         tristate
         depends on HAS_DMA
-        select FW_CONFIG
+        select FW_LOADER
         select VIRTIO
 
 config OMAP_REMOTEPROC
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 29387df4bfc9..8edb4aed5d36 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -217,7 +217,7 @@ int rproc_alloc_vring(struct rproc_vdev *rvdev, int i)
          * TODO: support predefined notifyids (via resource table)
          */
         ret = idr_alloc(&rproc->notifyids, rvring, 0, 0, GFP_KERNEL);
-        if (ret) {
+        if (ret < 0) {
                 dev_err(dev, "idr_alloc failed: %d\n", ret);
                 dma_free_coherent(dev->parent, size, va, dma);
                 return ret;
@@ -366,10 +366,12 @@ static int rproc_handle_vdev(struct rproc *rproc, struct fw_rsc_vdev *rsc,
         /* it is now safe to add the virtio device */
         ret = rproc_add_virtio_dev(rvdev, rsc->id);
         if (ret)
-                goto free_rvdev;
+                goto remove_rvdev;
 
         return 0;
 
+remove_rvdev:
+        list_del(&rvdev->node);
 free_rvdev:
         kfree(rvdev);
         return ret;
diff --git a/drivers/remoteproc/ste_modem_rproc.c b/drivers/remoteproc/ste_modem_rproc.c
index a7743c069339..fb95c4220052 100644
--- a/drivers/remoteproc/ste_modem_rproc.c
+++ b/drivers/remoteproc/ste_modem_rproc.c
@@ -240,6 +240,8 @@ static int sproc_drv_remove(struct platform_device *pdev)
 
         /* Unregister as remoteproc device */
         rproc_del(sproc->rproc);
+        dma_free_coherent(sproc->rproc->dev.parent, SPROC_FW_SIZE,
+                          sproc->fw_addr, sproc->fw_dma_addr);
         rproc_put(sproc->rproc);
 
         mdev->drv_data = NULL;
@@ -297,10 +299,13 @@ static int sproc_probe(struct platform_device *pdev)
         /* Register as a remoteproc device */
         err = rproc_add(rproc);
         if (err)
-                goto free_rproc;
+                goto free_mem;
 
         return 0;
 
+free_mem:
+        dma_free_coherent(rproc->dev.parent, SPROC_FW_SIZE,
+                          sproc->fw_addr, sproc->fw_dma_addr);
 free_rproc:
         /* Reset device data upon error */
         mdev->drv_data = NULL;
diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
index 0a9f27e094ea..434ebc3a99dc 100644
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -44,7 +44,6 @@ static DECLARE_COMPLETION(at91_rtc_updated);
 static unsigned int at91_alarm_year = AT91_RTC_EPOCH;
 static void __iomem *at91_rtc_regs;
 static int irq;
-static u32 at91_rtc_imr;
 
 /*
  * Decode time/date into rtc_time structure
@@ -109,11 +108,9 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm)
         cr = at91_rtc_read(AT91_RTC_CR);
         at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM);
 
-        at91_rtc_imr |= AT91_RTC_ACKUPD;
         at91_rtc_write(AT91_RTC_IER, AT91_RTC_ACKUPD);
         wait_for_completion(&at91_rtc_updated); /* wait for ACKUPD interrupt */
         at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD);
-        at91_rtc_imr &= ~AT91_RTC_ACKUPD;
 
         at91_rtc_write(AT91_RTC_TIMR,
                           bin2bcd(tm->tm_sec) << 0
@@ -145,7 +142,7 @@ static int at91_rtc_readalarm(struct device *dev, struct rtc_wkalrm *alrm)
         tm->tm_yday = rtc_year_days(tm->tm_mday, tm->tm_mon, tm->tm_year);
         tm->tm_year = at91_alarm_year - 1900;
 
-        alrm->enabled = (at91_rtc_imr & AT91_RTC_ALARM)
+        alrm->enabled = (at91_rtc_read(AT91_RTC_IMR) & AT91_RTC_ALARM)
                         ? 1 : 0;
 
         dev_dbg(dev, "%s(): %4d-%02d-%02d %02d:%02d:%02d\n", __func__,
@@ -171,7 +168,6 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
         tm.tm_sec = alrm->time.tm_sec;
 
         at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
-        at91_rtc_imr &= ~AT91_RTC_ALARM;
         at91_rtc_write(AT91_RTC_TIMALR,
                   bin2bcd(tm.tm_sec) << 0
                 | bin2bcd(tm.tm_min) << 8
@@ -184,7 +180,6 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
 
         if (alrm->enabled) {
                 at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
-                at91_rtc_imr |= AT91_RTC_ALARM;
                 at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
         }
 
@@ -201,12 +196,9 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
 
         if (enabled) {
                 at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
-                at91_rtc_imr |= AT91_RTC_ALARM;
                 at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
-        } else {
+        } else
                 at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
-                at91_rtc_imr &= ~AT91_RTC_ALARM;
-        }
 
         return 0;
 }
@@ -215,10 +207,12 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
  */
 static int at91_rtc_proc(struct device *dev, struct seq_file *seq)
 {
+        unsigned long imr = at91_rtc_read(AT91_RTC_IMR);
+
         seq_printf(seq, "update_IRQ\t: %s\n",
-                        (at91_rtc_imr & AT91_RTC_ACKUPD) ? "yes" : "no");
+                        (imr & AT91_RTC_ACKUPD) ? "yes" : "no");
         seq_printf(seq, "periodic_IRQ\t: %s\n",
-                        (at91_rtc_imr & AT91_RTC_SECEV) ? "yes" : "no");
+                        (imr & AT91_RTC_SECEV) ? "yes" : "no");
 
         return 0;
 }
@@ -233,7 +227,7 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
         unsigned int rtsr;
         unsigned long events = 0;
 
-        rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_imr;
+        rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_read(AT91_RTC_IMR);
         if (rtsr) {             /* this interrupt is shared!  Is it ours? */
                 if (rtsr & AT91_RTC_ALARM)
                         events |= (RTC_AF | RTC_IRQF);
@@ -297,7 +291,6 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
         at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
                                         AT91_RTC_SECEV | AT91_RTC_TIMEV |
                                         AT91_RTC_CALEV);
-        at91_rtc_imr = 0;
 
         ret = request_irq(irq, at91_rtc_interrupt,
                                 IRQF_SHARED,
@@ -336,7 +329,6 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
         at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
                                         AT91_RTC_SECEV | AT91_RTC_TIMEV |
                                         AT91_RTC_CALEV);
-        at91_rtc_imr = 0;
         free_irq(irq, pdev);
 
         rtc_device_unregister(rtc);
@@ -349,35 +341,31 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
 
 /* AT91RM9200 RTC Power management control */
 
-static u32 at91_rtc_bkpimr;
-
+static u32 at91_rtc_imr;
 
 static int at91_rtc_suspend(struct device *dev)
 {
         /* this IRQ is shared with DBGU and other hardware which isn't
          * necessarily doing PM like we are...
          */
-        at91_rtc_bkpimr = at91_rtc_imr & (AT91_RTC_ALARM|AT91_RTC_SECEV);
-        if (at91_rtc_bkpimr) {
-                if (device_may_wakeup(dev)) {
+        at91_rtc_imr = at91_rtc_read(AT91_RTC_IMR)
+                        & (AT91_RTC_ALARM|AT91_RTC_SECEV);
+        if (at91_rtc_imr) {
+                if (device_may_wakeup(dev))
                         enable_irq_wake(irq);
-                } else {
-                        at91_rtc_write(AT91_RTC_IDR, at91_rtc_bkpimr);
-                        at91_rtc_imr &= ~at91_rtc_bkpimr;
-                }
-}
+                else
+                        at91_rtc_write(AT91_RTC_IDR, at91_rtc_imr);
+        }
         return 0;
 }
 
 static int at91_rtc_resume(struct device *dev)
 {
-        if (at91_rtc_bkpimr) {
-                if (device_may_wakeup(dev)) {
+        if (at91_rtc_imr) {
+                if (device_may_wakeup(dev))
                         disable_irq_wake(irq);
-                } else {
-                        at91_rtc_imr |= at91_rtc_bkpimr;
-                        at91_rtc_write(AT91_RTC_IER, at91_rtc_bkpimr);
-                }
+                else
+                        at91_rtc_write(AT91_RTC_IER, at91_rtc_imr);
         }
         return 0;
 }
diff --git a/drivers/rtc/rtc-at91rm9200.h b/drivers/rtc/rtc-at91rm9200.h
index 5f940b6844cb..da1945e5f714 100644
--- a/drivers/rtc/rtc-at91rm9200.h
+++ b/drivers/rtc/rtc-at91rm9200.h
@@ -64,6 +64,7 @@
 #define AT91_RTC_SCCR           0x1c                    /* Status Clear Command Register */
 #define AT91_RTC_IER            0x20                    /* Interrupt Enable Register */
 #define AT91_RTC_IDR            0x24                    /* Interrupt Disable Register */
+#define AT91_RTC_IMR            0x28                    /* Interrupt Mask Register */
 
 #define AT91_RTC_VER            0x2c                    /* Valid Entry Register */
 #define         AT91_RTC_NVTIM          (1 <<  0)               /* Non valid Time */
diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c
index 5ac9c935c151..e9b9c8392832 100644
--- a/drivers/s390/block/scm_blk.c
+++ b/drivers/s390/block/scm_blk.c
@@ -307,7 +307,7 @@ static void scm_blk_handle_error(struct scm_request *scmrq)
         case EQC_WR_PROHIBIT:
                 spin_lock_irqsave(&bdev->lock, flags);
                 if (bdev->state != SCM_WR_PROHIBIT)
-                        pr_info("%lu: Write access to the SCM increment is suspended\n",
+                        pr_info("%lx: Write access to the SCM increment is suspended\n",
                                 (unsigned long) bdev->scmdev->address);
                 bdev->state = SCM_WR_PROHIBIT;
                 spin_unlock_irqrestore(&bdev->lock, flags);
@@ -445,7 +445,7 @@ void scm_blk_set_available(struct scm_blk_dev *bdev)
 
         spin_lock_irqsave(&bdev->lock, flags);
         if (bdev->state == SCM_WR_PROHIBIT)
-                pr_info("%lu: Write access to the SCM increment is restored\n",
+                pr_info("%lx: Write access to the SCM increment is restored\n",
                         (unsigned long) bdev->scmdev->address);
         bdev->state = SCM_OPER;
         spin_unlock_irqrestore(&bdev->lock, flags);
@@ -463,12 +463,15 @@ static int __init scm_blk_init(void)
                 goto out;
 
         scm_major = ret;
-        if (scm_alloc_rqs(nr_requests))
+        ret = scm_alloc_rqs(nr_requests);
+        if (ret)
                 goto out_unreg;
 
         scm_debug = debug_register("scm_log", 16, 1, 16);
-        if (!scm_debug)
+        if (!scm_debug) {
+                ret = -ENOMEM;
                 goto out_free;
+        }
 
         debug_register_view(scm_debug, &debug_hex_ascii_view);
         debug_set_level(scm_debug, 2);
diff --git a/drivers/s390/block/scm_drv.c b/drivers/s390/block/scm_drv.c
index 5f6180d6ff08..c98cf52d78d1 100644
--- a/drivers/s390/block/scm_drv.c
+++ b/drivers/s390/block/scm_drv.c
@@ -19,7 +19,7 @@ static void scm_notify(struct scm_device *scmdev, enum scm_event event)
 
         switch (event) {
         case SCM_CHANGE:
-                pr_info("%lu: The capabilities of the SCM increment changed\n",
+                pr_info("%lx: The capabilities of the SCM increment changed\n",
                         (unsigned long) scmdev->address);
                 SCM_LOG(2, "State changed");
                 SCM_LOG_STATE(2, scmdev);
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index b907dba24025..cee69dac3e18 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -915,7 +915,7 @@ static int tty3270_install(struct tty_driver *driver, struct tty_struct *tty)
         int i, rc;
 
         /* Check if the tty3270 is already there. */
-        view = raw3270_find_view(&tty3270_fn, tty->index);
+        view = raw3270_find_view(&tty3270_fn, tty->index + RAW3270_FIRSTMINOR);
         if (!IS_ERR(view)) {
                 tp = container_of(view, struct tty3270, view);
                 tty->driver_data = tp;
@@ -927,15 +927,16 @@ static int tty3270_install(struct tty_driver *driver, struct tty_struct *tty)
                 tp->inattr = TF_INPUT;
                 return tty_port_install(&tp->port, driver, tty);
         }
-        if (tty3270_max_index < tty->index)
-                tty3270_max_index = tty->index;
+        if (tty3270_max_index < tty->index + 1)
+                tty3270_max_index = tty->index + 1;
 
         /* Allocate tty3270 structure on first open. */
         tp = tty3270_alloc_view();
         if (IS_ERR(tp))
                 return PTR_ERR(tp);
 
-        rc = raw3270_add_view(&tp->view, &tty3270_fn, tty->index);
+        rc = raw3270_add_view(&tp->view, &tty3270_fn,
+                              tty->index + RAW3270_FIRSTMINOR);
         if (rc) {
                 tty3270_free_view(tp);
                 return rc;
@@ -1846,12 +1847,12 @@ static const struct tty_operations tty3270_ops = {
 
 void tty3270_create_cb(int minor)
 {
-        tty_register_device(tty3270_driver, minor, NULL);
+        tty_register_device(tty3270_driver, minor - RAW3270_FIRSTMINOR, NULL);
 }
 
 void tty3270_destroy_cb(int minor)
 {
-        tty_unregister_device(tty3270_driver, minor);
+        tty_unregister_device(tty3270_driver, minor - RAW3270_FIRSTMINOR);
 }
 
 struct raw3270_notifier tty3270_notifier =
@@ -1884,7 +1885,8 @@ static int __init tty3270_init(void)
         driver->driver_name = "tty3270";
         driver->name = "3270/tty";
         driver->major = IBM_TTY3270_MAJOR;
-        driver->minor_start = 0;
+        driver->minor_start = RAW3270_FIRSTMINOR;
+        driver->name_base = RAW3270_FIRSTMINOR;
         driver->type = TTY_DRIVER_TYPE_SYSTEM;
         driver->subtype = SYSTEM_TYPE_TTY;
         driver->init_termios = tty_std_termios;
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 8c0622399fcd..6ccb7457746b 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -769,6 +769,7 @@ struct qeth_card {
         unsigned long thread_start_mask;
         unsigned long thread_allowed_mask;
         unsigned long thread_running_mask;
+        struct task_struct *recovery_task;
         spinlock_t ip_lock;
         struct list_head ip_list;
         struct list_head *ip_tbd_list;
@@ -862,6 +863,8 @@ extern struct qeth_card_list_struct qeth_core_card_list;
 extern struct kmem_cache *qeth_core_header_cache;
 extern struct qeth_dbf_info qeth_dbf[QETH_DBF_INFOS];
 
+void qeth_set_recovery_task(struct qeth_card *);
+void qeth_clear_recovery_task(struct qeth_card *);
 void qeth_set_allowed_threads(struct qeth_card *, unsigned long , int);
 int qeth_threads_running(struct qeth_card *, unsigned long);
 int qeth_wait_for_threads(struct qeth_card *, unsigned long);
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 0d73a999983d..451f92020599 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -177,6 +177,23 @@ const char *qeth_get_cardname_short(struct qeth_card *card)
         return "n/a";
 }
 
+void qeth_set_recovery_task(struct qeth_card *card)
+{
+        card->recovery_task = current;
+}
+EXPORT_SYMBOL_GPL(qeth_set_recovery_task);
+
+void qeth_clear_recovery_task(struct qeth_card *card)
+{
+        card->recovery_task = NULL;
+}
+EXPORT_SYMBOL_GPL(qeth_clear_recovery_task);
+
+static bool qeth_is_recovery_task(const struct qeth_card *card)
+{
+        return card->recovery_task == current;
+}
+
 void qeth_set_allowed_threads(struct qeth_card *card, unsigned long threads,
                          int clear_start_mask)
 {
@@ -205,6 +222,8 @@ EXPORT_SYMBOL_GPL(qeth_threads_running);
 
 int qeth_wait_for_threads(struct qeth_card *card, unsigned long threads)
 {
+        if (qeth_is_recovery_task(card))
+                return 0;
         return wait_event_interruptible(card->wait_q,
                         qeth_threads_running(card, threads) == 0);
 }
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index d690166efeaf..155b101bd730 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1143,6 +1143,7 @@ static int qeth_l2_recover(void *ptr)
         QETH_CARD_TEXT(card, 2, "recover2");
         dev_warn(&card->gdev->dev,
                 "A recovery process has been started for the device\n");
+        qeth_set_recovery_task(card);
         __qeth_l2_set_offline(card->gdev, 1);
         rc = __qeth_l2_set_online(card->gdev, 1);
         if (!rc)
@@ -1153,6 +1154,7 @@ static int qeth_l2_recover(void *ptr)
                 dev_warn(&card->gdev->dev, "The qeth device driver "
                                 "failed to recover an error on the device\n");
         }
+        qeth_clear_recovery_task(card);
         qeth_clear_thread_start_bit(card, QETH_RECOVER_THREAD);
         qeth_clear_thread_running_bit(card, QETH_RECOVER_THREAD);
         return 0;
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 8710337dab3e..1f7edf1b26c3 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3515,6 +3515,7 @@ static int qeth_l3_recover(void *ptr)
         QETH_CARD_TEXT(card, 2, "recover2");
         dev_warn(&card->gdev->dev,
                 "A recovery process has been started for the device\n");
+        qeth_set_recovery_task(card);
         __qeth_l3_set_offline(card->gdev, 1);
         rc = __qeth_l3_set_online(card->gdev, 1);
         if (!rc)
@@ -3525,6 +3526,7 @@ static int qeth_l3_recover(void *ptr)
                 dev_warn(&card->gdev->dev, "The qeth device driver "
                                 "failed to recover an error on the device\n");
         }
+        qeth_clear_recovery_task(card);
         qeth_clear_thread_start_bit(card, QETH_RECOVER_THREAD);
         qeth_clear_thread_running_bit(card, QETH_RECOVER_THREAD);
         return 0;
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index 2daf4b0da434..90bc7bd00966 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -940,6 +940,7 @@ static int bnx2fc_libfc_config(struct fc_lport *lport)
         fc_exch_init(lport);
         fc_rport_init(lport);
         fc_disc_init(lport);
+        fc_disc_config(lport, lport);
         return 0;
 }
 
@@ -2133,6 +2134,7 @@ static int _bnx2fc_create(struct net_device *netdev,
         }
 
         ctlr = bnx2fc_to_ctlr(interface);
+        cdev = fcoe_ctlr_to_ctlr_dev(ctlr);
         interface->vlan_id = vlan_id;
 
         interface->timer_work_queue =
@@ -2143,7 +2145,7 @@ static int _bnx2fc_create(struct net_device *netdev,
                 goto ifput_err;
         }
 
-        lport = bnx2fc_if_create(interface, &interface->hba->pcidev->dev, 0);
+        lport = bnx2fc_if_create(interface, &cdev->dev, 0);
         if (!lport) {
                 printk(KERN_ERR PFX "Failed to create interface (%s)\n",
                         netdev->name);
@@ -2159,8 +2161,6 @@ static int _bnx2fc_create(struct net_device *netdev,
         /* Make this master N_port */
         ctlr->lp = lport;
 
-        cdev = fcoe_ctlr_to_ctlr_dev(ctlr);
-
         if (link_state == BNX2FC_CREATE_LINK_UP)
                 cdev->enabled = FCOE_CTLR_ENABLED;
         else
diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
index b5d92fc93c70..9bfdc9a3f897 100644
--- a/drivers/scsi/fcoe/fcoe.c
+++ b/drivers/scsi/fcoe/fcoe.c
@@ -490,7 +490,6 @@ static void fcoe_interface_cleanup(struct fcoe_interface *fcoe)
 {
         struct net_device *netdev = fcoe->netdev;
         struct fcoe_ctlr *fip = fcoe_to_ctlr(fcoe);
-        struct fcoe_ctlr_device *ctlr_dev = fcoe_ctlr_to_ctlr_dev(fip);
 
         rtnl_lock();
         if (!fcoe->removed)
@@ -501,7 +500,6 @@ static void fcoe_interface_cleanup(struct fcoe_interface *fcoe)
         /* tear-down the FCoE controller */
         fcoe_ctlr_destroy(fip);
         scsi_host_put(fip->lp->host);
-        fcoe_ctlr_device_delete(ctlr_dev);
         dev_put(netdev);
         module_put(THIS_MODULE);
 }
@@ -2194,6 +2192,8 @@ out_nodev:
  */
 static void fcoe_destroy_work(struct work_struct *work)
 {
+        struct fcoe_ctlr_device *cdev;
+        struct fcoe_ctlr *ctlr;
         struct fcoe_port *port;
         struct fcoe_interface *fcoe;
         struct Scsi_Host *shost;
@@ -2224,10 +2224,15 @@ static void fcoe_destroy_work(struct work_struct *work)
         mutex_lock(&fcoe_config_mutex);
 
         fcoe = port->priv;
+        ctlr = fcoe_to_ctlr(fcoe);
+        cdev = fcoe_ctlr_to_ctlr_dev(ctlr);
+
         fcoe_if_destroy(port->lport);
         fcoe_interface_cleanup(fcoe);
 
         mutex_unlock(&fcoe_config_mutex);
+
+        fcoe_ctlr_device_delete(cdev);
 }
 
 /**
@@ -2335,7 +2340,9 @@ static int _fcoe_create(struct net_device *netdev, enum fip_state fip_mode,
                 rc = -EIO;
                 rtnl_unlock();
                 fcoe_interface_cleanup(fcoe);
-                goto out_nortnl;
+                mutex_unlock(&fcoe_config_mutex);
+                fcoe_ctlr_device_delete(ctlr_dev);
+                goto out;
         }
 
         /* Make this the "master" N_Port */
@@ -2375,8 +2382,8 @@ static int _fcoe_create(struct net_device *netdev, enum fip_state fip_mode,
 
 out_nodev:
         rtnl_unlock();
-out_nortnl:
         mutex_unlock(&fcoe_config_mutex);
+out:
         return rc;
 }
 
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index 08c3bc398da2..a76247201be5 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -2815,6 +2815,47 @@ unlock:
 }
 
 /**
+ * fcoe_ctlr_mode_set() - Set or reset the ctlr's mode
+ * @lport: The local port to be (re)configured
+ * @fip:   The FCoE controller whose mode is changing
+ * @fip_mode: The new fip mode
+ *
+ * Note that the we shouldn't be changing the libfc discovery settings
+ * (fc_disc_config) while an lport is going through the libfc state
+ * machine. The mode can only be changed when a fcoe_ctlr device is
+ * disabled, so that should ensure that this routine is only called
+ * when nothing is happening.
+ */
+void fcoe_ctlr_mode_set(struct fc_lport *lport, struct fcoe_ctlr *fip,
+                        enum fip_state fip_mode)
+{
+        void *priv;
+
+        WARN_ON(lport->state != LPORT_ST_RESET &&
+                lport->state != LPORT_ST_DISABLED);
+
+        if (fip_mode == FIP_MODE_VN2VN) {
+                lport->rport_priv_size = sizeof(struct fcoe_rport);
+                lport->point_to_multipoint = 1;
+                lport->tt.disc_recv_req = fcoe_ctlr_disc_recv;
+                lport->tt.disc_start = fcoe_ctlr_disc_start;
+                lport->tt.disc_stop = fcoe_ctlr_disc_stop;
+                lport->tt.disc_stop_final = fcoe_ctlr_disc_stop_final;
+                priv = fip;
+        } else {
+                lport->rport_priv_size = 0;
+                lport->point_to_multipoint = 0;
+                lport->tt.disc_recv_req = NULL;
+                lport->tt.disc_start = NULL;
+                lport->tt.disc_stop = NULL;
+                lport->tt.disc_stop_final = NULL;
+                priv = lport;
+        }
+
+        fc_disc_config(lport, priv);
+}
+
+/**
  * fcoe_libfc_config() - Sets up libfc related properties for local port
  * @lport:    The local port to configure libfc for
  * @fip:      The FCoE controller in use by the local port
@@ -2833,21 +2874,9 @@ int fcoe_libfc_config(struct fc_lport *lport, struct fcoe_ctlr *fip,
         fc_exch_init(lport);
         fc_elsct_init(lport);
         fc_lport_init(lport);
-        if (fip->mode == FIP_MODE_VN2VN)
-                lport->rport_priv_size = sizeof(struct fcoe_rport);
         fc_rport_init(lport);
-        if (fip->mode == FIP_MODE_VN2VN) {
-                lport->point_to_multipoint = 1;
-                lport->tt.disc_recv_req = fcoe_ctlr_disc_recv;
-                lport->tt.disc_start = fcoe_ctlr_disc_start;
-                lport->tt.disc_stop = fcoe_ctlr_disc_stop;
-                lport->tt.disc_stop_final = fcoe_ctlr_disc_stop_final;
-                mutex_init(&lport->disc.disc_mutex);
-                INIT_LIST_HEAD(&lport->disc.rports);
-                lport->disc.priv = fip;
-        } else {
-                fc_disc_init(lport);
-        }
+        fc_disc_init(lport);
+        fcoe_ctlr_mode_set(lport, fip, fip->mode);
         return 0;
 }
 EXPORT_SYMBOL_GPL(fcoe_libfc_config);
@@ -2875,6 +2904,7 @@ EXPORT_SYMBOL(fcoe_fcf_get_selected);
 void fcoe_ctlr_set_fip_mode(struct fcoe_ctlr_device *ctlr_dev)
 {
         struct fcoe_ctlr *ctlr = fcoe_ctlr_device_priv(ctlr_dev);
+        struct fc_lport *lport = ctlr->lp;
 
         mutex_lock(&ctlr->ctlr_mutex);
         switch (ctlr_dev->mode) {
@@ -2888,5 +2918,7 @@ void fcoe_ctlr_set_fip_mode(struct fcoe_ctlr_device *ctlr_dev)
         }
 
         mutex_unlock(&ctlr->ctlr_mutex);
+
+        fcoe_ctlr_mode_set(lport, ctlr, ctlr->mode);
 }
 EXPORT_SYMBOL(fcoe_ctlr_set_fip_mode);
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index a044f593e8b9..d0fa4b6c551f 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -1899,8 +1899,8 @@ static int ibmvscsi_slave_configure(struct scsi_device *sdev)
                 sdev->allow_restart = 1;
                 blk_queue_rq_timeout(sdev->request_queue, 120 * HZ);
         }
-        scsi_adjust_queue_depth(sdev, 0, shost->cmd_per_lun);
         spin_unlock_irqrestore(shost->host_lock, lock_flags);
+        scsi_adjust_queue_depth(sdev, 0, shost->cmd_per_lun);
         return 0;
 }
 
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index f328089a1060..2197b57fb225 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -5148,7 +5148,7 @@ static int ipr_cancel_op(struct scsi_cmnd *scsi_cmd)
                 ipr_trace;
         }
 
-        list_add_tail(&ipr_cmd->queue, &hrrq->hrrq_free_q);
+        list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
         if (!ipr_is_naca_model(res))
                 res->needs_sync_complete = 1;
 
@@ -9349,7 +9349,10 @@ static int ipr_test_msi(struct ipr_ioa_cfg *ioa_cfg, struct pci_dev *pdev)
         int_reg = readl(ioa_cfg->regs.sense_interrupt_mask_reg);
         spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
 
-        rc = request_irq(pdev->irq, ipr_test_intr, 0, IPR_NAME, ioa_cfg);
+        if (ioa_cfg->intr_flag == IPR_USE_MSIX)
+                rc = request_irq(ioa_cfg->vectors_info[0].vec, ipr_test_intr, 0, IPR_NAME, ioa_cfg);
+        else
+                rc = request_irq(pdev->irq, ipr_test_intr, 0, IPR_NAME, ioa_cfg);
         if (rc) {
                 dev_err(&pdev->dev, "Can not assign irq %d\n", pdev->irq);
                 return rc;
@@ -9371,7 +9374,10 @@ static int ipr_test_msi(struct ipr_ioa_cfg *ioa_cfg, struct pci_dev *pdev)
 
         spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
 
-        free_irq(pdev->irq, ioa_cfg);
+        if (ioa_cfg->intr_flag == IPR_USE_MSIX)
+                free_irq(ioa_cfg->vectors_info[0].vec, ioa_cfg);
+        else
+                free_irq(pdev->irq, ioa_cfg);
 
         LEAVE;
 
@@ -9722,6 +9728,7 @@ static void __ipr_remove(struct pci_dev *pdev)
         spin_unlock_irqrestore(ioa_cfg->host->host_lock, host_lock_flags);
         wait_event(ioa_cfg->reset_wait_q, !ioa_cfg->in_reset_reload);
         flush_work(&ioa_cfg->work_q);
+        INIT_LIST_HEAD(&ioa_cfg->used_res_q);
         spin_lock_irqsave(ioa_cfg->host->host_lock, host_lock_flags);
 
         spin_lock(&ipr_driver_lock);
diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c
index 8e561e6a557c..880a9068ca12 100644
--- a/drivers/scsi/libfc/fc_disc.c
+++ b/drivers/scsi/libfc/fc_disc.c
@@ -712,12 +712,13 @@ static void fc_disc_stop_final(struct fc_lport *lport)
 }
 
 /**
- * fc_disc_init() - Initialize the discovery layer for a local port
- * @lport: The local port that needs the discovery layer to be initialized
+ * fc_disc_config() - Configure the discovery layer for a local port
+ * @lport: The local port that needs the discovery layer to be configured
+ * @priv: Private data structre for users of the discovery layer
  */
-int fc_disc_init(struct fc_lport *lport)
+void fc_disc_config(struct fc_lport *lport, void *priv)
 {
-        struct fc_disc *disc;
+        struct fc_disc *disc = &lport->disc;
 
         if (!lport->tt.disc_start)
                 lport->tt.disc_start = fc_disc_start;
@@ -732,12 +733,21 @@ int fc_disc_init(struct fc_lport *lport)
                 lport->tt.disc_recv_req = fc_disc_recv_req;
 
         disc = &lport->disc;
+
+        disc->priv = priv;
+}
+EXPORT_SYMBOL(fc_disc_config);
+
+/**
+ * fc_disc_init() - Initialize the discovery layer for a local port
+ * @lport: The local port that needs the discovery layer to be initialized
+ */
+void fc_disc_init(struct fc_lport *lport)
+{
+        struct fc_disc *disc = &lport->disc;
+
         INIT_DELAYED_WORK(&disc->disc_work, fc_disc_timeout);
         mutex_init(&disc->disc_mutex);
         INIT_LIST_HEAD(&disc->rports);
-
-        disc->priv = lport;
-
-        return 0;
 }
 EXPORT_SYMBOL(fc_disc_init);
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index aec2e0da5016..55cbd0180159 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -235,6 +235,17 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
         linkrate  = phy->linkrate;
         memcpy(sas_addr, phy->attached_sas_addr, SAS_ADDR_SIZE);
 
+        /* Handle vacant phy - rest of dr data is not valid so skip it */
+        if (phy->phy_state == PHY_VACANT) {
+                memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
+                phy->attached_dev_type = NO_DEVICE;
+                if (!test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state)) {
+                        phy->phy_id = phy_id;
+                        goto skip;
+                } else
+                        goto out;
+        }
+
         phy->attached_dev_type = to_dev_type(dr);
         if (test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state))
                 goto out;
@@ -272,6 +283,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
         phy->phy->maximum_linkrate = dr->pmax_linkrate;
         phy->phy->negotiated_linkrate = phy->linkrate;
 
+ skip:
         if (new_phy)
                 if (sas_phy_add(phy->phy)) {
                         sas_phy_free(phy->phy);
@@ -388,7 +400,7 @@ int sas_ex_phy_discover(struct domain_device *dev, int single)
         if (!disc_req)
                 return -ENOMEM;
 
-        disc_resp = alloc_smp_req(DISCOVER_RESP_SIZE);
+        disc_resp = alloc_smp_resp(DISCOVER_RESP_SIZE);
         if (!disc_resp) {
                 kfree(disc_req);
                 return -ENOMEM;
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 74b67d98e952..d43faf34c1e2 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -438,11 +438,12 @@ lpfc_sli4_rq_put(struct lpfc_queue *hq, struct lpfc_queue *dq,
         struct lpfc_rqe *temp_hrqe;
         struct lpfc_rqe *temp_drqe;
         struct lpfc_register doorbell;
-        int put_index = hq->host_index;
+        int put_index;
 
         /* sanity check on queue memory */
         if (unlikely(!hq) || unlikely(!dq))
                 return -ENOMEM;
+        put_index = hq->host_index;
         temp_hrqe = hq->qe[hq->host_index].rqe;
         temp_drqe = dq->qe[dq->host_index].rqe;
 
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 1d82eef4e1eb..b3db9dcc2619 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -1938,11 +1938,6 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
                     "Timer for the VP[%d] has stopped\n", vha->vp_idx);
         }
 
-        /* No pending activities shall be there on the vha now */
-        if (ql2xextended_error_logging & ql_dbg_user)
-                msleep(random32()%10);  /* Just to see if something falls on
-                                        * the net we have placed below */
-
         BUG_ON(atomic_read(&vha->vref_count));
 
         qla2x00_free_fcports(vha);
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 1626de52e32a..fbc305f1c87c 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -15,6 +15,7 @@
  * | Mailbox commands             |       0x115b       | 0x111a-0x111b  |
  * |                              |                    | 0x112c-0x112e  |
  * |                              |                    | 0x113a         |
+ * |                              |                    | 0x1155-0x1158  |
  * | Device Discovery             |       0x2087       | 0x2020-0x2022, |
  * |                              |                    | 0x2016         |
  * | Queue Command and IO tracing |       0x3031       | 0x3006-0x300b  |
@@ -401,7 +402,7 @@ qla2xxx_copy_atioqueues(struct qla_hw_data *ha, void *ptr,
                 void *ring;
         } aq, *aqp;
 
-        if (!ha->tgt.atio_q_length)
+        if (!ha->tgt.atio_ring)
                 return ptr;
 
         num_queues = 1;
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index c6509911772b..65c5ff75936b 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -863,7 +863,6 @@ typedef struct {
 #define MBX_1           BIT_1
 #define MBX_0           BIT_0
 
-#define RNID_TYPE_SET_VERSION   0x9
 #define RNID_TYPE_ASIC_TEMP     0xC
 
 /*
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index eb3ca21a7f17..b310fa97b545 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -358,9 +358,6 @@ extern int
 qla2x00_disable_fce_trace(scsi_qla_host_t *, uint64_t *, uint64_t *);
 
 extern int
-qla2x00_set_driver_version(scsi_qla_host_t *, char *);
-
-extern int
 qla2x00_read_sfp(scsi_qla_host_t *, dma_addr_t, uint8_t *,
         uint16_t, uint16_t, uint16_t, uint16_t);
 
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index edf4d14a1335..b59203393cb2 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -619,8 +619,6 @@ qla2x00_initialize_adapter(scsi_qla_host_t *vha)
         if (IS_QLA24XX_TYPE(ha) || IS_QLA25XX(ha))
                 qla24xx_read_fcp_prio_cfg(vha);
 
-        qla2x00_set_driver_version(vha, QLA2XXX_VERSION);
-
         return (rval);
 }
 
@@ -1399,7 +1397,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha)
                         mq_size += ha->max_rsp_queues *
                             (rsp->length * sizeof(response_t));
                 }
-                if (ha->tgt.atio_q_length)
+                if (ha->tgt.atio_ring)
                         mq_size += ha->tgt.atio_q_length * sizeof(request_t);
                 /* Allocate memory for Fibre Channel Event Buffer. */
                 if (!IS_QLA25XX(ha) && !IS_QLA81XX(ha) && !IS_QLA83XX(ha))
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 186dd59ce4fa..43345af56431 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -3866,64 +3866,6 @@ qla81xx_restart_mpi_firmware(scsi_qla_host_t *vha)
         return rval;
 }
 
-int
-qla2x00_set_driver_version(scsi_qla_host_t *vha, char *version)
-{
-        int rval;
-        mbx_cmd_t mc;
-        mbx_cmd_t *mcp = &mc;
-        int len;
-        uint16_t dwlen;
-        uint8_t *str;
-        dma_addr_t str_dma;
-        struct qla_hw_data *ha = vha->hw;
-
-        if (!IS_FWI2_CAPABLE(ha) || IS_QLA82XX(ha))
-                return QLA_FUNCTION_FAILED;
-
-        ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x1155,
-            "Entered %s.\n", __func__);
-
-        str = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &str_dma);
-        if (!str) {
-                ql_log(ql_log_warn, vha, 0x1156,
-                    "Failed to allocate driver version param.\n");
-                return QLA_MEMORY_ALLOC_FAILED;
-        }
-
-        memcpy(str, "\x7\x3\x11\x0", 4);
-        dwlen = str[0];
-        len = dwlen * sizeof(uint32_t) - 4;
-        memset(str + 4, 0, len);
-        if (len > strlen(version))
-                len = strlen(version);
-        memcpy(str + 4, version, len);
-
-        mcp->mb[0] = MBC_SET_RNID_PARAMS;
-        mcp->mb[1] = RNID_TYPE_SET_VERSION << 8 | dwlen;
-        mcp->mb[2] = MSW(LSD(str_dma));
-        mcp->mb[3] = LSW(LSD(str_dma));
-        mcp->mb[6] = MSW(MSD(str_dma));
-        mcp->mb[7] = LSW(MSD(str_dma));
-        mcp->out_mb = MBX_7|MBX_6|MBX_3|MBX_2|MBX_1|MBX_0;
-        mcp->in_mb = MBX_0;
-        mcp->tov = MBX_TOV_SECONDS;
-        mcp->flags = 0;
-        rval = qla2x00_mailbox_command(vha, mcp);
-
-        if (rval != QLA_SUCCESS) {
-                ql_dbg(ql_dbg_mbx, vha, 0x1157,
-                    "Failed=%x mb[0]=%x.\n", rval, mcp->mb[0]);
-        } else {
-                ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x1158,
-                    "Done %s.\n", __func__);
-        }
-
-        dma_pool_free(ha->s_dma_pool, str, str_dma);
-
-        return rval;
-}
-
 static int
 qla2x00_read_asic_temperature(scsi_qla_host_t *vha, uint16_t *temp)
 {
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 2b6e478d9e33..ec54036d1e12 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "8.04.00.08-k"
+#define QLA2XXX_VERSION      "8.04.00.13-k"
 
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    4
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 86974471af68..2a32036a9404 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4112,6 +4112,10 @@ static int st_probe(struct device *dev)
         tpnt->disk = disk;
         disk->private_data = &tpnt->driver;
         disk->queue = SDp->request_queue;
+        /* SCSI tape doesn't register this gendisk via add_disk().  Manually
+         * take queue reference that release_disk() expects. */
+        if (!blk_get_queue(disk->queue))
+                goto out_put_disk;
         tpnt->driver = &st_template;
 
         tpnt->device = SDp;
@@ -4185,7 +4189,7 @@ static int st_probe(struct device *dev)
         idr_preload_end();
         if (error < 0) {
                 pr_warn("st: idr allocation failed: %d\n", error);
-                goto out_put_disk;
+                goto out_put_queue;
         }
         tpnt->index = error;
         sprintf(disk->disk_name, "st%d", tpnt->index);
@@ -4211,6 +4215,8 @@ out_remove_devs:
         spin_lock(&st_index_lock);
         idr_remove(&st_index_idr, tpnt->index);
         spin_unlock(&st_index_lock);
+out_put_queue:
+        blk_put_queue(disk->queue);
 out_put_disk:
         put_disk(disk);
         kfree(tpnt);
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index f80eee74a311..2be0de920d67 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -55,6 +55,7 @@ comment "SPI Master Controller Drivers"
 
 config SPI_ALTERA
         tristate "Altera SPI Controller"
+        depends on GENERIC_HARDIRQS
         select SPI_BITBANG
         help
           This is the driver for the Altera SPI Controller.
@@ -310,7 +311,7 @@ config SPI_PXA2XX_DMA
 
 config SPI_PXA2XX
         tristate "PXA2xx SSP SPI master"
-        depends on ARCH_PXA || PCI || ACPI
+        depends on (ARCH_PXA || PCI || ACPI) && GENERIC_HARDIRQS
         select PXA_SSP if ARCH_PXA
         help
           This enables using a PXA2xx or Sodaville SSP port as a SPI master
diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
index 9578af782a77..d7df435d962e 100644
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -152,7 +152,6 @@ static void bcm63xx_spi_setup_transfer(struct spi_device *spi,
 static int bcm63xx_spi_setup(struct spi_device *spi)
 {
         struct bcm63xx_spi *bs;
-        int ret;
 
         bs = spi_master_get_devdata(spi->master);
 
@@ -490,7 +489,7 @@ static int bcm63xx_spi_probe(struct platform_device *pdev)
         default:
                 dev_err(dev, "unsupported MSG_CTL width: %d\n",
                          bs->msg_ctl_width);
-                goto out_clk_disable;
+                goto out_err;
         }
 
         /* Initialize hardware */
diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c
index 89480b281d74..3e490ee7f275 100644
--- a/drivers/spi/spi-mpc512x-psc.c
+++ b/drivers/spi/spi-mpc512x-psc.c
@@ -164,7 +164,7 @@ static int mpc512x_psc_spi_transfer_rxtx(struct spi_device *spi,
 
                 for (i = count; i > 0; i--) {
                         data = tx_buf ? *tx_buf++ : 0;
-                        if (len == EOFBYTE)
+                        if (len == EOFBYTE && t->cs_change)
                                 setbits32(&fifo->txcmd, MPC512x_PSC_FIFO_EOF);
                         out_8(&fifo->txdata_8, data);
                         len--;
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index 90b27a3508a6..810413883c79 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1168,7 +1168,6 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
 
         master->dev.parent = &pdev->dev;
         master->dev.of_node = pdev->dev.of_node;
-        ACPI_HANDLE_SET(&master->dev, ACPI_HANDLE(&pdev->dev));
         /* the spi->mode bits understood by this driver: */
         master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
 
diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index e862ab8853aa..4188b2faac5c 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -994,25 +994,30 @@ static irqreturn_t s3c64xx_spi_irq(int irq, void *data)
 {
         struct s3c64xx_spi_driver_data *sdd = data;
         struct spi_master *spi = sdd->master;
-        unsigned int val;
+        unsigned int val, clr = 0;
 
-        val = readl(sdd->regs + S3C64XX_SPI_PENDING_CLR);
+        val = readl(sdd->regs + S3C64XX_SPI_STATUS);
 
-        val &= S3C64XX_SPI_PND_RX_OVERRUN_CLR |
-                S3C64XX_SPI_PND_RX_UNDERRUN_CLR |
-                S3C64XX_SPI_PND_TX_OVERRUN_CLR |
-                S3C64XX_SPI_PND_TX_UNDERRUN_CLR;
-
-        writel(val, sdd->regs + S3C64XX_SPI_PENDING_CLR);
-
-        if (val & S3C64XX_SPI_PND_RX_OVERRUN_CLR)
+        if (val & S3C64XX_SPI_ST_RX_OVERRUN_ERR) {
+                clr = S3C64XX_SPI_PND_RX_OVERRUN_CLR;
                 dev_err(&spi->dev, "RX overrun\n");
-        if (val & S3C64XX_SPI_PND_RX_UNDERRUN_CLR)
+        }
+        if (val & S3C64XX_SPI_ST_RX_UNDERRUN_ERR) {
+                clr |= S3C64XX_SPI_PND_RX_UNDERRUN_CLR;
                 dev_err(&spi->dev, "RX underrun\n");
-        if (val & S3C64XX_SPI_PND_TX_OVERRUN_CLR)
+        }
+        if (val & S3C64XX_SPI_ST_TX_OVERRUN_ERR) {
+                clr |= S3C64XX_SPI_PND_TX_OVERRUN_CLR;
                 dev_err(&spi->dev, "TX overrun\n");
-        if (val & S3C64XX_SPI_PND_TX_UNDERRUN_CLR)
+        }
+        if (val & S3C64XX_SPI_ST_TX_UNDERRUN_ERR) {
+                clr |= S3C64XX_SPI_PND_TX_UNDERRUN_CLR;
                 dev_err(&spi->dev, "TX underrun\n");
+        }
+
+        /* Clear the pending irq by setting and then clearing it */
+        writel(clr, sdd->regs + S3C64XX_SPI_PENDING_CLR);
+        writel(0, sdd->regs + S3C64XX_SPI_PENDING_CLR);
 
         return IRQ_HANDLED;
 }
@@ -1036,9 +1041,13 @@ static void s3c64xx_spi_hwinit(struct s3c64xx_spi_driver_data *sdd, int channel)
         writel(0, regs + S3C64XX_SPI_MODE_CFG);
         writel(0, regs + S3C64XX_SPI_PACKET_CNT);
 
-        /* Clear any irq pending bits */
-        writel(readl(regs + S3C64XX_SPI_PENDING_CLR),
-                                regs + S3C64XX_SPI_PENDING_CLR);
+        /* Clear any irq pending bits, should set and clear the bits */
+        val = S3C64XX_SPI_PND_RX_OVERRUN_CLR |
+                S3C64XX_SPI_PND_RX_UNDERRUN_CLR |
+                S3C64XX_SPI_PND_TX_OVERRUN_CLR |
+                S3C64XX_SPI_PND_TX_UNDERRUN_CLR;
+        writel(val, regs + S3C64XX_SPI_PENDING_CLR);
+        writel(0, regs + S3C64XX_SPI_PENDING_CLR);
 
         writel(0, regs + S3C64XX_SPI_SWAP_CFG);
 
diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
index b8698b389ef3..a829563f4713 100644
--- a/drivers/spi/spi-tegra20-slink.c
+++ b/drivers/spi/spi-tegra20-slink.c
@@ -858,21 +858,6 @@ static int tegra_slink_setup(struct spi_device *spi)
         return 0;
 }
 
-static int tegra_slink_prepare_transfer(struct spi_master *master)
-{
-        struct tegra_slink_data *tspi = spi_master_get_devdata(master);
-
-        return pm_runtime_get_sync(tspi->dev);
-}
-
-static int tegra_slink_unprepare_transfer(struct spi_master *master)
-{
-        struct tegra_slink_data *tspi = spi_master_get_devdata(master);
-
-        pm_runtime_put(tspi->dev);
-        return 0;
-}
-
 static int tegra_slink_transfer_one_message(struct spi_master *master,
                         struct spi_message *msg)
 {
@@ -885,6 +870,12 @@ static int tegra_slink_transfer_one_message(struct spi_master *master,
 
         msg->status = 0;
         msg->actual_length = 0;
+        ret = pm_runtime_get_sync(tspi->dev);
+        if (ret < 0) {
+                dev_err(tspi->dev, "runtime get failed: %d\n", ret);
+                goto done;
+        }
+
         single_xfer = list_is_singular(&msg->transfers);
         list_for_each_entry(xfer, &msg->transfers, transfer_list) {
                 INIT_COMPLETION(tspi->xfer_completion);
@@ -921,6 +912,8 @@ static int tegra_slink_transfer_one_message(struct spi_master *master,
 exit:
         tegra_slink_writel(tspi, tspi->def_command_reg, SLINK_COMMAND);
         tegra_slink_writel(tspi, tspi->def_command2_reg, SLINK_COMMAND2);
+        pm_runtime_put(tspi->dev);
+done:
         msg->status = ret;
         spi_finalize_current_message(master);
         return ret;
@@ -1148,9 +1141,7 @@ static int tegra_slink_probe(struct platform_device *pdev)
         /* the spi->mode bits understood by this driver: */
         master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH;
         master->setup = tegra_slink_setup;
-        master->prepare_transfer_hardware = tegra_slink_prepare_transfer;
         master->transfer_one_message = tegra_slink_transfer_one_message;
-        master->unprepare_transfer_hardware = tegra_slink_unprepare_transfer;
         master->num_chipselect = MAX_CHIP_SELECT;
         master->bus_num = -1;
 
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index f996c600eb8c..004b10f184d4 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -543,17 +543,16 @@ static void spi_pump_messages(struct kthread_work *work)
         /* Lock queue and check for queue work */
         spin_lock_irqsave(&master->queue_lock, flags);
         if (list_empty(&master->queue) || !master->running) {
-                if (master->busy && master->unprepare_transfer_hardware) {
-                        ret = master->unprepare_transfer_hardware(master);
-                        if (ret) {
-                                spin_unlock_irqrestore(&master->queue_lock, flags);
-                                dev_err(&master->dev,
-                                        "failed to unprepare transfer hardware\n");
-                                return;
-                        }
+                if (!master->busy) {
+                        spin_unlock_irqrestore(&master->queue_lock, flags);
+                        return;
                 }
                 master->busy = false;
                 spin_unlock_irqrestore(&master->queue_lock, flags);
+                if (master->unprepare_transfer_hardware &&
+                    master->unprepare_transfer_hardware(master))
+                        dev_err(&master->dev,
+                                "failed to unprepare transfer hardware\n");
                 return;
         }
 
@@ -984,7 +983,7 @@ static void acpi_register_spi_devices(struct spi_master *master)
         acpi_status status;
         acpi_handle handle;
 
-        handle = ACPI_HANDLE(&master->dev);
+        handle = ACPI_HANDLE(master->dev.parent);
         if (!handle)
                 return;
 
diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c
index 81a1fe661579..71a73ec5af8d 100644
--- a/drivers/staging/comedi/drivers/s626.c
+++ b/drivers/staging/comedi/drivers/s626.c
@@ -1483,7 +1483,7 @@ static int s626_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
         case TRIG_NONE:
                 /*  continous acquisition */
                 devpriv->ai_continous = 1;
-                devpriv->ai_sample_count = 0;
+                devpriv->ai_sample_count = 1;
                 break;
         }
 
diff --git a/drivers/staging/zcache/Kconfig b/drivers/staging/zcache/Kconfig
index 73582705e8c5..5c3714530961 100644
--- a/drivers/staging/zcache/Kconfig
+++ b/drivers/staging/zcache/Kconfig
@@ -15,7 +15,7 @@ config RAMSTER
         depends on CONFIGFS_FS=y && SYSFS=y && !HIGHMEM && ZCACHE=y
         depends on NET
         # must ensure struct page is 8-byte aligned
-        select HAVE_ALIGNED_STRUCT_PAGE if !64_BIT
+        select HAVE_ALIGNED_STRUCT_PAGE if !64BIT
         default n
         help
           RAMster allows RAM on other machines in a cluster to be utilized
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index ff1c5ee352cb..cbe48ab41745 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -409,6 +409,7 @@ static inline int core_alua_state_standby(
         case REPORT_LUNS:
         case RECEIVE_DIAGNOSTIC:
         case SEND_DIAGNOSTIC:
+                return 0;
         case MAINTENANCE_IN:
                 switch (cdb[1] & 0x1f) {
                 case MI_REPORT_TARGET_PGS:
@@ -451,6 +452,7 @@ static inline int core_alua_state_unavailable(
         switch (cdb[0]) {
         case INQUIRY:
         case REPORT_LUNS:
+                return 0;
         case MAINTENANCE_IN:
                 switch (cdb[1] & 0x1f) {
                 case MI_REPORT_TARGET_PGS:
@@ -491,6 +493,7 @@ static inline int core_alua_state_transition(
         switch (cdb[0]) {
         case INQUIRY:
         case REPORT_LUNS:
+                return 0;
         case MAINTENANCE_IN:
                 switch (cdb[1] & 0x1f) {
                 case MI_REPORT_TARGET_PGS:
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 2030b608136d..3243ea790eab 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1139,8 +1139,10 @@ target_setup_cmd_from_cdb(struct se_cmd *cmd, unsigned char *cdb)
                 return ret;
 
         ret = target_check_reservation(cmd);
-        if (ret)
+        if (ret) {
+                cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT;
                 return ret;
+        }
 
         ret = dev->transport->parse_cdb(cmd);
         if (ret)
diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
index 484b6a3c9b03..302909ccf183 100644
--- a/drivers/tty/mxser.c
+++ b/drivers/tty/mxser.c
@@ -2643,9 +2643,9 @@ static int mxser_probe(struct pci_dev *pdev,
                                 mxvar_sdriver, brd->idx + i, &pdev->dev);
                 if (IS_ERR(tty_dev)) {
                         retval = PTR_ERR(tty_dev);
-                        for (i--; i >= 0; i--)
+                        for (; i > 0; i--)
                                 tty_unregister_device(mxvar_sdriver,
-                                        brd->idx + i);
+                                        brd->idx + i - 1);
                         goto err_relbrd;
                 }
         }
@@ -2751,9 +2751,9 @@ static int __init mxser_module_init(void)
                         tty_dev = tty_port_register_device(&brd->ports[i].port,
                                         mxvar_sdriver, brd->idx + i, NULL);
                         if (IS_ERR(tty_dev)) {
-                                for (i--; i >= 0; i--)
+                                for (; i > 0; i--)
                                         tty_unregister_device(mxvar_sdriver,
-                                                brd->idx + i);
+                                                brd->idx + i - 1);
                                 for (i = 0; i < brd->info->nports; i++)
                                         tty_port_destroy(&brd->ports[i].port);
                                 free_irq(brd->irq, brd);
diff --git a/drivers/tty/serial/8250/8250.c b/drivers/tty/serial/8250/8250_core.c
index cf6a5383748a..35f9c96aada9 100644
--- a/drivers/tty/serial/8250/8250.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -3418,6 +3418,7 @@ MODULE_PARM_DESC(probe_rsa, "Probe I/O ports for RSA");
 #endif
 MODULE_ALIAS_CHARDEV_MAJOR(TTY_MAJOR);
 
+#ifdef CONFIG_SERIAL_8250_DEPRECATED_OPTIONS
 #ifndef MODULE
 /* This module was renamed to 8250_core in 3.7.  Keep the old "8250" name
  * working as well for the module options so we don't break people.  We
@@ -3432,7 +3433,7 @@ MODULE_ALIAS_CHARDEV_MAJOR(TTY_MAJOR);
 static void __used s8250_options(void)
 {
 #undef MODULE_PARAM_PREFIX
-#define MODULE_PARAM_PREFIX "8250."
+#define MODULE_PARAM_PREFIX "8250_core."
 
         module_param_cb(share_irqs, &param_ops_uint, &share_irqs, 0644);
         module_param_cb(nr_uarts, &param_ops_uint, &nr_uarts, 0644);
@@ -3444,5 +3445,6 @@ static void __used s8250_options(void)
 #endif
 }
 #else
-MODULE_ALIAS("8250");
+MODULE_ALIAS("8250_core");
+#endif
 #endif
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index aa76825229dc..26e3a97ab157 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1554,6 +1554,7 @@ pci_wch_ch353_setup(struct serial_private *priv,
 #define PCI_DEVICE_ID_PLX_CRONYX_OMEGA  0xc001
 #define PCI_DEVICE_ID_INTEL_PATSBURG_KT 0x1d3d
 #define PCI_VENDOR_ID_WCH               0x4348
+#define PCI_DEVICE_ID_WCH_CH352_2S      0x3253
 #define PCI_DEVICE_ID_WCH_CH353_4S      0x3453
 #define PCI_DEVICE_ID_WCH_CH353_2S1PF   0x5046
 #define PCI_DEVICE_ID_WCH_CH353_2S1P    0x7053
@@ -2172,6 +2173,14 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
                 .subdevice      = PCI_ANY_ID,
                 .setup          = pci_wch_ch353_setup,
         },
+        /* WCH CH352 2S card (16550 clone) */
+        {
+                .vendor         = PCI_VENDOR_ID_WCH,
+                .device         = PCI_DEVICE_ID_WCH_CH352_2S,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .setup          = pci_wch_ch353_setup,
+        },
         /*
          * ASIX devices with FIFO bug
          */
@@ -4870,6 +4879,10 @@ static struct pci_device_id serial_pci_tbl[] = {
                 PCI_ANY_ID, PCI_ANY_ID,
                 0, 0, pbn_b0_bt_2_115200 },
 
+        {       PCI_VENDOR_ID_WCH, PCI_DEVICE_ID_WCH_CH352_2S,
+                PCI_ANY_ID, PCI_ANY_ID,
+                0, 0, pbn_b0_bt_2_115200 },
+
         /*
          * Commtech, Inc. Fastcom adapters
          */
diff --git a/drivers/tty/serial/8250/8250_pnp.c b/drivers/tty/serial/8250/8250_pnp.c
index b3455a970a1d..35d9ab95c5cb 100644
--- a/drivers/tty/serial/8250/8250_pnp.c
+++ b/drivers/tty/serial/8250/8250_pnp.c
@@ -429,7 +429,6 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
 {
         struct uart_8250_port uart;
         int ret, line, flags = dev_id->driver_data;
-        struct resource *res = NULL;
 
         if (flags & UNKNOWN_DEV) {
                 ret = serial_pnp_guess_board(dev);
@@ -440,12 +439,11 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
         memset(&uart, 0, sizeof(uart));
         if (pnp_irq_valid(dev, 0))
                 uart.port.irq = pnp_irq(dev, 0);
-        if ((flags & CIR_PORT) && pnp_port_valid(dev, 2))
-                res = pnp_get_resource(dev, IORESOURCE_IO, 2);
-        else if (pnp_port_valid(dev, 0))
-                res = pnp_get_resource(dev, IORESOURCE_IO, 0);
-        if (pnp_resource_enabled(res)) {
-                uart.port.iobase = res->start;
+        if ((flags & CIR_PORT) && pnp_port_valid(dev, 2)) {
+                uart.port.iobase = pnp_port_start(dev, 2);
+                uart.port.iotype = UPIO_PORT;
+        } else if (pnp_port_valid(dev, 0)) {
+                uart.port.iobase = pnp_port_start(dev, 0);
                 uart.port.iotype = UPIO_PORT;
         } else if (pnp_mem_valid(dev, 0)) {
                 uart.port.mapbase = pnp_mem_start(dev, 0);
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index 2ef9537bcb2c..80fe91e64a52 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -33,6 +33,23 @@ config SERIAL_8250
           Most people will say Y or M here, so that they can use serial mice,
           modems and similar devices connecting to the standard serial ports.
 
+config SERIAL_8250_DEPRECATED_OPTIONS
+        bool "Support 8250_core.* kernel options (DEPRECATED)"
+        depends on SERIAL_8250
+        default y
+        ---help---
+          In 3.7 we renamed 8250 to 8250_core by mistake, so now we have to
+          accept kernel parameters in both forms like 8250_core.nr_uarts=4 and
+          8250.nr_uarts=4. We now renamed the module back to 8250, but if
+          anybody noticed in 3.7 and changed their userspace we still have to
+          keep the 8350_core.* options around until they revert the changes
+          they already did.
+
+          If 8250 is built as a module, this adds 8250_core alias instead. 
+
+          If you did not notice yet and/or you have userspace from pre-3.7, it
+          is safe (and recommended) to say N here.
+
 config SERIAL_8250_PNP
         bool "8250/16550 PNP device support" if EXPERT
         depends on SERIAL_8250 && PNP
diff --git a/drivers/tty/serial/8250/Makefile b/drivers/tty/serial/8250/Makefile
index a23838a4d535..36d68d054307 100644
--- a/drivers/tty/serial/8250/Makefile
+++ b/drivers/tty/serial/8250/Makefile
@@ -2,10 +2,10 @@
 # Makefile for the 8250 serial device drivers.
 #
 
-obj-$(CONFIG_SERIAL_8250)               += 8250_core.o
-8250_core-y                             := 8250.o
-8250_core-$(CONFIG_SERIAL_8250_PNP)     += 8250_pnp.o
-8250_core-$(CONFIG_SERIAL_8250_DMA)     += 8250_dma.o
+obj-$(CONFIG_SERIAL_8250)               += 8250.o
+8250-y                                  := 8250_core.o
+8250-$(CONFIG_SERIAL_8250_PNP)          += 8250_pnp.o
+8250-$(CONFIG_SERIAL_8250_DMA)          += 8250_dma.o
 obj-$(CONFIG_SERIAL_8250_GSC)           += 8250_gsc.o
 obj-$(CONFIG_SERIAL_8250_PCI)           += 8250_pci.o
 obj-$(CONFIG_SERIAL_8250_HP300)         += 8250_hp300.o
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index d4a7c241b751..3467462869ce 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -158,7 +158,7 @@ struct atmel_uart_port {
 };
 
 static struct atmel_uart_port atmel_ports[ATMEL_MAX_UART];
-static unsigned long atmel_ports_in_use;
+static DECLARE_BITMAP(atmel_ports_in_use, ATMEL_MAX_UART);
 
 #ifdef SUPPORT_SYSRQ
 static struct console atmel_console;
@@ -1769,15 +1769,14 @@ static int atmel_serial_probe(struct platform_device *pdev)
         if (ret < 0)
                 /* port id not found in platform data nor device-tree aliases:
                  * auto-enumerate it */
-                ret = find_first_zero_bit(&atmel_ports_in_use,
-                                sizeof(atmel_ports_in_use));
+                ret = find_first_zero_bit(atmel_ports_in_use, ATMEL_MAX_UART);
 
-        if (ret > ATMEL_MAX_UART) {
+        if (ret >= ATMEL_MAX_UART) {
                 ret = -ENODEV;
                 goto err;
         }
 
-        if (test_and_set_bit(ret, &atmel_ports_in_use)) {
+        if (test_and_set_bit(ret, atmel_ports_in_use)) {
                 /* port already in use */
                 ret = -EBUSY;
                 goto err;
@@ -1857,7 +1856,7 @@ static int atmel_serial_remove(struct platform_device *pdev)
 
         /* "port" is allocated statically, so we shouldn't free it */
 
-        clear_bit(port->line, &atmel_ports_in_use);
+        clear_bit(port->line, atmel_ports_in_use);
 
         clk_put(atmel_port->clk);
 
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index 4dc41408ecb7..30d4f7a783cd 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -886,6 +886,17 @@ serial_omap_set_termios(struct uart_port *port, struct ktermios *termios,
         serial_out(up, UART_MCR, up->mcr | UART_MCR_TCRTLR);
         /* FIFO ENABLE, DMA MODE */
 
+        up->scr |= OMAP_UART_SCR_RX_TRIG_GRANU1_MASK;
+        /*
+         * NOTE: Setting OMAP_UART_SCR_RX_TRIG_GRANU1_MASK
+         * sets Enables the granularity of 1 for TRIGGER RX
+         * level. Along with setting RX FIFO trigger level
+         * to 1 (as noted below, 16 characters) and TLR[3:0]
+         * to zero this will result RX FIFO threshold level
+         * to 1 character, instead of 16 as noted in comment
+         * below.
+         */
+
         /* Set receive FIFO threshold to 16 characters and
          * transmit FIFO threshold to 16 spaces
          */
diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
index ba451c7209fc..f36bbba1ac8b 100644
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -578,6 +578,8 @@ static int xuartps_startup(struct uart_port *port)
         /* Receive Timeout register is enabled with value of 10 */
         xuartps_writel(10, XUARTPS_RXTOUT_OFFSET);
 
+        /* Clear out any pending interrupts before enabling them */
+        xuartps_writel(xuartps_readl(XUARTPS_ISR_OFFSET), XUARTPS_ISR_OFFSET);
 
         /* Set the Interrupt Registers with desired interrupts */
         xuartps_writel(XUARTPS_IXR_TXEMPTY | XUARTPS_IXR_PARITY |
diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
index e4ca345873c3..d7799deacb21 100644
--- a/drivers/tty/vt/vc_screen.c
+++ b/drivers/tty/vt/vc_screen.c
@@ -93,7 +93,7 @@ vcs_poll_data_free(struct vcs_poll_data *poll)
 static struct vcs_poll_data *
 vcs_poll_data_get(struct file *file)
 {
-        struct vcs_poll_data *poll = file->private_data;
+        struct vcs_poll_data *poll = file->private_data, *kill = NULL;
 
         if (poll)
                 return poll;
@@ -122,10 +122,12 @@ vcs_poll_data_get(struct file *file)
                 file->private_data = poll;
         } else {
                 /* someone else raced ahead of us */
-                vcs_poll_data_free(poll);
+                kill = poll;
                 poll = file->private_data;
         }
         spin_unlock(&file->f_lock);
+        if (kill)
+                vcs_poll_data_free(kill);
 
         return poll;
 }
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 99b34a30354f..f9ec44cbb82f 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2412,6 +2412,14 @@ int usb_hcd_is_primary_hcd(struct usb_hcd *hcd)
 }
 EXPORT_SYMBOL_GPL(usb_hcd_is_primary_hcd);
 
+int usb_hcd_find_raw_port_number(struct usb_hcd *hcd, int port1)
+{
+        if (!hcd->driver->find_raw_port_number)
+                return port1;
+
+        return hcd->driver->find_raw_port_number(hcd, port1);
+}
+
 static int usb_hcd_request_irqs(struct usb_hcd *hcd,
                 unsigned int irqnum, unsigned long irqflags)
 {
diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c
index 797f9d514732..65d4e55552c6 100644
--- a/drivers/usb/core/port.c
+++ b/drivers/usb/core/port.c
@@ -67,7 +67,6 @@ static void usb_port_device_release(struct device *dev)
 {
         struct usb_port *port_dev = to_usb_port(dev);
 
-        dev_pm_qos_hide_flags(dev);
         kfree(port_dev);
 }
 
diff --git a/drivers/usb/core/usb-acpi.c b/drivers/usb/core/usb-acpi.c
index b6f4bad3f756..255c14464bf2 100644
--- a/drivers/usb/core/usb-acpi.c
+++ b/drivers/usb/core/usb-acpi.c
@@ -15,6 +15,7 @@
 #include <linux/kernel.h>
 #include <linux/acpi.h>
 #include <linux/pci.h>
+#include <linux/usb/hcd.h>
 #include <acpi/acpi_bus.h>
 
 #include "usb.h"
@@ -188,8 +189,13 @@ static int usb_acpi_find_device(struct device *dev, acpi_handle *handle)
                  * connected to.
                  */
                 if (!udev->parent) {
-                        *handle = acpi_get_child(DEVICE_ACPI_HANDLE(&udev->dev),
+                        struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+                        int raw_port_num;
+
+                        raw_port_num = usb_hcd_find_raw_port_number(hcd,
                                 port_num);
+                        *handle = acpi_get_child(DEVICE_ACPI_HANDLE(&udev->dev),
+                                raw_port_num);
                         if (!*handle)
                                 return -ENODEV;
                 } else {
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 5a0c541daf89..c7525b1cad74 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -145,6 +145,7 @@ config USB_LPC32XX
         tristate "LPC32XX USB Peripheral Controller"
         depends on ARCH_LPC32XX
         select USB_ISP1301
+        select USB_OTG_UTILS
         help
            This option selects the USB device controller in the LPC32xx SoC.
 
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index b476daf49f6f..010f686d8881 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1214,6 +1214,7 @@ itd_urb_transaction (
 
                 memset (itd, 0, sizeof *itd);
                 itd->itd_dma = itd_dma;
+                itd->frame = 9999;              /* an invalid value */
                 list_add (&itd->itd_list, &sched->td_list);
         }
         spin_unlock_irqrestore (&ehci->lock, flags);
@@ -1915,6 +1916,7 @@ sitd_urb_transaction (
 
                 memset (sitd, 0, sizeof *sitd);
                 sitd->sitd_dma = sitd_dma;
+                sitd->frame = 9999;             /* an invalid value */
                 list_add (&sitd->sitd_list, &iso_sched->td_list);
         }
 
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 35616ffbe3ae..6dc238c592bc 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1022,44 +1022,24 @@ void xhci_copy_ep0_dequeue_into_input_ctx(struct xhci_hcd *xhci,
  * is attached to (or the roothub port its ancestor hub is attached to).  All we
  * know is the index of that port under either the USB 2.0 or the USB 3.0
  * roothub, but that doesn't give us the real index into the HW port status
- * registers.  Scan through the xHCI roothub port array, looking for the Nth
- * entry of the correct port speed.  Return the port number of that entry.
+ * registers. Call xhci_find_raw_port_number() to get real index.
  */
 static u32 xhci_find_real_port_number(struct xhci_hcd *xhci,
                 struct usb_device *udev)
 {
         struct usb_device *top_dev;
-        unsigned int num_similar_speed_ports;
-        unsigned int faked_port_num;
-        int i;
+        struct usb_hcd *hcd;
+
+        if (udev->speed == USB_SPEED_SUPER)
+                hcd = xhci->shared_hcd;
+        else
+                hcd = xhci->main_hcd;
 
         for (top_dev = udev; top_dev->parent && top_dev->parent->parent;
                         top_dev = top_dev->parent)
                 /* Found device below root hub */;
-        faked_port_num = top_dev->portnum;
-        for (i = 0, num_similar_speed_ports = 0;
-                        i < HCS_MAX_PORTS(xhci->hcs_params1); i++) {
-                u8 port_speed = xhci->port_array[i];
-
-                /*
-                 * Skip ports that don't have known speeds, or have duplicate
-                 * Extended Capabilities port speed entries.
-                 */
-                if (port_speed == 0 || port_speed == DUPLICATE_ENTRY)
-                        continue;
 
-                /*
-                 * USB 3.0 ports are always under a USB 3.0 hub.  USB 2.0 and
-                 * 1.1 ports are under the USB 2.0 hub.  If the port speed
-                 * matches the device speed, it's a similar speed port.
-                 */
-                if ((port_speed == 0x03) == (udev->speed == USB_SPEED_SUPER))
-                        num_similar_speed_ports++;
-                if (num_similar_speed_ports == faked_port_num)
-                        /* Roothub ports are numbered from 1 to N */
-                        return i+1;
-        }
-        return 0;
+        return  xhci_find_raw_port_number(hcd, top_dev->portnum);
 }
 
 /* Setup an xHCI virtual device for a Set Address command */
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index af259e0ec172..1a30c380043c 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -313,6 +313,7 @@ static const struct hc_driver xhci_pci_hc_driver = {
         .set_usb2_hw_lpm =      xhci_set_usb2_hardware_lpm,
         .enable_usb3_lpm_timeout =      xhci_enable_usb3_lpm_timeout,
         .disable_usb3_lpm_timeout =     xhci_disable_usb3_lpm_timeout,
+        .find_raw_port_number = xhci_find_raw_port_number,
 };
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 882875465301..1969c001b3f9 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1599,14 +1599,20 @@ static void handle_port_status(struct xhci_hcd *xhci,
         max_ports = HCS_MAX_PORTS(xhci->hcs_params1);
         if ((port_id <= 0) || (port_id > max_ports)) {
                 xhci_warn(xhci, "Invalid port id %d\n", port_id);
-                bogus_port_status = true;
-                goto cleanup;
+                inc_deq(xhci, xhci->event_ring);
+                return;
         }
 
         /* Figure out which usb_hcd this port is attached to:
          * is it a USB 3.0 port or a USB 2.0/1.1 port?
          */
         major_revision = xhci->port_array[port_id - 1];
+
+        /* Find the right roothub. */
+        hcd = xhci_to_hcd(xhci);
+        if ((major_revision == 0x03) != (hcd->speed == HCD_USB3))
+                hcd = xhci->shared_hcd;
+
         if (major_revision == 0) {
                 xhci_warn(xhci, "Event for port %u not in "
                                 "Extended Capabilities, ignoring.\n",
@@ -1629,10 +1635,6 @@ static void handle_port_status(struct xhci_hcd *xhci,
          * into the index into the ports on the correct split roothub, and the
          * correct bus_state structure.
          */
-        /* Find the right roothub. */
-        hcd = xhci_to_hcd(xhci);
-        if ((major_revision == 0x03) != (hcd->speed == HCD_USB3))
-                hcd = xhci->shared_hcd;
         bus_state = &xhci->bus_state[hcd_index(hcd)];
         if (hcd->speed == HCD_USB3)
                 port_array = xhci->usb3_ports;
@@ -2027,8 +2029,8 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 if (event_trb != ep_ring->dequeue &&
                                 event_trb != td->last_trb)
                         td->urb->actual_length =
-                                td->urb->transfer_buffer_length
-                                - TRB_LEN(le32_to_cpu(event->transfer_len));
+                                td->urb->transfer_buffer_length -
+                                EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
                 else
                         td->urb->actual_length = 0;
 
@@ -2060,7 +2062,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 /* Maybe the event was for the data stage? */
                         td->urb->actual_length =
                                 td->urb->transfer_buffer_length -
-                                TRB_LEN(le32_to_cpu(event->transfer_len));
+                                EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
                         xhci_dbg(xhci, "Waiting for status "
                                         "stage event\n");
                         return 0;
@@ -2096,7 +2098,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
         /* handle completion code */
         switch (trb_comp_code) {
         case COMP_SUCCESS:
-                if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
+                if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
                         frame->status = 0;
                         break;
                 }
@@ -2141,7 +2143,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
                                 len += TRB_LEN(le32_to_cpu(cur_trb->generic.field[2]));
                 }
                 len += TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
-                        TRB_LEN(le32_to_cpu(event->transfer_len));
+                        EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
 
                 if (trb_comp_code != COMP_STOP_INVAL) {
                         frame->actual_length = len;
@@ -2199,7 +2201,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
         case COMP_SUCCESS:
                 /* Double check that the HW transferred everything. */
                 if (event_trb != td->last_trb ||
-                                TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+                    EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
                         xhci_warn(xhci, "WARN Successful completion "
                                         "on short TX\n");
                         if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
@@ -2227,18 +2229,18 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
                                 "%d bytes untransferred\n",
                                 td->urb->ep->desc.bEndpointAddress,
                                 td->urb->transfer_buffer_length,
-                                TRB_LEN(le32_to_cpu(event->transfer_len)));
+                                EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
         /* Fast path - was this the last TRB in the TD for this URB? */
         if (event_trb == td->last_trb) {
-                if (TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+                if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
                         td->urb->actual_length =
                                 td->urb->transfer_buffer_length -
-                                TRB_LEN(le32_to_cpu(event->transfer_len));
+                                EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
                         if (td->urb->transfer_buffer_length <
                                         td->urb->actual_length) {
                                 xhci_warn(xhci, "HC gave bad length "
                                                 "of %d bytes left\n",
-                                          TRB_LEN(le32_to_cpu(event->transfer_len)));
+                                          EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
                                 td->urb->actual_length = 0;
                                 if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
                                         *status = -EREMOTEIO;
@@ -2280,7 +2282,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 if (trb_comp_code != COMP_STOP_INVAL)
                         td->urb->actual_length +=
                                 TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
-                                TRB_LEN(le32_to_cpu(event->transfer_len));
+                                EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
         }
 
         return finish_td(xhci, td, event_trb, event, ep, status, false);
@@ -2368,7 +2370,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
          * transfer type
          */
         case COMP_SUCCESS:
-                if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
+                if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
                         break;
                 if (xhci->quirks & XHCI_TRUST_TX_LENGTH)
                         trb_comp_code = COMP_SHORT_TX;
@@ -2461,14 +2463,21 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                  * TD list.
                  */
                 if (list_empty(&ep_ring->td_list)) {
-                        xhci_warn(xhci, "WARN Event TRB for slot %d ep %d "
-                                        "with no TDs queued?\n",
-                                  TRB_TO_SLOT_ID(le32_to_cpu(event->flags)),
-                                  ep_index);
-                        xhci_dbg(xhci, "Event TRB with TRB type ID %u\n",
-                                 (le32_to_cpu(event->flags) &
-                                  TRB_TYPE_BITMASK)>>10);
-                        xhci_print_trb_offsets(xhci, (union xhci_trb *) event);
+                        /*
+                         * A stopped endpoint may generate an extra completion
+                         * event if the device was suspended.  Don't print
+                         * warnings.
+                         */
+                        if (!(trb_comp_code == COMP_STOP ||
+                                                trb_comp_code == COMP_STOP_INVAL)) {
+                                xhci_warn(xhci, "WARN Event TRB for slot %d ep %d with no TDs queued?\n",
+                                                TRB_TO_SLOT_ID(le32_to_cpu(event->flags)),
+                                                ep_index);
+                                xhci_dbg(xhci, "Event TRB with TRB type ID %u\n",
+                                                (le32_to_cpu(event->flags) &
+                                                 TRB_TYPE_BITMASK)>>10);
+                                xhci_print_trb_offsets(xhci, (union xhci_trb *) event);
+                        }
                         if (ep->skip) {
                                 ep->skip = false;
                                 xhci_dbg(xhci, "td_list is empty while skip "
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 849470b18831..53b8f89a0b1c 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3779,6 +3779,28 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
         return 0;
 }
 
+/*
+ * Transfer the port index into real index in the HW port status
+ * registers. Caculate offset between the port's PORTSC register
+ * and port status base. Divide the number of per port register
+ * to get the real index. The raw port number bases 1.
+ */
+int xhci_find_raw_port_number(struct usb_hcd *hcd, int port1)
+{
+        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        __le32 __iomem *base_addr = &xhci->op_regs->port_status_base;
+        __le32 __iomem *addr;
+        int raw_port;
+
+        if (hcd->speed != HCD_USB3)
+                addr = xhci->usb2_ports[port1 - 1];
+        else
+                addr = xhci->usb3_ports[port1 - 1];
+
+        raw_port = (addr - base_addr)/NUM_PORT_REGS + 1;
+        return raw_port;
+}
+
 #ifdef CONFIG_USB_SUSPEND
 
 /* BESL to HIRD Encoding array for USB2 LPM */
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 2c510e4a7d4c..63582719e0fb 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -972,6 +972,10 @@ struct xhci_transfer_event {
         __le32  flags;
 };
 
+/* Transfer event TRB length bit mask */
+/* bits 0:23 */
+#define EVENT_TRB_LEN(p)                ((p) & 0xffffff)
+
 /** Transfer Event bit fields **/
 #define TRB_TO_EP_ID(p) (((p) >> 16) & 0x1f)
 
@@ -1829,6 +1833,7 @@ void xhci_test_and_clear_bit(struct xhci_hcd *xhci, __le32 __iomem **port_array,
 int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex,
                 char *buf, u16 wLength);
 int xhci_hub_status_data(struct usb_hcd *hcd, char *buf);
+int xhci_find_raw_port_number(struct usb_hcd *hcd, int port1);
 
 #ifdef CONFIG_PM
 int xhci_bus_suspend(struct usb_hcd *hcd);
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 65217a590068..90549382eba5 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -38,6 +38,7 @@ config USB_ISP1301
         tristate "NXP ISP1301 USB transceiver support"
         depends on USB || USB_GADGET
         depends on I2C
+        select USB_OTG_UTILS
         help
           Say Y here to add support for the NXP ISP1301 USB transceiver driver.
           This chip is typically used as USB transceiver for USB host, gadget
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index d4809d551473..9886180e45f1 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -640,6 +640,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_RM_CANVIEW_PID) },
         { USB_DEVICE(ACTON_VID, ACTON_SPECTRAPRO_PID) },
         { USB_DEVICE(CONTEC_VID, CONTEC_COM1USBH_PID) },
+        { USB_DEVICE(MITSUBISHI_VID, MITSUBISHI_FXUSB_PID) },
         { USB_DEVICE(BANDB_VID, BANDB_USOTL4_PID) },
         { USB_DEVICE(BANDB_VID, BANDB_USTL4_PID) },
         { USB_DEVICE(BANDB_VID, BANDB_USO9ML2_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 9d359e189a64..e79861eeed4c 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -584,6 +584,13 @@
 #define CONTEC_COM1USBH_PID     0x8311  /* COM-1(USB)H */
 
 /*
+ * Mitsubishi Electric Corp. (http://www.meau.com)
+ * Submitted by Konstantin Holoborodko
+ */
+#define MITSUBISHI_VID          0x06D3
+#define MITSUBISHI_FXUSB_PID    0x0284 /* USB/RS422 converters: FX-USB-AW/-BD */
+
+/*
  * Definitions for B&B Electronics products.
  */
 #define BANDB_VID               0x0856  /* B&B Electronics Vendor ID */
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 2e70efa08b77..5d9b178484fd 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -903,6 +903,7 @@ static int usb_serial_probe(struct usb_interface *interface,
                 port->port.ops = &serial_port_ops;
                 port->serial = serial;
                 spin_lock_init(&port->lock);
+                init_waitqueue_head(&port->delta_msr_wait);
                 /* Keep this for private driver use for the moment but
                    should probably go away */
                 INIT_WORK(&port->work, usb_serial_port_work);
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 8189cb6a86af..7abc5c81af2c 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -346,6 +346,7 @@ static long vfio_pci_ioctl(void *device_data,
 
                 if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
                         size_t size;
+                        int max = vfio_pci_get_irq_count(vdev, hdr.index);
 
                         if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL)
                                 size = sizeof(uint8_t);
@@ -355,7 +356,7 @@ static long vfio_pci_ioctl(void *device_data,
                                 return -EINVAL;
 
                         if (hdr.argsz - minsz < hdr.count * size ||
-                            hdr.count > vfio_pci_get_irq_count(vdev, hdr.index))
+                            hdr.start >= max || hdr.start + hdr.count > max)
                                 return -EINVAL;
 
                         data = memdup_user((void __user *)(arg + minsz),
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c
index 43fb11ee2e8d..957a0b98a5d9 100644
--- a/drivers/vhost/tcm_vhost.c
+++ b/drivers/vhost/tcm_vhost.c
@@ -60,14 +60,22 @@ enum {
         VHOST_SCSI_VQ_IO = 2,
 };
 
+/*
+ * VIRTIO_RING_F_EVENT_IDX seems broken. Not sure the bug is in
+ * kernel but disabling it helps.
+ * TODO: debug and remove the workaround.
+ */
+enum {
+        VHOST_SCSI_FEATURES = VHOST_FEATURES & (~VIRTIO_RING_F_EVENT_IDX)
+};
+
 #define VHOST_SCSI_MAX_TARGET   256
 #define VHOST_SCSI_MAX_VQ       128
 
 struct vhost_scsi {
         /* Protected by vhost_scsi->dev.mutex */
-        struct tcm_vhost_tpg *vs_tpg[VHOST_SCSI_MAX_TARGET];
+        struct tcm_vhost_tpg **vs_tpg;
         char vs_vhost_wwpn[TRANSPORT_IQN_LEN];
-        bool vs_endpoint;
 
         struct vhost_dev dev;
         struct vhost_virtqueue vqs[VHOST_SCSI_MAX_VQ];
@@ -570,9 +578,27 @@ static void tcm_vhost_submission_work(struct work_struct *work)
         }
 }
 
+static void vhost_scsi_send_bad_target(struct vhost_scsi *vs,
+        struct vhost_virtqueue *vq, int head, unsigned out)
+{
+        struct virtio_scsi_cmd_resp __user *resp;
+        struct virtio_scsi_cmd_resp rsp;
+        int ret;
+
+        memset(&rsp, 0, sizeof(rsp));
+        rsp.response = VIRTIO_SCSI_S_BAD_TARGET;
+        resp = vq->iov[out].iov_base;
+        ret = __copy_to_user(resp, &rsp, sizeof(rsp));
+        if (!ret)
+                vhost_add_used_and_signal(&vs->dev, vq, head, 0);
+        else
+                pr_err("Faulted on virtio_scsi_cmd_resp\n");
+}
+
 static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
         struct vhost_virtqueue *vq)
 {
+        struct tcm_vhost_tpg **vs_tpg;
         struct virtio_scsi_cmd_req v_req;
         struct tcm_vhost_tpg *tv_tpg;
         struct tcm_vhost_cmd *tv_cmd;
@@ -581,8 +607,16 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
         int head, ret;
         u8 target;
 
-        /* Must use ioctl VHOST_SCSI_SET_ENDPOINT */
-        if (unlikely(!vs->vs_endpoint))
+        /*
+         * We can handle the vq only after the endpoint is setup by calling the
+         * VHOST_SCSI_SET_ENDPOINT ioctl.
+         *
+         * TODO: Check that we are running from vhost_worker which acts
+         * as read-side critical section for vhost kind of RCU.
+         * See the comments in struct vhost_virtqueue in drivers/vhost/vhost.h
+         */
+        vs_tpg = rcu_dereference_check(vq->private_data, 1);
+        if (!vs_tpg)
                 return;
 
         mutex_lock(&vq->mutex);
@@ -652,23 +686,11 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
 
                 /* Extract the tpgt */
                 target = v_req.lun[1];
-                tv_tpg = vs->vs_tpg[target];
+                tv_tpg = ACCESS_ONCE(vs_tpg[target]);
 
                 /* Target does not exist, fail the request */
                 if (unlikely(!tv_tpg)) {
-                        struct virtio_scsi_cmd_resp __user *resp;
-                        struct virtio_scsi_cmd_resp rsp;
-
-                        memset(&rsp, 0, sizeof(rsp));
-                        rsp.response = VIRTIO_SCSI_S_BAD_TARGET;
-                        resp = vq->iov[out].iov_base;
-                        ret = __copy_to_user(resp, &rsp, sizeof(rsp));
-                        if (!ret)
-                                vhost_add_used_and_signal(&vs->dev,
-                                                          vq, head, 0);
-                        else
-                                pr_err("Faulted on virtio_scsi_cmd_resp\n");
-
+                        vhost_scsi_send_bad_target(vs, vq, head, out);
                         continue;
                 }
 
@@ -681,22 +703,13 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
                 if (IS_ERR(tv_cmd)) {
                         vq_err(vq, "vhost_scsi_allocate_cmd failed %ld\n",
                                         PTR_ERR(tv_cmd));
-                        break;
+                        goto err_cmd;
                 }
                 pr_debug("Allocated tv_cmd: %p exp_data_len: %d, data_direction"
                         ": %d\n", tv_cmd, exp_data_len, data_direction);
 
                 tv_cmd->tvc_vhost = vs;
                 tv_cmd->tvc_vq = vq;
-
-                if (unlikely(vq->iov[out].iov_len !=
-                                sizeof(struct virtio_scsi_cmd_resp))) {
-                        vq_err(vq, "Expecting virtio_scsi_cmd_resp, got %zu"
-                                " bytes, out: %d, in: %d\n",
-                                vq->iov[out].iov_len, out, in);
-                        break;
-                }
-
                 tv_cmd->tvc_resp = vq->iov[out].iov_base;
 
                 /*
@@ -716,7 +729,7 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
                                 " exceeds SCSI_MAX_VARLEN_CDB_SIZE: %d\n",
                                 scsi_command_size(tv_cmd->tvc_cdb),
                                 TCM_VHOST_MAX_CDB_SIZE);
-                        break; /* TODO */
+                        goto err_free;
                 }
                 tv_cmd->tvc_lun = ((v_req.lun[2] << 8) | v_req.lun[3]) & 0x3FFF;
 
@@ -729,7 +742,7 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
                                         data_direction == DMA_TO_DEVICE);
                         if (unlikely(ret)) {
                                 vq_err(vq, "Failed to map iov to sgl\n");
-                                break; /* TODO */
+                                goto err_free;
                         }
                 }
 
@@ -750,6 +763,13 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
         }
 
         mutex_unlock(&vq->mutex);
+        return;
+
+err_free:
+        vhost_scsi_free_cmd(tv_cmd);
+err_cmd:
+        vhost_scsi_send_bad_target(vs, vq, head, out);
+        mutex_unlock(&vq->mutex);
 }
 
 static void vhost_scsi_ctl_handle_kick(struct vhost_work *work)
@@ -771,6 +791,20 @@ static void vhost_scsi_handle_kick(struct vhost_work *work)
         vhost_scsi_handle_vq(vs, vq);
 }
 
+static void vhost_scsi_flush_vq(struct vhost_scsi *vs, int index)
+{
+        vhost_poll_flush(&vs->dev.vqs[index].poll);
+}
+
+static void vhost_scsi_flush(struct vhost_scsi *vs)
+{
+        int i;
+
+        for (i = 0; i < VHOST_SCSI_MAX_VQ; i++)
+                vhost_scsi_flush_vq(vs, i);
+        vhost_work_flush(&vs->dev, &vs->vs_completion_work);
+}
+
 /*
  * Called from vhost_scsi_ioctl() context to walk the list of available
  * tcm_vhost_tpg with an active struct tcm_vhost_nexus
@@ -781,8 +815,10 @@ static int vhost_scsi_set_endpoint(
 {
         struct tcm_vhost_tport *tv_tport;
         struct tcm_vhost_tpg *tv_tpg;
+        struct tcm_vhost_tpg **vs_tpg;
+        struct vhost_virtqueue *vq;
+        int index, ret, i, len;
         bool match = false;
-        int index, ret;
 
         mutex_lock(&vs->dev.mutex);
         /* Verify that ring has been setup correctly. */
@@ -794,6 +830,15 @@ static int vhost_scsi_set_endpoint(
                 }
         }
 
+        len = sizeof(vs_tpg[0]) * VHOST_SCSI_MAX_TARGET;
+        vs_tpg = kzalloc(len, GFP_KERNEL);
+        if (!vs_tpg) {
+                mutex_unlock(&vs->dev.mutex);
+                return -ENOMEM;
+        }
+        if (vs->vs_tpg)
+                memcpy(vs_tpg, vs->vs_tpg, len);
+
         mutex_lock(&tcm_vhost_mutex);
         list_for_each_entry(tv_tpg, &tcm_vhost_list, tv_tpg_list) {
                 mutex_lock(&tv_tpg->tv_tpg_mutex);
@@ -808,14 +853,15 @@ static int vhost_scsi_set_endpoint(
                 tv_tport = tv_tpg->tport;
 
                 if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) {
-                        if (vs->vs_tpg[tv_tpg->tport_tpgt]) {
+                        if (vs->vs_tpg && vs->vs_tpg[tv_tpg->tport_tpgt]) {
                                 mutex_unlock(&tv_tpg->tv_tpg_mutex);
                                 mutex_unlock(&tcm_vhost_mutex);
                                 mutex_unlock(&vs->dev.mutex);
+                                kfree(vs_tpg);
                                 return -EEXIST;
                         }
                         tv_tpg->tv_tpg_vhost_count++;
-                        vs->vs_tpg[tv_tpg->tport_tpgt] = tv_tpg;
+                        vs_tpg[tv_tpg->tport_tpgt] = tv_tpg;
                         smp_mb__after_atomic_inc();
                         match = true;
                 }
@@ -826,12 +872,27 @@ static int vhost_scsi_set_endpoint(
         if (match) {
                 memcpy(vs->vs_vhost_wwpn, t->vhost_wwpn,
                        sizeof(vs->vs_vhost_wwpn));
-                vs->vs_endpoint = true;
+                for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
+                        vq = &vs->vqs[i];
+                        /* Flushing the vhost_work acts as synchronize_rcu */
+                        mutex_lock(&vq->mutex);
+                        rcu_assign_pointer(vq->private_data, vs_tpg);
+                        vhost_init_used(vq);
+                        mutex_unlock(&vq->mutex);
+                }
                 ret = 0;
         } else {
                 ret = -EEXIST;
         }
 
+        /*
+         * Act as synchronize_rcu to make sure access to
+         * old vs->vs_tpg is finished.
+         */
+        vhost_scsi_flush(vs);
+        kfree(vs->vs_tpg);
+        vs->vs_tpg = vs_tpg;
+
         mutex_unlock(&vs->dev.mutex);
         return ret;
 }
@@ -842,6 +903,8 @@ static int vhost_scsi_clear_endpoint(
 {
         struct tcm_vhost_tport *tv_tport;
         struct tcm_vhost_tpg *tv_tpg;
+        struct vhost_virtqueue *vq;
+        bool match = false;
         int index, ret, i;
         u8 target;
 
@@ -853,9 +916,14 @@ static int vhost_scsi_clear_endpoint(
                         goto err_dev;
                 }
         }
+
+        if (!vs->vs_tpg) {
+                mutex_unlock(&vs->dev.mutex);
+                return 0;
+        }
+
         for (i = 0; i < VHOST_SCSI_MAX_TARGET; i++) {
                 target = i;
-
                 tv_tpg = vs->vs_tpg[target];
                 if (!tv_tpg)
                         continue;
@@ -877,10 +945,27 @@ static int vhost_scsi_clear_endpoint(
                 }
                 tv_tpg->tv_tpg_vhost_count--;
                 vs->vs_tpg[target] = NULL;
-                vs->vs_endpoint = false;
+                match = true;
                 mutex_unlock(&tv_tpg->tv_tpg_mutex);
         }
+        if (match) {
+                for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
+                        vq = &vs->vqs[i];
+                        /* Flushing the vhost_work acts as synchronize_rcu */
+                        mutex_lock(&vq->mutex);
+                        rcu_assign_pointer(vq->private_data, NULL);
+                        mutex_unlock(&vq->mutex);
+                }
+        }
+        /*
+         * Act as synchronize_rcu to make sure access to
+         * old vs->vs_tpg is finished.
+         */
+        vhost_scsi_flush(vs);
+        kfree(vs->vs_tpg);
+        vs->vs_tpg = NULL;
         mutex_unlock(&vs->dev.mutex);
+
         return 0;
 
 err_tpg:
@@ -890,6 +975,24 @@ err_dev:
         return ret;
 }
 
+static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
+{
+        if (features & ~VHOST_SCSI_FEATURES)
+                return -EOPNOTSUPP;
+
+        mutex_lock(&vs->dev.mutex);
+        if ((features & (1 << VHOST_F_LOG_ALL)) &&
+            !vhost_log_access_ok(&vs->dev)) {
+                mutex_unlock(&vs->dev.mutex);
+                return -EFAULT;
+        }
+        vs->dev.acked_features = features;
+        smp_wmb();
+        vhost_scsi_flush(vs);
+        mutex_unlock(&vs->dev.mutex);
+        return 0;
+}
+
 static int vhost_scsi_open(struct inode *inode, struct file *f)
 {
         struct vhost_scsi *s;
@@ -930,38 +1033,6 @@ static int vhost_scsi_release(struct inode *inode, struct file *f)
         return 0;
 }
 
-static void vhost_scsi_flush_vq(struct vhost_scsi *vs, int index)
-{
-        vhost_poll_flush(&vs->dev.vqs[index].poll);
-}
-
-static void vhost_scsi_flush(struct vhost_scsi *vs)
-{
-        int i;
-
-        for (i = 0; i < VHOST_SCSI_MAX_VQ; i++)
-                vhost_scsi_flush_vq(vs, i);
-        vhost_work_flush(&vs->dev, &vs->vs_completion_work);
-}
-
-static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
-{
-        if (features & ~VHOST_FEATURES)
-                return -EOPNOTSUPP;
-
-        mutex_lock(&vs->dev.mutex);
-        if ((features & (1 << VHOST_F_LOG_ALL)) &&
-            !vhost_log_access_ok(&vs->dev)) {
-                mutex_unlock(&vs->dev.mutex);
-                return -EFAULT;
-        }
-        vs->dev.acked_features = features;
-        smp_wmb();
-        vhost_scsi_flush(vs);
-        mutex_unlock(&vs->dev.mutex);
-        return 0;
-}
-
 static long vhost_scsi_ioctl(struct file *f, unsigned int ioctl,
                                 unsigned long arg)
 {
@@ -992,7 +1063,7 @@ static long vhost_scsi_ioctl(struct file *f, unsigned int ioctl,
                         return -EFAULT;
                 return 0;
         case VHOST_GET_FEATURES:
-                features = VHOST_FEATURES;
+                features = VHOST_SCSI_FEATURES;
                 if (copy_to_user(featurep, &features, sizeof features))
                         return -EFAULT;
                 return 0;
diff --git a/drivers/video/fbmon.c b/drivers/video/fbmon.c
index 94ad0f71383c..7f6709991a5c 100644
--- a/drivers/video/fbmon.c
+++ b/drivers/video/fbmon.c
@@ -1400,7 +1400,7 @@ int fb_videomode_from_videomode(const struct videomode *vm,
         fbmode->vmode = 0;
         if (vm->dmt_flags & VESA_DMT_HSYNC_HIGH)
                 fbmode->sync |= FB_SYNC_HOR_HIGH_ACT;
-        if (vm->dmt_flags & VESA_DMT_HSYNC_HIGH)
+        if (vm->dmt_flags & VESA_DMT_VSYNC_HIGH)
                 fbmode->sync |= FB_SYNC_VERT_HIGH_ACT;
         if (vm->data_flags & DISPLAY_FLAGS_INTERLACED)
                 fbmode->vmode |= FB_VMODE_INTERLACED;
diff --git a/drivers/video/mxsfb.c b/drivers/video/mxsfb.c
index 755556ca5b2d..45169cbaba6e 100644
--- a/drivers/video/mxsfb.c
+++ b/drivers/video/mxsfb.c
@@ -169,6 +169,7 @@ struct mxsfb_info {
         unsigned dotclk_delay;
         const struct mxsfb_devdata *devdata;
         int mapped;
+        u32 sync;
 };
 
 #define mxsfb_is_v3(host) (host->devdata->ipversion == 3)
@@ -456,9 +457,9 @@ static int mxsfb_set_par(struct fb_info *fb_info)
                 vdctrl0 |= VDCTRL0_HSYNC_ACT_HIGH;
         if (fb_info->var.sync & FB_SYNC_VERT_HIGH_ACT)
                 vdctrl0 |= VDCTRL0_VSYNC_ACT_HIGH;
-        if (fb_info->var.sync & FB_SYNC_DATA_ENABLE_HIGH_ACT)
+        if (host->sync & MXSFB_SYNC_DATA_ENABLE_HIGH_ACT)
                 vdctrl0 |= VDCTRL0_ENABLE_ACT_HIGH;
-        if (fb_info->var.sync & FB_SYNC_DOTCLK_FAILING_ACT)
+        if (host->sync & MXSFB_SYNC_DOTCLK_FAILING_ACT)
                 vdctrl0 |= VDCTRL0_DOTCLK_ACT_FAILING;
 
         writel(vdctrl0, host->base + LCDC_VDCTRL0);
@@ -861,6 +862,8 @@ static int mxsfb_probe(struct platform_device *pdev)
 
         INIT_LIST_HEAD(&fb_info->modelist);
 
+        host->sync = pdata->sync;
+
         ret = mxsfb_init_fbinfo(host);
         if (ret != 0)
                 goto error_init_fb;
diff --git a/drivers/video/omap/omapfb_main.c b/drivers/video/omap/omapfb_main.c
index e31f5b33b501..d40612c31a98 100644
--- a/drivers/video/omap/omapfb_main.c
+++ b/drivers/video/omap/omapfb_main.c
@@ -32,6 +32,8 @@
 
 #include <linux/omap-dma.h>
 
+#include <mach/hardware.h>
+
 #include "omapfb.h"
 #include "lcdc.h"
 
diff --git a/drivers/video/omap2/displays/panel-tpo-td043mtea1.c b/drivers/video/omap2/displays/panel-tpo-td043mtea1.c
index 6b6643911d29..048c98381ef6 100644
--- a/drivers/video/omap2/displays/panel-tpo-td043mtea1.c
+++ b/drivers/video/omap2/displays/panel-tpo-td043mtea1.c
@@ -63,6 +63,9 @@ struct tpo_td043_device {
         u32 power_on_resume:1;
 };
 
+/* used to pass spi_device from SPI to DSS portion of the driver */
+static struct tpo_td043_device *g_tpo_td043;
+
 static int tpo_td043_write(struct spi_device *spi, u8 addr, u8 data)
 {
         struct spi_message      m;
@@ -403,7 +406,7 @@ static void tpo_td043_disable(struct omap_dss_device *dssdev)
 
 static int tpo_td043_probe(struct omap_dss_device *dssdev)
 {
-        struct tpo_td043_device *tpo_td043 = dev_get_drvdata(&dssdev->dev);
+        struct tpo_td043_device *tpo_td043 = g_tpo_td043;
         int nreset_gpio = dssdev->reset_gpio;
         int ret = 0;
 
@@ -440,6 +443,8 @@ static int tpo_td043_probe(struct omap_dss_device *dssdev)
         if (ret)
                 dev_warn(&dssdev->dev, "failed to create sysfs files\n");
 
+        dev_set_drvdata(&dssdev->dev, tpo_td043);
+
         return 0;
 
 fail_gpio_req:
@@ -505,6 +510,9 @@ static int tpo_td043_spi_probe(struct spi_device *spi)
                 return -ENODEV;
         }
 
+        if (g_tpo_td043 != NULL)
+                return -EBUSY;
+
         spi->bits_per_word = 16;
         spi->mode = SPI_MODE_0;
 
@@ -521,7 +529,7 @@ static int tpo_td043_spi_probe(struct spi_device *spi)
         tpo_td043->spi = spi;
         tpo_td043->nreset_gpio = dssdev->reset_gpio;
         dev_set_drvdata(&spi->dev, tpo_td043);
-        dev_set_drvdata(&dssdev->dev, tpo_td043);
+        g_tpo_td043 = tpo_td043;
 
         omap_dss_register_driver(&tpo_td043_driver);
 
@@ -534,6 +542,7 @@ static int tpo_td043_spi_remove(struct spi_device *spi)
 
         omap_dss_unregister_driver(&tpo_td043_driver);
         kfree(tpo_td043);
+        g_tpo_td043 = NULL;
 
         return 0;
 }
diff --git a/drivers/video/omap2/dss/dss_features.c b/drivers/video/omap2/dss/dss_features.c
index d7d66ef5cb58..7f791aeda4d2 100644
--- a/drivers/video/omap2/dss/dss_features.c
+++ b/drivers/video/omap2/dss/dss_features.c
@@ -202,12 +202,10 @@ static const enum omap_dss_output_id omap3630_dss_supported_outputs[] = {
 
 static const enum omap_dss_output_id omap4_dss_supported_outputs[] = {
         /* OMAP_DSS_CHANNEL_LCD */
-        OMAP_DSS_OUTPUT_DPI | OMAP_DSS_OUTPUT_DBI |
-        OMAP_DSS_OUTPUT_DSI1,
+        OMAP_DSS_OUTPUT_DBI | OMAP_DSS_OUTPUT_DSI1,
 
         /* OMAP_DSS_CHANNEL_DIGIT */
-        OMAP_DSS_OUTPUT_VENC | OMAP_DSS_OUTPUT_HDMI |
-        OMAP_DSS_OUTPUT_DPI,
+        OMAP_DSS_OUTPUT_VENC | OMAP_DSS_OUTPUT_HDMI,
 
         /* OMAP_DSS_CHANNEL_LCD2 */
         OMAP_DSS_OUTPUT_DPI | OMAP_DSS_OUTPUT_DBI |
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 63203acef812..0264704a52be 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -858,6 +858,7 @@ static void sh_mobile_lcdc_geometry(struct sh_mobile_lcdc_chan *ch)
         tmp = ((mode->xres & 7) << 24) | ((display_h_total & 7) << 16)
             | ((mode->hsync_len & 7) << 8) | (hsync_pos & 7);
         lcdc_write_chan(ch, LDHAJR, tmp);
+        lcdc_write_chan_mirror(ch, LDHAJR, tmp);
 }
 
 static void sh_mobile_lcdc_overlay_setup(struct sh_mobile_lcdc_overlay *ovl)
diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
index b75db0186488..d4284458377e 100644
--- a/drivers/video/uvesafb.c
+++ b/drivers/video/uvesafb.c
@@ -1973,7 +1973,8 @@ static int uvesafb_init(void)
                         err = -ENOMEM;
 
                 if (err) {
-                        platform_device_put(uvesafb_device);
+                        if (uvesafb_device)
+                                platform_device_put(uvesafb_device);
                         platform_driver_unregister(&uvesafb_driver);
                         cn_del_callback(&uvesafb_cn_id);
                         return err;
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 9fcc70c11cea..e89fc3133972 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -117,7 +117,7 @@ config ARM_SP805_WATCHDOG
 
 config AT91RM9200_WATCHDOG
         tristate "AT91RM9200 watchdog"
-        depends on ARCH_AT91
+        depends on ARCH_AT91RM9200
         help
           Watchdog timer embedded into AT91RM9200 chips. This will reboot your
           system when the timeout is reached.
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index 5a32232cf7c1..67af155cf602 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -182,7 +182,7 @@ config XEN_PRIVCMD
 
 config XEN_STUB
         bool "Xen stub drivers"
-        depends on XEN && X86_64
+        depends on XEN && X86_64 && BROKEN
         default n
         help
           Allow kernel to install stub drivers, to reserve space for Xen drivers,
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index d17aa41a9041..2647ad8e1f19 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -403,11 +403,23 @@ static void unmask_evtchn(int port)
 
         if (unlikely((cpu != cpu_from_evtchn(port))))
                 do_hypercall = 1;
-        else
+        else {
+                /*
+                 * Need to clear the mask before checking pending to
+                 * avoid a race with an event becoming pending.
+                 *
+                 * EVTCHNOP_unmask will only trigger an upcall if the
+                 * mask bit was set, so if a hypercall is needed
+                 * remask the event.
+                 */
+                sync_clear_bit(port, BM(&s->evtchn_mask[0]));
                 evtchn_pending = sync_test_bit(port, BM(&s->evtchn_pending[0]));
 
-        if (unlikely(evtchn_pending && xen_hvm_domain()))
-                do_hypercall = 1;
+                if (unlikely(evtchn_pending && xen_hvm_domain())) {
+                        sync_set_bit(port, BM(&s->evtchn_mask[0]));
+                        do_hypercall = 1;
+                }
+        }
 
         /* Slow path (hypercall) if this is a non-local port or if this is
          * an hvm domain and an event is pending (hvm domains don't have
@@ -418,8 +430,6 @@ static void unmask_evtchn(int port)
         } else {
                 struct vcpu_info *vcpu_info = __this_cpu_read(xen_vcpu);
 
-                sync_clear_bit(port, BM(&s->evtchn_mask[0]));
-
                 /*
                  * The following is basically the equivalent of
                  * 'hw_resend_irq'. Just like a real IO-APIC we 'lose
@@ -1306,7 +1316,7 @@ static void __xen_evtchn_do_upcall(void)
 {
         int start_word_idx, start_bit_idx;
         int word_idx, bit_idx;
-        int i;
+        int i, irq;
         int cpu = get_cpu();
         struct shared_info *s = HYPERVISOR_shared_info;
         struct vcpu_info *vcpu_info = __this_cpu_read(xen_vcpu);
@@ -1314,6 +1324,8 @@ static void __xen_evtchn_do_upcall(void)
 
         do {
                 xen_ulong_t pending_words;
+                xen_ulong_t pending_bits;
+                struct irq_desc *desc;
 
                 vcpu_info->evtchn_upcall_pending = 0;
 
@@ -1325,6 +1337,17 @@ static void __xen_evtchn_do_upcall(void)
                  * selector flag. xchg_xen_ulong must contain an
                  * appropriate barrier.
                  */
+                if ((irq = per_cpu(virq_to_irq, cpu)[VIRQ_TIMER]) != -1) {
+                        int evtchn = evtchn_from_irq(irq);
+                        word_idx = evtchn / BITS_PER_LONG;
+                        pending_bits = evtchn % BITS_PER_LONG;
+                        if (active_evtchns(cpu, s, word_idx) & (1ULL << pending_bits)) {
+                                desc = irq_to_desc(irq);
+                                if (desc)
+                                        generic_handle_irq_desc(irq, desc);
+                        }
+                }
+
                 pending_words = xchg_xen_ulong(&vcpu_info->evtchn_pending_sel, 0);
 
                 start_word_idx = __this_cpu_read(current_word_idx);
@@ -1333,7 +1356,6 @@ static void __xen_evtchn_do_upcall(void)
                 word_idx = start_word_idx;
 
                 for (i = 0; pending_words != 0; i++) {
-                        xen_ulong_t pending_bits;
                         xen_ulong_t words;
 
                         words = MASK_LSBS(pending_words, word_idx);
@@ -1362,8 +1384,7 @@ static void __xen_evtchn_do_upcall(void)
 
                         do {
                                 xen_ulong_t bits;
-                                int port, irq;
-                                struct irq_desc *desc;
+                                int port;
 
                                 bits = MASK_LSBS(pending_bits, bit_idx);
 
diff --git a/drivers/xen/fallback.c b/drivers/xen/fallback.c
index 0ef7c4d40f86..b04fb64c5a91 100644
--- a/drivers/xen/fallback.c
+++ b/drivers/xen/fallback.c
@@ -44,7 +44,7 @@ int xen_event_channel_op_compat(int cmd, void *arg)
 }
 EXPORT_SYMBOL_GPL(xen_event_channel_op_compat);
 
-int HYPERVISOR_physdev_op_compat(int cmd, void *arg)
+int xen_physdev_op_compat(int cmd, void *arg)
 {
         struct physdev_op op;
         int rc;
@@ -78,3 +78,4 @@ int HYPERVISOR_physdev_op_compat(int cmd, void *arg)
 
         return rc;
 }
+EXPORT_SYMBOL_GPL(xen_physdev_op_compat);
diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
index f3278a6603ca..90e34ac7e522 100644
--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -505,6 +505,9 @@ static int __init xen_acpi_processor_init(void)
 
                 pr = per_cpu(processors, i);
                 perf = per_cpu_ptr(acpi_perf_data, i);
+                if (!pr)
+                        continue;
+
                 pr->performance = perf;
                 rc = acpi_processor_get_performance_info(pr);
                 if (rc)
diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
index 9204126f1560..a2278ba7fb27 100644
--- a/drivers/xen/xen-pciback/pci_stub.c
+++ b/drivers/xen/xen-pciback/pci_stub.c
@@ -17,6 +17,7 @@
 #include <xen/events.h>
 #include <asm/xen/pci.h>
 #include <asm/xen/hypervisor.h>
+#include <xen/interface/physdev.h>
 #include "pciback.h"
 #include "conf_space.h"
 #include "conf_space_quirks.h"
@@ -85,37 +86,52 @@ static struct pcistub_device *pcistub_device_alloc(struct pci_dev *dev)
 static void pcistub_device_release(struct kref *kref)
 {
         struct pcistub_device *psdev;
+        struct pci_dev *dev;
         struct xen_pcibk_dev_data *dev_data;
 
         psdev = container_of(kref, struct pcistub_device, kref);
-        dev_data = pci_get_drvdata(psdev->dev);
+        dev = psdev->dev;
+        dev_data = pci_get_drvdata(dev);
 
-        dev_dbg(&psdev->dev->dev, "pcistub_device_release\n");
+        dev_dbg(&dev->dev, "pcistub_device_release\n");
 
-        xen_unregister_device_domain_owner(psdev->dev);
+        xen_unregister_device_domain_owner(dev);
 
         /* Call the reset function which does not take lock as this
          * is called from "unbind" which takes a device_lock mutex.
          */
-        __pci_reset_function_locked(psdev->dev);
-        if (pci_load_and_free_saved_state(psdev->dev,
-                                          &dev_data->pci_saved_state)) {
-                dev_dbg(&psdev->dev->dev, "Could not reload PCI state\n");
-        } else
-                pci_restore_state(psdev->dev);
+        __pci_reset_function_locked(dev);
+        if (pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
+                dev_dbg(&dev->dev, "Could not reload PCI state\n");
+        else
+                pci_restore_state(dev);
+
+        if (pci_find_capability(dev, PCI_CAP_ID_MSIX)) {
+                struct physdev_pci_device ppdev = {
+                        .seg = pci_domain_nr(dev->bus),
+                        .bus = dev->bus->number,
+                        .devfn = dev->devfn
+                };
+                int err = HYPERVISOR_physdev_op(PHYSDEVOP_release_msix,
+                                                &ppdev);
+
+                if (err)
+                        dev_warn(&dev->dev, "MSI-X release failed (%d)\n",
+                                 err);
+        }
 
         /* Disable the device */
-        xen_pcibk_reset_device(psdev->dev);
+        xen_pcibk_reset_device(dev);
 
         kfree(dev_data);
-        pci_set_drvdata(psdev->dev, NULL);
+        pci_set_drvdata(dev, NULL);
 
         /* Clean-up the device */
-        xen_pcibk_config_free_dyn_fields(psdev->dev);
-        xen_pcibk_config_free_dev(psdev->dev);
+        xen_pcibk_config_free_dyn_fields(dev);
+        xen_pcibk_config_free_dev(dev);
 
-        psdev->dev->dev_flags &= ~PCI_DEV_FLAGS_ASSIGNED;
-        pci_dev_put(psdev->dev);
+        dev->dev_flags &= ~PCI_DEV_FLAGS_ASSIGNED;
+        pci_dev_put(dev);
 
         kfree(psdev);
 }
@@ -355,6 +371,19 @@ static int pcistub_init_device(struct pci_dev *dev)
         if (err)
                 goto config_release;
 
+        if (pci_find_capability(dev, PCI_CAP_ID_MSIX)) {
+                struct physdev_pci_device ppdev = {
+                        .seg = pci_domain_nr(dev->bus),
+                        .bus = dev->bus->number,
+                        .devfn = dev->devfn
+                };
+
+                err = HYPERVISOR_physdev_op(PHYSDEVOP_prepare_msix, &ppdev);
+                if (err)
+                        dev_err(&dev->dev, "MSI-X preparation failed (%d)\n",
+                                err);
+        }
+
         /* We need the device active to save the state. */
         dev_dbg(&dev->dev, "save state of device\n");
         pci_save_state(dev);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index aea605c98ba6..aae187a7f94a 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -551,6 +551,7 @@ struct block_device *bdgrab(struct block_device *bdev)
         ihold(bdev->bd_inode);
         return bdev;
 }
+EXPORT_SYMBOL(bdgrab);
 
 long nr_blockdev_pages(void)
 {
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index ecd25a1b4e51..ca9d8f1a3bb6 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -651,6 +651,8 @@ tree_mod_log_insert_root(struct btrfs_fs_info *fs_info,
         if (tree_mod_dont_log(fs_info, NULL))
                 return 0;
 
+        __tree_mod_log_free_eb(fs_info, old_root);
+
         ret = tree_mod_alloc(fs_info, flags, &tm);
         if (ret < 0)
                 goto out;
@@ -736,7 +738,7 @@ tree_mod_log_search(struct btrfs_fs_info *fs_info, u64 start, u64 min_seq)
 static noinline void
 tree_mod_log_eb_copy(struct btrfs_fs_info *fs_info, struct extent_buffer *dst,
                      struct extent_buffer *src, unsigned long dst_offset,
-                     unsigned long src_offset, int nr_items)
+                     unsigned long src_offset, int nr_items, int log_removal)
 {
         int ret;
         int i;
@@ -750,10 +752,12 @@ tree_mod_log_eb_copy(struct btrfs_fs_info *fs_info, struct extent_buffer *dst,
         }
 
         for (i = 0; i < nr_items; i++) {
-                ret = tree_mod_log_insert_key_locked(fs_info, src,
-                                                     i + src_offset,
-                                                     MOD_LOG_KEY_REMOVE);
-                BUG_ON(ret < 0);
+                if (log_removal) {
+                        ret = tree_mod_log_insert_key_locked(fs_info, src,
+                                                        i + src_offset,
+                                                        MOD_LOG_KEY_REMOVE);
+                        BUG_ON(ret < 0);
+                }
                 ret = tree_mod_log_insert_key_locked(fs_info, dst,
                                                      i + dst_offset,
                                                      MOD_LOG_KEY_ADD);
@@ -927,7 +931,6 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
                         ret = btrfs_dec_ref(trans, root, buf, 1, 1);
                         BUG_ON(ret); /* -ENOMEM */
                 }
-                tree_mod_log_free_eb(root->fs_info, buf);
                 clean_tree_block(trans, root, buf);
                 *last_ref = 1;
         }
@@ -1046,6 +1049,7 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
                 btrfs_set_node_ptr_generation(parent, parent_slot,
                                               trans->transid);
                 btrfs_mark_buffer_dirty(parent);
+                tree_mod_log_free_eb(root->fs_info, buf);
                 btrfs_free_tree_block(trans, root, buf, parent_start,
                                       last_ref);
         }
@@ -1750,7 +1754,6 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                         goto enospc;
                 }
 
-                tree_mod_log_free_eb(root->fs_info, root->node);
                 tree_mod_log_set_root_pointer(root, child);
                 rcu_assign_pointer(root->node, child);
 
@@ -2995,7 +2998,7 @@ static int push_node_left(struct btrfs_trans_handle *trans,
                 push_items = min(src_nritems - 8, push_items);
 
         tree_mod_log_eb_copy(root->fs_info, dst, src, dst_nritems, 0,
-                             push_items);
+                             push_items, 1);
         copy_extent_buffer(dst, src,
                            btrfs_node_key_ptr_offset(dst_nritems),
                            btrfs_node_key_ptr_offset(0),
@@ -3066,7 +3069,7 @@ static int balance_node_right(struct btrfs_trans_handle *trans,
                                       sizeof(struct btrfs_key_ptr));
 
         tree_mod_log_eb_copy(root->fs_info, dst, src, 0,
-                             src_nritems - push_items, push_items);
+                             src_nritems - push_items, push_items, 1);
         copy_extent_buffer(dst, src,
                            btrfs_node_key_ptr_offset(0),
                            btrfs_node_key_ptr_offset(src_nritems - push_items),
@@ -3218,12 +3221,18 @@ static noinline int split_node(struct btrfs_trans_handle *trans,
         int mid;
         int ret;
         u32 c_nritems;
+        int tree_mod_log_removal = 1;
 
         c = path->nodes[level];
         WARN_ON(btrfs_header_generation(c) != trans->transid);
         if (c == root->node) {
                 /* trying to split the root, lets make a new one */
                 ret = insert_new_root(trans, root, path, level + 1);
+                /*
+                 * removal of root nodes has been logged by
+                 * tree_mod_log_set_root_pointer due to locking
+                 */
+                tree_mod_log_removal = 0;
                 if (ret)
                         return ret;
         } else {
@@ -3261,7 +3270,8 @@ static noinline int split_node(struct btrfs_trans_handle *trans,
                             (unsigned long)btrfs_header_chunk_tree_uuid(split),
                             BTRFS_UUID_SIZE);
 
-        tree_mod_log_eb_copy(root->fs_info, split, c, 0, mid, c_nritems - mid);
+        tree_mod_log_eb_copy(root->fs_info, split, c, 0, mid, c_nritems - mid,
+                             tree_mod_log_removal);
         copy_extent_buffer(split, c,
                            btrfs_node_key_ptr_offset(0),
                            btrfs_node_key_ptr_offset(mid),
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 7d84651e850b..6d19a0a554aa 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1291,6 +1291,7 @@ struct btrfs_root *btrfs_create_tree(struct btrfs_trans_handle *trans,
                                       0, objectid, NULL, 0, 0, 0);
         if (IS_ERR(leaf)) {
                 ret = PTR_ERR(leaf);
+                leaf = NULL;
                 goto fail;
         }
 
@@ -1334,11 +1335,16 @@ struct btrfs_root *btrfs_create_tree(struct btrfs_trans_handle *trans,
 
         btrfs_tree_unlock(leaf);
 
+        return root;
+
 fail:
-        if (ret)
-                return ERR_PTR(ret);
+        if (leaf) {
+                btrfs_tree_unlock(leaf);
+                free_extent_buffer(leaf);
+        }
+        kfree(root);
 
-        return root;
+        return ERR_PTR(ret);
 }
 
 static struct btrfs_root *alloc_log_tree(struct btrfs_trans_handle *trans,
@@ -3253,7 +3259,7 @@ void btrfs_free_fs_root(struct btrfs_fs_info *fs_info, struct btrfs_root *root)
         if (btrfs_root_refs(&root->root_item) == 0)
                 synchronize_srcu(&fs_info->subvol_srcu);
 
-        if (fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) {
+        if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state)) {
                 btrfs_free_log(NULL, root);
                 btrfs_free_log_root_tree(NULL, fs_info);
         }
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 9ac2eca681eb..3d551231caba 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -257,7 +257,8 @@ static int exclude_super_stripes(struct btrfs_root *root,
                 cache->bytes_super += stripe_len;
                 ret = add_excluded_extent(root, cache->key.objectid,
                                           stripe_len);
-                BUG_ON(ret); /* -ENOMEM */
+                if (ret)
+                        return ret;
         }
 
         for (i = 0; i < BTRFS_SUPER_MIRROR_MAX; i++) {
@@ -265,13 +266,17 @@ static int exclude_super_stripes(struct btrfs_root *root,
                 ret = btrfs_rmap_block(&root->fs_info->mapping_tree,
                                        cache->key.objectid, bytenr,
                                        0, &logical, &nr, &stripe_len);
-                BUG_ON(ret); /* -ENOMEM */
+                if (ret)
+                        return ret;
 
                 while (nr--) {
                         cache->bytes_super += stripe_len;
                         ret = add_excluded_extent(root, logical[nr],
                                                   stripe_len);
-                        BUG_ON(ret); /* -ENOMEM */
+                        if (ret) {
+                                kfree(logical);
+                                return ret;
+                        }
                 }
 
                 kfree(logical);
@@ -4438,7 +4443,7 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
         spin_lock(&sinfo->lock);
         spin_lock(&block_rsv->lock);
 
-        block_rsv->size = num_bytes;
+        block_rsv->size = min_t(u64, num_bytes, 512 * 1024 * 1024);
 
         num_bytes = sinfo->bytes_used + sinfo->bytes_pinned +
                     sinfo->bytes_reserved + sinfo->bytes_readonly +
@@ -4793,14 +4798,49 @@ out_fail:
          * If the inodes csum_bytes is the same as the original
          * csum_bytes then we know we haven't raced with any free()ers
          * so we can just reduce our inodes csum bytes and carry on.
-         * Otherwise we have to do the normal free thing to account for
-         * the case that the free side didn't free up its reserve
-         * because of this outstanding reservation.
          */
-        if (BTRFS_I(inode)->csum_bytes == csum_bytes)
+        if (BTRFS_I(inode)->csum_bytes == csum_bytes) {
                 calc_csum_metadata_size(inode, num_bytes, 0);
-        else
-                to_free = calc_csum_metadata_size(inode, num_bytes, 0);
+        } else {
+                u64 orig_csum_bytes = BTRFS_I(inode)->csum_bytes;
+                u64 bytes;
+
+                /*
+                 * This is tricky, but first we need to figure out how much we
+                 * free'd from any free-ers that occured during this
+                 * reservation, so we reset ->csum_bytes to the csum_bytes
+                 * before we dropped our lock, and then call the free for the
+                 * number of bytes that were freed while we were trying our
+                 * reservation.
+                 */
+                bytes = csum_bytes - BTRFS_I(inode)->csum_bytes;
+                BTRFS_I(inode)->csum_bytes = csum_bytes;
+                to_free = calc_csum_metadata_size(inode, bytes, 0);
+
+
+                /*
+                 * Now we need to see how much we would have freed had we not
+                 * been making this reservation and our ->csum_bytes were not
+                 * artificially inflated.
+                 */
+                BTRFS_I(inode)->csum_bytes = csum_bytes - num_bytes;
+                bytes = csum_bytes - orig_csum_bytes;
+                bytes = calc_csum_metadata_size(inode, bytes, 0);
+
+                /*
+                 * Now reset ->csum_bytes to what it should be.  If bytes is
+                 * more than to_free then we would have free'd more space had we
+                 * not had an artificially high ->csum_bytes, so we need to free
+                 * the remainder.  If bytes is the same or less then we don't
+                 * need to do anything, the other free-ers did the correct
+                 * thing.
+                 */
+                BTRFS_I(inode)->csum_bytes = orig_csum_bytes - num_bytes;
+                if (bytes > to_free)
+                        to_free = bytes - to_free;
+                else
+                        to_free = 0;
+        }
         spin_unlock(&BTRFS_I(inode)->lock);
         if (dropped)
                 to_free += btrfs_calc_trans_metadata_size(root, dropped);
@@ -7947,7 +7987,17 @@ int btrfs_read_block_groups(struct btrfs_root *root)
                  * info has super bytes accounted for, otherwise we'll think
                  * we have more space than we actually do.
                  */
-                exclude_super_stripes(root, cache);
+                ret = exclude_super_stripes(root, cache);
+                if (ret) {
+                        /*
+                         * We may have excluded something, so call this just in
+                         * case.
+                         */
+                        free_excluded_extents(root, cache);
+                        kfree(cache->free_space_ctl);
+                        kfree(cache);
+                        goto error;
+                }
 
                 /*
                  * check for two cases, either we are full, and therefore
@@ -8089,7 +8139,17 @@ int btrfs_make_block_group(struct btrfs_trans_handle *trans,
 
         cache->last_byte_to_unpin = (u64)-1;
         cache->cached = BTRFS_CACHE_FINISHED;
-        exclude_super_stripes(root, cache);
+        ret = exclude_super_stripes(root, cache);
+        if (ret) {
+                /*
+                 * We may have excluded something, so call this just in
+                 * case.
+                 */
+                free_excluded_extents(root, cache);
+                kfree(cache->free_space_ctl);
+                kfree(cache);
+                return ret;
+        }
 
         add_new_free_space(cache, root->fs_info, chunk_offset,
                            chunk_offset + size);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index f173c5af6461..cdee391fc7bf 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -1257,6 +1257,39 @@ int unlock_extent(struct extent_io_tree *tree, u64 start, u64 end)
                                 GFP_NOFS);
 }
 
+int extent_range_clear_dirty_for_io(struct inode *inode, u64 start, u64 end)
+{
+        unsigned long index = start >> PAGE_CACHE_SHIFT;
+        unsigned long end_index = end >> PAGE_CACHE_SHIFT;
+        struct page *page;
+
+        while (index <= end_index) {
+                page = find_get_page(inode->i_mapping, index);
+                BUG_ON(!page); /* Pages should be in the extent_io_tree */
+                clear_page_dirty_for_io(page);
+                page_cache_release(page);
+                index++;
+        }
+        return 0;
+}
+
+int extent_range_redirty_for_io(struct inode *inode, u64 start, u64 end)
+{
+        unsigned long index = start >> PAGE_CACHE_SHIFT;
+        unsigned long end_index = end >> PAGE_CACHE_SHIFT;
+        struct page *page;
+
+        while (index <= end_index) {
+                page = find_get_page(inode->i_mapping, index);
+                BUG_ON(!page); /* Pages should be in the extent_io_tree */
+                account_page_redirty(page);
+                __set_page_dirty_nobuffers(page);
+                page_cache_release(page);
+                index++;
+        }
+        return 0;
+}
+
 /*
  * helper function to set both pages and extents in the tree writeback
  */
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index 6068a1985560..258c92156857 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -325,6 +325,8 @@ int map_private_extent_buffer(struct extent_buffer *eb, unsigned long offset,
                       unsigned long *map_len);
 int extent_range_uptodate(struct extent_io_tree *tree,
                           u64 start, u64 end);
+int extent_range_clear_dirty_for_io(struct inode *inode, u64 start, u64 end);
+int extent_range_redirty_for_io(struct inode *inode, u64 start, u64 end);
 int extent_clear_unlock_delalloc(struct inode *inode,
                                 struct extent_io_tree *tree,
                                 u64 start, u64 end, struct page *locked_page,
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
index ec160202be3e..c4628a201cb3 100644
--- a/fs/btrfs/file-item.c
+++ b/fs/btrfs/file-item.c
@@ -118,9 +118,11 @@ struct btrfs_csum_item *btrfs_lookup_csum(struct btrfs_trans_handle *trans,
                 csums_in_item = btrfs_item_size_nr(leaf, path->slots[0]);
                 csums_in_item /= csum_size;
 
-                if (csum_offset >= csums_in_item) {
+                if (csum_offset == csums_in_item) {
                         ret = -EFBIG;
                         goto fail;
+                } else if (csum_offset > csums_in_item) {
+                        goto fail;
                 }
         }
         item = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_csum_item);
@@ -728,7 +730,6 @@ int btrfs_csum_file_blocks(struct btrfs_trans_handle *trans,
                 return -ENOMEM;
 
         sector_sum = sums->sums;
-        trans->adding_csums = 1;
 again:
         next_offset = (u64)-1;
         found_next = 0;
@@ -899,7 +900,6 @@ next_sector:
                 goto again;
         }
 out:
-        trans->adding_csums = 0;
         btrfs_free_path(path);
         return ret;
 
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 5b4ea5f55b8f..ade03e6f7bd2 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -2142,6 +2142,7 @@ static long btrfs_fallocate(struct file *file, int mode,
 {
         struct inode *inode = file_inode(file);
         struct extent_state *cached_state = NULL;
+        struct btrfs_root *root = BTRFS_I(inode)->root;
         u64 cur_offset;
         u64 last_byte;
         u64 alloc_start;
@@ -2169,6 +2170,11 @@ static long btrfs_fallocate(struct file *file, int mode,
         ret = btrfs_check_data_free_space(inode, alloc_end - alloc_start);
         if (ret)
                 return ret;
+        if (root->fs_info->quota_enabled) {
+                ret = btrfs_qgroup_reserve(root, alloc_end - alloc_start);
+                if (ret)
+                        goto out_reserve_fail;
+        }
 
         /*
          * wait for ordered IO before we have any locks.  We'll loop again
@@ -2272,6 +2278,9 @@ static long btrfs_fallocate(struct file *file, int mode,
                              &cached_state, GFP_NOFS);
 out:
         mutex_unlock(&inode->i_mutex);
+        if (root->fs_info->quota_enabled)
+                btrfs_qgroup_free(root, alloc_end - alloc_start);
+out_reserve_fail:
         /* Let go of our reservation. */
         btrfs_free_reserved_data_space(inode, alloc_end - alloc_start);
         return ret;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index ca1b767d51f7..09c58a35b429 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -353,6 +353,7 @@ static noinline int compress_file_range(struct inode *inode,
         int i;
         int will_compress;
         int compress_type = root->fs_info->compress_type;
+        int redirty = 0;
 
         /* if this is a small write inside eof, kick off a defrag */
         if ((end - start + 1) < 16 * 1024 &&
@@ -415,6 +416,17 @@ again:
                 if (BTRFS_I(inode)->force_compress)
                         compress_type = BTRFS_I(inode)->force_compress;
 
+                /*
+                 * we need to call clear_page_dirty_for_io on each
+                 * page in the range.  Otherwise applications with the file
+                 * mmap'd can wander in and change the page contents while
+                 * we are compressing them.
+                 *
+                 * If the compression fails for any reason, we set the pages
+                 * dirty again later on.
+                 */
+                extent_range_clear_dirty_for_io(inode, start, end);
+                redirty = 1;
                 ret = btrfs_compress_pages(compress_type,
                                            inode->i_mapping, start,
                                            total_compressed, pages,
@@ -554,6 +566,8 @@ cleanup_and_bail_uncompressed:
                         __set_page_dirty_nobuffers(locked_page);
                         /* unlocked later on in the async handlers */
                 }
+                if (redirty)
+                        extent_range_redirty_for_io(inode, start, end);
                 add_async_extent(async_cow, start, end - start + 1,
                                  0, NULL, 0, BTRFS_COMPRESS_NONE);
                 *num_added += 1;
@@ -1743,8 +1757,10 @@ static noinline int add_pending_csums(struct btrfs_trans_handle *trans,
         struct btrfs_ordered_sum *sum;
 
         list_for_each_entry(sum, list, list) {
+                trans->adding_csums = 1;
                 btrfs_csum_file_blocks(trans,
                        BTRFS_I(inode)->root->fs_info->csum_root, sum);
+                trans->adding_csums = 0;
         }
         return 0;
 }
@@ -3679,11 +3695,9 @@ static struct btrfs_trans_handle *__unlink_start_trans(struct inode *dir,
          * 1 for the dir item
          * 1 for the dir index
          * 1 for the inode ref
-         * 1 for the inode ref in the tree log
-         * 2 for the dir entries in the log
          * 1 for the inode
          */
-        trans = btrfs_start_transaction(root, 8);
+        trans = btrfs_start_transaction(root, 5);
         if (!IS_ERR(trans) || PTR_ERR(trans) != -ENOSPC)
                 return trans;
 
@@ -8127,7 +8141,7 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
          * inodes.  So 5 * 2 is 10, plus 1 for the new link, so 11 total items
          * should cover the worst case number of items we'll modify.
          */
-        trans = btrfs_start_transaction(root, 20);
+        trans = btrfs_start_transaction(root, 11);
         if (IS_ERR(trans)) {
                 ret = PTR_ERR(trans);
                 goto out_notrans;
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index dc08d77b717e..005c45db699e 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -557,6 +557,7 @@ void btrfs_wait_ordered_extents(struct btrfs_root *root, int delay_iput)
         INIT_LIST_HEAD(&splice);
         INIT_LIST_HEAD(&works);
 
+        mutex_lock(&root->fs_info->ordered_operations_mutex);
         spin_lock(&root->fs_info->ordered_extent_lock);
         list_splice_init(&root->fs_info->ordered_extents, &splice);
         while (!list_empty(&splice)) {
@@ -600,6 +601,7 @@ void btrfs_wait_ordered_extents(struct btrfs_root *root, int delay_iput)
 
                 cond_resched();
         }
+        mutex_unlock(&root->fs_info->ordered_operations_mutex);
 }
 
 /*
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 5471e47d6559..b44124dd2370 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1153,7 +1153,7 @@ int btrfs_qgroup_account_ref(struct btrfs_trans_handle *trans,
         ret = btrfs_find_all_roots(trans, fs_info, node->bytenr,
                                    sgn > 0 ? node->seq - 1 : node->seq, &roots);
         if (ret < 0)
-                goto out;
+                return ret;
 
         spin_lock(&fs_info->qgroup_lock);
         quota_root = fs_info->quota_root;
@@ -1275,7 +1275,6 @@ int btrfs_qgroup_account_ref(struct btrfs_trans_handle *trans,
         ret = 0;
 unlock:
         spin_unlock(&fs_info->qgroup_lock);
-out:
         ulist_free(roots);
         ulist_free(tmp);
 
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 53c3501fa4ca..85e072b956d5 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -542,7 +542,6 @@ static void scrub_print_warning(const char *errstr, struct scrub_block *sblock)
         eb = path->nodes[0];
         ei = btrfs_item_ptr(eb, path->slots[0], struct btrfs_extent_item);
         item_size = btrfs_item_size_nr(eb, path->slots[0]);
-        btrfs_release_path(path);
 
         if (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK) {
                 do {
@@ -558,7 +557,9 @@ static void scrub_print_warning(const char *errstr, struct scrub_block *sblock)
                                 ret < 0 ? -1 : ref_level,
                                 ret < 0 ? -1 : ref_root);
                 } while (ret != 1);
+                btrfs_release_path(path);
         } else {
+                btrfs_release_path(path);
                 swarn.path = path;
                 swarn.dev = dev;
                 iterate_extent_inodes(fs_info, found_key.objectid,
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index f7a8b861058b..c85e7c6b4598 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -3945,12 +3945,10 @@ static int is_extent_unchanged(struct send_ctx *sctx,
                     found_key.type != key.type) {
                         key.offset += right_len;
                         break;
-                } else {
-                        if (found_key.offset != key.offset + right_len) {
-                                /* Should really not happen */
-                                ret = -EIO;
-                                goto out;
-                        }
+                }
+                if (found_key.offset != key.offset + right_len) {
+                        ret = 0;
+                        goto out;
                 }
                 key = found_key;
         }
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 451fad96ecd1..ef96381569a4 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -317,6 +317,7 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
         unsigned long src_ptr;
         unsigned long dst_ptr;
         int overwrite_root = 0;
+        bool inode_item = key->type == BTRFS_INODE_ITEM_KEY;
 
         if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID)
                 overwrite_root = 1;
@@ -326,6 +327,9 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
 
         /* look for the key in the destination tree */
         ret = btrfs_search_slot(NULL, root, key, path, 0, 0);
+        if (ret < 0)
+                return ret;
+
         if (ret == 0) {
                 char *src_copy;
                 char *dst_copy;
@@ -367,6 +371,30 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
                         return 0;
                 }
 
+                /*
+                 * We need to load the old nbytes into the inode so when we
+                 * replay the extents we've logged we get the right nbytes.
+                 */
+                if (inode_item) {
+                        struct btrfs_inode_item *item;
+                        u64 nbytes;
+
+                        item = btrfs_item_ptr(path->nodes[0], path->slots[0],
+                                              struct btrfs_inode_item);
+                        nbytes = btrfs_inode_nbytes(path->nodes[0], item);
+                        item = btrfs_item_ptr(eb, slot,
+                                              struct btrfs_inode_item);
+                        btrfs_set_inode_nbytes(eb, item, nbytes);
+                }
+        } else if (inode_item) {
+                struct btrfs_inode_item *item;
+
+                /*
+                 * New inode, set nbytes to 0 so that the nbytes comes out
+                 * properly when we replay the extents.
+                 */
+                item = btrfs_item_ptr(eb, slot, struct btrfs_inode_item);
+                btrfs_set_inode_nbytes(eb, item, 0);
         }
 insert:
         btrfs_release_path(path);
@@ -486,7 +514,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
         int found_type;
         u64 extent_end;
         u64 start = key->offset;
-        u64 saved_nbytes;
+        u64 nbytes = 0;
         struct btrfs_file_extent_item *item;
         struct inode *inode = NULL;
         unsigned long size;
@@ -496,10 +524,19 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
         found_type = btrfs_file_extent_type(eb, item);
 
         if (found_type == BTRFS_FILE_EXTENT_REG ||
-            found_type == BTRFS_FILE_EXTENT_PREALLOC)
-                extent_end = start + btrfs_file_extent_num_bytes(eb, item);
-        else if (found_type == BTRFS_FILE_EXTENT_INLINE) {
+            found_type == BTRFS_FILE_EXTENT_PREALLOC) {
+                nbytes = btrfs_file_extent_num_bytes(eb, item);
+                extent_end = start + nbytes;
+
+                /*
+                 * We don't add to the inodes nbytes if we are prealloc or a
+                 * hole.
+                 */
+                if (btrfs_file_extent_disk_bytenr(eb, item) == 0)
+                        nbytes = 0;
+        } else if (found_type == BTRFS_FILE_EXTENT_INLINE) {
                 size = btrfs_file_extent_inline_len(eb, item);
+                nbytes = btrfs_file_extent_ram_bytes(eb, item);
                 extent_end = ALIGN(start + size, root->sectorsize);
         } else {
                 ret = 0;
@@ -548,7 +585,6 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
         }
         btrfs_release_path(path);
 
-        saved_nbytes = inode_get_bytes(inode);
         /* drop any overlapping extents */
         ret = btrfs_drop_extents(trans, root, inode, start, extent_end, 1);
         BUG_ON(ret);
@@ -635,7 +671,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
                 BUG_ON(ret);
         }
 
-        inode_set_bytes(inode, saved_nbytes);
+        inode_add_bytes(inode, nbytes);
         ret = btrfs_update_inode(trans, root, inode);
 out:
         if (inode)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 5989a92236f7..2854c824ab64 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4935,7 +4935,18 @@ int btrfs_rmap_block(struct btrfs_mapping_tree *map_tree,
         em = lookup_extent_mapping(em_tree, chunk_start, 1);
         read_unlock(&em_tree->lock);
 
-        BUG_ON(!em || em->start != chunk_start);
+        if (!em) {
+                printk(KERN_ERR "btrfs: couldn't find em for chunk %Lu\n",
+                       chunk_start);
+                return -EIO;
+        }
+
+        if (em->start != chunk_start) {
+                printk(KERN_ERR "btrfs: bad chunk start, em=%Lu, wanted=%Lu\n",
+                       em->start, chunk_start);
+                free_extent_map(em);
+                return -EIO;
+        }
         map = (struct map_lookup *)em->bdev;
 
         length = em->len;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 991c63c6bdd0..21b3a291c327 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1575,14 +1575,24 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         }
                         break;
                 case Opt_blank_pass:
-                        vol->password = NULL;
-                        break;
-                case Opt_pass:
                         /* passwords have to be handled differently
                          * to allow the character used for deliminator
                          * to be passed within them
                          */
 
+                        /*
+                         * Check if this is a case where the  password
+                         * starts with a delimiter
+                         */
+                        tmp_end = strchr(data, '=');
+                        tmp_end++;
+                        if (!(tmp_end < end && tmp_end[1] == delim)) {
+                                /* No it is not. Set the password to NULL */
+                                vol->password = NULL;
+                                break;
+                        }
+                        /* Yes it is. Drop down to Opt_pass below.*/
+                case Opt_pass:
                         /* Obtain the value string */
                         value = strchr(data, '=');
                         value++;
diff --git a/fs/dcache.c b/fs/dcache.c
index fbfae008ba44..e8bc3420d63e 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2542,7 +2542,6 @@ static int prepend_path(const struct path *path,
         bool slash = false;
         int error = 0;
 
-        br_read_lock(&vfsmount_lock);
         while (dentry != root->dentry || vfsmnt != root->mnt) {
                 struct dentry * parent;
 
@@ -2572,8 +2571,6 @@ static int prepend_path(const struct path *path,
         if (!error && !slash)
                 error = prepend(buffer, buflen, "/", 1);
 
-out:
-        br_read_unlock(&vfsmount_lock);
         return error;
 
 global_root:
@@ -2590,7 +2587,7 @@ global_root:
                 error = prepend(buffer, buflen, "/", 1);
         if (!error)
                 error = is_mounted(vfsmnt) ? 1 : 2;
-        goto out;
+        return error;
 }
 
 /**
@@ -2617,9 +2614,11 @@ char *__d_path(const struct path *path,
         int error;
 
         prepend(&res, &buflen, "\0", 1);
+        br_read_lock(&vfsmount_lock);
         write_seqlock(&rename_lock);
         error = prepend_path(path, root, &res, &buflen);
         write_sequnlock(&rename_lock);
+        br_read_unlock(&vfsmount_lock);
 
         if (error < 0)
                 return ERR_PTR(error);
@@ -2636,9 +2635,11 @@ char *d_absolute_path(const struct path *path,
         int error;
 
         prepend(&res, &buflen, "\0", 1);
+        br_read_lock(&vfsmount_lock);
         write_seqlock(&rename_lock);
         error = prepend_path(path, &root, &res, &buflen);
         write_sequnlock(&rename_lock);
+        br_read_unlock(&vfsmount_lock);
 
         if (error > 1)
                 error = -EINVAL;
@@ -2702,11 +2703,13 @@ char *d_path(const struct path *path, char *buf, int buflen)
                 return path->dentry->d_op->d_dname(path->dentry, buf, buflen);
 
         get_fs_root(current->fs, &root);
+        br_read_lock(&vfsmount_lock);
         write_seqlock(&rename_lock);
         error = path_with_deleted(path, &root, &res, &buflen);
+        write_sequnlock(&rename_lock);
+        br_read_unlock(&vfsmount_lock);
         if (error < 0)
                 res = ERR_PTR(error);
-        write_sequnlock(&rename_lock);
         path_put(&root);
         return res;
 }
@@ -2830,6 +2833,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
         get_fs_root_and_pwd(current->fs, &root, &pwd);
 
         error = -ENOENT;
+        br_read_lock(&vfsmount_lock);
         write_seqlock(&rename_lock);
         if (!d_unlinked(pwd.dentry)) {
                 unsigned long len;
@@ -2839,6 +2843,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
                 prepend(&cwd, &buflen, "\0", 1);
                 error = prepend_path(&pwd, &root, &cwd, &buflen);
                 write_sequnlock(&rename_lock);
+                br_read_unlock(&vfsmount_lock);
 
                 if (error < 0)
                         goto out;
@@ -2859,6 +2864,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
                 }
         } else {
                 write_sequnlock(&rename_lock);
+                br_read_unlock(&vfsmount_lock);
         }
 
 out:
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index 412e6eda25f8..e4141f257495 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -80,13 +80,6 @@ ecryptfs_miscdev_open(struct inode *inode, struct file *file)
         int rc;
 
         mutex_lock(&ecryptfs_daemon_hash_mux);
-        rc = try_module_get(THIS_MODULE);
-        if (rc == 0) {
-                rc = -EIO;
-                printk(KERN_ERR "%s: Error attempting to increment module use "
-                       "count; rc = [%d]\n", __func__, rc);
-                goto out_unlock_daemon_list;
-        }
         rc = ecryptfs_find_daemon_by_euid(&daemon);
         if (!rc) {
                 rc = -EINVAL;
@@ -96,7 +89,7 @@ ecryptfs_miscdev_open(struct inode *inode, struct file *file)
         if (rc) {
                 printk(KERN_ERR "%s: Error attempting to spawn daemon; "
                        "rc = [%d]\n", __func__, rc);
-                goto out_module_put_unlock_daemon_list;
+                goto out_unlock_daemon_list;
         }
         mutex_lock(&daemon->mux);
         if (daemon->flags & ECRYPTFS_DAEMON_MISCDEV_OPEN) {
@@ -108,9 +101,6 @@ ecryptfs_miscdev_open(struct inode *inode, struct file *file)
         atomic_inc(&ecryptfs_num_miscdev_opens);
 out_unlock_daemon:
         mutex_unlock(&daemon->mux);
-out_module_put_unlock_daemon_list:
-        if (rc)
-                module_put(THIS_MODULE);
 out_unlock_daemon_list:
         mutex_unlock(&ecryptfs_daemon_hash_mux);
         return rc;
@@ -147,7 +137,6 @@ ecryptfs_miscdev_release(struct inode *inode, struct file *file)
                        "bug.\n", __func__, rc);
                 BUG();
         }
-        module_put(THIS_MODULE);
         return rc;
 }
 
@@ -471,6 +460,7 @@ out_free:
 
 
 static const struct file_operations ecryptfs_miscdev_fops = {
+        .owner   = THIS_MODULE,
         .open    = ecryptfs_miscdev_open,
         .poll    = ecryptfs_miscdev_poll,
         .read    = ecryptfs_miscdev_read,
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 56efcaadf848..9c6d06dcef8b 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2999,20 +2999,23 @@ static int ext4_split_extent_at(handle_t *handle,
                         if (split_flag & EXT4_EXT_DATA_VALID1) {
                                 err = ext4_ext_zeroout(inode, ex2);
                                 zero_ex.ee_block = ex2->ee_block;
-                                zero_ex.ee_len = ext4_ext_get_actual_len(ex2);
+                                zero_ex.ee_len = cpu_to_le16(
+                                                ext4_ext_get_actual_len(ex2));
                                 ext4_ext_store_pblock(&zero_ex,
                                                       ext4_ext_pblock(ex2));
                         } else {
                                 err = ext4_ext_zeroout(inode, ex);
                                 zero_ex.ee_block = ex->ee_block;
-                                zero_ex.ee_len = ext4_ext_get_actual_len(ex);
+                                zero_ex.ee_len = cpu_to_le16(
+                                                ext4_ext_get_actual_len(ex));
                                 ext4_ext_store_pblock(&zero_ex,
                                                       ext4_ext_pblock(ex));
                         }
                 } else {
                         err = ext4_ext_zeroout(inode, &orig_ex);
                         zero_ex.ee_block = orig_ex.ee_block;
-                        zero_ex.ee_len = ext4_ext_get_actual_len(&orig_ex);
+                        zero_ex.ee_len = cpu_to_le16(
+                                                ext4_ext_get_actual_len(&orig_ex));
                         ext4_ext_store_pblock(&zero_ex,
                                               ext4_ext_pblock(&orig_ex));
                 }
@@ -3272,7 +3275,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
                 if (err)
                         goto out;
                 zero_ex.ee_block = ex->ee_block;
-                zero_ex.ee_len = ext4_ext_get_actual_len(ex);
+                zero_ex.ee_len = cpu_to_le16(ext4_ext_get_actual_len(ex));
                 ext4_ext_store_pblock(&zero_ex, ext4_ext_pblock(ex));
 
                 err = ext4_ext_get_access(handle, inode, path + depth);
diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index b505a145a593..a04183127ef0 100644
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -1539,9 +1539,9 @@ static int free_hole_blocks(handle_t *handle, struct inode *inode,
                 blk = *i_data;
                 if (level > 0) {
                         ext4_lblk_t first2;
-                        bh = sb_bread(inode->i_sb, blk);
+                        bh = sb_bread(inode->i_sb, le32_to_cpu(blk));
                         if (!bh) {
-                                EXT4_ERROR_INODE_BLOCK(inode, blk,
+                                EXT4_ERROR_INODE_BLOCK(inode, le32_to_cpu(blk),
                                                        "Read failure");
                                 return -EIO;
                         }
diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index 019f45e45097..d79c2dadc536 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -923,8 +923,11 @@ static int gfs2_lock(struct file *file, int cmd, struct file_lock *fl)
                 cmd = F_SETLK;
                 fl->fl_type = F_UNLCK;
         }
-        if (unlikely(test_bit(SDF_SHUTDOWN, &sdp->sd_flags)))
+        if (unlikely(test_bit(SDF_SHUTDOWN, &sdp->sd_flags))) {
+                if (fl->fl_type == F_UNLCK)
+                        posix_lock_file_wait(file, fl);
                 return -EIO;
+        }
         if (IS_GETLK(cmd))
                 return dlm_posix_get(ls->ls_dlm, ip->i_no_addr, file, fl);
         else if (fl->fl_type == F_UNLCK)
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index 156e42ec84ea..5c29216e9cc1 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -588,6 +588,7 @@ struct lm_lockstruct {
         struct dlm_lksb ls_control_lksb; /* control_lock */
         char ls_control_lvb[GDLM_LVB_SIZE]; /* control_lock lvb */
         struct completion ls_sync_wait; /* {control,mounted}_{lock,unlock} */
+        char *ls_lvb_bits;
 
         spinlock_t ls_recover_spin; /* protects following fields */
         unsigned long ls_recover_flags; /* DFL_ */
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index 9802de0f85e6..c8423d6de6c3 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -483,12 +483,8 @@ static void control_lvb_write(struct lm_lockstruct *ls, uint32_t lvb_gen,
 
 static int all_jid_bits_clear(char *lvb)
 {
-        int i;
-        for (i = JID_BITMAP_OFFSET; i < GDLM_LVB_SIZE; i++) {
-                if (lvb[i])
-                        return 0;
-        }
-        return 1;
+        return !memchr_inv(lvb + JID_BITMAP_OFFSET, 0,
+                        GDLM_LVB_SIZE - JID_BITMAP_OFFSET);
 }
 
 static void sync_wait_cb(void *arg)
@@ -580,7 +576,6 @@ static void gfs2_control_func(struct work_struct *work)
 {
         struct gfs2_sbd *sdp = container_of(work, struct gfs2_sbd, sd_control_work.work);
         struct lm_lockstruct *ls = &sdp->sd_lockstruct;
-        char lvb_bits[GDLM_LVB_SIZE];
         uint32_t block_gen, start_gen, lvb_gen, flags;
         int recover_set = 0;
         int write_lvb = 0;
@@ -634,7 +629,7 @@ static void gfs2_control_func(struct work_struct *work)
                 return;
         }
 
-        control_lvb_read(ls, &lvb_gen, lvb_bits);
+        control_lvb_read(ls, &lvb_gen, ls->ls_lvb_bits);
 
         spin_lock(&ls->ls_recover_spin);
         if (block_gen != ls->ls_recover_block ||
@@ -664,10 +659,10 @@ static void gfs2_control_func(struct work_struct *work)
 
                         ls->ls_recover_result[i] = 0;
 
-                        if (!test_bit_le(i, lvb_bits + JID_BITMAP_OFFSET))
+                        if (!test_bit_le(i, ls->ls_lvb_bits + JID_BITMAP_OFFSET))
                                 continue;
 
-                        __clear_bit_le(i, lvb_bits + JID_BITMAP_OFFSET);
+                        __clear_bit_le(i, ls->ls_lvb_bits + JID_BITMAP_OFFSET);
                         write_lvb = 1;
                 }
         }
@@ -691,7 +686,7 @@ static void gfs2_control_func(struct work_struct *work)
                                 continue;
                         if (ls->ls_recover_submit[i] < start_gen) {
                                 ls->ls_recover_submit[i] = 0;
-                                __set_bit_le(i, lvb_bits + JID_BITMAP_OFFSET);
+                                __set_bit_le(i, ls->ls_lvb_bits + JID_BITMAP_OFFSET);
                         }
                 }
                 /* even if there are no bits to set, we need to write the
@@ -705,7 +700,7 @@ static void gfs2_control_func(struct work_struct *work)
         spin_unlock(&ls->ls_recover_spin);
 
         if (write_lvb) {
-                control_lvb_write(ls, start_gen, lvb_bits);
+                control_lvb_write(ls, start_gen, ls->ls_lvb_bits);
                 flags = DLM_LKF_CONVERT | DLM_LKF_VALBLK;
         } else {
                 flags = DLM_LKF_CONVERT;
@@ -725,7 +720,7 @@ static void gfs2_control_func(struct work_struct *work)
          */
 
         for (i = 0; i < recover_size; i++) {
-                if (test_bit_le(i, lvb_bits + JID_BITMAP_OFFSET)) {
+                if (test_bit_le(i, ls->ls_lvb_bits + JID_BITMAP_OFFSET)) {
                         fs_info(sdp, "recover generation %u jid %d\n",
                                 start_gen, i);
                         gfs2_recover_set(sdp, i);
@@ -758,7 +753,6 @@ static void gfs2_control_func(struct work_struct *work)
 static int control_mount(struct gfs2_sbd *sdp)
 {
         struct lm_lockstruct *ls = &sdp->sd_lockstruct;
-        char lvb_bits[GDLM_LVB_SIZE];
         uint32_t start_gen, block_gen, mount_gen, lvb_gen;
         int mounted_mode;
         int retries = 0;
@@ -857,7 +851,7 @@ locks_done:
          * lvb_gen will be non-zero.
          */
 
-        control_lvb_read(ls, &lvb_gen, lvb_bits);
+        control_lvb_read(ls, &lvb_gen, ls->ls_lvb_bits);
 
         if (lvb_gen == 0xFFFFFFFF) {
                 /* special value to force mount attempts to fail */
@@ -887,7 +881,7 @@ locks_done:
          * and all lvb bits to be clear (no pending journal recoveries.)
          */
 
-        if (!all_jid_bits_clear(lvb_bits)) {
+        if (!all_jid_bits_clear(ls->ls_lvb_bits)) {
                 /* journals need recovery, wait until all are clear */
                 fs_info(sdp, "control_mount wait for journal recovery\n");
                 goto restart;
@@ -949,7 +943,6 @@ static int dlm_recovery_wait(void *word)
 static int control_first_done(struct gfs2_sbd *sdp)
 {
         struct lm_lockstruct *ls = &sdp->sd_lockstruct;
-        char lvb_bits[GDLM_LVB_SIZE];
         uint32_t start_gen, block_gen;
         int error;
 
@@ -991,8 +984,8 @@ restart:
         memset(ls->ls_recover_result, 0, ls->ls_recover_size*sizeof(uint32_t));
         spin_unlock(&ls->ls_recover_spin);
 
-        memset(lvb_bits, 0, sizeof(lvb_bits));
-        control_lvb_write(ls, start_gen, lvb_bits);
+        memset(ls->ls_lvb_bits, 0, GDLM_LVB_SIZE);
+        control_lvb_write(ls, start_gen, ls->ls_lvb_bits);
 
         error = mounted_lock(sdp, DLM_LOCK_PR, DLM_LKF_CONVERT);
         if (error)
@@ -1022,6 +1015,12 @@ static int set_recover_size(struct gfs2_sbd *sdp, struct dlm_slot *slots,
         uint32_t old_size, new_size;
         int i, max_jid;
 
+        if (!ls->ls_lvb_bits) {
+                ls->ls_lvb_bits = kzalloc(GDLM_LVB_SIZE, GFP_NOFS);
+                if (!ls->ls_lvb_bits)
+                        return -ENOMEM;
+        }
+
         max_jid = 0;
         for (i = 0; i < num_slots; i++) {
                 if (max_jid < slots[i].slot - 1)
@@ -1057,6 +1056,7 @@ static int set_recover_size(struct gfs2_sbd *sdp, struct dlm_slot *slots,
 
 static void free_recover_size(struct lm_lockstruct *ls)
 {
+        kfree(ls->ls_lvb_bits);
         kfree(ls->ls_recover_submit);
         kfree(ls->ls_recover_result);
         ls->ls_recover_submit = NULL;
@@ -1205,6 +1205,7 @@ static int gdlm_mount(struct gfs2_sbd *sdp, const char *table)
         ls->ls_recover_size = 0;
         ls->ls_recover_submit = NULL;
         ls->ls_recover_result = NULL;
+        ls->ls_lvb_bits = NULL;
 
         error = set_recover_size(sdp, NULL, 0);
         if (error)
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index d1f51fd73f86..5a51265a4341 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -576,7 +576,7 @@ int gfs2_rs_alloc(struct gfs2_inode *ip)
         RB_CLEAR_NODE(&ip->i_res->rs_node);
 out:
         up_write(&ip->i_rw_mutex);
-        return 0;
+        return error;
 }
 
 static void dump_rs(struct seq_file *seq, const struct gfs2_blkreserv *rs)
@@ -1181,12 +1181,9 @@ int gfs2_rgrp_send_discards(struct gfs2_sbd *sdp, u64 offset,
                              const struct gfs2_bitmap *bi, unsigned minlen, u64 *ptrimmed)
 {
         struct super_block *sb = sdp->sd_vfs;
-        struct block_device *bdev = sb->s_bdev;
-        const unsigned int sects_per_blk = sdp->sd_sb.sb_bsize /
-                                           bdev_logical_block_size(sb->s_bdev);
         u64 blk;
         sector_t start = 0;
-        sector_t nr_sects = 0;
+        sector_t nr_blks = 0;
         int rv;
         unsigned int x;
         u32 trimmed = 0;
@@ -1206,35 +1203,34 @@ int gfs2_rgrp_send_discards(struct gfs2_sbd *sdp, u64 offset,
                 if (diff == 0)
                         continue;
                 blk = offset + ((bi->bi_start + x) * GFS2_NBBY);
-                blk *= sects_per_blk; /* convert to sectors */
                 while(diff) {
                         if (diff & 1) {
-                                if (nr_sects == 0)
+                                if (nr_blks == 0)
                                         goto start_new_extent;
-                                if ((start + nr_sects) != blk) {
-                                        if (nr_sects >= minlen) {
-                                                rv = blkdev_issue_discard(bdev,
-                                                        start, nr_sects,
+                                if ((start + nr_blks) != blk) {
+                                        if (nr_blks >= minlen) {
+                                                rv = sb_issue_discard(sb,
+                                                        start, nr_blks,
                                                         GFP_NOFS, 0);
                                                 if (rv)
                                                         goto fail;
-                                                trimmed += nr_sects;
+                                                trimmed += nr_blks;
                                         }
-                                        nr_sects = 0;
+                                        nr_blks = 0;
 start_new_extent:
                                         start = blk;
                                 }
-                                nr_sects += sects_per_blk;
+                                nr_blks++;
                         }
                         diff >>= 2;
-                        blk += sects_per_blk;
+                        blk++;
                 }
         }
-        if (nr_sects >= minlen) {
-                rv = blkdev_issue_discard(bdev, start, nr_sects, GFP_NOFS, 0);
+        if (nr_blks >= minlen) {
+                rv = sb_issue_discard(sb, start, nr_blks, GFP_NOFS, 0);
                 if (rv)
                         goto fail;
-                trimmed += nr_sects;
+                trimmed += nr_blks;
         }
         if (ptrimmed)
                 *ptrimmed = trimmed;
diff --git a/fs/inode.c b/fs/inode.c
index f5f7c06c36fb..a898b3d43ccf 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -725,7 +725,7 @@ void prune_icache_sb(struct super_block *sb, int nr_to_scan)
                  * inode to the back of the list so we don't spin on it.
                  */
                 if (!spin_trylock(&inode->i_lock)) {
-                        list_move_tail(&inode->i_lru, &sb->s_inode_lru);
+                        list_move(&inode->i_lru, &sb->s_inode_lru);
                         continue;
                 }
 
diff --git a/fs/internal.h b/fs/internal.h
index 507141fceb99..4be78237d896 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -125,3 +125,8 @@ extern int invalidate_inodes(struct super_block *, bool);
  * dcache.c
  */
 extern struct dentry *__d_alloc(struct super_block *, const struct qstr *);
+
+/*
+ * read_write.c
+ */
+extern ssize_t __kernel_write(struct file *, const char *, size_t, loff_t *);
diff --git a/fs/namespace.c b/fs/namespace.c
index 50ca17d3cb45..341d3f564082 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -798,6 +798,10 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root,
         }
 
         mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~MNT_WRITE_HOLD;
+        /* Don't allow unprivileged users to change mount flags */
+        if ((flag & CL_UNPRIVILEGED) && (mnt->mnt.mnt_flags & MNT_READONLY))
+                mnt->mnt.mnt_flags |= MNT_LOCK_READONLY;
+
         atomic_inc(&sb->s_active);
         mnt->mnt.mnt_sb = sb;
         mnt->mnt.mnt_root = dget(root);
@@ -1686,7 +1690,7 @@ static int do_loopback(struct path *path, const char *old_name,
 
         if (IS_ERR(mnt)) {
                 err = PTR_ERR(mnt);
-                goto out;
+                goto out2;
         }
 
         err = graft_tree(mnt, path);
@@ -1713,6 +1717,9 @@ static int change_mount_flags(struct vfsmount *mnt, int ms_flags)
         if (readonly_request == __mnt_is_readonly(mnt))
                 return 0;
 
+        if (mnt->mnt_flags & MNT_LOCK_READONLY)
+                return -EPERM;
+
         if (readonly_request)
                 error = mnt_make_readonly(real_mount(mnt));
         else
@@ -2339,7 +2346,7 @@ static struct mnt_namespace *dup_mnt_ns(struct mnt_namespace *mnt_ns,
         /* First pass: copy the tree topology */
         copy_flags = CL_COPY_ALL | CL_EXPIRE;
         if (user_ns != mnt_ns->user_ns)
-                copy_flags |= CL_SHARED_TO_SLAVE;
+                copy_flags |= CL_SHARED_TO_SLAVE | CL_UNPRIVILEGED;
         new = copy_tree(old, old->mnt.mnt_root, copy_flags);
         if (IS_ERR(new)) {
                 up_write(&namespace_sem);
@@ -2732,6 +2739,51 @@ bool our_mnt(struct vfsmount *mnt)
         return check_mnt(real_mount(mnt));
 }
 
+bool current_chrooted(void)
+{
+        /* Does the current process have a non-standard root */
+        struct path ns_root;
+        struct path fs_root;
+        bool chrooted;
+
+        /* Find the namespace root */
+        ns_root.mnt = &current->nsproxy->mnt_ns->root->mnt;
+        ns_root.dentry = ns_root.mnt->mnt_root;
+        path_get(&ns_root);
+        while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root))
+                ;
+
+        get_fs_root(current->fs, &fs_root);
+
+        chrooted = !path_equal(&fs_root, &ns_root);
+
+        path_put(&fs_root);
+        path_put(&ns_root);
+
+        return chrooted;
+}
+
+void update_mnt_policy(struct user_namespace *userns)
+{
+        struct mnt_namespace *ns = current->nsproxy->mnt_ns;
+        struct mount *mnt;
+
+        down_read(&namespace_sem);
+        list_for_each_entry(mnt, &ns->list, mnt_list) {
+                switch (mnt->mnt.mnt_sb->s_magic) {
+                case SYSFS_MAGIC:
+                        userns->may_mount_sysfs = true;
+                        break;
+                case PROC_SUPER_MAGIC:
+                        userns->may_mount_proc = true;
+                        break;
+                }
+                if (userns->may_mount_sysfs && userns->may_mount_proc)
+                        break;
+        }
+        up_read(&namespace_sem);
+}
+
 static void *mntns_get(struct task_struct *task)
 {
         struct mnt_namespace *ns = NULL;
diff --git a/fs/nfs/blocklayout/blocklayoutdm.c b/fs/nfs/blocklayout/blocklayoutdm.c
index 737d839bc17b..6fc7b5cae92b 100644
--- a/fs/nfs/blocklayout/blocklayoutdm.c
+++ b/fs/nfs/blocklayout/blocklayoutdm.c
@@ -55,7 +55,8 @@ static void dev_remove(struct net *net, dev_t dev)
 
         bl_pipe_msg.bl_wq = &nn->bl_wq;
         memset(msg, 0, sizeof(*msg));
-        msg->data = kzalloc(1 + sizeof(bl_umount_request), GFP_NOFS);
+        msg->len = sizeof(bl_msg) + bl_msg.totallen;
+        msg->data = kzalloc(msg->len, GFP_NOFS);
         if (!msg->data)
                 goto out;
 
@@ -66,7 +67,6 @@ static void dev_remove(struct net *net, dev_t dev)
         memcpy(msg->data, &bl_msg, sizeof(bl_msg));
         dataptr = (uint8_t *) msg->data;
         memcpy(&dataptr[sizeof(bl_msg)], &bl_umount_request, sizeof(bl_umount_request));
-        msg->len = sizeof(bl_msg) + bl_msg.totallen;
 
         add_wait_queue(&nn->bl_wq, &wq);
         if (rpc_queue_upcall(nn->bl_device_pipe, msg) < 0) {
diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
index dc0f98dfa717..c516da5873fd 100644
--- a/fs/nfs/idmap.c
+++ b/fs/nfs/idmap.c
@@ -726,9 +726,9 @@ out1:
         return ret;
 }
 
-static int nfs_idmap_instantiate(struct key *key, struct key *authkey, char *data)
+static int nfs_idmap_instantiate(struct key *key, struct key *authkey, char *data, size_t datalen)
 {
-        return key_instantiate_and_link(key, data, strlen(data) + 1,
+        return key_instantiate_and_link(key, data, datalen,
                                         id_resolver_cache->thread_keyring,
                                         authkey);
 }
@@ -738,6 +738,7 @@ static int nfs_idmap_read_and_verify_message(struct idmap_msg *im,
                 struct key *key, struct key *authkey)
 {
         char id_str[NFS_UINT_MAXLEN];
+        size_t len;
         int ret = -ENOKEY;
 
         /* ret = -ENOKEY */
@@ -747,13 +748,15 @@ static int nfs_idmap_read_and_verify_message(struct idmap_msg *im,
         case IDMAP_CONV_NAMETOID:
                 if (strcmp(upcall->im_name, im->im_name) != 0)
                         break;
-                sprintf(id_str, "%d", im->im_id);
-                ret = nfs_idmap_instantiate(key, authkey, id_str);
+                /* Note: here we store the NUL terminator too */
+                len = sprintf(id_str, "%d", im->im_id) + 1;
+                ret = nfs_idmap_instantiate(key, authkey, id_str, len);
                 break;
         case IDMAP_CONV_IDTONAME:
                 if (upcall->im_id != im->im_id)
                         break;
-                ret = nfs_idmap_instantiate(key, authkey, im->im_name);
+                len = strlen(im->im_name);
+                ret = nfs_idmap_instantiate(key, authkey, im->im_name, len);
                 break;
         default:
                 ret = -EINVAL;
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index ac4fc9a8fdbc..66b6664dcd4c 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -300,7 +300,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
                            struct rpc_cred *cred)
 {
         struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
-        struct nfs_client *pos, *n, *prev = NULL;
+        struct nfs_client *pos, *prev = NULL;
         struct nfs4_setclientid_res clid = {
                 .clientid       = new->cl_clientid,
                 .confirm        = new->cl_confirm,
@@ -308,10 +308,23 @@ int nfs40_walk_client_list(struct nfs_client *new,
         int status = -NFS4ERR_STALE_CLIENTID;
 
         spin_lock(&nn->nfs_client_lock);
-        list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
+        list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
                 /* If "pos" isn't marked ready, we can't trust the
                  * remaining fields in "pos" */
-                if (pos->cl_cons_state < NFS_CS_READY)
+                if (pos->cl_cons_state > NFS_CS_READY) {
+                        atomic_inc(&pos->cl_count);
+                        spin_unlock(&nn->nfs_client_lock);
+
+                        if (prev)
+                                nfs_put_client(prev);
+                        prev = pos;
+
+                        status = nfs_wait_client_init_complete(pos);
+                        spin_lock(&nn->nfs_client_lock);
+                        if (status < 0)
+                                continue;
+                }
+                if (pos->cl_cons_state != NFS_CS_READY)
                         continue;
 
                 if (pos->rpc_ops != new->rpc_ops)
@@ -423,16 +436,16 @@ int nfs41_walk_client_list(struct nfs_client *new,
                            struct rpc_cred *cred)
 {
         struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
-        struct nfs_client *pos, *n, *prev = NULL;
+        struct nfs_client *pos, *prev = NULL;
         int status = -NFS4ERR_STALE_CLIENTID;
 
         spin_lock(&nn->nfs_client_lock);
-        list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
+        list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
                 /* If "pos" isn't marked ready, we can't trust the
                  * remaining fields in "pos", especially the client
                  * ID and serverowner fields.  Wait for CREATE_SESSION
                  * to finish. */
-                if (pos->cl_cons_state < NFS_CS_READY) {
+                if (pos->cl_cons_state > NFS_CS_READY) {
                         atomic_inc(&pos->cl_count);
                         spin_unlock(&nn->nfs_client_lock);
 
@@ -440,18 +453,17 @@ int nfs41_walk_client_list(struct nfs_client *new,
                                 nfs_put_client(prev);
                         prev = pos;
 
-                        nfs4_schedule_lease_recovery(pos);
                         status = nfs_wait_client_init_complete(pos);
-                        if (status < 0) {
-                                nfs_put_client(pos);
-                                spin_lock(&nn->nfs_client_lock);
-                                continue;
+                        if (status == 0) {
+                                nfs4_schedule_lease_recovery(pos);
+                                status = nfs4_wait_clnt_recover(pos);
                         }
-                        status = pos->cl_cons_state;
                         spin_lock(&nn->nfs_client_lock);
                         if (status < 0)
                                 continue;
                 }
+                if (pos->cl_cons_state != NFS_CS_READY)
+                        continue;
 
                 if (pos->rpc_ops != new->rpc_ops)
                         continue;
@@ -469,17 +481,18 @@ int nfs41_walk_client_list(struct nfs_client *new,
                         continue;
 
                 atomic_inc(&pos->cl_count);
-                spin_unlock(&nn->nfs_client_lock);
+                *result = pos;
+                status = 0;
                 dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n",
                         __func__, pos, atomic_read(&pos->cl_count));
-
-                *result = pos;
-                return 0;
+                break;
         }
 
         /* No matching nfs_client found. */
         spin_unlock(&nn->nfs_client_lock);
         dprintk("NFS: <-- %s status = %d\n", __func__, status);
+        if (prev)
+                nfs_put_client(prev);
         return status;
 }
 #endif  /* CONFIG_NFS_V4_1 */
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 49eeb044c109..4fb234d3aefb 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -129,7 +129,6 @@ static void filelayout_fenceme(struct inode *inode, struct pnfs_layout_hdr *lo)
 {
         if (!test_and_clear_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
                 return;
-        clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(inode)->flags);
         pnfs_return_layout(inode);
 }
 
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index b2671cb0f901..0ad025eb523b 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1046,6 +1046,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
                 /* Save the delegation */
                 nfs4_stateid_copy(&stateid, &delegation->stateid);
                 rcu_read_unlock();
+                nfs_release_seqid(opendata->o_arg.seqid);
                 ret = nfs_may_open(state->inode, state->owner->so_cred, open_mode);
                 if (ret != 0)
                         goto out;
@@ -2632,7 +2633,7 @@ nfs4_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
         int status;
 
         if (pnfs_ld_layoutret_on_setattr(inode))
-                pnfs_return_layout(inode);
+                pnfs_commit_and_return_layout(inode);
 
         nfs_fattr_init(fattr);
         
@@ -6416,22 +6417,8 @@ nfs4_layoutcommit_done(struct rpc_task *task, void *calldata)
 static void nfs4_layoutcommit_release(void *calldata)
 {
         struct nfs4_layoutcommit_data *data = calldata;
-        struct pnfs_layout_segment *lseg, *tmp;
-        unsigned long *bitlock = &NFS_I(data->args.inode)->flags;
 
         pnfs_cleanup_layoutcommit(data);
-        /* Matched by references in pnfs_set_layoutcommit */
-        list_for_each_entry_safe(lseg, tmp, &data->lseg_list, pls_lc_list) {
-                list_del_init(&lseg->pls_lc_list);
-                if (test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT,
-                                       &lseg->pls_flags))
-                        pnfs_put_lseg(lseg);
-        }
-
-        clear_bit_unlock(NFS_INO_LAYOUTCOMMITTING, bitlock);
-        smp_mb__after_clear_bit();
-        wake_up_bit(bitlock, NFS_INO_LAYOUTCOMMITTING);
-
         put_rpccred(data->cred);
         kfree(data);
 }
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 6ace365c6334..d41a3518509f 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1886,7 +1886,13 @@ again:
                         status = PTR_ERR(clnt);
                         break;
                 }
-                clp->cl_rpcclient = clnt;
+                /* Note: this is safe because we haven't yet marked the
+                 * client as ready, so we are the only user of
+                 * clp->cl_rpcclient
+                 */
+                clnt = xchg(&clp->cl_rpcclient, clnt);
+                rpc_shutdown_client(clnt);
+                clnt = clp->cl_rpcclient;
                 goto again;
 
         case -NFS4ERR_MINOR_VERS_MISMATCH:
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 48ac5aad6258..4bdffe0ba025 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -417,6 +417,16 @@ should_free_lseg(struct pnfs_layout_range *lseg_range,
                lo_seg_intersecting(lseg_range, recall_range);
 }
 
+static bool pnfs_lseg_dec_and_remove_zero(struct pnfs_layout_segment *lseg,
+                struct list_head *tmp_list)
+{
+        if (!atomic_dec_and_test(&lseg->pls_refcount))
+                return false;
+        pnfs_layout_remove_lseg(lseg->pls_layout, lseg);
+        list_add(&lseg->pls_list, tmp_list);
+        return true;
+}
+
 /* Returns 1 if lseg is removed from list, 0 otherwise */
 static int mark_lseg_invalid(struct pnfs_layout_segment *lseg,
                              struct list_head *tmp_list)
@@ -430,11 +440,8 @@ static int mark_lseg_invalid(struct pnfs_layout_segment *lseg,
                  */
                 dprintk("%s: lseg %p ref %d\n", __func__, lseg,
                         atomic_read(&lseg->pls_refcount));
-                if (atomic_dec_and_test(&lseg->pls_refcount)) {
-                        pnfs_layout_remove_lseg(lseg->pls_layout, lseg);
-                        list_add(&lseg->pls_list, tmp_list);
+                if (pnfs_lseg_dec_and_remove_zero(lseg, tmp_list))
                         rv = 1;
-                }
         }
         return rv;
 }
@@ -777,6 +784,21 @@ send_layoutget(struct pnfs_layout_hdr *lo,
         return lseg;
 }
 
+static void pnfs_clear_layoutcommit(struct inode *inode,
+                struct list_head *head)
+{
+        struct nfs_inode *nfsi = NFS_I(inode);
+        struct pnfs_layout_segment *lseg, *tmp;
+
+        if (!test_and_clear_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags))
+                return;
+        list_for_each_entry_safe(lseg, tmp, &nfsi->layout->plh_segs, pls_list) {
+                if (!test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
+                        continue;
+                pnfs_lseg_dec_and_remove_zero(lseg, head);
+        }
+}
+
 /*
  * Initiates a LAYOUTRETURN(FILE), and removes the pnfs_layout_hdr
  * when the layout segment list is empty.
@@ -808,6 +830,7 @@ _pnfs_return_layout(struct inode *ino)
         /* Reference matched in nfs4_layoutreturn_release */
         pnfs_get_layout_hdr(lo);
         empty = list_empty(&lo->plh_segs);
+        pnfs_clear_layoutcommit(ino, &tmp_list);
         pnfs_mark_matching_lsegs_invalid(lo, &tmp_list, NULL);
         /* Don't send a LAYOUTRETURN if list was initially empty */
         if (empty) {
@@ -820,8 +843,6 @@ _pnfs_return_layout(struct inode *ino)
         spin_unlock(&ino->i_lock);
         pnfs_free_lseg_list(&tmp_list);
 
-        WARN_ON(test_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags));
-
         lrp = kzalloc(sizeof(*lrp), GFP_KERNEL);
         if (unlikely(lrp == NULL)) {
                 status = -ENOMEM;
@@ -845,6 +866,33 @@ out:
 }
 EXPORT_SYMBOL_GPL(_pnfs_return_layout);
 
+int
+pnfs_commit_and_return_layout(struct inode *inode)
+{
+        struct pnfs_layout_hdr *lo;
+        int ret;
+
+        spin_lock(&inode->i_lock);
+        lo = NFS_I(inode)->layout;
+        if (lo == NULL) {
+                spin_unlock(&inode->i_lock);
+                return 0;
+        }
+        pnfs_get_layout_hdr(lo);
+        /* Block new layoutgets and read/write to ds */
+        lo->plh_block_lgets++;
+        spin_unlock(&inode->i_lock);
+        filemap_fdatawait(inode->i_mapping);
+        ret = pnfs_layoutcommit_inode(inode, true);
+        if (ret == 0)
+                ret = _pnfs_return_layout(inode);
+        spin_lock(&inode->i_lock);
+        lo->plh_block_lgets--;
+        spin_unlock(&inode->i_lock);
+        pnfs_put_layout_hdr(lo);
+        return ret;
+}
+
 bool pnfs_roc(struct inode *ino)
 {
         struct pnfs_layout_hdr *lo;
@@ -1458,7 +1506,6 @@ static void pnfs_ld_handle_write_error(struct nfs_write_data *data)
         dprintk("pnfs write error = %d\n", hdr->pnfs_error);
         if (NFS_SERVER(hdr->inode)->pnfs_curr_ld->flags &
             PNFS_LAYOUTRET_ON_ERROR) {
-                clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(hdr->inode)->flags);
                 pnfs_return_layout(hdr->inode);
         }
         if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags))
@@ -1613,7 +1660,6 @@ static void pnfs_ld_handle_read_error(struct nfs_read_data *data)
         dprintk("pnfs read error = %d\n", hdr->pnfs_error);
         if (NFS_SERVER(hdr->inode)->pnfs_curr_ld->flags &
             PNFS_LAYOUTRET_ON_ERROR) {
-                clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(hdr->inode)->flags);
                 pnfs_return_layout(hdr->inode);
         }
         if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags))
@@ -1746,11 +1792,27 @@ static void pnfs_list_write_lseg(struct inode *inode, struct list_head *listp)
 
         list_for_each_entry(lseg, &NFS_I(inode)->layout->plh_segs, pls_list) {
                 if (lseg->pls_range.iomode == IOMODE_RW &&
-                    test_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
+                    test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
                         list_add(&lseg->pls_lc_list, listp);
         }
 }
 
+static void pnfs_list_write_lseg_done(struct inode *inode, struct list_head *listp)
+{
+        struct pnfs_layout_segment *lseg, *tmp;
+        unsigned long *bitlock = &NFS_I(inode)->flags;
+
+        /* Matched by references in pnfs_set_layoutcommit */
+        list_for_each_entry_safe(lseg, tmp, listp, pls_lc_list) {
+                list_del_init(&lseg->pls_lc_list);
+                pnfs_put_lseg(lseg);
+        }
+
+        clear_bit_unlock(NFS_INO_LAYOUTCOMMITTING, bitlock);
+        smp_mb__after_clear_bit();
+        wake_up_bit(bitlock, NFS_INO_LAYOUTCOMMITTING);
+}
+
 void pnfs_set_lo_fail(struct pnfs_layout_segment *lseg)
 {
         pnfs_layout_io_set_failed(lseg->pls_layout, lseg->pls_range.iomode);
@@ -1795,6 +1857,7 @@ void pnfs_cleanup_layoutcommit(struct nfs4_layoutcommit_data *data)
 
         if (nfss->pnfs_curr_ld->cleanup_layoutcommit)
                 nfss->pnfs_curr_ld->cleanup_layoutcommit(data);
+        pnfs_list_write_lseg_done(data->args.inode, &data->lseg_list);
 }
 
 /*
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 94ba80417748..f5f8a470a647 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -219,6 +219,7 @@ void pnfs_set_layoutcommit(struct nfs_write_data *wdata);
 void pnfs_cleanup_layoutcommit(struct nfs4_layoutcommit_data *data);
 int pnfs_layoutcommit_inode(struct inode *inode, bool sync);
 int _pnfs_return_layout(struct inode *);
+int pnfs_commit_and_return_layout(struct inode *);
 void pnfs_ld_write_done(struct nfs_write_data *);
 void pnfs_ld_read_done(struct nfs_read_data *);
 struct pnfs_layout_segment *pnfs_update_layout(struct inode *ino,
@@ -407,6 +408,11 @@ static inline int pnfs_return_layout(struct inode *ino)
         return 0;
 }
 
+static inline int pnfs_commit_and_return_layout(struct inode *inode)
+{
+        return 0;
+}
+
 static inline bool
 pnfs_ld_layoutret_on_setattr(struct inode *inode)
 {
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 01168865dd37..a2720071f282 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -264,7 +264,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
                 iattr->ia_valid |= ATTR_SIZE;
         }
         if (bmval[0] & FATTR4_WORD0_ACL) {
-                int nace;
+                u32 nace;
                 struct nfs4_ace *ace;
 
                 READ_BUF(4); len += 4;
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index 62c1ee128aeb..ca05f6dc3544 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -102,7 +102,8 @@ nfsd_reply_cache_free_locked(struct svc_cacherep *rp)
 {
         if (rp->c_type == RC_REPLBUFF)
                 kfree(rp->c_replvec.iov_base);
-        hlist_del(&rp->c_hash);
+        if (!hlist_unhashed(&rp->c_hash))
+                hlist_del(&rp->c_hash);
         list_del(&rp->c_lru);
         --num_drc_entries;
         kmem_cache_free(drc_slab, rp);
@@ -118,6 +119,10 @@ nfsd_reply_cache_free(struct svc_cacherep *rp)
 
 int nfsd_reply_cache_init(void)
 {
+        INIT_LIST_HEAD(&lru_head);
+        max_drc_entries = nfsd_cache_size_limit();
+        num_drc_entries = 0;
+
         register_shrinker(&nfsd_reply_cache_shrinker);
         drc_slab = kmem_cache_create("nfsd_drc", sizeof(struct svc_cacherep),
                                         0, 0, NULL);
@@ -128,10 +133,6 @@ int nfsd_reply_cache_init(void)
         if (!cache_hash)
                 goto out_nomem;
 
-        INIT_LIST_HEAD(&lru_head);
-        max_drc_entries = nfsd_cache_size_limit();
-        num_drc_entries = 0;
-
         return 0;
 out_nomem:
         printk(KERN_ERR "nfsd: failed to allocate reply cache\n");
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 2a7eb536de0b..2b2e2396a869 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1013,6 +1013,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
         int                     host_err;
         int                     stable = *stablep;
         int                     use_wgather;
+        loff_t                  pos = offset;
 
         dentry = file->f_path.dentry;
         inode = dentry->d_inode;
@@ -1025,7 +1026,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
 
         /* Write the data. */
         oldfs = get_fs(); set_fs(KERNEL_DS);
-        host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
+        host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &pos);
         set_fs(oldfs);
         if (host_err < 0)
                 goto out_nfserr;
diff --git a/fs/pnode.c b/fs/pnode.c
index 3e000a51ac0d..8b29d2164da6 100644
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -9,6 +9,7 @@
 #include <linux/mnt_namespace.h>
 #include <linux/mount.h>
 #include <linux/fs.h>
+#include <linux/nsproxy.h>
 #include "internal.h"
 #include "pnode.h"
 
@@ -220,6 +221,7 @@ static struct mount *get_source(struct mount *dest,
 int propagate_mnt(struct mount *dest_mnt, struct dentry *dest_dentry,
                     struct mount *source_mnt, struct list_head *tree_list)
 {
+        struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
         struct mount *m, *child;
         int ret = 0;
         struct mount *prev_dest_mnt = dest_mnt;
@@ -237,6 +239,10 @@ int propagate_mnt(struct mount *dest_mnt, struct dentry *dest_dentry,
 
                 source =  get_source(m, prev_dest_mnt, prev_src_mnt, &type);
 
+                /* Notice when we are propagating across user namespaces */
+                if (m->mnt_ns->user_ns != user_ns)
+                        type |= CL_UNPRIVILEGED;
+
                 child = copy_tree(source, source->mnt.mnt_root, type);
                 if (IS_ERR(child)) {
                         ret = PTR_ERR(child);
diff --git a/fs/pnode.h b/fs/pnode.h
index 19b853a3445c..a0493d5ebfbf 100644
--- a/fs/pnode.h
+++ b/fs/pnode.h
@@ -23,6 +23,7 @@
 #define CL_MAKE_SHARED          0x08
 #define CL_PRIVATE              0x10
 #define CL_SHARED_TO_SLAVE      0x20
+#define CL_UNPRIVILEGED         0x40
 
 static inline void set_mnt_shared(struct mount *mnt)
 {
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 4b3b3ffb52f1..21e1a8f1659d 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -755,37 +755,8 @@ void pde_put(struct proc_dir_entry *pde)
                 free_proc_entry(pde);
 }
 
-/*
- * Remove a /proc entry and free it if it's not currently in use.
- */
-void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
+static void entry_rundown(struct proc_dir_entry *de)
 {
-        struct proc_dir_entry **p;
-        struct proc_dir_entry *de = NULL;
-        const char *fn = name;
-        unsigned int len;
-
-        spin_lock(&proc_subdir_lock);
-        if (__xlate_proc_name(name, &parent, &fn) != 0) {
-                spin_unlock(&proc_subdir_lock);
-                return;
-        }
-        len = strlen(fn);
-
-        for (p = &parent->subdir; *p; p=&(*p)->next ) {
-                if (proc_match(len, fn, *p)) {
-                        de = *p;
-                        *p = de->next;
-                        de->next = NULL;
-                        break;
-                }
-        }
-        spin_unlock(&proc_subdir_lock);
-        if (!de) {
-                WARN(1, "name '%s'\n", name);
-                return;
-        }
-
         spin_lock(&de->pde_unload_lock);
         /*
          * Stop accepting new callers into module. If you're
@@ -817,6 +788,40 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
                 spin_lock(&de->pde_unload_lock);
         }
         spin_unlock(&de->pde_unload_lock);
+}
+
+/*
+ * Remove a /proc entry and free it if it's not currently in use.
+ */
+void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
+{
+        struct proc_dir_entry **p;
+        struct proc_dir_entry *de = NULL;
+        const char *fn = name;
+        unsigned int len;
+
+        spin_lock(&proc_subdir_lock);
+        if (__xlate_proc_name(name, &parent, &fn) != 0) {
+                spin_unlock(&proc_subdir_lock);
+                return;
+        }
+        len = strlen(fn);
+
+        for (p = &parent->subdir; *p; p=&(*p)->next ) {
+                if (proc_match(len, fn, *p)) {
+                        de = *p;
+                        *p = de->next;
+                        de->next = NULL;
+                        break;
+                }
+        }
+        spin_unlock(&proc_subdir_lock);
+        if (!de) {
+                WARN(1, "name '%s'\n", name);
+                return;
+        }
+
+        entry_rundown(de);
 
         if (S_ISDIR(de->mode))
                 parent->nlink--;
@@ -827,3 +832,57 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
         pde_put(de);
 }
 EXPORT_SYMBOL(remove_proc_entry);
+
+int remove_proc_subtree(const char *name, struct proc_dir_entry *parent)
+{
+        struct proc_dir_entry **p;
+        struct proc_dir_entry *root = NULL, *de, *next;
+        const char *fn = name;
+        unsigned int len;
+
+        spin_lock(&proc_subdir_lock);
+        if (__xlate_proc_name(name, &parent, &fn) != 0) {
+                spin_unlock(&proc_subdir_lock);
+                return -ENOENT;
+        }
+        len = strlen(fn);
+
+        for (p = &parent->subdir; *p; p=&(*p)->next ) {
+                if (proc_match(len, fn, *p)) {
+                        root = *p;
+                        *p = root->next;
+                        root->next = NULL;
+                        break;
+                }
+        }
+        if (!root) {
+                spin_unlock(&proc_subdir_lock);
+                return -ENOENT;
+        }
+        de = root;
+        while (1) {
+                next = de->subdir;
+                if (next) {
+                        de->subdir = next->next;
+                        next->next = NULL;
+                        de = next;
+                        continue;
+                }
+                spin_unlock(&proc_subdir_lock);
+
+                entry_rundown(de);
+                next = de->parent;
+                if (S_ISDIR(de->mode))
+                        next->nlink--;
+                de->nlink = 0;
+                if (de == root)
+                        break;
+                pde_put(de);
+
+                spin_lock(&proc_subdir_lock);
+                de = next;
+        }
+        pde_put(root);
+        return 0;
+}
+EXPORT_SYMBOL(remove_proc_subtree);
diff --git a/fs/proc/root.c b/fs/proc/root.c
index c6e9fac26bac..9c7fab1d23f0 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -16,6 +16,7 @@
 #include <linux/sched.h>
 #include <linux/module.h>
 #include <linux/bitops.h>
+#include <linux/user_namespace.h>
 #include <linux/mount.h>
 #include <linux/pid_namespace.h>
 #include <linux/parser.h>
@@ -108,6 +109,9 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
         } else {
                 ns = task_active_pid_ns(current);
                 options = data;
+
+                if (!current_user_ns()->may_mount_proc)
+                        return ERR_PTR(-EPERM);
         }
 
         sb = sget(fs_type, proc_test_super, proc_set_super, flags, ns);
diff --git a/fs/read_write.c b/fs/read_write.c
index a698eff457fb..e6ddc8dceb96 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -17,6 +17,7 @@
 #include <linux/splice.h>
 #include <linux/compat.h>
 #include "read_write.h"
+#include "internal.h"
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -417,6 +418,33 @@ ssize_t do_sync_write(struct file *filp, const char __user *buf, size_t len, lof
 
 EXPORT_SYMBOL(do_sync_write);
 
+ssize_t __kernel_write(struct file *file, const char *buf, size_t count, loff_t *pos)
+{
+        mm_segment_t old_fs;
+        const char __user *p;
+        ssize_t ret;
+
+        if (!file->f_op || (!file->f_op->write && !file->f_op->aio_write))
+                return -EINVAL;
+
+        old_fs = get_fs();
+        set_fs(get_ds());
+        p = (__force const char __user *)buf;
+        if (count > MAX_RW_COUNT)
+                count =  MAX_RW_COUNT;
+        if (file->f_op->write)
+                ret = file->f_op->write(file, p, count, pos);
+        else
+                ret = do_sync_write(file, p, count, pos);
+        set_fs(old_fs);
+        if (ret > 0) {
+                fsnotify_modify(file);
+                add_wchar(current, ret);
+        }
+        inc_syscw(current);
+        return ret;
+}
+
 ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_t *pos)
 {
         ssize_t ret;
diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index c196369fe408..4cce1d9552fb 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -187,8 +187,8 @@ fill_with_dentries(void *buf, const char *name, int namelen, loff_t offset,
         if (dbuf->count == ARRAY_SIZE(dbuf->dentries))
                 return -ENOSPC;
 
-        if (name[0] == '.' && (name[1] == '\0' ||
-                               (name[1] == '.' && name[2] == '\0')))
+        if (name[0] == '.' && (namelen < 2 ||
+                               (namelen == 2 && name[1] == '.')))
                 return 0;
 
         dentry = lookup_one_len(name, dbuf->xadir, namelen);
diff --git a/fs/splice.c b/fs/splice.c
index 718bd0056384..29e394e49ddd 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -31,6 +31,7 @@
 #include <linux/security.h>
 #include <linux/gfp.h>
 #include <linux/socket.h>
+#include "internal.h"
 
 /*
  * Attempt to steal a page from a pipe buffer. This should perhaps go into
@@ -1048,9 +1049,10 @@ static int write_pipe_buf(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
 {
         int ret;
         void *data;
+        loff_t tmp = sd->pos;
 
         data = buf->ops->map(pipe, buf, 0);
-        ret = kernel_write(sd->u.file, data + buf->offset, sd->len, sd->pos);
+        ret = __kernel_write(sd->u.file, data + buf->offset, sd->len, &tmp);
         buf->ops->unmap(pipe, buf, data);
 
         return ret;
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 2fbdff6be25c..e14512678c9b 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -1020,6 +1020,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
                 ino = parent_sd->s_ino;
                 if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) == 0)
                         filp->f_pos++;
+                else
+                        return 0;
         }
         if (filp->f_pos == 1) {
                 if (parent_sd->s_parent)
@@ -1028,6 +1030,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
                         ino = parent_sd->s_ino;
                 if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0)
                         filp->f_pos++;
+                else
+                        return 0;
         }
         mutex_lock(&sysfs_mutex);
         for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos);
@@ -1058,10 +1062,21 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
         return 0;
 }
 
+static loff_t sysfs_dir_llseek(struct file *file, loff_t offset, int whence)
+{
+        struct inode *inode = file_inode(file);
+        loff_t ret;
+
+        mutex_lock(&inode->i_mutex);
+        ret = generic_file_llseek(file, offset, whence);
+        mutex_unlock(&inode->i_mutex);
+
+        return ret;
+}
 
 const struct file_operations sysfs_dir_operations = {
         .read           = generic_read_dir,
         .readdir        = sysfs_readdir,
         .release        = sysfs_dir_release,
-        .llseek         = generic_file_llseek,
+        .llseek         = sysfs_dir_llseek,
 };
diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
index 8d924b5ec733..afd83273e6ce 100644
--- a/fs/sysfs/mount.c
+++ b/fs/sysfs/mount.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 #include <linux/magic.h>
 #include <linux/slab.h>
+#include <linux/user_namespace.h>
 
 #include "sysfs.h"
 
@@ -111,6 +112,9 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type,
         struct super_block *sb;
         int error;
 
+        if (!(flags & MS_KERNMOUNT) && !current_user_ns()->may_mount_sysfs)
+                return ERR_PTR(-EPERM);
+
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (!info)
                 return ERR_PTR(-ENOMEM);
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index ac838b844936..f21acf0ef01f 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -1568,6 +1568,12 @@ static int ubifs_remount_rw(struct ubifs_info *c)
         c->remounting_rw = 1;
         c->ro_mount = 0;
 
+        if (c->space_fixup) {
+                err = ubifs_fixup_free_space(c);
+                if (err)
+                        return err;
+        }
+
         err = check_free_space(c);
         if (err)
                 goto out;
@@ -1684,12 +1690,6 @@ static int ubifs_remount_rw(struct ubifs_info *c)
                 err = dbg_check_space_info(c);
         }
 
-        if (c->space_fixup) {
-                err = ubifs_fixup_free_space(c);
-                if (err)
-                        goto out;
-        }
-
         mutex_unlock(&c->umount_mutex);
         return err;
 
diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
index 25f01d0bc149..b1b1fa6ffffe 100644
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -99,7 +99,12 @@ struct mmu_gather {
         unsigned int            need_flush : 1, /* Did free PTEs */
                                 fast_mode  : 1; /* No batching   */
 
-        unsigned int            fullmm;
+        /* we are in the middle of an operation to clear
+         * a full mm and can make some optimizations */
+        unsigned int            fullmm : 1,
+        /* we have performed an operation which
+         * requires a complete flush of the tlb */
+                                need_flush_all : 1;
 
         struct mmu_gather_batch *active;
         struct mmu_gather_batch local;
diff --git a/include/linux/ata.h b/include/linux/ata.h
index 8f7a3d68371a..ee0bd9524055 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -954,7 +954,7 @@ static inline int atapi_cdb_len(const u16 *dev_id)
         }
 }
 
-static inline bool atapi_command_packet_set(const u16 *dev_id)
+static inline int atapi_command_packet_set(const u16 *dev_id)
 {
         return (dev_id[ATA_ID_CONFIG] >> 8) & 0x1f;
 }
diff --git a/include/linux/capability.h b/include/linux/capability.h
index 98503b792369..d9a4f7f40f32 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -35,6 +35,7 @@ struct cpu_vfs_cap_data {
 #define _KERNEL_CAP_T_SIZE     (sizeof(kernel_cap_t))
 
 
+struct file;
 struct inode;
 struct dentry;
 struct user_namespace;
@@ -211,6 +212,7 @@ extern bool capable(int cap);
 extern bool ns_capable(struct user_namespace *ns, int cap);
 extern bool nsown_capable(int cap);
 extern bool inode_capable(const struct inode *inode, int cap);
+extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
 
 /* audit system wants to get cap info from files as well */
 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 76a87fb57ac2..377cd8c3395e 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -141,11 +141,11 @@ typedef struct {
 } compat_sigset_t;
 
 struct compat_sigaction {
-#ifndef __ARCH_HAS_ODD_SIGACTION
+#ifndef __ARCH_HAS_IRIX_SIGACTION
         compat_uptr_t                   sa_handler;
         compat_ulong_t                  sa_flags;
 #else
-        compat_ulong_t                  sa_flags;
+        compat_uint_t                   sa_flags;
         compat_uptr_t                   sa_handler;
 #endif
 #ifdef __ARCH_HAS_SA_RESTORER
diff --git a/include/linux/debug_locks.h b/include/linux/debug_locks.h
index a975de1ff59f..3bd46f766751 100644
--- a/include/linux/debug_locks.h
+++ b/include/linux/debug_locks.h
@@ -51,7 +51,7 @@ struct task_struct;
 extern void debug_show_all_locks(void);
 extern void debug_show_held_locks(struct task_struct *task);
 extern void debug_check_no_locks_freed(const void *from, unsigned long len);
-extern void debug_check_no_locks_held(void);
+extern void debug_check_no_locks_held(struct task_struct *task);
 #else
 static inline void debug_show_all_locks(void)
 {
@@ -67,7 +67,7 @@ debug_check_no_locks_freed(const void *from, unsigned long len)
 }
 
 static inline void
-debug_check_no_locks_held(void)
+debug_check_no_locks_held(struct task_struct *task)
 {
 }
 #endif
diff --git a/include/linux/devfreq.h b/include/linux/devfreq.h
index e83ef39b3bea..fe8c4476f7e4 100644
--- a/include/linux/devfreq.h
+++ b/include/linux/devfreq.h
@@ -213,7 +213,7 @@ struct devfreq_simple_ondemand_data {
 #endif
 
 #else /* !CONFIG_PM_DEVFREQ */
-static struct devfreq *devfreq_add_device(struct device *dev,
+static inline struct devfreq *devfreq_add_device(struct device *dev,
                                           struct devfreq_dev_profile *profile,
                                           const char *governor_name,
                                           void *data)
@@ -221,34 +221,34 @@ static struct devfreq *devfreq_add_device(struct device *dev,
         return NULL;
 }
 
-static int devfreq_remove_device(struct devfreq *devfreq)
+static inline int devfreq_remove_device(struct devfreq *devfreq)
 {
         return 0;
 }
 
-static int devfreq_suspend_device(struct devfreq *devfreq)
+static inline int devfreq_suspend_device(struct devfreq *devfreq)
 {
         return 0;
 }
 
-static int devfreq_resume_device(struct devfreq *devfreq)
+static inline int devfreq_resume_device(struct devfreq *devfreq)
 {
         return 0;
 }
 
-static struct opp *devfreq_recommended_opp(struct device *dev,
+static inline struct opp *devfreq_recommended_opp(struct device *dev,
                                            unsigned long *freq, u32 flags)
 {
-        return -EINVAL;
+        return ERR_PTR(-EINVAL);
 }
 
-static int devfreq_register_opp_notifier(struct device *dev,
+static inline int devfreq_register_opp_notifier(struct device *dev,
                                          struct devfreq *devfreq)
 {
         return -EINVAL;
 }
 
-static int devfreq_unregister_opp_notifier(struct device *dev,
+static inline int devfreq_unregister_opp_notifier(struct device *dev,
                                            struct devfreq *devfreq)
 {
         return -EINVAL;
diff --git a/include/linux/freezer.h b/include/linux/freezer.h
index 043a5cf8b5ba..e70df40d84f6 100644
--- a/include/linux/freezer.h
+++ b/include/linux/freezer.h
@@ -3,7 +3,6 @@
 #ifndef FREEZER_H_INCLUDED
 #define FREEZER_H_INCLUDED
 
-#include <linux/debug_locks.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
 #include <linux/atomic.h>
@@ -49,8 +48,6 @@ extern void thaw_kernel_threads(void);
 
 static inline bool try_to_freeze(void)
 {
-        if (!(current->flags & PF_NOFREEZE))
-                debug_check_no_locks_held();
         might_sleep();
         if (likely(!freezing(current)))
                 return false;
diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
index 729eded4b24f..2b93a9a5a1e6 100644
--- a/include/linux/fs_struct.h
+++ b/include/linux/fs_struct.h
@@ -50,4 +50,6 @@ static inline void get_fs_root_and_pwd(struct fs_struct *fs, struct path *root,
         spin_unlock(&fs->lock);
 }
 
+extern bool current_chrooted(void);
+
 #endif /* _LINUX_FS_STRUCT_H */
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index e5ca8ef50e9b..52da2a250795 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -89,6 +89,7 @@ typedef void (*ftrace_func_t)(unsigned long ip, unsigned long parent_ip,
  *            that the call back has its own recursion protection. If it does
  *            not set this, then the ftrace infrastructure will add recursion
  *            protection for the caller.
+ * STUB   - The ftrace_ops is just a place holder.
  */
 enum {
         FTRACE_OPS_FL_ENABLED                   = 1 << 0,
@@ -98,6 +99,7 @@ enum {
         FTRACE_OPS_FL_SAVE_REGS                 = 1 << 4,
         FTRACE_OPS_FL_SAVE_REGS_IF_SUPPORTED    = 1 << 5,
         FTRACE_OPS_FL_RECURSION_SAFE            = 1 << 6,
+        FTRACE_OPS_FL_STUB                      = 1 << 7,
 };
 
 struct ftrace_ops {
@@ -394,7 +396,6 @@ ssize_t ftrace_filter_write(struct file *file, const char __user *ubuf,
                             size_t cnt, loff_t *ppos);
 ssize_t ftrace_notrace_write(struct file *file, const char __user *ubuf,
                              size_t cnt, loff_t *ppos);
-loff_t ftrace_regex_lseek(struct file *file, loff_t offset, int whence);
 int ftrace_regex_release(struct inode *inode, struct file *file);
 
 void __init
@@ -567,6 +568,8 @@ static inline int
 ftrace_regex_release(struct inode *inode, struct file *file) { return -ENODEV; }
 #endif /* CONFIG_DYNAMIC_FTRACE */
 
+loff_t ftrace_filter_lseek(struct file *file, loff_t offset, int whence);
+
 /* totally disable ftrace - can not re-enable after this */
 void ftrace_kill(void);
 
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index cad77fe09d77..c13958251927 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -518,7 +518,7 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
 int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
                            void *data, unsigned long len);
 int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
-                              gpa_t gpa);
+                              gpa_t gpa, unsigned long len);
 int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len);
 int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len);
 struct kvm_memory_slot *gfn_to_memslot(struct kvm *kvm, gfn_t gfn);
diff --git a/include/linux/kvm_types.h b/include/linux/kvm_types.h
index fa7cc7244cbd..b0bcce0ddc95 100644
--- a/include/linux/kvm_types.h
+++ b/include/linux/kvm_types.h
@@ -71,6 +71,7 @@ struct gfn_to_hva_cache {
         u64 generation;
         gpa_t gpa;
         unsigned long hva;
+        unsigned long len;
         struct kvm_memory_slot *memslot;
 };
 
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 91c9d109e5f1..eae7a053dc51 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -398,6 +398,7 @@ enum {
         ATA_HORKAGE_NOSETXFER   = (1 << 14),    /* skip SETXFER, SATA only */
         ATA_HORKAGE_BROKEN_FPDMA_AA     = (1 << 15),    /* skip AA */
         ATA_HORKAGE_DUMP_ID     = (1 << 16),    /* dump IDENTIFY data */
+        ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17),  /* Set max sects to 65535 */
 
          /* DMA mask for user DMA control: User visible values; DO NOT
             renumber */
diff --git a/include/linux/mfd/max77693-private.h b/include/linux/mfd/max77693-private.h
index 5b18ecde69b5..1aa4f13cdfa6 100644
--- a/include/linux/mfd/max77693-private.h
+++ b/include/linux/mfd/max77693-private.h
@@ -106,6 +106,29 @@ enum max77693_muic_reg {
         MAX77693_MUIC_REG_END,
 };
 
+/* MAX77693 INTMASK1~2 Register */
+#define INTMASK1_ADC1K_SHIFT            3
+#define INTMASK1_ADCERR_SHIFT           2
+#define INTMASK1_ADCLOW_SHIFT           1
+#define INTMASK1_ADC_SHIFT              0
+#define INTMASK1_ADC1K_MASK             (1 << INTMASK1_ADC1K_SHIFT)
+#define INTMASK1_ADCERR_MASK            (1 << INTMASK1_ADCERR_SHIFT)
+#define INTMASK1_ADCLOW_MASK            (1 << INTMASK1_ADCLOW_SHIFT)
+#define INTMASK1_ADC_MASK               (1 << INTMASK1_ADC_SHIFT)
+
+#define INTMASK2_VIDRM_SHIFT            5
+#define INTMASK2_VBVOLT_SHIFT           4
+#define INTMASK2_DXOVP_SHIFT            3
+#define INTMASK2_DCDTMR_SHIFT           2
+#define INTMASK2_CHGDETRUN_SHIFT        1
+#define INTMASK2_CHGTYP_SHIFT           0
+#define INTMASK2_VIDRM_MASK             (1 << INTMASK2_VIDRM_SHIFT)
+#define INTMASK2_VBVOLT_MASK            (1 << INTMASK2_VBVOLT_SHIFT)
+#define INTMASK2_DXOVP_MASK             (1 << INTMASK2_DXOVP_SHIFT)
+#define INTMASK2_DCDTMR_MASK            (1 << INTMASK2_DCDTMR_SHIFT)
+#define INTMASK2_CHGDETRUN_MASK         (1 << INTMASK2_CHGDETRUN_SHIFT)
+#define INTMASK2_CHGTYP_MASK            (1 << INTMASK2_CHGTYP_SHIFT)
+
 /* MAX77693 MUIC - STATUS1~3 Register */
 #define STATUS1_ADC_SHIFT               (0)
 #define STATUS1_ADCLOW_SHIFT            (5)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 7acc9dc73c9f..e19ff30ad0a2 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -87,7 +87,6 @@ extern unsigned int kobjsize(const void *objp);
 #define VM_PFNMAP       0x00000400      /* Page-ranges managed without "struct page", just pure PFN */
 #define VM_DENYWRITE    0x00000800      /* ETXTBSY on write attempts.. */
 
-#define VM_POPULATE     0x00001000
 #define VM_LOCKED       0x00002000
 #define VM_IO           0x00004000      /* Memory mapped I/O or similar */
 
diff --git a/include/linux/mman.h b/include/linux/mman.h
index 61c7a87e5d2b..9aa863da287f 100644
--- a/include/linux/mman.h
+++ b/include/linux/mman.h
@@ -79,8 +79,6 @@ calc_vm_flag_bits(unsigned long flags)
 {
         return _calc_vm_trans(flags, MAP_GROWSDOWN,  VM_GROWSDOWN ) |
                _calc_vm_trans(flags, MAP_DENYWRITE,  VM_DENYWRITE ) |
-               ((flags & MAP_LOCKED) ? (VM_LOCKED | VM_POPULATE) : 0) |
-               (((flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE) ?
-                                                        VM_POPULATE : 0);
+               _calc_vm_trans(flags, MAP_LOCKED,     VM_LOCKED    );
 }
 #endif /* _LINUX_MMAN_H */
diff --git a/include/linux/mount.h b/include/linux/mount.h
index d7029f4a191a..73005f9957ea 100644
--- a/include/linux/mount.h
+++ b/include/linux/mount.h
@@ -47,6 +47,8 @@ struct mnt_namespace;
 
 #define MNT_INTERNAL    0x4000
 
+#define MNT_LOCK_READONLY       0x400000
+
 struct vfsmount {
         struct dentry *mnt_root;        /* root of the mounted tree */
         struct super_block *mnt_sb;     /* pointer to superblock */
diff --git a/include/linux/mxsfb.h b/include/linux/mxsfb.h
index f14943d55315..f80af8674342 100644
--- a/include/linux/mxsfb.h
+++ b/include/linux/mxsfb.h
@@ -24,8 +24,8 @@
 #define STMLCDIF_18BIT 2 /** pixel data bus to the display is of 18 bit width */
 #define STMLCDIF_24BIT 3 /** pixel data bus to the display is of 24 bit width */
 
-#define FB_SYNC_DATA_ENABLE_HIGH_ACT    (1 << 6)
-#define FB_SYNC_DOTCLK_FAILING_ACT      (1 << 7) /* failing/negtive edge sampling */
+#define MXSFB_SYNC_DATA_ENABLE_HIGH_ACT (1 << 6)
+#define MXSFB_SYNC_DOTCLK_FAILING_ACT   (1 << 7) /* failing/negtive edge sampling */
 
 struct mxsfb_platform_data {
         struct fb_videomode *mode_list;
@@ -44,6 +44,9 @@ struct mxsfb_platform_data {
                                  * allocated. If specified,fb_size must also be specified.
                                  * fb_phys must be unused by Linux.
                                  */
+        u32 sync;               /* sync mask, contains MXSFB specifics not
+                                 * carried in fb_info->var.sync
+                                 */
 };
 
 #endif /* __LINUX_MXSFB_H */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index b3d00fa4b314..6151e903eef0 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -210,9 +210,9 @@ struct netdev_hw_addr {
 #define NETDEV_HW_ADDR_T_SLAVE          3
 #define NETDEV_HW_ADDR_T_UNICAST        4
 #define NETDEV_HW_ADDR_T_MULTICAST      5
-        bool                    synced;
         bool                    global_use;
         int                     refcount;
+        int                     synced;
         struct rcu_head         rcu_head;
 };
 
@@ -895,7 +895,7 @@ struct netdev_fcoe_hbainfo {
  *
  * int (*ndo_bridge_setlink)(struct net_device *dev, struct nlmsghdr *nlh)
  * int (*ndo_bridge_getlink)(struct sk_buff *skb, u32 pid, u32 seq,
- *                           struct net_device *dev)
+ *                           struct net_device *dev, u32 filter_mask)
  *
  * int (*ndo_change_carrier)(struct net_device *dev, bool new_carrier);
  *      Called to change device carrier. Soft-devices (like dummy, team, etc)
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 2461033a7987..710067f3618c 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -916,6 +916,7 @@ void pci_disable_rom(struct pci_dev *pdev);
 void __iomem __must_check *pci_map_rom(struct pci_dev *pdev, size_t *size);
 void pci_unmap_rom(struct pci_dev *pdev, void __iomem *rom);
 size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size);
+void __iomem __must_check *pci_platform_rom(struct pci_dev *pdev, size_t *size);
 
 /* Power management related routines */
 int pci_save_state(struct pci_dev *dev);
diff --git a/include/linux/preempt.h b/include/linux/preempt.h
index 5a710b9c578e..87a03c746f17 100644
--- a/include/linux/preempt.h
+++ b/include/linux/preempt.h
@@ -93,14 +93,20 @@ do { \
 
 #else /* !CONFIG_PREEMPT_COUNT */
 
-#define preempt_disable()               do { } while (0)
-#define sched_preempt_enable_no_resched()       do { } while (0)
-#define preempt_enable_no_resched()     do { } while (0)
-#define preempt_enable()                do { } while (0)
-
-#define preempt_disable_notrace()               do { } while (0)
-#define preempt_enable_no_resched_notrace()     do { } while (0)
-#define preempt_enable_notrace()                do { } while (0)
+/*
+ * Even if we don't have any preemption, we need preempt disable/enable
+ * to be barriers, so that we don't have things like get_user/put_user
+ * that can cause faults and scheduling migrate into our preempt-protected
+ * region.
+ */
+#define preempt_disable()               barrier()
+#define sched_preempt_enable_no_resched()       barrier()
+#define preempt_enable_no_resched()     barrier()
+#define preempt_enable()                barrier()
+
+#define preempt_disable_notrace()               barrier()
+#define preempt_enable_no_resched_notrace()     barrier()
+#define preempt_enable_notrace()                barrier()
 
 #endif /* CONFIG_PREEMPT_COUNT */
 
diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
index 8307f2f94d86..94dfb2aa5533 100644
--- a/include/linux/proc_fs.h
+++ b/include/linux/proc_fs.h
@@ -117,6 +117,7 @@ struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
                                 const struct file_operations *proc_fops,
                                 void *data);
 extern void remove_proc_entry(const char *name, struct proc_dir_entry *parent);
+extern int remove_proc_subtree(const char *name, struct proc_dir_entry *parent);
 
 struct pid_namespace;
 
@@ -202,6 +203,7 @@ static inline struct proc_dir_entry *proc_create_data(const char *name,
         return NULL;
 }
 #define remove_proc_entry(name, parent) do {} while (0)
+#define remove_proc_subtree(name, parent) do {} while (0)
 
 static inline struct proc_dir_entry *proc_symlink(const char *name,
                 struct proc_dir_entry *parent,const char *dest) {return NULL;}
diff --git a/include/linux/security.h b/include/linux/security.h
index eee7478cda70..032c366ef1c6 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1012,6 +1012,10 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      This hook can be used by the module to update any security state
  *      associated with the TUN device's security structure.
  *      @security pointer to the TUN devices's security structure.
+ * @skb_owned_by:
+ *      This hook sets the packet's owning sock.
+ *      @skb is the packet.
+ *      @sk the sock which owns the packet.
  *
  * Security hooks for XFRM operations.
  *
@@ -1638,6 +1642,7 @@ struct security_operations {
         int (*tun_dev_attach_queue) (void *security);
         int (*tun_dev_attach) (struct sock *sk, void *security);
         int (*tun_dev_open) (void *security);
+        void (*skb_owned_by) (struct sk_buff *skb, struct sock *sk);
 #endif  /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
@@ -2588,6 +2593,8 @@ int security_tun_dev_attach_queue(void *security);
 int security_tun_dev_attach(struct sock *sk, void *security);
 int security_tun_dev_open(void *security);
 
+void security_skb_owned_by(struct sk_buff *skb, struct sock *sk);
+
 #else   /* CONFIG_SECURITY_NETWORK */
 static inline int security_unix_stream_connect(struct sock *sock,
                                                struct sock *other,
@@ -2779,6 +2786,11 @@ static inline int security_tun_dev_open(void *security)
 {
         return 0;
 }
+
+static inline void security_skb_owned_by(struct sk_buff *skb, struct sock *sk)
+{
+}
+
 #endif  /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
diff --git a/include/linux/signal.h b/include/linux/signal.h
index a2dcb94ea49d..9475c5cb28bc 100644
--- a/include/linux/signal.h
+++ b/include/linux/signal.h
@@ -250,11 +250,11 @@ extern int show_unhandled_signals;
 extern int sigsuspend(sigset_t *);
 
 struct sigaction {
-#ifndef __ARCH_HAS_ODD_SIGACTION
+#ifndef __ARCH_HAS_IRIX_SIGACTION
         __sighandler_t  sa_handler;
         unsigned long   sa_flags;
 #else
-        unsigned long   sa_flags;
+        unsigned int    sa_flags;
         __sighandler_t  sa_handler;
 #endif
 #ifdef __ARCH_HAS_SA_RESTORER
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 441f5bfdab8e..b8292d8cc9fa 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2643,6 +2643,13 @@ static inline void nf_reset(struct sk_buff *skb)
 #endif
 }
 
+static inline void nf_reset_trace(struct sk_buff *skb)
+{
+#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
+        skb->nf_trace = 0;
+#endif
+}
+
 /* Note: This doesn't put any conntrack and bridge info in dst. */
 static inline void __nf_copy(struct sk_buff *dst, const struct sk_buff *src)
 {
diff --git a/include/linux/spinlock_up.h b/include/linux/spinlock_up.h
index a26e2fb604e6..e2369c167dbd 100644
--- a/include/linux/spinlock_up.h
+++ b/include/linux/spinlock_up.h
@@ -16,7 +16,10 @@
  * In the debug case, 1 means unlocked, 0 means locked. (the values
  * are inverted, to catch initialization bugs)
  *
- * No atomicity anywhere, we are on UP.
+ * No atomicity anywhere, we are on UP. However, we still need
+ * the compiler barriers, because we do not want the compiler to
+ * move potentially faulting instructions (notably user accesses)
+ * into the locked sequence, resulting in non-atomic execution.
  */
 
 #ifdef CONFIG_DEBUG_SPINLOCK
@@ -25,6 +28,7 @@
 static inline void arch_spin_lock(arch_spinlock_t *lock)
 {
         lock->slock = 0;
+        barrier();
 }
 
 static inline void
@@ -32,6 +36,7 @@ arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long flags)
 {
         local_irq_save(flags);
         lock->slock = 0;
+        barrier();
 }
 
 static inline int arch_spin_trylock(arch_spinlock_t *lock)
@@ -39,32 +44,34 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
         char oldval = lock->slock;
 
         lock->slock = 0;
+        barrier();
 
         return oldval > 0;
 }
 
 static inline void arch_spin_unlock(arch_spinlock_t *lock)
 {
+        barrier();
         lock->slock = 1;
 }
 
 /*
  * Read-write spinlocks. No debug version.
  */
-#define arch_read_lock(lock)            do { (void)(lock); } while (0)
-#define arch_write_lock(lock)           do { (void)(lock); } while (0)
-#define arch_read_trylock(lock) ({ (void)(lock); 1; })
-#define arch_write_trylock(lock)        ({ (void)(lock); 1; })
-#define arch_read_unlock(lock)          do { (void)(lock); } while (0)
-#define arch_write_unlock(lock) do { (void)(lock); } while (0)
+#define arch_read_lock(lock)            do { barrier(); (void)(lock); } while (0)
+#define arch_write_lock(lock)           do { barrier(); (void)(lock); } while (0)
+#define arch_read_trylock(lock) ({ barrier(); (void)(lock); 1; })
+#define arch_write_trylock(lock)        ({ barrier(); (void)(lock); 1; })
+#define arch_read_unlock(lock)          do { barrier(); (void)(lock); } while (0)
+#define arch_write_unlock(lock) do { barrier(); (void)(lock); } while (0)
 
 #else /* DEBUG_SPINLOCK */
 #define arch_spin_is_locked(lock)       ((void)(lock), 0)
 /* for sched.c and kernel_lock.c: */
-# define arch_spin_lock(lock)           do { (void)(lock); } while (0)
-# define arch_spin_lock_flags(lock, flags)      do { (void)(lock); } while (0)
-# define arch_spin_unlock(lock) do { (void)(lock); } while (0)
-# define arch_spin_trylock(lock)        ({ (void)(lock); 1; })
+# define arch_spin_lock(lock)           do { barrier(); (void)(lock); } while (0)
+# define arch_spin_lock_flags(lock, flags)      do { barrier(); (void)(lock); } while (0)
+# define arch_spin_unlock(lock) do { barrier(); (void)(lock); } while (0)
+# define arch_spin_trylock(lock)        ({ barrier(); (void)(lock); 1; })
 #endif /* DEBUG_SPINLOCK */
 
 #define arch_spin_is_contended(lock)    (((void)(lock), 0))
diff --git a/include/linux/thermal.h b/include/linux/thermal.h
index f0bd7f90a90d..e3c0ae9bb1fa 100644
--- a/include/linux/thermal.h
+++ b/include/linux/thermal.h
@@ -44,7 +44,7 @@
 /* Adding event notification support elements */
 #define THERMAL_GENL_FAMILY_NAME                "thermal_event"
 #define THERMAL_GENL_VERSION                    0x01
-#define THERMAL_GENL_MCAST_GROUP_NAME           "thermal_mc_group"
+#define THERMAL_GENL_MCAST_GROUP_NAME           "thermal_mc_grp"
 
 /* Default Thermal Governor */
 #if defined(CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE)
diff --git a/include/linux/udp.h b/include/linux/udp.h
index 9d81de123c90..42278bbf7a88 100644
--- a/include/linux/udp.h
+++ b/include/linux/udp.h
@@ -68,6 +68,7 @@ struct udp_sock {
          * For encapsulation sockets.
          */
         int (*encap_rcv)(struct sock *sk, struct sk_buff *skb);
+        void (*encap_destroy)(struct sock *sk);
 };
 
 static inline struct udp_sock *udp_sk(const struct sock *sk)
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index 0a78df5f6cfd..59694b5e5e90 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -357,6 +357,7 @@ struct hc_driver {
                  */
         int     (*disable_usb3_lpm_timeout)(struct usb_hcd *,
                         struct usb_device *, enum usb3_link_state state);
+        int     (*find_raw_port_number)(struct usb_hcd *, int);
 };
 
 extern int usb_hcd_link_urb_to_ep(struct usb_hcd *hcd, struct urb *urb);
@@ -396,6 +397,7 @@ extern int usb_hcd_is_primary_hcd(struct usb_hcd *hcd);
 extern int usb_add_hcd(struct usb_hcd *hcd,
                 unsigned int irqnum, unsigned long irqflags);
 extern void usb_remove_hcd(struct usb_hcd *hcd);
+extern int usb_hcd_find_raw_port_number(struct usb_hcd *hcd, int port1);
 
 struct platform_device;
 extern void usb_hcd_platform_shutdown(struct platform_device *dev);
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index 4ce009324933..b6b215f13b45 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -26,6 +26,8 @@ struct user_namespace {
         kuid_t                  owner;
         kgid_t                  group;
         unsigned int            proc_inum;
+        bool                    may_mount_sysfs;
+        bool                    may_mount_proc;
 };
 
 extern struct user_namespace init_user_ns;
@@ -82,4 +84,6 @@ static inline void put_user_ns(struct user_namespace *ns)
 
 #endif
 
+void update_mnt_policy(struct user_namespace *userns);
+
 #endif /* _LINUX_USER_H */
diff --git a/include/net/flow_keys.h b/include/net/flow_keys.h
index 80461c1ae9ef..bb8271d487b7 100644
--- a/include/net/flow_keys.h
+++ b/include/net/flow_keys.h
@@ -9,6 +9,7 @@ struct flow_keys {
                 __be32 ports;
                 __be16 port16[2];
         };
+        u16 thoff;
         u8 ip_proto;
 };
 
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 68c69d54d392..fce8e6b66d55 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -976,6 +976,7 @@ struct netns_ipvs {
         int                     sysctl_sync_retries;
         int                     sysctl_nat_icmp_send;
         int                     sysctl_pmtu_disc;
+        int                     sysctl_backup_only;
 
         /* ip_vs_lblc */
         int                     sysctl_lblc_expiration;
@@ -1067,6 +1068,12 @@ static inline int sysctl_pmtu_disc(struct netns_ipvs *ipvs)
         return ipvs->sysctl_pmtu_disc;
 }
 
+static inline int sysctl_backup_only(struct netns_ipvs *ipvs)
+{
+        return ipvs->sync_state & IP_VS_STATE_BACKUP &&
+               ipvs->sysctl_backup_only;
+}
+
 #else
 
 static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs)
@@ -1114,6 +1121,11 @@ static inline int sysctl_pmtu_disc(struct netns_ipvs *ipvs)
         return 1;
 }
 
+static inline int sysctl_backup_only(struct netns_ipvs *ipvs)
+{
+        return 0;
+}
+
 #endif
 
 /*
diff --git a/include/net/ipip.h b/include/net/ipip.h
index fd19625ff99d..982141c15200 100644
--- a/include/net/ipip.h
+++ b/include/net/ipip.h
@@ -77,15 +77,11 @@ static inline void tunnel_ip_select_ident(struct sk_buff *skb,
 {
         struct iphdr *iph = ip_hdr(skb);
 
-        if (iph->frag_off & htons(IP_DF))
-                iph->id = 0;
-        else {
-                /* Use inner packet iph-id if possible. */
-                if (skb->protocol == htons(ETH_P_IP) && old_iph->id)
-                        iph->id = old_iph->id;
-                else
-                        __ip_select_ident(iph, dst,
-                                          (skb_shinfo(skb)->gso_segs ?: 1) - 1);
-        }
+        /* Use inner packet iph-id if possible. */
+        if (skb->protocol == htons(ETH_P_IP) && old_iph->id)
+                iph->id = old_iph->id;
+        else
+                __ip_select_ident(iph, dst,
+                                  (skb_shinfo(skb)->gso_segs ?: 1) - 1);
 }
 #endif
diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
index cc7c19732389..714cc9a54a4c 100644
--- a/include/net/iucv/af_iucv.h
+++ b/include/net/iucv/af_iucv.h
@@ -130,6 +130,14 @@ struct iucv_sock {
                                                enum iucv_tx_notify n);
 };
 
+struct iucv_skb_cb {
+        u32     class;          /* target class of message */
+        u32     tag;            /* tag associated with message */
+        u32     offset;         /* offset for skb receival */
+};
+
+#define IUCV_SKB_CB(__skb)      ((struct iucv_skb_cb *)&((__skb)->cb[0]))
+
 /* iucv socket options (SOL_IUCV) */
 #define SO_IPRMDATA_MSG 0x0080          /* send/recv IPRM_DATA msgs */
 #define SO_MSGLIMIT     0x1000          /* get/set IUCV MSGLIMIT */
diff --git a/include/scsi/libfc.h b/include/scsi/libfc.h
index 399162b50a8d..e1379b4e8faf 100644
--- a/include/scsi/libfc.h
+++ b/include/scsi/libfc.h
@@ -1074,7 +1074,8 @@ void fc_rport_terminate_io(struct fc_rport *);
 /*
  * DISCOVERY LAYER
  *****************************/
-int fc_disc_init(struct fc_lport *);
+void fc_disc_init(struct fc_lport *);
+void fc_disc_config(struct fc_lport *, void *);
 
 static inline struct fc_lport *fc_disc_lport(struct fc_disc *disc)
 {
diff --git a/include/sound/max98090.h b/include/sound/max98090.h
index 95efb13f8478..95efb13f8478 100755..100644
--- a/include/sound/max98090.h
+++ b/include/sound/max98090.h
diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h
index d4c004929ae5..d4609029f014 100644
--- a/include/sound/soc-dapm.h
+++ b/include/sound/soc-dapm.h
@@ -488,6 +488,7 @@ struct snd_soc_dapm_path {
         /* status */
         u32 connect:1;  /* source and sink widgets are connected */
         u32 walked:1;   /* path has been walked */
+        u32 walking:1;  /* path is in the process of being walked */
         u32 weak:1;     /* path ignored for power management */
 
         int (*connected)(struct snd_soc_dapm_widget *source,
diff --git a/include/uapi/linux/packet_diag.h b/include/uapi/linux/packet_diag.h
index 93f5fa94a431..afafd703ad92 100644
--- a/include/uapi/linux/packet_diag.h
+++ b/include/uapi/linux/packet_diag.h
@@ -33,9 +33,11 @@ enum {
         PACKET_DIAG_TX_RING,
         PACKET_DIAG_FANOUT,
 
-        PACKET_DIAG_MAX,
+        __PACKET_DIAG_MAX,
 };
 
+#define PACKET_DIAG_MAX (__PACKET_DIAG_MAX - 1)
+
 struct packet_diag_info {
         __u32   pdi_index;
         __u32   pdi_version;
diff --git a/include/uapi/linux/unix_diag.h b/include/uapi/linux/unix_diag.h
index b8a24941db21..b9e2a6a7446f 100644
--- a/include/uapi/linux/unix_diag.h
+++ b/include/uapi/linux/unix_diag.h
@@ -39,9 +39,11 @@ enum {
         UNIX_DIAG_MEMINFO,
         UNIX_DIAG_SHUTDOWN,
 
-        UNIX_DIAG_MAX,
+        __UNIX_DIAG_MAX,
 };
 
+#define UNIX_DIAG_MAX (__UNIX_DIAG_MAX - 1)
+
 struct unix_diag_vfs {
         __u32   udiag_vfs_ino;
         __u32   udiag_vfs_dev;
diff --git a/include/xen/interface/io/blkif.h b/include/xen/interface/io/blkif.h
index 01c3d62436ef..ffd4652de91c 100644
--- a/include/xen/interface/io/blkif.h
+++ b/include/xen/interface/io/blkif.h
@@ -138,11 +138,21 @@ struct blkif_request_discard {
         uint8_t        _pad3;
 } __attribute__((__packed__));
 
+struct blkif_request_other {
+        uint8_t      _pad1;
+        blkif_vdev_t _pad2;        /* only for read/write requests         */
+#ifdef CONFIG_X86_64
+        uint32_t     _pad3;        /* offsetof(blkif_req..,u.other.id)==8*/
+#endif
+        uint64_t     id;           /* private guest value, echoed in resp  */
+} __attribute__((__packed__));
+
 struct blkif_request {
         uint8_t        operation;    /* BLKIF_OP_???                         */
         union {
                 struct blkif_request_rw rw;
                 struct blkif_request_discard discard;
+                struct blkif_request_other other;
         } u;
 } __attribute__((__packed__));
 
diff --git a/include/xen/interface/physdev.h b/include/xen/interface/physdev.h
index 1844d31f4552..7000bb1f6e96 100644
--- a/include/xen/interface/physdev.h
+++ b/include/xen/interface/physdev.h
@@ -251,6 +251,12 @@ struct physdev_pci_device_add {
 
 #define PHYSDEVOP_pci_device_remove     26
 #define PHYSDEVOP_restore_msi_ext       27
+/*
+ * Dom0 should use these two to announce MMIO resources assigned to
+ * MSI-X capable devices won't (prepare) or may (release) change.
+ */
+#define PHYSDEVOP_prepare_msix          30
+#define PHYSDEVOP_release_msix          31
 struct physdev_pci_device {
     /* IN */
     uint16_t seg;
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 3953fda2e8bd..e4e47f647446 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -330,8 +330,16 @@ static struct dentry *mqueue_mount(struct file_system_type *fs_type,
                          int flags, const char *dev_name,
                          void *data)
 {
-        if (!(flags & MS_KERNMOUNT))
-                data = current->nsproxy->ipc_ns;
+        if (!(flags & MS_KERNMOUNT)) {
+                struct ipc_namespace *ns = current->nsproxy->ipc_ns;
+                /* Don't allow mounting unless the caller has CAP_SYS_ADMIN
+                 * over the ipc namespace.
+                 */
+                if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+                        return ERR_PTR(-EPERM);
+
+                data = ns;
+        }
         return mount_ns(fs_type, flags, data, mqueue_fill_super);
 }
 
diff --git a/ipc/msg.c b/ipc/msg.c
index 31cd1bf6af27..fede1d06ef30 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -872,6 +872,7 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp,
                                                         goto out_unlock;
                                                 break;
                                         }
+                                        msg = ERR_PTR(-EAGAIN);
                                 } else
                                         break;
                                 msg_counter++;
diff --git a/kernel/capability.c b/kernel/capability.c
index 493d97259484..f6c2ce5701e1 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -393,6 +393,30 @@ bool ns_capable(struct user_namespace *ns, int cap)
 EXPORT_SYMBOL(ns_capable);
 
 /**
+ * file_ns_capable - Determine if the file's opener had a capability in effect
+ * @file:  The file we want to check
+ * @ns:  The usernamespace we want the capability in
+ * @cap: The capability to be tested for
+ *
+ * Return true if task that opened the file had a capability in effect
+ * when the file was opened.
+ *
+ * This does not set PF_SUPERPRIV because the caller may not
+ * actually be privileged.
+ */
+bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap)
+{
+        if (WARN_ON_ONCE(!cap_valid(cap)))
+                return false;
+
+        if (security_capable(file->f_cred, ns, cap) == 0)
+                return true;
+
+        return false;
+}
+EXPORT_SYMBOL(file_ns_capable);
+
+/**
  * capable - Determine if the current task has a superior capability in effect
  * @cap: The capability to be tested for
  *
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 59412d037eed..7e0962ed7f8a 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4737,7 +4737,8 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
         } else {
                 if (arch_vma_name(mmap_event->vma)) {
                         name = strncpy(tmp, arch_vma_name(mmap_event->vma),
-                                       sizeof(tmp));
+                                       sizeof(tmp) - 1);
+                        tmp[sizeof(tmp) - 1] = '\0';
                         goto got_name;
                 }
 
@@ -5986,6 +5987,7 @@ skip_type:
         if (pmu->pmu_cpu_context)
                 goto got_cpu_context;
 
+        ret = -ENOMEM;
         pmu->pmu_cpu_context = alloc_percpu(struct perf_cpu_context);
         if (!pmu->pmu_cpu_context)
                 goto free_dev;
diff --git a/kernel/events/internal.h b/kernel/events/internal.h
index d56a64c99a8b..eb675c4d59df 100644
--- a/kernel/events/internal.h
+++ b/kernel/events/internal.h
@@ -16,7 +16,7 @@ struct ring_buffer {
         int                             page_order;     /* allocation order  */
 #endif
         int                             nr_pages;       /* nr of data pages  */
-        int                             writable;       /* are we writable   */
+        int                             overwrite;      /* can overwrite itself */
 
         atomic_t                        poll;           /* POLL_ for wakeups */
 
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 23cb34ff3973..97fddb09762b 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -18,12 +18,24 @@
 static bool perf_output_space(struct ring_buffer *rb, unsigned long tail,
                               unsigned long offset, unsigned long head)
 {
-        unsigned long mask;
+        unsigned long sz = perf_data_size(rb);
+        unsigned long mask = sz - 1;
 
-        if (!rb->writable)
+        /*
+         * check if user-writable
+         * overwrite : over-write its own tail
+         * !overwrite: buffer possibly drops events.
+         */
+        if (rb->overwrite)
                 return true;
 
-        mask = perf_data_size(rb) - 1;
+        /*
+         * verify that payload is not bigger than buffer
+         * otherwise masking logic may fail to detect
+         * the "not enough space" condition
+         */
+        if ((head - offset) > sz)
+                return false;
 
         offset = (offset - tail) & mask;
         head   = (head   - tail) & mask;
@@ -212,7 +224,9 @@ ring_buffer_init(struct ring_buffer *rb, long watermark, int flags)
                 rb->watermark = max_size / 2;
 
         if (flags & RING_BUFFER_WRITABLE)
-                rb->writable = 1;
+                rb->overwrite = 0;
+        else
+                rb->overwrite = 1;
 
         atomic_set(&rb->refcount, 1);
 
diff --git a/kernel/exit.c b/kernel/exit.c
index 51e485ca9935..60bc027c61c3 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -835,7 +835,7 @@ void do_exit(long code)
         /*
          * Make sure we are holding no locks:
          */
-        debug_check_no_locks_held();
+        debug_check_no_locks_held(tsk);
         /*
          * We can do this unlocked here. The futex code uses this flag
          * just to verify whether the pi state cleanup has been done
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 259db207b5d9..8a0efac4f99d 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -4088,7 +4088,7 @@ void debug_check_no_locks_freed(const void *mem_from, unsigned long mem_len)
 }
 EXPORT_SYMBOL_GPL(debug_check_no_locks_freed);
 
-static void print_held_locks_bug(void)
+static void print_held_locks_bug(struct task_struct *curr)
 {
         if (!debug_locks_off())
                 return;
@@ -4097,21 +4097,22 @@ static void print_held_locks_bug(void)
 
         printk("\n");
         printk("=====================================\n");
-        printk("[ BUG: %s/%d still has locks held! ]\n",
-               current->comm, task_pid_nr(current));
+        printk("[ BUG: lock held at task exit time! ]\n");
         print_kernel_ident();
         printk("-------------------------------------\n");
-        lockdep_print_held_locks(current);
+        printk("%s/%d is exiting with locks still held!\n",
+                curr->comm, task_pid_nr(curr));
+        lockdep_print_held_locks(curr);
+
         printk("\nstack backtrace:\n");
         dump_stack();
 }
 
-void debug_check_no_locks_held(void)
+void debug_check_no_locks_held(struct task_struct *task)
 {
-        if (unlikely(current->lockdep_depth > 0))
-                print_held_locks_bug();
+        if (unlikely(task->lockdep_depth > 0))
+                print_held_locks_bug(task);
 }
-EXPORT_SYMBOL_GPL(debug_check_no_locks_held);
 
 void debug_show_all_locks(void)
 {
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index c1c3dc1c6023..bea15bdf82b0 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -181,6 +181,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
         int nr;
         int rc;
         struct task_struct *task, *me = current;
+        int init_pids = thread_group_leader(me) ? 1 : 2;
 
         /* Don't allow any more processes into the pid namespace */
         disable_pid_allocation(pid_ns);
@@ -230,7 +231,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
          */
         for (;;) {
                 set_current_state(TASK_UNINTERRUPTIBLE);
-                if (pid_ns->nr_hashed == 1)
+                if (pid_ns->nr_hashed == init_pids)
                         break;
                 schedule();
         }
diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
index c685e31492df..c3ae1446461c 100644
--- a/kernel/sched/clock.c
+++ b/kernel/sched/clock.c
@@ -176,10 +176,36 @@ static u64 sched_clock_remote(struct sched_clock_data *scd)
         u64 this_clock, remote_clock;
         u64 *ptr, old_val, val;
 
+#if BITS_PER_LONG != 64
+again:
+        /*
+         * Careful here: The local and the remote clock values need to
+         * be read out atomic as we need to compare the values and
+         * then update either the local or the remote side. So the
+         * cmpxchg64 below only protects one readout.
+         *
+         * We must reread via sched_clock_local() in the retry case on
+         * 32bit as an NMI could use sched_clock_local() via the
+         * tracer and hit between the readout of
+         * the low32bit and the high 32bit portion.
+         */
+        this_clock = sched_clock_local(my_scd);
+        /*
+         * We must enforce atomic readout on 32bit, otherwise the
+         * update on the remote cpu can hit inbetween the readout of
+         * the low32bit and the high 32bit portion.
+         */
+        remote_clock = cmpxchg64(&scd->clock, 0, 0);
+#else
+        /*
+         * On 64bit the read of [my]scd->clock is atomic versus the
+         * update, so we can avoid the above 32bit dance.
+         */
         sched_clock_local(my_scd);
 again:
         this_clock = my_scd->clock;
         remote_clock = scd->clock;
+#endif
 
         /*
          * Use the opportunity that we have both locks
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 7f12624a393c..67d04651f44b 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1498,8 +1498,10 @@ static void try_to_wake_up_local(struct task_struct *p)
 {
         struct rq *rq = task_rq(p);
 
-        BUG_ON(rq != this_rq());
-        BUG_ON(p == current);
+        if (WARN_ON_ONCE(rq != this_rq()) ||
+            WARN_ON_ONCE(p == current))
+                return;
+
         lockdep_assert_held(&rq->lock);
 
         if (!raw_spin_trylock(&p->pi_lock)) {
@@ -4999,7 +5001,7 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
 }
 
 static int min_load_idx = 0;
-static int max_load_idx = CPU_LOAD_IDX_MAX;
+static int max_load_idx = CPU_LOAD_IDX_MAX-1;
 
 static void
 set_table_entry(struct ctl_table *entry,
diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
index ed12cbb135f4..e93cca92f38b 100644
--- a/kernel/sched/cputime.c
+++ b/kernel/sched/cputime.c
@@ -310,7 +310,7 @@ void thread_group_cputime(struct task_struct *tsk, struct task_cputime *times)
 
         t = tsk;
         do {
-                task_cputime(tsk, &utime, &stime);
+                task_cputime(t, &utime, &stime);
                 times->utime += utime;
                 times->stime += stime;
                 times->sum_exec_runtime += task_sched_runtime(t);
diff --git a/kernel/sys.c b/kernel/sys.c
index 39c9c4a2949f..0da73cf73e60 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -324,7 +324,6 @@ void kernel_restart_prepare(char *cmd)
         system_state = SYSTEM_RESTART;
         usermodehelper_disable();
         device_shutdown();
-        syscore_shutdown();
 }
 
 /**
@@ -370,6 +369,7 @@ void kernel_restart(char *cmd)
 {
         kernel_restart_prepare(cmd);
         disable_nonboot_cpus();
+        syscore_shutdown();
         if (!cmd)
                 printk(KERN_EMERG "Restarting system.\n");
         else
@@ -395,6 +395,7 @@ static void kernel_shutdown_prepare(enum system_states state)
 void kernel_halt(void)
 {
         kernel_shutdown_prepare(SYSTEM_HALT);
+        disable_nonboot_cpus();
         syscore_shutdown();
         printk(KERN_EMERG "System halted.\n");
         kmsg_dump(KMSG_DUMP_HALT);
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 2fb8cb88df8d..7f32fe0e52cd 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -67,7 +67,8 @@ static void tick_broadcast_start_periodic(struct clock_event_device *bc)
  */
 int tick_check_broadcast_device(struct clock_event_device *dev)
 {
-        if ((tick_broadcast_device.evtdev &&
+        if ((dev->features & CLOCK_EVT_FEAT_DUMMY) ||
+            (tick_broadcast_device.evtdev &&
              tick_broadcast_device.evtdev->rating >= dev->rating) ||
              (dev->features & CLOCK_EVT_FEAT_C3STOP))
                 return 0;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 6893d5a2bf08..b3fde6d7b7fc 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -66,7 +66,7 @@
 
 static struct ftrace_ops ftrace_list_end __read_mostly = {
         .func           = ftrace_stub,
-        .flags          = FTRACE_OPS_FL_RECURSION_SAFE,
+        .flags          = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_STUB,
 };
 
 /* ftrace_enabled is a method to turn ftrace on or off */
@@ -694,7 +694,6 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
                 free_page(tmp);
         }
 
-        free_page((unsigned long)stat->pages);
         stat->pages = NULL;
         stat->start = NULL;
 
@@ -1053,6 +1052,19 @@ static __init void ftrace_profile_debugfs(struct dentry *d_tracer)
 
 static struct pid * const ftrace_swapper_pid = &init_struct_pid;
 
+loff_t
+ftrace_filter_lseek(struct file *file, loff_t offset, int whence)
+{
+        loff_t ret;
+
+        if (file->f_mode & FMODE_READ)
+                ret = seq_lseek(file, offset, whence);
+        else
+                file->f_pos = ret = 1;
+
+        return ret;
+}
+
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 #ifndef CONFIG_FTRACE_MCOUNT_RECORD
@@ -2613,7 +2625,7 @@ static void ftrace_filter_reset(struct ftrace_hash *hash)
  * routine, you can use ftrace_filter_write() for the write
  * routine if @flag has FTRACE_ITER_FILTER set, or
  * ftrace_notrace_write() if @flag has FTRACE_ITER_NOTRACE set.
- * ftrace_regex_lseek() should be used as the lseek routine, and
+ * ftrace_filter_lseek() should be used as the lseek routine, and
  * release must call ftrace_regex_release().
  */
 int
@@ -2697,19 +2709,6 @@ ftrace_notrace_open(struct inode *inode, struct file *file)
                                  inode, file);
 }
 
-loff_t
-ftrace_regex_lseek(struct file *file, loff_t offset, int whence)
-{
-        loff_t ret;
-
-        if (file->f_mode & FMODE_READ)
-                ret = seq_lseek(file, offset, whence);
-        else
-                file->f_pos = ret = 1;
-
-        return ret;
-}
-
 static int ftrace_match(char *str, char *regex, int len, int type)
 {
         int matched = 0;
@@ -3441,14 +3440,14 @@ static char ftrace_filter_buf[FTRACE_FILTER_SIZE] __initdata;
 
 static int __init set_ftrace_notrace(char *str)
 {
-        strncpy(ftrace_notrace_buf, str, FTRACE_FILTER_SIZE);
+        strlcpy(ftrace_notrace_buf, str, FTRACE_FILTER_SIZE);
         return 1;
 }
 __setup("ftrace_notrace=", set_ftrace_notrace);
 
 static int __init set_ftrace_filter(char *str)
 {
-        strncpy(ftrace_filter_buf, str, FTRACE_FILTER_SIZE);
+        strlcpy(ftrace_filter_buf, str, FTRACE_FILTER_SIZE);
         return 1;
 }
 __setup("ftrace_filter=", set_ftrace_filter);
@@ -3571,7 +3570,7 @@ static const struct file_operations ftrace_filter_fops = {
         .open = ftrace_filter_open,
         .read = seq_read,
         .write = ftrace_filter_write,
-        .llseek = ftrace_regex_lseek,
+        .llseek = ftrace_filter_lseek,
         .release = ftrace_regex_release,
 };
 
@@ -3579,7 +3578,7 @@ static const struct file_operations ftrace_notrace_fops = {
         .open = ftrace_notrace_open,
         .read = seq_read,
         .write = ftrace_notrace_write,
-        .llseek = ftrace_regex_lseek,
+        .llseek = ftrace_filter_lseek,
         .release = ftrace_regex_release,
 };
 
@@ -3784,8 +3783,8 @@ static const struct file_operations ftrace_graph_fops = {
         .open           = ftrace_graph_open,
         .read           = seq_read,
         .write          = ftrace_graph_write,
+        .llseek         = ftrace_filter_lseek,
         .release        = ftrace_graph_release,
-        .llseek         = seq_lseek,
 };
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
 
@@ -4131,7 +4130,8 @@ ftrace_ops_control_func(unsigned long ip, unsigned long parent_ip,
         preempt_disable_notrace();
         trace_recursion_set(TRACE_CONTROL_BIT);
         do_for_each_ftrace_op(op, ftrace_control_list) {
-                if (!ftrace_function_local_disabled(op) &&
+                if (!(op->flags & FTRACE_OPS_FL_STUB) &&
+                    !ftrace_function_local_disabled(op) &&
                     ftrace_ops_test(op, ip))
                         op->func(ip, parent_ip, op, regs);
         } while_for_each_ftrace_op(op);
@@ -4439,7 +4439,7 @@ static const struct file_operations ftrace_pid_fops = {
         .open           = ftrace_pid_open,
         .write          = ftrace_pid_write,
         .read           = seq_read,
-        .llseek         = seq_lseek,
+        .llseek         = ftrace_filter_lseek,
         .release        = ftrace_pid_release,
 };
 
@@ -4555,12 +4555,8 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
                 ftrace_startup_sysctl();
 
                 /* we are starting ftrace again */
-                if (ftrace_ops_list != &ftrace_list_end) {
-                        if (ftrace_ops_list->next == &ftrace_list_end)
-                                ftrace_trace_function = ftrace_ops_list->func;
-                        else
-                                ftrace_trace_function = ftrace_ops_list_func;
-                }
+                if (ftrace_ops_list != &ftrace_list_end)
+                        update_ftrace_function();
 
         } else {
                 /* stopping ftrace calls (just send to ftrace_stub) */
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 4f1dade56981..66338c4f7f4b 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -132,7 +132,7 @@ static char *default_bootup_tracer;
 
 static int __init set_cmdline_ftrace(char *str)
 {
-        strncpy(bootup_tracer_buf, str, MAX_TRACER_SIZE);
+        strlcpy(bootup_tracer_buf, str, MAX_TRACER_SIZE);
         default_bootup_tracer = bootup_tracer_buf;
         /* We are using ftrace early, expand it */
         ring_buffer_expanded = 1;
@@ -162,7 +162,7 @@ static char *trace_boot_options __initdata;
 
 static int __init set_trace_boot_options(char *str)
 {
-        strncpy(trace_boot_options_buf, str, MAX_TRACER_SIZE);
+        strlcpy(trace_boot_options_buf, str, MAX_TRACER_SIZE);
         trace_boot_options = trace_boot_options_buf;
         return 0;
 }
@@ -744,8 +744,11 @@ update_max_tr_single(struct trace_array *tr, struct task_struct *tsk, int cpu)
                 return;
 
         WARN_ON_ONCE(!irqs_disabled());
-        if (WARN_ON_ONCE(!current_trace->allocated_snapshot))
+        if (!current_trace->allocated_snapshot) {
+                /* Only the nop tracer should hit this when disabling */
+                WARN_ON_ONCE(current_trace != &nop_trace);
                 return;
+        }
 
         arch_spin_lock(&ftrace_max_lock);
 
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 42ca822fc701..83a8b5b7bd35 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -322,7 +322,7 @@ static const struct file_operations stack_trace_filter_fops = {
         .open = stack_trace_filter_open,
         .read = seq_read,
         .write = ftrace_filter_write,
-        .llseek = ftrace_regex_lseek,
+        .llseek = ftrace_filter_lseek,
         .release = ftrace_regex_release,
 };
 
diff --git a/kernel/user.c b/kernel/user.c
index e81978e8c03b..8e635a18ab52 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -51,6 +51,8 @@ struct user_namespace init_user_ns = {
         .owner = GLOBAL_ROOT_UID,
         .group = GLOBAL_ROOT_GID,
         .proc_inum = PROC_USER_INIT_INO,
+        .may_mount_sysfs = true,
+        .may_mount_proc = true,
 };
 EXPORT_SYMBOL_GPL(init_user_ns);
 
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index b14f4d342043..a54f26f82eb2 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -61,6 +61,15 @@ int create_user_ns(struct cred *new)
         kgid_t group = new->egid;
         int ret;
 
+        /*
+         * Verify that we can not violate the policy of which files
+         * may be accessed that is specified by the root directory,
+         * by verifing that the root directory is at the root of the
+         * mount namespace which allows all files to be accessed.
+         */
+        if (current_chrooted())
+                return -EPERM;
+
         /* The creator needs a mapping in the parent user namespace
          * or else we won't be able to reasonably tell userspace who
          * created a user_namespace.
@@ -87,6 +96,8 @@ int create_user_ns(struct cred *new)
 
         set_cred_user_ns(new, ns);
 
+        update_mnt_policy(ns);
+
         return 0;
 }
 
diff --git a/lib/kobject.c b/lib/kobject.c
index e07ee1fcd6f1..a65486613d79 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -529,6 +529,13 @@ struct kobject *kobject_get(struct kobject *kobj)
         return kobj;
 }
 
+static struct kobject *kobject_get_unless_zero(struct kobject *kobj)
+{
+        if (!kref_get_unless_zero(&kobj->kref))
+                kobj = NULL;
+        return kobj;
+}
+
 /*
  * kobject_cleanup - free kobject resources.
  * @kobj: object to cleanup
@@ -751,7 +758,7 @@ struct kobject *kset_find_obj(struct kset *kset, const char *name)
 
         list_for_each_entry(k, &kset->list, entry) {
                 if (kobject_name(k) && !strcmp(kobject_name(k), name)) {
-                        ret = kobject_get(k);
+                        ret = kobject_get_unless_zero(k);
                         break;
                 }
         }
diff --git a/mm/fremap.c b/mm/fremap.c
index 4723ac8d2fc2..87da3590c61e 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -204,10 +204,8 @@ get_write_lock:
                         unsigned long addr;
                         struct file *file = get_file(vma->vm_file);
 
-                        vm_flags = vma->vm_flags;
-                        if (!(flags & MAP_NONBLOCK))
-                                vm_flags |= VM_POPULATE;
-                        addr = mmap_region(file, start, size, vm_flags, pgoff);
+                        addr = mmap_region(file, start, size,
+                                        vma->vm_flags, pgoff);
                         fput(file);
                         if (IS_ERR_VALUE(addr)) {
                                 err = addr;
@@ -226,12 +224,6 @@ get_write_lock:
                 mutex_unlock(&mapping->i_mmap_mutex);
         }
 
-        if (!(flags & MAP_NONBLOCK) && !(vma->vm_flags & VM_POPULATE)) {
-                if (!has_write_lock)
-                        goto get_write_lock;
-                vma->vm_flags |= VM_POPULATE;
-        }
-
         if (vma->vm_flags & VM_LOCKED) {
                 /*
                  * drop PG_Mlocked flag for over-mapped range
diff --git a/mm/memory.c b/mm/memory.c
index 494526ae024a..13cbc420fead 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -216,6 +216,7 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, bool fullmm)
         tlb->mm = mm;
 
         tlb->fullmm     = fullmm;
+        tlb->need_flush_all = 0;
         tlb->start      = -1UL;
         tlb->end        = 0;
         tlb->need_flush = 0;
diff --git a/mm/mlock.c b/mm/mlock.c
index 1c5e33fce639..79b7cf7d1bca 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -358,7 +358,7 @@ static int do_mlock(unsigned long start, size_t len, int on)
 
                 newflags = vma->vm_flags & ~VM_LOCKED;
                 if (on)
-                        newflags |= VM_LOCKED | VM_POPULATE;
+                        newflags |= VM_LOCKED;
 
                 tmp = vma->vm_end;
                 if (tmp > end)
@@ -418,8 +418,7 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
                  * range with the first VMA. Also, skip undesirable VMA types.
                  */
                 nend = min(end, vma->vm_end);
-                if ((vma->vm_flags & (VM_IO | VM_PFNMAP | VM_POPULATE)) !=
-                    VM_POPULATE)
+                if (vma->vm_flags & (VM_IO | VM_PFNMAP))
                         continue;
                 if (nstart < vma->vm_start)
                         nstart = vma->vm_start;
@@ -492,9 +491,9 @@ static int do_mlockall(int flags)
         struct vm_area_struct * vma, * prev = NULL;
 
         if (flags & MCL_FUTURE)
-                current->mm->def_flags |= VM_LOCKED | VM_POPULATE;
+                current->mm->def_flags |= VM_LOCKED;
         else
-                current->mm->def_flags &= ~(VM_LOCKED | VM_POPULATE);
+                current->mm->def_flags &= ~VM_LOCKED;
         if (flags == MCL_FUTURE)
                 goto out;
 
@@ -503,7 +502,7 @@ static int do_mlockall(int flags)
 
                 newflags = vma->vm_flags & ~VM_LOCKED;
                 if (flags & MCL_CURRENT)
-                        newflags |= VM_LOCKED | VM_POPULATE;
+                        newflags |= VM_LOCKED;
 
                 /* Ignore errors */
                 mlock_fixup(vma, &prev, vma->vm_start, vma->vm_end, newflags);
diff --git a/mm/mmap.c b/mm/mmap.c
index 2664a47cec93..0db0de1c2fbe 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1306,7 +1306,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
         }
 
         addr = mmap_region(file, addr, len, vm_flags, pgoff);
-        if (!IS_ERR_VALUE(addr) && (vm_flags & VM_POPULATE))
+        if (!IS_ERR_VALUE(addr) &&
+            ((vm_flags & VM_LOCKED) ||
+             (flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE))
                 *populate = len;
         return addr;
 }
@@ -1938,7 +1940,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
 
         /* Check the cache first. */
         /* (Cache hit rate is typically around 35%.) */
-        vma = mm->mmap_cache;
+        vma = ACCESS_ONCE(mm->mmap_cache);
         if (!(vma && vma->vm_end > addr && vma->vm_start <= addr)) {
                 struct rb_node *rb_node;
 
diff --git a/mm/nommu.c b/mm/nommu.c
index e19328087534..2f3ea749c318 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -821,7 +821,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
         struct vm_area_struct *vma;
 
         /* check the cache first */
-        vma = mm->mmap_cache;
+        vma = ACCESS_ONCE(mm->mmap_cache);
         if (vma && vma->vm_start <= addr && vma->vm_end > addr)
                 return vma;
 
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index a18714469bf7..85addcd9372b 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -86,13 +86,6 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
 
         grp = &vlan_info->grp;
 
-        /* Take it out of our own structures, but be sure to interlock with
-         * HW accelerating devices or SW vlan input packet processing if
-         * VLAN is not 0 (leave it there for 802.1p).
-         */
-        if (vlan_id)
-                vlan_vid_del(real_dev, vlan_id);
-
         grp->nr_vlan_devs--;
 
         if (vlan->flags & VLAN_FLAG_MVRP)
@@ -114,6 +107,13 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
                 vlan_gvrp_uninit_applicant(real_dev);
         }
 
+        /* Take it out of our own structures, but be sure to interlock with
+         * HW accelerating devices or SW vlan input packet processing if
+         * VLAN is not 0 (leave it there for 802.1p).
+         */
+        if (vlan_id)
+                vlan_vid_del(real_dev, vlan_id);
+
         /* Get rid of the vlan's reference to real_dev */
         dev_put(real_dev);
 }
diff --git a/net/atm/common.c b/net/atm/common.c
index 7b491006eaf4..737bef59ce89 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -531,6 +531,8 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         struct sk_buff *skb;
         int copied, error = -EINVAL;
 
+        msg->msg_namelen = 0;
+
         if (sock->state != SS_CONNECTED)
                 return -ENOTCONN;
 
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 7b11f8bc5071..e277e38f736b 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1642,6 +1642,7 @@ static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock,
                 ax25_address src;
                 const unsigned char *mac = skb_mac_header(skb);
 
+                memset(sax, 0, sizeof(struct full_sockaddr_ax25));
                 ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL,
                                 &digi, NULL, NULL);
                 sax->sax25_family = AF_AX25;
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index d3ee69b35a78..0d1b08cc76e1 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -230,6 +230,8 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (flags & (MSG_OOB))
                 return -EOPNOTSUPP;
 
+        msg->msg_namelen = 0;
+
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb) {
                 if (sk->sk_shutdown & RCV_SHUTDOWN)
@@ -237,8 +239,6 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 return err;
         }
 
-        msg->msg_namelen = 0;
-
         copied = skb->len;
         if (len < copied) {
                 msg->msg_flags |= MSG_TRUNC;
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index c23bae86263b..7c9224bcce17 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -608,6 +608,7 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                 rfcomm_dlc_accept(d);
+                msg->msg_namelen = 0;
                 return 0;
         }
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 79d87d8d4f51..fb6192c9812e 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -359,6 +359,7 @@ static void __sco_sock_close(struct sock *sk)
                         sco_chan_del(sk, ECONNRESET);
                 break;
 
+        case BT_CONNECT2:
         case BT_CONNECT:
         case BT_DISCONN:
                 sco_chan_del(sk, ECONNRESET);
@@ -664,6 +665,7 @@ static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
                 hci_conn_accept(pi->conn->hcon, 0);
                 sk->sk_state = BT_CONFIG;
+                msg->msg_namelen = 0;
 
                 release_sock(sk);
                 return 0;
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index b0812c91c0f0..bab338e6270d 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -423,7 +423,7 @@ static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                         return 0;
                 br_warn(br, "adding interface %s with same address "
                        "as a received packet\n",
-                       source->dev->name);
+                       source ? source->dev->name : br->dev->name);
                 fdb_delete(br, fdb);
         }
 
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 095259f83902..ff2ff3ce6965 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -286,6 +286,8 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (m->msg_flags&MSG_OOB)
                 goto read_error;
 
+        m->msg_namelen = 0;
+
         skb = skb_recv_datagram(sk, flags, 0 , &ret);
         if (!skb)
                 goto read_error;
diff --git a/net/can/gw.c b/net/can/gw.c
index 2d117dc5ebea..117814a7e73c 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -466,7 +466,7 @@ static int cgw_notifier(struct notifier_block *nb,
                         if (gwj->src.dev == dev || gwj->dst.dev == dev) {
                                 hlist_del(&gwj->list);
                                 cgw_unregister_filter(gwj);
-                                kfree(gwj);
+                                kmem_cache_free(cgw_cache, gwj);
                         }
                 }
         }
@@ -864,7 +864,7 @@ static void cgw_remove_all_jobs(void)
         hlist_for_each_entry_safe(gwj, nx, &cgw_list, list) {
                 hlist_del(&gwj->list);
                 cgw_unregister_filter(gwj);
-                kfree(gwj);
+                kmem_cache_free(cgw_cache, gwj);
         }
 }
 
@@ -920,7 +920,7 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
 
                 hlist_del(&gwj->list);
                 cgw_unregister_filter(gwj);
-                kfree(gwj);
+                kmem_cache_free(cgw_cache, gwj);
                 err = 0;
                 break;
         }
diff --git a/net/core/dev.c b/net/core/dev.c
index d540ced1f6c6..e7d68ed8aafe 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1545,7 +1545,6 @@ void net_enable_timestamp(void)
                 return;
         }
 #endif
-        WARN_ON(in_interrupt());
         static_key_slow_inc(&netstamp_needed);
 }
 EXPORT_SYMBOL(net_enable_timestamp);
@@ -1625,7 +1624,6 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
         }
 
         skb_orphan(skb);
-        nf_reset(skb);
 
         if (unlikely(!is_skb_forwardable(dev, skb))) {
                 atomic_long_inc(&dev->rx_dropped);
@@ -1641,6 +1639,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
         skb->mark = 0;
         secpath_reset(skb);
         nf_reset(skb);
+        nf_reset_trace(skb);
         return netif_rx(skb);
 }
 EXPORT_SYMBOL_GPL(dev_forward_skb);
@@ -3315,6 +3314,7 @@ int netdev_rx_handler_register(struct net_device *dev,
         if (dev->rx_handler)
                 return -EBUSY;
 
+        /* Note: rx_handler_data must be set before rx_handler */
         rcu_assign_pointer(dev->rx_handler_data, rx_handler_data);
         rcu_assign_pointer(dev->rx_handler, rx_handler);
 
@@ -3335,6 +3335,11 @@ void netdev_rx_handler_unregister(struct net_device *dev)
 
         ASSERT_RTNL();
         RCU_INIT_POINTER(dev->rx_handler, NULL);
+        /* a reader seeing a non NULL rx_handler in a rcu_read_lock()
+         * section has a guarantee to see a non NULL rx_handler_data
+         * as well.
+         */
+        synchronize_net();
         RCU_INIT_POINTER(dev->rx_handler_data, NULL);
 }
 EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister);
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index bd2eb9d3e369..abdc9e6ef33e 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -37,7 +37,7 @@ static int __hw_addr_create_ex(struct netdev_hw_addr_list *list,
         ha->type = addr_type;
         ha->refcount = 1;
         ha->global_use = global;
-        ha->synced = false;
+        ha->synced = 0;
         list_add_tail_rcu(&ha->list, &list->list);
         list->count++;
 
@@ -165,7 +165,7 @@ int __hw_addr_sync(struct netdev_hw_addr_list *to_list,
                                             addr_len, ha->type);
                         if (err)
                                 break;
-                        ha->synced = true;
+                        ha->synced++;
                         ha->refcount++;
                 } else if (ha->refcount == 1) {
                         __hw_addr_del(to_list, ha->addr, addr_len, ha->type);
@@ -186,7 +186,7 @@ void __hw_addr_unsync(struct netdev_hw_addr_list *to_list,
                 if (ha->synced) {
                         __hw_addr_del(to_list, ha->addr,
                                       addr_len, ha->type);
-                        ha->synced = false;
+                        ha->synced--;
                         __hw_addr_del(from_list, ha->addr,
                                       addr_len, ha->type);
                 }
diff --git a/net/core/flow.c b/net/core/flow.c
index c56ea6f7f6c7..2bfd081c59f7 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -328,7 +328,7 @@ static void flow_cache_flush_per_cpu(void *data)
         struct flow_flush_info *info = data;
         struct tasklet_struct *tasklet;
 
-        tasklet = this_cpu_ptr(&info->cache->percpu->flush_tasklet);
+        tasklet = &this_cpu_ptr(info->cache->percpu)->flush_tasklet;
         tasklet->data = (unsigned long)info;
         tasklet_schedule(tasklet);
 }
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 9d4c7201400d..e187bf06d673 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -140,6 +140,8 @@ ipv6:
                         flow->ports = *ports;
         }
 
+        flow->thoff = (u16) nhoff;
+
         return true;
 }
 EXPORT_SYMBOL(skb_flow_dissect);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 5fb8d7e47294..23854b51a259 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -496,8 +496,10 @@ static int rtnl_link_fill(struct sk_buff *skb, const struct net_device *dev)
         }
         if (ops->fill_info) {
                 data = nla_nest_start(skb, IFLA_INFO_DATA);
-                if (data == NULL)
+                if (data == NULL) {
+                        err = -EMSGSIZE;
                         goto err_cancel_link;
+                }
                 err = ops->fill_info(skb, dev);
                 if (err < 0)
                         goto err_cancel_data;
@@ -1070,7 +1072,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         rcu_read_lock();
         cb->seq = net->dev_base_seq;
 
-        if (nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+        if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
                         ifla_policy) >= 0) {
 
                 if (tb[IFLA_EXT_MASK])
@@ -1920,7 +1922,7 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
         u32 ext_filter_mask = 0;
         u16 min_ifinfo_dump_size = 0;
 
-        if (nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+        if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
                         ifla_policy) >= 0) {
                 if (tb[IFLA_EXT_MASK])
                         ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
diff --git a/net/core/scm.c b/net/core/scm.c
index 905dcc6ad1e3..2dc6cdaaae8a 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -24,6 +24,7 @@
 #include <linux/interrupt.h>
 #include <linux/netdevice.h>
 #include <linux/security.h>
+#include <linux/pid_namespace.h>
 #include <linux/pid.h>
 #include <linux/nsproxy.h>
 #include <linux/slab.h>
@@ -52,7 +53,8 @@ static __inline__ int scm_check_creds(struct ucred *creds)
         if (!uid_valid(uid) || !gid_valid(gid))
                 return -EINVAL;
 
-        if ((creds->pid == task_tgid_vnr(current) || nsown_capable(CAP_SYS_ADMIN)) &&
+        if ((creds->pid == task_tgid_vnr(current) ||
+             ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
             ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
               uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
             ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 68f6a94f7661..c929d9c1c4b6 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1333,8 +1333,7 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb,
                                 iph->frag_off |= htons(IP_MF);
                         offset += (skb->len - skb->mac_len - iph->ihl * 4);
                 } else  {
-                        if (!(iph->frag_off & htons(IP_DF)))
-                                iph->id = htons(id++);
+                        iph->id = htons(id++);
                 }
                 iph->tot_len = htons(skb->len - skb->mac_len);
                 iph->check = 0;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index f678507bc829..c6287cd978c2 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -587,13 +587,16 @@ static void check_lifetime(struct work_struct *work)
 {
         unsigned long now, next, next_sec, next_sched;
         struct in_ifaddr *ifa;
+        struct hlist_node *n;
         int i;
 
         now = jiffies;
         next = round_jiffies_up(now + ADDR_CHECK_FREQUENCY);
 
-        rcu_read_lock();
         for (i = 0; i < IN4_ADDR_HSIZE; i++) {
+                bool change_needed = false;
+
+                rcu_read_lock();
                 hlist_for_each_entry_rcu(ifa, &inet_addr_lst[i], hash) {
                         unsigned long age;
 
@@ -606,16 +609,7 @@ static void check_lifetime(struct work_struct *work)
 
                         if (ifa->ifa_valid_lft != INFINITY_LIFE_TIME &&
                             age >= ifa->ifa_valid_lft) {
-                                struct in_ifaddr **ifap ;
-
-                                rtnl_lock();
-                                for (ifap = &ifa->ifa_dev->ifa_list;
-                                     *ifap != NULL; ifap = &ifa->ifa_next) {
-                                        if (*ifap == ifa)
-                                                inet_del_ifa(ifa->ifa_dev,
-                                                             ifap, 1);
-                                }
-                                rtnl_unlock();
+                                change_needed = true;
                         } else if (ifa->ifa_preferred_lft ==
                                    INFINITY_LIFE_TIME) {
                                 continue;
@@ -625,10 +619,8 @@ static void check_lifetime(struct work_struct *work)
                                         next = ifa->ifa_tstamp +
                                                ifa->ifa_valid_lft * HZ;
 
-                                if (!(ifa->ifa_flags & IFA_F_DEPRECATED)) {
-                                        ifa->ifa_flags |= IFA_F_DEPRECATED;
-                                        rtmsg_ifa(RTM_NEWADDR, ifa, NULL, 0);
-                                }
+                                if (!(ifa->ifa_flags & IFA_F_DEPRECATED))
+                                        change_needed = true;
                         } else if (time_before(ifa->ifa_tstamp +
                                                ifa->ifa_preferred_lft * HZ,
                                                next)) {
@@ -636,8 +628,42 @@ static void check_lifetime(struct work_struct *work)
                                        ifa->ifa_preferred_lft * HZ;
                         }
                 }
+                rcu_read_unlock();
+                if (!change_needed)
+                        continue;
+                rtnl_lock();
+                hlist_for_each_entry_safe(ifa, n, &inet_addr_lst[i], hash) {
+                        unsigned long age;
+
+                        if (ifa->ifa_flags & IFA_F_PERMANENT)
+                                continue;
+
+                        /* We try to batch several events at once. */
+                        age = (now - ifa->ifa_tstamp +
+                               ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
+
+                        if (ifa->ifa_valid_lft != INFINITY_LIFE_TIME &&
+                            age >= ifa->ifa_valid_lft) {
+                                struct in_ifaddr **ifap;
+
+                                for (ifap = &ifa->ifa_dev->ifa_list;
+                                     *ifap != NULL; ifap = &(*ifap)->ifa_next) {
+                                        if (*ifap == ifa) {
+                                                inet_del_ifa(ifa->ifa_dev,
+                                                             ifap, 1);
+                                                break;
+                                        }
+                                }
+                        } else if (ifa->ifa_preferred_lft !=
+                                   INFINITY_LIFE_TIME &&
+                                   age >= ifa->ifa_preferred_lft &&
+                                   !(ifa->ifa_flags & IFA_F_DEPRECATED)) {
+                                ifa->ifa_flags |= IFA_F_DEPRECATED;
+                                rtmsg_ifa(RTM_NEWADDR, ifa, NULL, 0);
+                        }
+                }
+                rtnl_unlock();
         }
-        rcu_read_unlock();
 
         next_sec = round_jiffies_up(next);
         next_sched = next;
@@ -802,8 +828,12 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
                 if (nlh->nlmsg_flags & NLM_F_EXCL ||
                     !(nlh->nlmsg_flags & NLM_F_REPLACE))
                         return -EEXIST;
-
-                set_ifa_lifetime(ifa_existing, valid_lft, prefered_lft);
+                ifa = ifa_existing;
+                set_ifa_lifetime(ifa, valid_lft, prefered_lft);
+                cancel_delayed_work(&check_lifetime_work);
+                schedule_delayed_work(&check_lifetime_work, 0);
+                rtmsg_ifa(RTM_NEWADDR, ifa, nlh, NETLINK_CB(skb).portid);
+                blocking_notifier_call_chain(&inetaddr_chain, NETDEV_UP, ifa);
         }
         return 0;
 }
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 98cbc6877019..bf6c5cf31aed 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1522,7 +1522,8 @@ static int __init ip_auto_config(void)
                 }
         for (i++; i < CONF_NAMESERVERS_MAX; i++)
                 if (ic_nameservers[i] != NONE)
-                        pr_cont(", nameserver%u=%pI4\n", i, &ic_nameservers[i]);
+                        pr_cont(", nameserver%u=%pI4", i, &ic_nameservers[i]);
+        pr_cont("\n");
 #endif /* !SILENT */
 
         return 0;
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index ce2d43e1f09f..0d755c50994b 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -36,19 +36,6 @@ config NF_CONNTRACK_PROC_COMPAT
 
           If unsure, say Y.
 
-config IP_NF_QUEUE
-        tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
-        depends on NETFILTER_ADVANCED
-        help
-          Netfilter has the ability to queue packets to user space: the
-          netlink device can be used to access them using this driver.
-
-          This option enables the old IPv4-only "ip_queue" implementation
-          which has been obsoleted by the new "nfnetlink_queue" code (see
-          CONFIG_NETFILTER_NETLINK_QUEUE).
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
 config IP_NF_IPTABLES
         tristate "IP tables support (required for filtering/masq/NAT)"
         default m if NETFILTER_ADVANCED=n
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 0d9bdacce99f..3bd55bad230a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2059,11 +2059,8 @@ void tcp_enter_loss(struct sock *sk, int how)
         if (tcp_is_reno(tp))
                 tcp_reset_reno_sack(tp);
 
-        if (!how) {
-                /* Push undo marker, if it was plain RTO and nothing
-                 * was retransmitted. */
-                tp->undo_marker = tp->snd_una;
-        } else {
+        tp->undo_marker = tp->snd_una;
+        if (how) {
                 tp->sacked_out = 0;
                 tp->fackets_out = 0;
         }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 817fbb396bc8..b44cf81d8178 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1809,8 +1809,11 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
                         goto send_now;
         }
 
-        /* Ok, it looks like it is advisable to defer.  */
-        tp->tso_deferred = 1 | (jiffies << 1);
+        /* Ok, it looks like it is advisable to defer.
+         * Do not rearm the timer if already set to not break TCP ACK clocking.
+         */
+        if (!tp->tso_deferred)
+                tp->tso_deferred = 1 | (jiffies << 1);
 
         return true;
 
@@ -2706,6 +2709,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         skb_reserve(skb, MAX_TCP_HEADER);
 
         skb_dst_set(skb, dst);
+        security_skb_owned_by(skb, sk);
 
         mss = dst_metric_advmss(dst);
         if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < mss)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 265c42cf963c..0a073a263720 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1762,9 +1762,16 @@ int udp_rcv(struct sk_buff *skb)
 
 void udp_destroy_sock(struct sock *sk)
 {
+        struct udp_sock *up = udp_sk(sk);
         bool slow = lock_sock_fast(sk);
         udp_flush_pending_frames(sk);
         unlock_sock_fast(sk, slow);
+        if (static_key_false(&udp_encap_needed) && up->encap_type) {
+                void (*encap_destroy)(struct sock *sk);
+                encap_destroy = ACCESS_ONCE(up->encap_destroy);
+                if (encap_destroy)
+                        encap_destroy(sk);
+        }
 }
 
 /*
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f2c7e615f902..a459c4f5b769 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2529,6 +2529,9 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
 static void init_loopback(struct net_device *dev)
 {
         struct inet6_dev  *idev;
+        struct net_device *sp_dev;
+        struct inet6_ifaddr *sp_ifa;
+        struct rt6_info *sp_rt;
 
         /* ::1 */
 
@@ -2540,6 +2543,30 @@ static void init_loopback(struct net_device *dev)
         }
 
         add_addr(idev, &in6addr_loopback, 128, IFA_HOST);
+
+        /* Add routes to other interface's IPv6 addresses */
+        for_each_netdev(dev_net(dev), sp_dev) {
+                if (!strcmp(sp_dev->name, dev->name))
+                        continue;
+
+                idev = __in6_dev_get(sp_dev);
+                if (!idev)
+                        continue;
+
+                read_lock_bh(&idev->lock);
+                list_for_each_entry(sp_ifa, &idev->addr_list, if_list) {
+
+                        if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
+                                continue;
+
+                        sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
+
+                        /* Failure cases are ignored */
+                        if (!IS_ERR(sp_rt))
+                                ip6_ins_rt(sp_rt);
+                }
+                read_unlock_bh(&idev->lock);
+        }
 }
 
 static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr *addr)
@@ -4784,26 +4811,20 @@ static void addrconf_sysctl_unregister(struct inet6_dev *idev)
 
 static int __net_init addrconf_init_net(struct net *net)
 {
-        int err;
+        int err = -ENOMEM;
         struct ipv6_devconf *all, *dflt;
 
-        err = -ENOMEM;
-        all = &ipv6_devconf;
-        dflt = &ipv6_devconf_dflt;
+        all = kmemdup(&ipv6_devconf, sizeof(ipv6_devconf), GFP_KERNEL);
+        if (all == NULL)
+                goto err_alloc_all;
 
-        if (!net_eq(net, &init_net)) {
-                all = kmemdup(all, sizeof(ipv6_devconf), GFP_KERNEL);
-                if (all == NULL)
-                        goto err_alloc_all;
+        dflt = kmemdup(&ipv6_devconf_dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL);
+        if (dflt == NULL)
+                goto err_alloc_dflt;
 
-                dflt = kmemdup(dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL);
-                if (dflt == NULL)
-                        goto err_alloc_dflt;
-        } else {
-                /* these will be inherited by all namespaces */
-                dflt->autoconf = ipv6_defaults.autoconf;
-                dflt->disable_ipv6 = ipv6_defaults.disable_ipv6;
-        }
+        /* these will be inherited by all namespaces */
+        dflt->autoconf = ipv6_defaults.autoconf;
+        dflt->disable_ipv6 = ipv6_defaults.disable_ipv6;
 
         net->ipv6.devconf_all = all;
         net->ipv6.devconf_dflt = dflt;
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index e33fe0ab2568..2bab2aa59745 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -118,6 +118,18 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
             ipv6_addr_loopback(&hdr->daddr))
                 goto err;
 
+        /* RFC4291 Errata ID: 3480
+         * Interface-Local scope spans only a single interface on a
+         * node and is useful only for loopback transmission of
+         * multicast.  Packets with interface-local scope received
+         * from another node must be discarded.
+         */
+        if (!(skb->pkt_type == PACKET_LOOPBACK ||
+              dev->flags & IFF_LOOPBACK) &&
+            ipv6_addr_is_multicast(&hdr->daddr) &&
+            IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 1)
+                goto err;
+
         /* RFC4291 2.7
          * Nodes must not originate a packet to a multicast address whose scope
          * field contains the reserved value 0; if such a packet is received, it
diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
index 83acc1405a18..cb631143721c 100644
--- a/net/ipv6/netfilter/ip6t_NPT.c
+++ b/net/ipv6/netfilter/ip6t_NPT.c
@@ -57,7 +57,7 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
                 if (pfx_len - i >= 32)
                         mask = 0;
                 else
-                        mask = htonl(~((1 << (pfx_len - i)) - 1));
+                        mask = htonl((1 << (i - pfx_len + 32)) - 1);
 
                 idx = i / 32;
                 addr->s6_addr32[idx] &= mask;
@@ -114,6 +114,7 @@ ip6t_dnpt_tg(struct sk_buff *skb, const struct xt_action_param *par)
 static struct xt_target ip6t_npt_target_reg[] __read_mostly = {
         {
                 .name           = "SNPT",
+                .table          = "mangle",
                 .target         = ip6t_snpt_tg,
                 .targetsize     = sizeof(struct ip6t_npt_tginfo),
                 .checkentry     = ip6t_npt_checkentry,
@@ -124,6 +125,7 @@ static struct xt_target ip6t_npt_target_reg[] __read_mostly = {
         },
         {
                 .name           = "DNPT",
+                .table          = "mangle",
                 .target         = ip6t_dnpt_tg,
                 .targetsize     = sizeof(struct ip6t_npt_tginfo),
                 .checkentry     = ip6t_npt_checkentry,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f6d629fd6aee..46a5be85be87 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -386,6 +386,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
                 if (dst)
                         dst->ops->redirect(dst, sk, skb);
+                goto out;
         }
 
         if (type == ICMPV6_PKT_TOOBIG) {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 599e1ba6d1ce..d8e5e852fc7a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1285,10 +1285,18 @@ do_confirm:
 
 void udpv6_destroy_sock(struct sock *sk)
 {
+        struct udp_sock *up = udp_sk(sk);
         lock_sock(sk);
         udp_v6_flush_pending_frames(sk);
         release_sock(sk);
 
+        if (static_key_false(&udpv6_encap_needed) && up->encap_type) {
+                void (*encap_destroy)(struct sock *sk);
+                encap_destroy = ACCESS_ONCE(up->encap_destroy);
+                if (encap_destroy)
+                        encap_destroy(sk);
+        }
+
         inet6_destroy_sock(sk);
 }
 
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index d07e3a626446..e493b3397ae3 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1386,6 +1386,8 @@ static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,
 
         IRDA_DEBUG(4, "%s()\n", __func__);
 
+        msg->msg_namelen = 0;
+
         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                 flags & MSG_DONTWAIT, &err);
         if (!skb)
@@ -2583,8 +2585,10 @@ bed:
                                     NULL, NULL, NULL);
 
                 /* Check if the we got some results */
-                if (!self->cachedaddr)
-                        return -EAGAIN;         /* Didn't find any devices */
+                if (!self->cachedaddr) {
+                        err = -EAGAIN;          /* Didn't find any devices */
+                        goto out;
+                }
                 daddr = self->cachedaddr;
                 /* Cleanup */
                 self->cachedaddr = 0;
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index a7d11ffe4284..206ce6db2c36 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -49,12 +49,6 @@ static const u8 iprm_shutdown[8] =
 
 #define TRGCLS_SIZE     (sizeof(((struct iucv_message *)0)->class))
 
-/* macros to set/get socket control buffer at correct offset */
-#define CB_TAG(skb)     ((skb)->cb)             /* iucv message tag */
-#define CB_TAG_LEN      (sizeof(((struct iucv_message *) 0)->tag))
-#define CB_TRGCLS(skb)  ((skb)->cb + CB_TAG_LEN) /* iucv msg target class */
-#define CB_TRGCLS_LEN   (TRGCLS_SIZE)
-
 #define __iucv_sock_wait(sk, condition, timeo, ret)                     \
 do {                                                                    \
         DEFINE_WAIT(__wait);                                            \
@@ -1141,7 +1135,7 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         /* increment and save iucv message tag for msg_completion cbk */
         txmsg.tag = iucv->send_tag++;
-        memcpy(CB_TAG(skb), &txmsg.tag, CB_TAG_LEN);
+        IUCV_SKB_CB(skb)->tag = txmsg.tag;
 
         if (iucv->transport == AF_IUCV_TRANS_HIPER) {
                 atomic_inc(&iucv->msg_sent);
@@ -1224,7 +1218,7 @@ static int iucv_fragment_skb(struct sock *sk, struct sk_buff *skb, int len)
                         return -ENOMEM;
 
                 /* copy target class to control buffer of new skb */
-                memcpy(CB_TRGCLS(nskb), CB_TRGCLS(skb), CB_TRGCLS_LEN);
+                IUCV_SKB_CB(nskb)->class = IUCV_SKB_CB(skb)->class;
 
                 /* copy data fragment */
                 memcpy(nskb->data, skb->data + copied, size);
@@ -1256,7 +1250,7 @@ static void iucv_process_message(struct sock *sk, struct sk_buff *skb,
 
         /* store msg target class in the second 4 bytes of skb ctrl buffer */
         /* Note: the first 4 bytes are reserved for msg tag */
-        memcpy(CB_TRGCLS(skb), &msg->class, CB_TRGCLS_LEN);
+        IUCV_SKB_CB(skb)->class = msg->class;
 
         /* check for special IPRM messages (e.g. iucv_sock_shutdown) */
         if ((msg->flags & IUCV_IPRMDATA) && len > 7) {
@@ -1292,6 +1286,7 @@ static void iucv_process_message(struct sock *sk, struct sk_buff *skb,
                 }
         }
 
+        IUCV_SKB_CB(skb)->offset = 0;
         if (sock_queue_rcv_skb(sk, skb))
                 skb_queue_head(&iucv_sk(sk)->backlog_skb_q, skb);
 }
@@ -1327,6 +1322,9 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         unsigned int copied, rlen;
         struct sk_buff *skb, *rskb, *cskb;
         int err = 0;
+        u32 offset;
+
+        msg->msg_namelen = 0;
 
         if ((sk->sk_state == IUCV_DISCONN) &&
             skb_queue_empty(&iucv->backlog_skb_q) &&
@@ -1346,13 +1344,14 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 return err;
         }
 
-        rlen   = skb->len;              /* real length of skb */
+        offset = IUCV_SKB_CB(skb)->offset;
+        rlen   = skb->len - offset;             /* real length of skb */
         copied = min_t(unsigned int, rlen, len);
         if (!rlen)
                 sk->sk_shutdown = sk->sk_shutdown | RCV_SHUTDOWN;
 
         cskb = skb;
-        if (skb_copy_datagram_iovec(cskb, 0, msg->msg_iov, copied)) {
+        if (skb_copy_datagram_iovec(cskb, offset, msg->msg_iov, copied)) {
                 if (!(flags & MSG_PEEK))
                         skb_queue_head(&sk->sk_receive_queue, skb);
                 return -EFAULT;
@@ -1370,7 +1369,8 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
          * get the trgcls from the control buffer of the skb due to
          * fragmentation of original iucv message. */
         err = put_cmsg(msg, SOL_IUCV, SCM_IUCV_TRGCLS,
-                        CB_TRGCLS_LEN, CB_TRGCLS(skb));
+                       sizeof(IUCV_SKB_CB(skb)->class),
+                       (void *)&IUCV_SKB_CB(skb)->class);
         if (err) {
                 if (!(flags & MSG_PEEK))
                         skb_queue_head(&sk->sk_receive_queue, skb);
@@ -1382,9 +1382,8 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                 /* SOCK_STREAM: re-queue skb if it contains unreceived data */
                 if (sk->sk_type == SOCK_STREAM) {
-                        skb_pull(skb, copied);
-                        if (skb->len) {
-                                skb_queue_head(&sk->sk_receive_queue, skb);
+                        if (copied < rlen) {
+                                IUCV_SKB_CB(skb)->offset = offset + copied;
                                 goto done;
                         }
                 }
@@ -1403,6 +1402,7 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 spin_lock_bh(&iucv->message_q.lock);
                 rskb = skb_dequeue(&iucv->backlog_skb_q);
                 while (rskb) {
+                        IUCV_SKB_CB(rskb)->offset = 0;
                         if (sock_queue_rcv_skb(sk, rskb)) {
                                 skb_queue_head(&iucv->backlog_skb_q,
                                                 rskb);
@@ -1830,7 +1830,7 @@ static void iucv_callback_txdone(struct iucv_path *path,
                 spin_lock_irqsave(&list->lock, flags);
 
                 while (list_skb != (struct sk_buff *)list) {
-                        if (!memcmp(&msg->tag, CB_TAG(list_skb), CB_TAG_LEN)) {
+                        if (msg->tag != IUCV_SKB_CB(list_skb)->tag) {
                                 this = list_skb;
                                 break;
                         }
@@ -2091,6 +2091,7 @@ static int afiucv_hs_callback_rx(struct sock *sk, struct sk_buff *skb)
         skb_pull(skb, sizeof(struct af_iucv_trans_hdr));
         skb_reset_transport_header(skb);
         skb_reset_network_header(skb);
+        IUCV_SKB_CB(skb)->offset = 0;
         spin_lock(&iucv->message_q.lock);
         if (skb_queue_empty(&iucv->backlog_skb_q)) {
                 if (sock_queue_rcv_skb(sk, skb)) {
@@ -2195,8 +2196,7 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
                 /* fall through and receive zero length data */
         case 0:
                 /* plain data frame */
-                memcpy(CB_TRGCLS(skb), &trans_hdr->iucv_hdr.class,
-                       CB_TRGCLS_LEN);
+                IUCV_SKB_CB(skb)->class = trans_hdr->iucv_hdr.class;
                 err = afiucv_hs_callback_rx(sk, skb);
                 break;
         default:
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 8555f331ea60..5b1e5af25713 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2693,6 +2693,7 @@ static int key_notify_policy_flush(const struct km_event *c)
         hdr->sadb_msg_pid = c->portid;
         hdr->sadb_msg_version = PF_KEY_V2;
         hdr->sadb_msg_errno = (uint8_t) 0;
+        hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
         pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
         return 0;
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index d36875f3427e..8aecf5df6656 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -114,7 +114,6 @@ struct l2tp_net {
 
 static void l2tp_session_set_header_len(struct l2tp_session *session, int version);
 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
-static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel);
 
 static inline struct l2tp_net *l2tp_pernet(struct net *net)
 {
@@ -192,6 +191,7 @@ struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel)
         } else {
                 /* Socket is owned by kernelspace */
                 sk = tunnel->sock;
+                sock_hold(sk);
         }
 
 out:
@@ -210,6 +210,7 @@ void l2tp_tunnel_sock_put(struct sock *sk)
                 }
                 sock_put(sk);
         }
+        sock_put(sk);
 }
 EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_put);
 
@@ -373,10 +374,8 @@ static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *sk
         struct sk_buff *skbp;
         struct sk_buff *tmp;
         u32 ns = L2TP_SKB_CB(skb)->ns;
-        struct l2tp_stats *sstats;
 
         spin_lock_bh(&session->reorder_q.lock);
-        sstats = &session->stats;
         skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
                 if (L2TP_SKB_CB(skbp)->ns > ns) {
                         __skb_queue_before(&session->reorder_q, skbp, skb);
@@ -384,9 +383,7 @@ static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *sk
                                  "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
                                  session->name, ns, L2TP_SKB_CB(skbp)->ns,
                                  skb_queue_len(&session->reorder_q));
-                        u64_stats_update_begin(&sstats->syncp);
-                        sstats->rx_oos_packets++;
-                        u64_stats_update_end(&sstats->syncp);
+                        atomic_long_inc(&session->stats.rx_oos_packets);
                         goto out;
                 }
         }
@@ -403,23 +400,16 @@ static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *
 {
         struct l2tp_tunnel *tunnel = session->tunnel;
         int length = L2TP_SKB_CB(skb)->length;
-        struct l2tp_stats *tstats, *sstats;
 
         /* We're about to requeue the skb, so return resources
          * to its current owner (a socket receive buffer).
          */
         skb_orphan(skb);
 
-        tstats = &tunnel->stats;
-        u64_stats_update_begin(&tstats->syncp);
-        sstats = &session->stats;
-        u64_stats_update_begin(&sstats->syncp);
-        tstats->rx_packets++;
-        tstats->rx_bytes += length;
-        sstats->rx_packets++;
-        sstats->rx_bytes += length;
-        u64_stats_update_end(&tstats->syncp);
-        u64_stats_update_end(&sstats->syncp);
+        atomic_long_inc(&tunnel->stats.rx_packets);
+        atomic_long_add(length, &tunnel->stats.rx_bytes);
+        atomic_long_inc(&session->stats.rx_packets);
+        atomic_long_add(length, &session->stats.rx_bytes);
 
         if (L2TP_SKB_CB(skb)->has_seq) {
                 /* Bump our Nr */
@@ -450,7 +440,6 @@ static void l2tp_recv_dequeue(struct l2tp_session *session)
 {
         struct sk_buff *skb;
         struct sk_buff *tmp;
-        struct l2tp_stats *sstats;
 
         /* If the pkt at the head of the queue has the nr that we
          * expect to send up next, dequeue it and any other
@@ -458,13 +447,10 @@ static void l2tp_recv_dequeue(struct l2tp_session *session)
          */
 start:
         spin_lock_bh(&session->reorder_q.lock);
-        sstats = &session->stats;
         skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
                 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
-                        u64_stats_update_begin(&sstats->syncp);
-                        sstats->rx_seq_discards++;
-                        sstats->rx_errors++;
-                        u64_stats_update_end(&sstats->syncp);
+                        atomic_long_inc(&session->stats.rx_seq_discards);
+                        atomic_long_inc(&session->stats.rx_errors);
                         l2tp_dbg(session, L2TP_MSG_SEQ,
                                  "%s: oos pkt %u len %d discarded (too old), waiting for %u, reorder_q_len=%d\n",
                                  session->name, L2TP_SKB_CB(skb)->ns,
@@ -623,7 +609,6 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
         struct l2tp_tunnel *tunnel = session->tunnel;
         int offset;
         u32 ns, nr;
-        struct l2tp_stats *sstats = &session->stats;
 
         /* The ref count is increased since we now hold a pointer to
          * the session. Take care to decrement the refcnt when exiting
@@ -640,9 +625,7 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                                   "%s: cookie mismatch (%u/%u). Discarding.\n",
                                   tunnel->name, tunnel->tunnel_id,
                                   session->session_id);
-                        u64_stats_update_begin(&sstats->syncp);
-                        sstats->rx_cookie_discards++;
-                        u64_stats_update_end(&sstats->syncp);
+                        atomic_long_inc(&session->stats.rx_cookie_discards);
                         goto discard;
                 }
                 ptr += session->peer_cookie_len;
@@ -711,9 +694,7 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                         l2tp_warn(session, L2TP_MSG_SEQ,
                                   "%s: recv data has no seq numbers when required. Discarding.\n",
                                   session->name);
-                        u64_stats_update_begin(&sstats->syncp);
-                        sstats->rx_seq_discards++;
-                        u64_stats_update_end(&sstats->syncp);
+                        atomic_long_inc(&session->stats.rx_seq_discards);
                         goto discard;
                 }
 
@@ -732,9 +713,7 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                         l2tp_warn(session, L2TP_MSG_SEQ,
                                   "%s: recv data has no seq numbers when required. Discarding.\n",
                                   session->name);
-                        u64_stats_update_begin(&sstats->syncp);
-                        sstats->rx_seq_discards++;
-                        u64_stats_update_end(&sstats->syncp);
+                        atomic_long_inc(&session->stats.rx_seq_discards);
                         goto discard;
                 }
         }
@@ -788,9 +767,7 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                          * packets
                          */
                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
-                                u64_stats_update_begin(&sstats->syncp);
-                                sstats->rx_seq_discards++;
-                                u64_stats_update_end(&sstats->syncp);
+                                atomic_long_inc(&session->stats.rx_seq_discards);
                                 l2tp_dbg(session, L2TP_MSG_SEQ,
                                          "%s: oos pkt %u len %d discarded, waiting for %u, reorder_q_len=%d\n",
                                          session->name, L2TP_SKB_CB(skb)->ns,
@@ -816,9 +793,7 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
         return;
 
 discard:
-        u64_stats_update_begin(&sstats->syncp);
-        sstats->rx_errors++;
-        u64_stats_update_end(&sstats->syncp);
+        atomic_long_inc(&session->stats.rx_errors);
         kfree_skb(skb);
 
         if (session->deref)
@@ -828,6 +803,23 @@ discard:
 }
 EXPORT_SYMBOL(l2tp_recv_common);
 
+/* Drop skbs from the session's reorder_q
+ */
+int l2tp_session_queue_purge(struct l2tp_session *session)
+{
+        struct sk_buff *skb = NULL;
+        BUG_ON(!session);
+        BUG_ON(session->magic != L2TP_SESSION_MAGIC);
+        while ((skb = skb_dequeue(&session->reorder_q))) {
+                atomic_long_inc(&session->stats.rx_errors);
+                kfree_skb(skb);
+                if (session->deref)
+                        (*session->deref)(session);
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(l2tp_session_queue_purge);
+
 /* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
  * here. The skb is not on a list when we get here.
  * Returns 0 if the packet was a data packet and was successfully passed on.
@@ -843,7 +835,6 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
         u32 tunnel_id, session_id;
         u16 version;
         int length;
-        struct l2tp_stats *tstats;
 
         if (tunnel->sock && l2tp_verify_udp_checksum(tunnel->sock, skb))
                 goto discard_bad_csum;
@@ -932,10 +923,7 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
 discard_bad_csum:
         LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name);
         UDP_INC_STATS_USER(tunnel->l2tp_net, UDP_MIB_INERRORS, 0);
-        tstats = &tunnel->stats;
-        u64_stats_update_begin(&tstats->syncp);
-        tstats->rx_errors++;
-        u64_stats_update_end(&tstats->syncp);
+        atomic_long_inc(&tunnel->stats.rx_errors);
         kfree_skb(skb);
 
         return 0;
@@ -1062,7 +1050,6 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
         struct l2tp_tunnel *tunnel = session->tunnel;
         unsigned int len = skb->len;
         int error;
-        struct l2tp_stats *tstats, *sstats;
 
         /* Debug */
         if (session->send_seq)
@@ -1091,21 +1078,15 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
                 error = ip_queue_xmit(skb, fl);
 
         /* Update stats */
-        tstats = &tunnel->stats;
-        u64_stats_update_begin(&tstats->syncp);
-        sstats = &session->stats;
-        u64_stats_update_begin(&sstats->syncp);
         if (error >= 0) {
-                tstats->tx_packets++;
-                tstats->tx_bytes += len;
-                sstats->tx_packets++;
-                sstats->tx_bytes += len;
+                atomic_long_inc(&tunnel->stats.tx_packets);
+                atomic_long_add(len, &tunnel->stats.tx_bytes);
+                atomic_long_inc(&session->stats.tx_packets);
+                atomic_long_add(len, &session->stats.tx_bytes);
         } else {
-                tstats->tx_errors++;
-                sstats->tx_errors++;
+                atomic_long_inc(&tunnel->stats.tx_errors);
+                atomic_long_inc(&session->stats.tx_errors);
         }
-        u64_stats_update_end(&tstats->syncp);
-        u64_stats_update_end(&sstats->syncp);
 
         return 0;
 }
@@ -1282,6 +1263,7 @@ static void l2tp_tunnel_destruct(struct sock *sk)
                 /* No longer an encapsulation socket. See net/ipv4/udp.c */
                 (udp_sk(sk))->encap_type = 0;
                 (udp_sk(sk))->encap_rcv = NULL;
+                (udp_sk(sk))->encap_destroy = NULL;
                 break;
         case L2TP_ENCAPTYPE_IP:
                 break;
@@ -1311,7 +1293,7 @@ end:
 
 /* When the tunnel is closed, all the attached sessions need to go too.
  */
-static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
+void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
 {
         int hash;
         struct hlist_node *walk;
@@ -1334,25 +1316,13 @@ again:
 
                         hlist_del_init(&session->hlist);
 
-                        /* Since we should hold the sock lock while
-                         * doing any unbinding, we need to release the
-                         * lock we're holding before taking that lock.
-                         * Hold a reference to the sock so it doesn't
-                         * disappear as we're jumping between locks.
-                         */
                         if (session->ref != NULL)
                                 (*session->ref)(session);
 
                         write_unlock_bh(&tunnel->hlist_lock);
 
-                        if (tunnel->version != L2TP_HDR_VER_2) {
-                                struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
-
-                                spin_lock_bh(&pn->l2tp_session_hlist_lock);
-                                hlist_del_init_rcu(&session->global_hlist);
-                                spin_unlock_bh(&pn->l2tp_session_hlist_lock);
-                                synchronize_rcu();
-                        }
+                        __l2tp_session_unhash(session);
+                        l2tp_session_queue_purge(session);
 
                         if (session->session_close != NULL)
                                 (*session->session_close)(session);
@@ -1360,6 +1330,8 @@ again:
                         if (session->deref != NULL)
                                 (*session->deref)(session);
 
+                        l2tp_session_dec_refcount(session);
+
                         write_lock_bh(&tunnel->hlist_lock);
 
                         /* Now restart from the beginning of this hash
@@ -1372,6 +1344,17 @@ again:
         }
         write_unlock_bh(&tunnel->hlist_lock);
 }
+EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall);
+
+/* Tunnel socket destroy hook for UDP encapsulation */
+static void l2tp_udp_encap_destroy(struct sock *sk)
+{
+        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
+        if (tunnel) {
+                l2tp_tunnel_closeall(tunnel);
+                sock_put(sk);
+        }
+}
 
 /* Really kill the tunnel.
  * Come here only when all sessions have been cleared from the tunnel.
@@ -1397,19 +1380,21 @@ static void l2tp_tunnel_del_work(struct work_struct *work)
                 return;
 
         sock = sk->sk_socket;
-        BUG_ON(!sock);
 
-        /* If the tunnel socket was created directly by the kernel, use the
-         * sk_* API to release the socket now.  Otherwise go through the
-         * inet_* layer to shut the socket down, and let userspace close it.
+        /* If the tunnel socket was created by userspace, then go through the
+         * inet layer to shut the socket down, and let userspace close it.
+         * Otherwise, if we created the socket directly within the kernel, use
+         * the sk API to release it here.
          * In either case the tunnel resources are freed in the socket
          * destructor when the tunnel socket goes away.
          */
-        if (sock->file == NULL) {
-                kernel_sock_shutdown(sock, SHUT_RDWR);
-                sk_release_kernel(sk);
+        if (tunnel->fd >= 0) {
+                if (sock)
+                        inet_shutdown(sock, 2);
         } else {
-                inet_shutdown(sock, 2);
+                if (sock)
+                        kernel_sock_shutdown(sock, SHUT_RDWR);
+                sk_release_kernel(sk);
         }
 
         l2tp_tunnel_sock_put(sk);
@@ -1668,6 +1653,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                 /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
                 udp_sk(sk)->encap_type = UDP_ENCAP_L2TPINUDP;
                 udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
+                udp_sk(sk)->encap_destroy = l2tp_udp_encap_destroy;
 #if IS_ENABLED(CONFIG_IPV6)
                 if (sk->sk_family == PF_INET6)
                         udpv6_encap_enable();
@@ -1723,6 +1709,7 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
  */
 int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
 {
+        l2tp_tunnel_closeall(tunnel);
         return (false == queue_work(l2tp_wq, &tunnel->del_work));
 }
 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
@@ -1731,62 +1718,71 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
  */
 void l2tp_session_free(struct l2tp_session *session)
 {
-        struct l2tp_tunnel *tunnel;
+        struct l2tp_tunnel *tunnel = session->tunnel;
 
         BUG_ON(atomic_read(&session->ref_count) != 0);
 
-        tunnel = session->tunnel;
-        if (tunnel != NULL) {
+        if (tunnel) {
                 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
+                if (session->session_id != 0)
+                        atomic_dec(&l2tp_session_count);
+                sock_put(tunnel->sock);
+                session->tunnel = NULL;
+                l2tp_tunnel_dec_refcount(tunnel);
+        }
+
+        kfree(session);
 
-                /* Delete the session from the hash */
+        return;
+}
+EXPORT_SYMBOL_GPL(l2tp_session_free);
+
+/* Remove an l2tp session from l2tp_core's hash lists.
+ * Provides a tidyup interface for pseudowire code which can't just route all
+ * shutdown via. l2tp_session_delete and a pseudowire-specific session_close
+ * callback.
+ */
+void __l2tp_session_unhash(struct l2tp_session *session)
+{
+        struct l2tp_tunnel *tunnel = session->tunnel;
+
+        /* Remove the session from core hashes */
+        if (tunnel) {
+                /* Remove from the per-tunnel hash */
                 write_lock_bh(&tunnel->hlist_lock);
                 hlist_del_init(&session->hlist);
                 write_unlock_bh(&tunnel->hlist_lock);
 
-                /* Unlink from the global hash if not L2TPv2 */
+                /* For L2TPv3 we have a per-net hash: remove from there, too */
                 if (tunnel->version != L2TP_HDR_VER_2) {
                         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
-
                         spin_lock_bh(&pn->l2tp_session_hlist_lock);
                         hlist_del_init_rcu(&session->global_hlist);
                         spin_unlock_bh(&pn->l2tp_session_hlist_lock);
                         synchronize_rcu();
                 }
-
-                if (session->session_id != 0)
-                        atomic_dec(&l2tp_session_count);
-
-                sock_put(tunnel->sock);
-
-                /* This will delete the tunnel context if this
-                 * is the last session on the tunnel.
-                 */
-                session->tunnel = NULL;
-                l2tp_tunnel_dec_refcount(tunnel);
         }
-
-        kfree(session);
-
-        return;
 }
-EXPORT_SYMBOL_GPL(l2tp_session_free);
+EXPORT_SYMBOL_GPL(__l2tp_session_unhash);
 
 /* This function is used by the netlink SESSION_DELETE command and by
    pseudowire modules.
  */
 int l2tp_session_delete(struct l2tp_session *session)
 {
+        if (session->ref)
+                (*session->ref)(session);
+        __l2tp_session_unhash(session);
+        l2tp_session_queue_purge(session);
         if (session->session_close != NULL)
                 (*session->session_close)(session);
-
+        if (session->deref)
+                (*session->ref)(session);
         l2tp_session_dec_refcount(session);
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(l2tp_session_delete);
 
-
 /* We come here whenever a session's send_seq, cookie_len or
  * l2specific_len parameters are set.
  */
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 8eb8f1d47f3a..485a490fd990 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -36,16 +36,15 @@ enum {
 struct sk_buff;
 
 struct l2tp_stats {
-        u64                     tx_packets;
-        u64                     tx_bytes;
-        u64                     tx_errors;
-        u64                     rx_packets;
-        u64                     rx_bytes;
-        u64                     rx_seq_discards;
-        u64                     rx_oos_packets;
-        u64                     rx_errors;
-        u64                     rx_cookie_discards;
-        struct u64_stats_sync   syncp;
+        atomic_long_t           tx_packets;
+        atomic_long_t           tx_bytes;
+        atomic_long_t           tx_errors;
+        atomic_long_t           rx_packets;
+        atomic_long_t           rx_bytes;
+        atomic_long_t           rx_seq_discards;
+        atomic_long_t           rx_oos_packets;
+        atomic_long_t           rx_errors;
+        atomic_long_t           rx_cookie_discards;
 };
 
 struct l2tp_tunnel;
@@ -240,11 +239,14 @@ extern struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id);
 extern struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth);
 
 extern int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp);
+extern void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel);
 extern int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel);
 extern struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg);
+extern void __l2tp_session_unhash(struct l2tp_session *session);
 extern int l2tp_session_delete(struct l2tp_session *session);
 extern void l2tp_session_free(struct l2tp_session *session);
 extern void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb, unsigned char *ptr, unsigned char *optr, u16 hdrflags, int length, int (*payload_hook)(struct sk_buff *skb));
+extern int l2tp_session_queue_purge(struct l2tp_session *session);
 extern int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb);
 
 extern int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len);
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index c3813bc84552..072d7202e182 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -146,14 +146,14 @@ static void l2tp_dfs_seq_tunnel_show(struct seq_file *m, void *v)
                    tunnel->sock ? atomic_read(&tunnel->sock->sk_refcnt) : 0,
                    atomic_read(&tunnel->ref_count));
 
-        seq_printf(m, " %08x rx %llu/%llu/%llu rx %llu/%llu/%llu\n",
+        seq_printf(m, " %08x rx %ld/%ld/%ld rx %ld/%ld/%ld\n",
                    tunnel->debug,
-                   (unsigned long long)tunnel->stats.tx_packets,
-                   (unsigned long long)tunnel->stats.tx_bytes,
-                   (unsigned long long)tunnel->stats.tx_errors,
-                   (unsigned long long)tunnel->stats.rx_packets,
-                   (unsigned long long)tunnel->stats.rx_bytes,
-                   (unsigned long long)tunnel->stats.rx_errors);
+                   atomic_long_read(&tunnel->stats.tx_packets),
+                   atomic_long_read(&tunnel->stats.tx_bytes),
+                   atomic_long_read(&tunnel->stats.tx_errors),
+                   atomic_long_read(&tunnel->stats.rx_packets),
+                   atomic_long_read(&tunnel->stats.rx_bytes),
+                   atomic_long_read(&tunnel->stats.rx_errors));
 
         if (tunnel->show != NULL)
                 tunnel->show(m, tunnel);
@@ -203,14 +203,14 @@ static void l2tp_dfs_seq_session_show(struct seq_file *m, void *v)
                 seq_printf(m, "\n");
         }
 
-        seq_printf(m, "   %hu/%hu tx %llu/%llu/%llu rx %llu/%llu/%llu\n",
+        seq_printf(m, "   %hu/%hu tx %ld/%ld/%ld rx %ld/%ld/%ld\n",
                    session->nr, session->ns,
-                   (unsigned long long)session->stats.tx_packets,
-                   (unsigned long long)session->stats.tx_bytes,
-                   (unsigned long long)session->stats.tx_errors,
-                   (unsigned long long)session->stats.rx_packets,
-                   (unsigned long long)session->stats.rx_bytes,
-                   (unsigned long long)session->stats.rx_errors);
+                   atomic_long_read(&session->stats.tx_packets),
+                   atomic_long_read(&session->stats.tx_bytes),
+                   atomic_long_read(&session->stats.tx_errors),
+                   atomic_long_read(&session->stats.rx_packets),
+                   atomic_long_read(&session->stats.rx_bytes),
+                   atomic_long_read(&session->stats.rx_errors));
 
         if (session->show != NULL)
                 session->show(m, session);
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 7f41b7051269..571db8dd2292 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -228,10 +228,16 @@ static void l2tp_ip_close(struct sock *sk, long timeout)
 static void l2tp_ip_destroy_sock(struct sock *sk)
 {
         struct sk_buff *skb;
+        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
 
         while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL)
                 kfree_skb(skb);
 
+        if (tunnel) {
+                l2tp_tunnel_closeall(tunnel);
+                sock_put(sk);
+        }
+
         sk_refcnt_debug_dec(sk);
 }
 
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 41f2f8126ebc..b8a6039314e8 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -241,10 +241,17 @@ static void l2tp_ip6_close(struct sock *sk, long timeout)
 
 static void l2tp_ip6_destroy_sock(struct sock *sk)
 {
+        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
+
         lock_sock(sk);
         ip6_flush_pending_frames(sk);
         release_sock(sk);
 
+        if (tunnel) {
+                l2tp_tunnel_closeall(tunnel);
+                sock_put(sk);
+        }
+
         inet6_destroy_sock(sk);
 }
 
@@ -683,6 +690,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                 lsa->l2tp_addr = ipv6_hdr(skb)->saddr;
                 lsa->l2tp_flowinfo = 0;
                 lsa->l2tp_scope_id = 0;
+                lsa->l2tp_conn_id = 0;
                 if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL)
                         lsa->l2tp_scope_id = IP6CB(skb)->iif;
         }
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index c1bab22db85e..0825ff26e113 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -246,8 +246,6 @@ static int l2tp_nl_tunnel_send(struct sk_buff *skb, u32 portid, u32 seq, int fla
 #if IS_ENABLED(CONFIG_IPV6)
         struct ipv6_pinfo *np = NULL;
 #endif
-        struct l2tp_stats stats;
-        unsigned int start;
 
         hdr = genlmsg_put(skb, portid, seq, &l2tp_nl_family, flags,
                           L2TP_CMD_TUNNEL_GET);
@@ -265,28 +263,22 @@ static int l2tp_nl_tunnel_send(struct sk_buff *skb, u32 portid, u32 seq, int fla
         if (nest == NULL)
                 goto nla_put_failure;
 
-        do {
-                start = u64_stats_fetch_begin(&tunnel->stats.syncp);
-                stats.tx_packets = tunnel->stats.tx_packets;
-                stats.tx_bytes = tunnel->stats.tx_bytes;
-                stats.tx_errors = tunnel->stats.tx_errors;
-                stats.rx_packets = tunnel->stats.rx_packets;
-                stats.rx_bytes = tunnel->stats.rx_bytes;
-                stats.rx_errors = tunnel->stats.rx_errors;
-                stats.rx_seq_discards = tunnel->stats.rx_seq_discards;
-                stats.rx_oos_packets = tunnel->stats.rx_oos_packets;
-        } while (u64_stats_fetch_retry(&tunnel->stats.syncp, start));
-
-        if (nla_put_u64(skb, L2TP_ATTR_TX_PACKETS, stats.tx_packets) ||
-            nla_put_u64(skb, L2TP_ATTR_TX_BYTES, stats.tx_bytes) ||
-            nla_put_u64(skb, L2TP_ATTR_TX_ERRORS, stats.tx_errors) ||
-            nla_put_u64(skb, L2TP_ATTR_RX_PACKETS, stats.rx_packets) ||
-            nla_put_u64(skb, L2TP_ATTR_RX_BYTES, stats.rx_bytes) ||
+        if (nla_put_u64(skb, L2TP_ATTR_TX_PACKETS,
+                    atomic_long_read(&tunnel->stats.tx_packets)) ||
+            nla_put_u64(skb, L2TP_ATTR_TX_BYTES,
+                    atomic_long_read(&tunnel->stats.tx_bytes)) ||
+            nla_put_u64(skb, L2TP_ATTR_TX_ERRORS,
+                    atomic_long_read(&tunnel->stats.tx_errors)) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_PACKETS,
+                    atomic_long_read(&tunnel->stats.rx_packets)) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_BYTES,
+                    atomic_long_read(&tunnel->stats.rx_bytes)) ||
             nla_put_u64(skb, L2TP_ATTR_RX_SEQ_DISCARDS,
-                        stats.rx_seq_discards) ||
+                    atomic_long_read(&tunnel->stats.rx_seq_discards)) ||
             nla_put_u64(skb, L2TP_ATTR_RX_OOS_PACKETS,
-                        stats.rx_oos_packets) ||
-            nla_put_u64(skb, L2TP_ATTR_RX_ERRORS, stats.rx_errors))
+                    atomic_long_read(&tunnel->stats.rx_oos_packets)) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_ERRORS,
+                    atomic_long_read(&tunnel->stats.rx_errors)))
                 goto nla_put_failure;
         nla_nest_end(skb, nest);
 
@@ -612,8 +604,6 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq, int fl
         struct nlattr *nest;
         struct l2tp_tunnel *tunnel = session->tunnel;
         struct sock *sk = NULL;
-        struct l2tp_stats stats;
-        unsigned int start;
 
         sk = tunnel->sock;
 
@@ -656,28 +646,22 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq, int fl
         if (nest == NULL)
                 goto nla_put_failure;
 
-        do {
-                start = u64_stats_fetch_begin(&session->stats.syncp);
-                stats.tx_packets = session->stats.tx_packets;
-                stats.tx_bytes = session->stats.tx_bytes;
-                stats.tx_errors = session->stats.tx_errors;
-                stats.rx_packets = session->stats.rx_packets;
-                stats.rx_bytes = session->stats.rx_bytes;
-                stats.rx_errors = session->stats.rx_errors;
-                stats.rx_seq_discards = session->stats.rx_seq_discards;
-                stats.rx_oos_packets = session->stats.rx_oos_packets;
-        } while (u64_stats_fetch_retry(&session->stats.syncp, start));
-
-        if (nla_put_u64(skb, L2TP_ATTR_TX_PACKETS, stats.tx_packets) ||
-            nla_put_u64(skb, L2TP_ATTR_TX_BYTES, stats.tx_bytes) ||
-            nla_put_u64(skb, L2TP_ATTR_TX_ERRORS, stats.tx_errors) ||
-            nla_put_u64(skb, L2TP_ATTR_RX_PACKETS, stats.rx_packets) ||
-            nla_put_u64(skb, L2TP_ATTR_RX_BYTES, stats.rx_bytes) ||
+        if (nla_put_u64(skb, L2TP_ATTR_TX_PACKETS,
+                atomic_long_read(&session->stats.tx_packets)) ||
+            nla_put_u64(skb, L2TP_ATTR_TX_BYTES,
+                atomic_long_read(&session->stats.tx_bytes)) ||
+            nla_put_u64(skb, L2TP_ATTR_TX_ERRORS,
+                atomic_long_read(&session->stats.tx_errors)) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_PACKETS,
+                atomic_long_read(&session->stats.rx_packets)) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_BYTES,
+                atomic_long_read(&session->stats.rx_bytes)) ||
             nla_put_u64(skb, L2TP_ATTR_RX_SEQ_DISCARDS,
-                        stats.rx_seq_discards) ||
+                atomic_long_read(&session->stats.rx_seq_discards)) ||
             nla_put_u64(skb, L2TP_ATTR_RX_OOS_PACKETS,
-                        stats.rx_oos_packets) ||
-            nla_put_u64(skb, L2TP_ATTR_RX_ERRORS, stats.rx_errors))
+                atomic_long_read(&session->stats.rx_oos_packets)) ||
+            nla_put_u64(skb, L2TP_ATTR_RX_ERRORS,
+                atomic_long_read(&session->stats.rx_errors)))
                 goto nla_put_failure;
         nla_nest_end(skb, nest);
 
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 6a53371dba1f..637a341c1e2d 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -97,6 +97,7 @@
 #include <net/ip.h>
 #include <net/udp.h>
 #include <net/xfrm.h>
+#include <net/inet_common.h>
 
 #include <asm/byteorder.h>
 #include <linux/atomic.h>
@@ -259,7 +260,7 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int
                           session->name);
 
                 /* Not bound. Nothing we can do, so discard. */
-                session->stats.rx_errors++;
+                atomic_long_inc(&session->stats.rx_errors);
                 kfree_skb(skb);
         }
 
@@ -447,34 +448,16 @@ static void pppol2tp_session_close(struct l2tp_session *session)
 {
         struct pppol2tp_session *ps = l2tp_session_priv(session);
         struct sock *sk = ps->sock;
-        struct sk_buff *skb;
+        struct socket *sock = sk->sk_socket;
 
         BUG_ON(session->magic != L2TP_SESSION_MAGIC);
 
-        if (session->session_id == 0)
-                goto out;
-
-        if (sk != NULL) {
-                lock_sock(sk);
-
-                if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
-                        pppox_unbind_sock(sk);
-                        sk->sk_state = PPPOX_DEAD;
-                        sk->sk_state_change(sk);
-                }
-
-                /* Purge any queued data */
-                skb_queue_purge(&sk->sk_receive_queue);
-                skb_queue_purge(&sk->sk_write_queue);
-                while ((skb = skb_dequeue(&session->reorder_q))) {
-                        kfree_skb(skb);
-                        sock_put(sk);
-                }
 
-                release_sock(sk);
+        if (sock) {
+                inet_shutdown(sock, 2);
+                /* Don't let the session go away before our socket does */
+                l2tp_session_inc_refcount(session);
         }
-
-out:
         return;
 }
 
@@ -483,19 +466,12 @@ out:
  */
 static void pppol2tp_session_destruct(struct sock *sk)
 {
-        struct l2tp_session *session;
-
-        if (sk->sk_user_data != NULL) {
-                session = sk->sk_user_data;
-                if (session == NULL)
-                        goto out;
-
+        struct l2tp_session *session = sk->sk_user_data;
+        if (session) {
                 sk->sk_user_data = NULL;
                 BUG_ON(session->magic != L2TP_SESSION_MAGIC);
                 l2tp_session_dec_refcount(session);
         }
-
-out:
         return;
 }
 
@@ -525,16 +501,13 @@ static int pppol2tp_release(struct socket *sock)
         session = pppol2tp_sock_to_session(sk);
 
         /* Purge any queued data */
-        skb_queue_purge(&sk->sk_receive_queue);
-        skb_queue_purge(&sk->sk_write_queue);
         if (session != NULL) {
-                struct sk_buff *skb;
-                while ((skb = skb_dequeue(&session->reorder_q))) {
-                        kfree_skb(skb);
-                        sock_put(sk);
-                }
+                __l2tp_session_unhash(session);
+                l2tp_session_queue_purge(session);
                 sock_put(sk);
         }
+        skb_queue_purge(&sk->sk_receive_queue);
+        skb_queue_purge(&sk->sk_write_queue);
 
         release_sock(sk);
 
@@ -880,18 +853,6 @@ out:
         return error;
 }
 
-/* Called when deleting sessions via the netlink interface.
- */
-static int pppol2tp_session_delete(struct l2tp_session *session)
-{
-        struct pppol2tp_session *ps = l2tp_session_priv(session);
-
-        if (ps->sock == NULL)
-                l2tp_session_dec_refcount(session);
-
-        return 0;
-}
-
 #endif /* CONFIG_L2TP_V3 */
 
 /* getname() support.
@@ -1025,14 +986,14 @@ end:
 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest,
                                 struct l2tp_stats *stats)
 {
-        dest->tx_packets = stats->tx_packets;
-        dest->tx_bytes = stats->tx_bytes;
-        dest->tx_errors = stats->tx_errors;
-        dest->rx_packets = stats->rx_packets;
-        dest->rx_bytes = stats->rx_bytes;
-        dest->rx_seq_discards = stats->rx_seq_discards;
-        dest->rx_oos_packets = stats->rx_oos_packets;
-        dest->rx_errors = stats->rx_errors;
+        dest->tx_packets = atomic_long_read(&stats->tx_packets);
+        dest->tx_bytes = atomic_long_read(&stats->tx_bytes);
+        dest->tx_errors = atomic_long_read(&stats->tx_errors);
+        dest->rx_packets = atomic_long_read(&stats->rx_packets);
+        dest->rx_bytes = atomic_long_read(&stats->rx_bytes);
+        dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards);
+        dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets);
+        dest->rx_errors = atomic_long_read(&stats->rx_errors);
 }
 
 /* Session ioctl helper.
@@ -1666,14 +1627,14 @@ static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
                    tunnel->name,
                    (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N',
                    atomic_read(&tunnel->ref_count) - 1);
-        seq_printf(m, " %08x %llu/%llu/%llu %llu/%llu/%llu\n",
+        seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n",
                    tunnel->debug,
-                   (unsigned long long)tunnel->stats.tx_packets,
-                   (unsigned long long)tunnel->stats.tx_bytes,
-                   (unsigned long long)tunnel->stats.tx_errors,
-                   (unsigned long long)tunnel->stats.rx_packets,
-                   (unsigned long long)tunnel->stats.rx_bytes,
-                   (unsigned long long)tunnel->stats.rx_errors);
+                   atomic_long_read(&tunnel->stats.tx_packets),
+                   atomic_long_read(&tunnel->stats.tx_bytes),
+                   atomic_long_read(&tunnel->stats.tx_errors),
+                   atomic_long_read(&tunnel->stats.rx_packets),
+                   atomic_long_read(&tunnel->stats.rx_bytes),
+                   atomic_long_read(&tunnel->stats.rx_errors));
 }
 
 static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
@@ -1708,14 +1669,14 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
                    session->lns_mode ? "LNS" : "LAC",
                    session->debug,
                    jiffies_to_msecs(session->reorder_timeout));
-        seq_printf(m, "   %hu/%hu %llu/%llu/%llu %llu/%llu/%llu\n",
+        seq_printf(m, "   %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n",
                    session->nr, session->ns,
-                   (unsigned long long)session->stats.tx_packets,
-                   (unsigned long long)session->stats.tx_bytes,
-                   (unsigned long long)session->stats.tx_errors,
-                   (unsigned long long)session->stats.rx_packets,
-                   (unsigned long long)session->stats.rx_bytes,
-                   (unsigned long long)session->stats.rx_errors);
+                   atomic_long_read(&session->stats.tx_packets),
+                   atomic_long_read(&session->stats.tx_bytes),
+                   atomic_long_read(&session->stats.tx_errors),
+                   atomic_long_read(&session->stats.rx_packets),
+                   atomic_long_read(&session->stats.rx_bytes),
+                   atomic_long_read(&session->stats.rx_errors));
 
         if (po)
                 seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
@@ -1839,7 +1800,7 @@ static const struct pppox_proto pppol2tp_proto = {
 
 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = {
         .session_create = pppol2tp_session_create,
-        .session_delete = pppol2tp_session_delete,
+        .session_delete = l2tp_session_delete,
 };
 
 #endif /* CONFIG_L2TP_V3 */
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 88709882c464..48aaa89253e0 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -720,6 +720,8 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
         int target;     /* Read at least this many bytes */
         long timeo;
 
+        msg->msg_namelen = 0;
+
         lock_sock(sk);
         copied = -ENOTCONN;
         if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN))
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index fb306814576a..a6893602f87a 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2582,7 +2582,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
                         list_del(&dep->list);
                         mutex_unlock(&local->mtx);
 
-                        ieee80211_roc_notify_destroy(dep);
+                        ieee80211_roc_notify_destroy(dep, true);
                         return 0;
                 }
 
@@ -2622,7 +2622,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
                         ieee80211_start_next_roc(local);
                 mutex_unlock(&local->mtx);
 
-                ieee80211_roc_notify_destroy(found);
+                ieee80211_roc_notify_destroy(found, true);
         } else {
                 /* work may be pending so use it all the time */
                 found->abort = true;
@@ -2632,6 +2632,8 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
 
                 /* work will clean up etc */
                 flush_delayed_work(&found->work);
+                WARN_ON(!found->to_be_freed);
+                kfree(found);
         }
 
         return 0;
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 78c0d90dd641..931be419ab5a 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -63,6 +63,7 @@ ieee80211_new_chanctx(struct ieee80211_local *local,
                       enum ieee80211_chanctx_mode mode)
 {
         struct ieee80211_chanctx *ctx;
+        u32 changed;
         int err;
 
         lockdep_assert_held(&local->chanctx_mtx);
@@ -76,6 +77,13 @@ ieee80211_new_chanctx(struct ieee80211_local *local,
         ctx->conf.rx_chains_dynamic = 1;
         ctx->mode = mode;
 
+        /* acquire mutex to prevent idle from changing */
+        mutex_lock(&local->mtx);
+        /* turn idle off *before* setting channel -- some drivers need that */
+        changed = ieee80211_idle_off(local);
+        if (changed)
+                ieee80211_hw_config(local, changed);
+
         if (!local->use_chanctx) {
                 local->_oper_channel_type =
                         cfg80211_get_chandef_type(chandef);
@@ -85,14 +93,17 @@ ieee80211_new_chanctx(struct ieee80211_local *local,
                 err = drv_add_chanctx(local, ctx);
                 if (err) {
                         kfree(ctx);
-                        return ERR_PTR(err);
+                        ctx = ERR_PTR(err);
+
+                        ieee80211_recalc_idle(local);
+                        goto out;
                 }
         }
 
+        /* and keep the mutex held until the new chanctx is on the list */
         list_add_rcu(&ctx->list, &local->chanctx_list);
 
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(local);
+ out:
         mutex_unlock(&local->mtx);
 
         return ctx;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 388580a1bada..5672533a0832 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -309,6 +309,7 @@ struct ieee80211_roc_work {
         struct ieee80211_channel *chan;
 
         bool started, abort, hw_begun, notified;
+        bool to_be_freed;
 
         unsigned long hw_start_time;
 
@@ -1347,7 +1348,7 @@ void ieee80211_offchannel_return(struct ieee80211_local *local);
 void ieee80211_roc_setup(struct ieee80211_local *local);
 void ieee80211_start_next_roc(struct ieee80211_local *local);
 void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata);
-void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc);
+void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free);
 void ieee80211_sw_roc_work(struct work_struct *work);
 void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
 
@@ -1361,6 +1362,7 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
                              enum nl80211_iftype type);
 void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata);
 void ieee80211_remove_interfaces(struct ieee80211_local *local);
+u32 ieee80211_idle_off(struct ieee80211_local *local);
 void ieee80211_recalc_idle(struct ieee80211_local *local);
 void ieee80211_adjust_monitor_flags(struct ieee80211_sub_if_data *sdata,
                                     const int offset);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index baaa8608e52d..58150f877ec3 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -78,7 +78,7 @@ void ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata)
                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_TXPOWER);
 }
 
-static u32 ieee80211_idle_off(struct ieee80211_local *local)
+u32 ieee80211_idle_off(struct ieee80211_local *local)
 {
         if (!(local->hw.conf.flags & IEEE80211_CONF_IDLE))
                 return 0;
@@ -349,21 +349,19 @@ static void ieee80211_set_default_queues(struct ieee80211_sub_if_data *sdata)
 static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
-        int ret = 0;
+        int ret;
 
         if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
                 return 0;
 
-        mutex_lock(&local->iflist_mtx);
+        ASSERT_RTNL();
 
         if (local->monitor_sdata)
-                goto out_unlock;
+                return 0;
 
         sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL);
-        if (!sdata) {
-                ret = -ENOMEM;
-                goto out_unlock;
-        }
+        if (!sdata)
+                return -ENOMEM;
 
         /* set up data */
         sdata->local = local;
@@ -377,13 +375,13 @@ static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
         if (WARN_ON(ret)) {
                 /* ok .. stupid driver, it asked for this! */
                 kfree(sdata);
-                goto out_unlock;
+                return ret;
         }
 
         ret = ieee80211_check_queues(sdata);
         if (ret) {
                 kfree(sdata);
-                goto out_unlock;
+                return ret;
         }
 
         ret = ieee80211_vif_use_channel(sdata, &local->monitor_chandef,
@@ -391,13 +389,14 @@ static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
         if (ret) {
                 drv_remove_interface(local, sdata);
                 kfree(sdata);
-                goto out_unlock;
+                return ret;
         }
 
+        mutex_lock(&local->iflist_mtx);
         rcu_assign_pointer(local->monitor_sdata, sdata);
- out_unlock:
         mutex_unlock(&local->iflist_mtx);
-        return ret;
+
+        return 0;
 }
 
 static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
@@ -407,14 +406,20 @@ static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
         if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
                 return;
 
+        ASSERT_RTNL();
+
         mutex_lock(&local->iflist_mtx);
 
         sdata = rcu_dereference_protected(local->monitor_sdata,
                                           lockdep_is_held(&local->iflist_mtx));
-        if (!sdata)
-                goto out_unlock;
+        if (!sdata) {
+                mutex_unlock(&local->iflist_mtx);
+                return;
+        }
 
         rcu_assign_pointer(local->monitor_sdata, NULL);
+        mutex_unlock(&local->iflist_mtx);
+
         synchronize_net();
 
         ieee80211_vif_release_channel(sdata);
@@ -422,8 +427,6 @@ static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
         drv_remove_interface(local, sdata);
 
         kfree(sdata);
- out_unlock:
-        mutex_unlock(&local->iflist_mtx);
 }
 
 /*
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 29ce2aa87e7b..4749b3858695 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1060,7 +1060,8 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
 
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                if (ieee80211_vif_is_mesh(&sdata->vif))
+                if (ieee80211_vif_is_mesh(&sdata->vif) &&
+                    ieee80211_sdata_running(sdata))
                         ieee80211_queue_work(&local->hw, &sdata->work);
         rcu_read_unlock();
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 141577412d84..82cc30318a86 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3608,8 +3608,10 @@ void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
 
         /* Restart STA timers */
         rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                ieee80211_restart_sta_timer(sdata);
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (ieee80211_sdata_running(sdata))
+                        ieee80211_restart_sta_timer(sdata);
+        }
         rcu_read_unlock();
 }
 
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index cc79b4a2e821..430bd254e496 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -297,10 +297,13 @@ void ieee80211_start_next_roc(struct ieee80211_local *local)
         }
 }
 
-void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
+void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free)
 {
         struct ieee80211_roc_work *dep, *tmp;
 
+        if (WARN_ON(roc->to_be_freed))
+                return;
+
         /* was never transmitted */
         if (roc->frame) {
                 cfg80211_mgmt_tx_status(&roc->sdata->wdev,
@@ -316,9 +319,12 @@ void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
                                                    GFP_KERNEL);
 
         list_for_each_entry_safe(dep, tmp, &roc->dependents, list)
-                ieee80211_roc_notify_destroy(dep);
+                ieee80211_roc_notify_destroy(dep, true);
 
-        kfree(roc);
+        if (free)
+                kfree(roc);
+        else
+                roc->to_be_freed = true;
 }
 
 void ieee80211_sw_roc_work(struct work_struct *work)
@@ -331,6 +337,9 @@ void ieee80211_sw_roc_work(struct work_struct *work)
 
         mutex_lock(&local->mtx);
 
+        if (roc->to_be_freed)
+                goto out_unlock;
+
         if (roc->abort)
                 goto finish;
 
@@ -370,7 +379,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
  finish:
                 list_del(&roc->list);
                 started = roc->started;
-                ieee80211_roc_notify_destroy(roc);
+                ieee80211_roc_notify_destroy(roc, !roc->abort);
 
                 if (started) {
                         drv_flush(local, false);
@@ -410,7 +419,7 @@ static void ieee80211_hw_roc_done(struct work_struct *work)
 
         list_del(&roc->list);
 
-        ieee80211_roc_notify_destroy(roc);
+        ieee80211_roc_notify_destroy(roc, true);
 
         /* if there's another roc, start it now */
         ieee80211_start_next_roc(local);
@@ -460,12 +469,14 @@ void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata)
         list_for_each_entry_safe(roc, tmp, &tmp_list, list) {
                 if (local->ops->remain_on_channel) {
                         list_del(&roc->list);
-                        ieee80211_roc_notify_destroy(roc);
+                        ieee80211_roc_notify_destroy(roc, true);
                 } else {
                         ieee80211_queue_delayed_work(&local->hw, &roc->work, 0);
 
                         /* work will clean up etc */
                         flush_delayed_work(&roc->work);
+                        WARN_ON(!roc->to_be_freed);
+                        kfree(roc);
                 }
         }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index bb73ed2d20b9..c6844ad080be 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2675,7 +2675,19 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
 
                 memset(nskb->cb, 0, sizeof(nskb->cb));
 
-                ieee80211_tx_skb(rx->sdata, nskb);
+                if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
+                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
+
+                        info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
+                                      IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
+                                      IEEE80211_TX_CTL_NO_CCK_RATE;
+                        if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
+                                info->hw_queue =
+                                        local->hw.offchannel_tx_hw_queue;
+                }
+
+                __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
+                                            status->band);
         }
         dev_kfree_skb(rx->skb);
         return RX_QUEUED;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index a79ce820cb50..238a0cca320e 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -766,6 +766,7 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
         int ret, i;
+        bool have_key = false;
 
         might_sleep();
 
@@ -793,12 +794,19 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
         list_del_rcu(&sta->list);
 
         mutex_lock(&local->key_mtx);
-        for (i = 0; i < NUM_DEFAULT_KEYS; i++)
+        for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
                 __ieee80211_key_free(key_mtx_dereference(local, sta->gtk[i]));
-        if (sta->ptk)
+                have_key = true;
+        }
+        if (sta->ptk) {
                 __ieee80211_key_free(key_mtx_dereference(local, sta->ptk));
+                have_key = true;
+        }
         mutex_unlock(&local->key_mtx);
 
+        if (!have_key)
+                synchronize_net();
+
         sta->dead = true;
 
         local->num_sta--;
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 47edf5a40a59..61f49d241712 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1394,10 +1394,8 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
                         skb_reset_network_header(skb);
                         IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n",
                                 &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr, mtu);
-                        rcu_read_lock();
                         ipv4_update_pmtu(skb, dev_net(skb->dev),
                                          mtu, 0, 0, 0, 0);
-                        rcu_read_unlock();
                         /* Client uses PMTUD? */
                         if (!(cih->frag_off & htons(IP_DF)))
                                 goto ignore_ipip;
@@ -1577,7 +1575,8 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
         }
         /* ipvs enabled in this netns ? */
         net = skb_net(skb);
-        if (!net_ipvs(net)->enable)
+        ipvs = net_ipvs(net);
+        if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
                 return NF_ACCEPT;
 
         ip_vs_fill_iph_skb(af, skb, &iph);
@@ -1654,7 +1653,6 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
         }
 
         IP_VS_DBG_PKT(11, af, pp, skb, 0, "Incoming packet");
-        ipvs = net_ipvs(net);
         /* Check the server status */
         if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {
                 /* the destination server is not available */
@@ -1815,13 +1813,15 @@ ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff *skb,
 {
         int r;
         struct net *net;
+        struct netns_ipvs *ipvs;
 
         if (ip_hdr(skb)->protocol != IPPROTO_ICMP)
                 return NF_ACCEPT;
 
         /* ipvs enabled in this netns ? */
         net = skb_net(skb);
-        if (!net_ipvs(net)->enable)
+        ipvs = net_ipvs(net);
+        if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
                 return NF_ACCEPT;
 
         return ip_vs_in_icmp(skb, &r, hooknum);
@@ -1835,6 +1835,7 @@ ip_vs_forward_icmp_v6(unsigned int hooknum, struct sk_buff *skb,
 {
         int r;
         struct net *net;
+        struct netns_ipvs *ipvs;
         struct ip_vs_iphdr iphdr;
 
         ip_vs_fill_iph_skb(AF_INET6, skb, &iphdr);
@@ -1843,7 +1844,8 @@ ip_vs_forward_icmp_v6(unsigned int hooknum, struct sk_buff *skb,
 
         /* ipvs enabled in this netns ? */
         net = skb_net(skb);
-        if (!net_ipvs(net)->enable)
+        ipvs = net_ipvs(net);
+        if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
                 return NF_ACCEPT;
 
         return ip_vs_in_icmp_v6(skb, &r, hooknum, &iphdr);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index c68198bf9128..9e2d1cccd1eb 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1808,6 +1808,12 @@ static struct ctl_table vs_vars[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
+        {
+                .procname       = "backup_only",
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
 #ifdef CONFIG_IP_VS_DEBUG
         {
                 .procname       = "debug_level",
@@ -3741,6 +3747,7 @@ static int __net_init ip_vs_control_net_init_sysctl(struct net *net)
         tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
         ipvs->sysctl_pmtu_disc = 1;
         tbl[idx++].data = &ipvs->sysctl_pmtu_disc;
+        tbl[idx++].data = &ipvs->sysctl_backup_only;
 
 
         ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index ae8ec6f27688..cd1d7298f7ba 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -906,7 +906,7 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
         sctp_chunkhdr_t _sctpch, *sch;
         unsigned char chunk_type;
         int event, next_state;
-        int ihl;
+        int ihl, cofs;
 
 #ifdef CONFIG_IP_VS_IPV6
         ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);
@@ -914,8 +914,8 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
         ihl = ip_hdrlen(skb);
 #endif
 
-        sch = skb_header_pointer(skb, ihl + sizeof(sctp_sctphdr_t),
-                                sizeof(_sctpch), &_sctpch);
+        cofs = ihl + sizeof(sctp_sctphdr_t);
+        sch = skb_header_pointer(skb, cofs, sizeof(_sctpch), &_sctpch);
         if (sch == NULL)
                 return;
 
@@ -933,10 +933,12 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
          */
         if ((sch->type == SCTP_CID_COOKIE_ECHO) ||
             (sch->type == SCTP_CID_COOKIE_ACK)) {
-                sch = skb_header_pointer(skb, (ihl + sizeof(sctp_sctphdr_t) +
-                                sch->length), sizeof(_sctpch), &_sctpch);
-                if (sch) {
-                        if (sch->type == SCTP_CID_ABORT)
+                int clen = ntohs(sch->length);
+
+                if (clen >= sizeof(sctp_chunkhdr_t)) {
+                        sch = skb_header_pointer(skb, cofs + ALIGN(clen, 4),
+                                                 sizeof(_sctpch), &_sctpch);
+                        if (sch && sch->type == SCTP_CID_ABORT)
                                 chunk_type = sch->type;
                 }
         }
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index 432f95780003..ba65b2041eb4 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -969,6 +969,10 @@ static int __init nf_conntrack_proto_dccp_init(void)
 {
         int ret;
 
+        ret = register_pernet_subsys(&dccp_net_ops);
+        if (ret < 0)
+                goto out_pernet;
+
         ret = nf_ct_l4proto_register(&dccp_proto4);
         if (ret < 0)
                 goto out_dccp4;
@@ -977,16 +981,12 @@ static int __init nf_conntrack_proto_dccp_init(void)
         if (ret < 0)
                 goto out_dccp6;
 
-        ret = register_pernet_subsys(&dccp_net_ops);
-        if (ret < 0)
-                goto out_pernet;
-
         return 0;
-out_pernet:
-        nf_ct_l4proto_unregister(&dccp_proto6);
 out_dccp6:
         nf_ct_l4proto_unregister(&dccp_proto4);
 out_dccp4:
+        unregister_pernet_subsys(&dccp_net_ops);
+out_pernet:
         return ret;
 }
 
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index bd7d01d9c7e7..155ce9f8a0db 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -420,18 +420,18 @@ static int __init nf_ct_proto_gre_init(void)
 {
         int ret;
 
-        ret = nf_ct_l4proto_register(&nf_conntrack_l4proto_gre4);
-        if (ret < 0)
-                goto out_gre4;
-
         ret = register_pernet_subsys(&proto_gre_net_ops);
         if (ret < 0)
                 goto out_pernet;
 
+        ret = nf_ct_l4proto_register(&nf_conntrack_l4proto_gre4);
+        if (ret < 0)
+                goto out_gre4;
+
         return 0;
-out_pernet:
-        nf_ct_l4proto_unregister(&nf_conntrack_l4proto_gre4);
 out_gre4:
+        unregister_pernet_subsys(&proto_gre_net_ops);
+out_pernet:
         return ret;
 }
 
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 480f616d5936..ec83536def9a 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -888,6 +888,10 @@ static int __init nf_conntrack_proto_sctp_init(void)
 {
         int ret;
 
+        ret = register_pernet_subsys(&sctp_net_ops);
+        if (ret < 0)
+                goto out_pernet;
+
         ret = nf_ct_l4proto_register(&nf_conntrack_l4proto_sctp4);
         if (ret < 0)
                 goto out_sctp4;
@@ -896,16 +900,12 @@ static int __init nf_conntrack_proto_sctp_init(void)
         if (ret < 0)
                 goto out_sctp6;
 
-        ret = register_pernet_subsys(&sctp_net_ops);
-        if (ret < 0)
-                goto out_pernet;
-
         return 0;
-out_pernet:
-        nf_ct_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
 out_sctp6:
         nf_ct_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
 out_sctp4:
+        unregister_pernet_subsys(&sctp_net_ops);
+out_pernet:
         return ret;
 }
 
diff --git a/net/netfilter/nf_conntrack_proto_udplite.c b/net/netfilter/nf_conntrack_proto_udplite.c
index 157489581c31..ca969f6273f7 100644
--- a/net/netfilter/nf_conntrack_proto_udplite.c
+++ b/net/netfilter/nf_conntrack_proto_udplite.c
@@ -371,6 +371,10 @@ static int __init nf_conntrack_proto_udplite_init(void)
 {
         int ret;
 
+        ret = register_pernet_subsys(&udplite_net_ops);
+        if (ret < 0)
+                goto out_pernet;
+
         ret = nf_ct_l4proto_register(&nf_conntrack_l4proto_udplite4);
         if (ret < 0)
                 goto out_udplite4;
@@ -379,16 +383,12 @@ static int __init nf_conntrack_proto_udplite_init(void)
         if (ret < 0)
                 goto out_udplite6;
 
-        ret = register_pernet_subsys(&udplite_net_ops);
-        if (ret < 0)
-                goto out_pernet;
-
         return 0;
-out_pernet:
-        nf_ct_l4proto_unregister(&nf_conntrack_l4proto_udplite6);
 out_udplite6:
         nf_ct_l4proto_unregister(&nf_conntrack_l4proto_udplite4);
 out_udplite4:
+        unregister_pernet_subsys(&udplite_net_ops);
+out_pernet:
         return ret;
 }
 
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 6bcce401fd1c..fedee3943661 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -568,6 +568,7 @@ static int __init nf_conntrack_standalone_init(void)
                 register_net_sysctl(&init_net, "net", nf_ct_netfilter_table);
         if (!nf_ct_netfilter_header) {
                 pr_err("nf_conntrack: can't register to sysctl.\n");
+                ret = -ENOMEM;
                 goto out_sysctl;
         }
 #endif
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 589d686f0b4c..dc3fd5d44464 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -49,6 +49,8 @@ nfnl_acct_new(struct sock *nfnl, struct sk_buff *skb,
                 return -EINVAL;
 
         acct_name = nla_data(tb[NFACCT_NAME]);
+        if (strlen(acct_name) == 0)
+                return -EINVAL;
 
         list_for_each_entry(nfacct, &nfnl_acct_list, head) {
                 if (strncmp(nfacct->name, acct_name, NFACCT_NAME_MAX) != 0)
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index 858fd52c1040..42680b2baa11 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -112,7 +112,7 @@ instance_create(u_int16_t queue_num, int portid)
         inst->queue_num = queue_num;
         inst->peer_portid = portid;
         inst->queue_maxlen = NFQNL_QMAX_DEFAULT;
-        inst->copy_range = 0xfffff;
+        inst->copy_range = 0xffff;
         inst->copy_mode = NFQNL_COPY_NONE;
         spin_lock_init(&inst->lock);
         INIT_LIST_HEAD(&inst->queue_list);
@@ -1062,8 +1062,10 @@ static int __init nfnetlink_queue_init(void)
 
 #ifdef CONFIG_PROC_FS
         if (!proc_create("nfnetlink_queue", 0440,
-                         proc_net_netfilter, &nfqnl_file_ops))
+                         proc_net_netfilter, &nfqnl_file_ops)) {
+                status = -ENOMEM;
                 goto cleanup_subsys;
+        }
 #endif
 
         register_netdevice_notifier(&nfqnl_dev_notifier);
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index f2aabb6f4105..5a55be3f17a5 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -142,6 +142,7 @@ int genl_register_mc_group(struct genl_family *family,
         int err = 0;
 
         BUG_ON(grp->name[0] == '\0');
+        BUG_ON(memchr(grp->name, '\0', GENL_NAMSIZ) == NULL);
 
         genl_lock();
 
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index d1fa1d9ffd2e..103bd704b5fc 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1173,6 +1173,7 @@ static int nr_recvmsg(struct kiocb *iocb, struct socket *sock,
         }
 
         if (sax != NULL) {
+                memset(sax, 0, sizeof(*sax));
                 sax->sax25_family = AF_NETROM;
                 skb_copy_from_linear_data_offset(skb, 7, sax->sax25_call.ax25_call,
                               AX25_ADDR_LEN);
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index b530afadd76c..ee25f25f0cd6 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -107,8 +107,6 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen,
                                 accept_sk->sk_state_change(sk);
 
                                 bh_unlock_sock(accept_sk);
-
-                                sock_orphan(accept_sk);
                         }
 
                         if (listen == true) {
@@ -134,8 +132,6 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen,
 
                 bh_unlock_sock(sk);
 
-                sock_orphan(sk);
-
                 sk_del_node_init(sk);
         }
 
@@ -164,8 +160,6 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen,
 
                 bh_unlock_sock(sk);
 
-                sock_orphan(sk);
-
                 sk_del_node_init(sk);
         }
 
@@ -827,7 +821,6 @@ static void nfc_llcp_recv_ui(struct nfc_llcp_local *local,
                 skb_get(skb);
         } else {
                 pr_err("Receive queue is full\n");
-                kfree_skb(skb);
         }
 
         nfc_llcp_sock_put(llcp_sock);
@@ -1028,7 +1021,6 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
                         skb_get(skb);
                 } else {
                         pr_err("Receive queue is full\n");
-                        kfree_skb(skb);
                 }
         }
 
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 5c7cdf3f2a83..6c94447ec414 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -270,7 +270,9 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *parent,
                 }
 
                 if (sk->sk_state == LLCP_CONNECTED || !newsock) {
-                        nfc_llcp_accept_unlink(sk);
+                        list_del_init(&lsk->accept_queue);
+                        sock_put(sk);
+
                         if (newsock)
                                 sock_graft(sk, newsock);
 
@@ -464,8 +466,6 @@ static int llcp_sock_release(struct socket *sock)
                         nfc_llcp_accept_unlink(accept_sk);
 
                         release_sock(accept_sk);
-
-                        sock_orphan(accept_sk);
                 }
         }
 
@@ -646,6 +646,8 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         pr_debug("%p %zu\n", sk, len);
 
+        msg->msg_namelen = 0;
+
         lock_sock(sk);
 
         if (sk->sk_state == LLCP_CLOSED &&
@@ -691,6 +693,7 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                 pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);
 
+                memset(sockaddr, 0, sizeof(*sockaddr));
                 sockaddr->sa_family = AF_NFC;
                 sockaddr->nfc_protocol = NFC_PROTO_NFC_DEP;
                 sockaddr->dsap = ui_cb->dsap;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index cf68e6e4054a..9c8347451597 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1253,6 +1253,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
         skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
 
         if (srose != NULL) {
+                memset(srose, 0, msg->msg_namelen);
                 srose->srose_family = AF_ROSE;
                 srose->srose_addr   = rose->dest_addr;
                 srose->srose_call   = rose->dest_call;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 13aa47aa2ffb..1bc210ffcba2 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -962,8 +962,11 @@ cbq_dequeue(struct Qdisc *sch)
                 cbq_update(q);
                 if ((incr -= incr2) < 0)
                         incr = 0;
+                q->now += incr;
+        } else {
+                if (now > q->now)
+                        q->now = now;
         }
-        q->now += incr;
         q->now_rt = now;
 
         for (;;) {
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 4e606fcb2534..55786283a3df 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -195,7 +195,7 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 flow->deficit = q->quantum;
                 flow->dropped = 0;
         }
-        if (++sch->q.qlen < sch->limit)
+        if (++sch->q.qlen <= sch->limit)
                 return NET_XMIT_SUCCESS;
 
         q->drop_overlimit++;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index ffad48109a22..eac7e0ee23c1 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -904,7 +904,7 @@ void psched_ratecfg_precompute(struct psched_ratecfg *r, u32 rate)
         u64 mult;
         int shift;
 
-        r->rate_bps = rate << 3;
+        r->rate_bps = (u64)rate << 3;
         r->shift = 0;
         r->mult = 1;
         /*
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index dcc446e7fbf6..d5f35f15af98 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -304,10 +304,8 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
         err = rpciod_up();
         if (err)
                 goto out_no_rpciod;
-        err = -EINVAL;
-        if (!xprt)
-                goto out_no_xprt;
 
+        err = -EINVAL;
         if (args->version >= program->nrvers)
                 goto out_err;
         version = program->version[args->version];
@@ -382,10 +380,9 @@ out_no_principal:
 out_no_stats:
         kfree(clnt);
 out_err:
-        xprt_put(xprt);
-out_no_xprt:
         rpciod_down();
 out_no_rpciod:
+        xprt_put(xprt);
         return ERR_PTR(err);
 }
 
@@ -512,7 +509,7 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
         new = rpc_new_client(args, xprt);
         if (IS_ERR(new)) {
                 err = PTR_ERR(new);
-                goto out_put;
+                goto out_err;
         }
 
         atomic_inc(&clnt->cl_count);
@@ -525,8 +522,6 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
         new->cl_chatty = clnt->cl_chatty;
         return new;
 
-out_put:
-        xprt_put(xprt);
 out_err:
         dprintk("RPC:       %s: returned error %d\n", __func__, err);
         return ERR_PTR(err);
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index fb20f25ddec9..f8529fc8e542 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -180,6 +180,8 @@ static void __rpc_add_wait_queue(struct rpc_wait_queue *queue,
                 list_add_tail(&task->u.tk_wait.list, &queue->tasks[0]);
         task->tk_waitqueue = queue;
         queue->qlen++;
+        /* barrier matches the read in rpc_wake_up_task_queue_locked() */
+        smp_wmb();
         rpc_set_queued(task);
 
         dprintk("RPC: %5u added to queue %p \"%s\"\n",
@@ -430,8 +432,11 @@ static void __rpc_do_wake_up_task(struct rpc_wait_queue *queue, struct rpc_task
  */
 static void rpc_wake_up_task_queue_locked(struct rpc_wait_queue *queue, struct rpc_task *task)
 {
-        if (RPC_IS_QUEUED(task) && task->tk_waitqueue == queue)
-                __rpc_do_wake_up_task(queue, task);
+        if (RPC_IS_QUEUED(task)) {
+                smp_rmb();
+                if (task->tk_waitqueue == queue)
+                        __rpc_do_wake_up_task(queue, task);
+        }
 }
 
 /*
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index a9622b6cd916..515ce38e4f4c 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -790,6 +790,7 @@ static void set_orig_addr(struct msghdr *m, struct tipc_msg *msg)
         if (addr) {
                 addr->family = AF_TIPC;
                 addr->addrtype = TIPC_ADDR_ID;
+                memset(&addr->addr, 0, sizeof(addr->addr));
                 addr->addr.id.ref = msg_origport(msg);
                 addr->addr.id.node = msg_orignode(msg);
                 addr->addr.name.domain = 0;     /* could leave uninitialized */
@@ -904,6 +905,9 @@ static int recv_msg(struct kiocb *iocb, struct socket *sock,
                 goto exit;
         }
 
+        /* will be updated in set_orig_addr() if needed */
+        m->msg_namelen = 0;
+
         timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 restart:
 
@@ -1013,6 +1017,9 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
                 goto exit;
         }
 
+        /* will be updated in set_orig_addr() if needed */
+        m->msg_namelen = 0;
+
         target = sock_rcvlowat(sk, flags & MSG_WAITALL, buf_len);
         timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 51be64f163ec..2db702d82e7d 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -382,7 +382,7 @@ static void unix_sock_destructor(struct sock *sk)
 #endif
 }
 
-static int unix_release_sock(struct sock *sk, int embrion)
+static void unix_release_sock(struct sock *sk, int embrion)
 {
         struct unix_sock *u = unix_sk(sk);
         struct path path;
@@ -451,8 +451,6 @@ static int unix_release_sock(struct sock *sk, int embrion)
 
         if (unix_tot_inflight)
                 unix_gc();              /* Garbage collect fds */
-
-        return 0;
 }
 
 static void init_peercred(struct sock *sk)
@@ -699,9 +697,10 @@ static int unix_release(struct socket *sock)
         if (!sk)
                 return 0;
 
+        unix_release_sock(sk, 0);
         sock->sk = NULL;
 
-        return unix_release_sock(sk, 0);
+        return 0;
 }
 
 static int unix_autobind(struct socket *sock)
@@ -1994,7 +1993,7 @@ again:
                         if ((UNIXCB(skb).pid  != siocb->scm->pid) ||
                             (UNIXCB(skb).cred != siocb->scm->cred))
                                 break;
-                } else {
+                } else if (test_bit(SOCK_PASSCRED, &sock->flags)) {
                         /* Copy credentials */
                         scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).cred);
                         check_creds = 1;
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index ca511c4f388a..7f93e2a42d7a 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -207,7 +207,7 @@ static struct sock *__vsock_find_bound_socket(struct sockaddr_vm *addr)
         struct vsock_sock *vsk;
 
         list_for_each_entry(vsk, vsock_bound_sockets(addr), bound_table)
-                if (vsock_addr_equals_addr_any(addr, &vsk->local_addr))
+                if (addr->svm_port == vsk->local_addr.svm_port)
                         return sk_vsock(vsk);
 
         return NULL;
@@ -220,8 +220,8 @@ static struct sock *__vsock_find_connected_socket(struct sockaddr_vm *src,
 
         list_for_each_entry(vsk, vsock_connected_sockets(src, dst),
                             connected_table) {
-                if (vsock_addr_equals_addr(src, &vsk->remote_addr)
-                    && vsock_addr_equals_addr(dst, &vsk->local_addr)) {
+                if (vsock_addr_equals_addr(src, &vsk->remote_addr) &&
+                    dst->svm_port == vsk->local_addr.svm_port) {
                         return sk_vsock(vsk);
                 }
         }
@@ -1670,6 +1670,8 @@ vsock_stream_recvmsg(struct kiocb *kiocb,
         vsk = vsock_sk(sk);
         err = 0;
 
+        msg->msg_namelen = 0;
+
         lock_sock(sk);
 
         if (sk->sk_state != SS_CONNECTED) {
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index a70ace83a153..5e04d3d96285 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -464,19 +464,16 @@ static struct sock *vmci_transport_get_pending(
         struct vsock_sock *vlistener;
         struct vsock_sock *vpending;
         struct sock *pending;
+        struct sockaddr_vm src;
+
+        vsock_addr_init(&src, pkt->dg.src.context, pkt->src_port);
 
         vlistener = vsock_sk(listener);
 
         list_for_each_entry(vpending, &vlistener->pending_links,
                             pending_links) {
-                struct sockaddr_vm src;
-                struct sockaddr_vm dst;
-
-                vsock_addr_init(&src, pkt->dg.src.context, pkt->src_port);
-                vsock_addr_init(&dst, pkt->dg.dst.context, pkt->dst_port);
-
                 if (vsock_addr_equals_addr(&src, &vpending->remote_addr) &&
-                    vsock_addr_equals_addr(&dst, &vpending->local_addr)) {
+                    pkt->dst_port == vpending->local_addr.svm_port) {
                         pending = sk_vsock(vpending);
                         sock_hold(pending);
                         goto found;
@@ -739,10 +736,15 @@ static int vmci_transport_recv_stream_cb(void *data, struct vmci_datagram *dg)
          */
         bh_lock_sock(sk);
 
-        if (!sock_owned_by_user(sk) && sk->sk_state == SS_CONNECTED)
-                vmci_trans(vsk)->notify_ops->handle_notify_pkt(
-                                sk, pkt, true, &dst, &src,
-                                &bh_process_pkt);
+        if (!sock_owned_by_user(sk)) {
+                /* The local context ID may be out of date, update it. */
+                vsk->local_addr.svm_cid = dst.svm_cid;
+
+                if (sk->sk_state == SS_CONNECTED)
+                        vmci_trans(vsk)->notify_ops->handle_notify_pkt(
+                                        sk, pkt, true, &dst, &src,
+                                        &bh_process_pkt);
+        }
 
         bh_unlock_sock(sk);
 
@@ -902,6 +904,9 @@ static void vmci_transport_recv_pkt_work(struct work_struct *work)
 
         lock_sock(sk);
 
+        /* The local context ID may be out of date. */
+        vsock_sk(sk)->local_addr.svm_cid = pkt->dg.dst.context;
+
         switch (sk->sk_state) {
         case SS_LISTEN:
                 vmci_transport_recv_listen(sk, pkt);
@@ -958,6 +963,10 @@ static int vmci_transport_recv_listen(struct sock *sk,
         pending = vmci_transport_get_pending(sk, pkt);
         if (pending) {
                 lock_sock(pending);
+
+                /* The local context ID may be out of date. */
+                vsock_sk(pending)->local_addr.svm_cid = pkt->dg.dst.context;
+
                 switch (pending->sk_state) {
                 case SS_CONNECTING:
                         err = vmci_transport_recv_connecting_server(sk,
@@ -1727,6 +1736,8 @@ static int vmci_transport_dgram_dequeue(struct kiocb *kiocb,
         if (flags & MSG_OOB || flags & MSG_ERRQUEUE)
                 return -EOPNOTSUPP;
 
+        msg->msg_namelen = 0;
+
         /* Retrieve the head sk_buff from the socket's receive queue. */
         err = 0;
         skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err);
@@ -1759,7 +1770,6 @@ static int vmci_transport_dgram_dequeue(struct kiocb *kiocb,
         if (err)
                 goto out;
 
-        msg->msg_namelen = 0;
         if (msg->msg_name) {
                 struct sockaddr_vm *vm_addr;
 
diff --git a/net/vmw_vsock/vsock_addr.c b/net/vmw_vsock/vsock_addr.c
index b7df1aea7c59..ec2611b4ea0e 100644
--- a/net/vmw_vsock/vsock_addr.c
+++ b/net/vmw_vsock/vsock_addr.c
@@ -64,16 +64,6 @@ bool vsock_addr_equals_addr(const struct sockaddr_vm *addr,
 }
 EXPORT_SYMBOL_GPL(vsock_addr_equals_addr);
 
-bool vsock_addr_equals_addr_any(const struct sockaddr_vm *addr,
-                                const struct sockaddr_vm *other)
-{
-        return (addr->svm_cid == VMADDR_CID_ANY ||
-                other->svm_cid == VMADDR_CID_ANY ||
-                addr->svm_cid == other->svm_cid) &&
-               addr->svm_port == other->svm_port;
-}
-EXPORT_SYMBOL_GPL(vsock_addr_equals_addr_any);
-
 int vsock_addr_cast(const struct sockaddr *addr,
                     size_t len, struct sockaddr_vm **out_addr)
 {
diff --git a/net/vmw_vsock/vsock_addr.h b/net/vmw_vsock/vsock_addr.h
index cdfbcefdf843..9ccd5316eac0 100644
--- a/net/vmw_vsock/vsock_addr.h
+++ b/net/vmw_vsock/vsock_addr.h
@@ -24,8 +24,6 @@ bool vsock_addr_bound(const struct sockaddr_vm *addr);
 void vsock_addr_unbind(struct sockaddr_vm *addr);
 bool vsock_addr_equals_addr(const struct sockaddr_vm *addr,
                             const struct sockaddr_vm *other);
-bool vsock_addr_equals_addr_any(const struct sockaddr_vm *addr,
-                                const struct sockaddr_vm *other);
 int vsock_addr_cast(const struct sockaddr *addr, size_t len,
                     struct sockaddr_vm **out_addr);
 
diff --git a/net/wireless/core.c b/net/wireless/core.c
index ea4155fe9733..6ddf74f0ae1e 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -212,6 +212,39 @@ static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data)
         rdev_rfkill_poll(rdev);
 }
 
+void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
+                              struct wireless_dev *wdev)
+{
+        lockdep_assert_held(&rdev->devlist_mtx);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_P2P_DEVICE))
+                return;
+
+        if (!wdev->p2p_started)
+                return;
+
+        rdev_stop_p2p_device(rdev, wdev);
+        wdev->p2p_started = false;
+
+        rdev->opencount--;
+
+        if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
+                bool busy = work_busy(&rdev->scan_done_wk);
+
+                /*
+                 * If the work isn't pending or running (in which case it would
+                 * be waiting for the lock we hold) the driver didn't properly
+                 * cancel the scan when the interface was removed. In this case
+                 * warn and leak the scan request object to not crash later.
+                 */
+                WARN_ON(!busy);
+
+                rdev->scan_req->aborted = true;
+                ___cfg80211_scan_done(rdev, !busy);
+        }
+}
+
 static int cfg80211_rfkill_set_block(void *data, bool blocked)
 {
         struct cfg80211_registered_device *rdev = data;
@@ -221,7 +254,8 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
                 return 0;
 
         rtnl_lock();
-        mutex_lock(&rdev->devlist_mtx);
+
+        /* read-only iteration need not hold the devlist_mtx */
 
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 if (wdev->netdev) {
@@ -231,18 +265,18 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
                 /* otherwise, check iftype */
                 switch (wdev->iftype) {
                 case NL80211_IFTYPE_P2P_DEVICE:
-                        if (!wdev->p2p_started)
-                                break;
-                        rdev_stop_p2p_device(rdev, wdev);
-                        wdev->p2p_started = false;
-                        rdev->opencount--;
+                        /* but this requires it */
+                        mutex_lock(&rdev->devlist_mtx);
+                        mutex_lock(&rdev->sched_scan_mtx);
+                        cfg80211_stop_p2p_device(rdev, wdev);
+                        mutex_unlock(&rdev->sched_scan_mtx);
+                        mutex_unlock(&rdev->devlist_mtx);
                         break;
                 default:
                         break;
                 }
         }
 
-        mutex_unlock(&rdev->devlist_mtx);
         rtnl_unlock();
 
         return 0;
@@ -745,17 +779,13 @@ static void wdev_cleanup_work(struct work_struct *work)
         wdev = container_of(work, struct wireless_dev, cleanup_work);
         rdev = wiphy_to_dev(wdev->wiphy);
 
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
 
         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
                 rdev->scan_req->aborted = true;
                 ___cfg80211_scan_done(rdev, true);
         }
 
-        cfg80211_unlock_rdev(rdev);
-
-        mutex_lock(&rdev->sched_scan_mtx);
-
         if (WARN_ON(rdev->sched_scan_req &&
                     rdev->sched_scan_req->dev == wdev->netdev)) {
                 __cfg80211_stop_sched_scan(rdev, false);
@@ -781,21 +811,19 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev)
                 return;
 
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         list_del_rcu(&wdev->list);
         rdev->devlist_generation++;
 
         switch (wdev->iftype) {
         case NL80211_IFTYPE_P2P_DEVICE:
-                if (!wdev->p2p_started)
-                        break;
-                rdev_stop_p2p_device(rdev, wdev);
-                wdev->p2p_started = false;
-                rdev->opencount--;
+                cfg80211_stop_p2p_device(rdev, wdev);
                 break;
         default:
                 WARN_ON_ONCE(1);
                 break;
         }
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
 }
 EXPORT_SYMBOL(cfg80211_unregister_wdev);
@@ -936,6 +964,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                 cfg80211_update_iface_num(rdev, wdev->iftype, 1);
                 cfg80211_lock_rdev(rdev);
                 mutex_lock(&rdev->devlist_mtx);
+                mutex_lock(&rdev->sched_scan_mtx);
                 wdev_lock(wdev);
                 switch (wdev->iftype) {
 #ifdef CONFIG_CFG80211_WEXT
@@ -967,6 +996,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                         break;
                 }
                 wdev_unlock(wdev);
+                mutex_unlock(&rdev->sched_scan_mtx);
                 rdev->opencount++;
                 mutex_unlock(&rdev->devlist_mtx);
                 cfg80211_unlock_rdev(rdev);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 3aec0e429d8a..5845c2b37aa8 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -503,6 +503,9 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
 void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
                                enum nl80211_iftype iftype, int num);
 
+void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
+                              struct wireless_dev *wdev);
+
 #define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
 
 #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d44ab216c0ec..58e13a8c95f9 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4702,14 +4702,19 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->scan)
                 return -EOPNOTSUPP;
 
-        if (rdev->scan_req)
-                return -EBUSY;
+        mutex_lock(&rdev->sched_scan_mtx);
+        if (rdev->scan_req) {
+                err = -EBUSY;
+                goto unlock;
+        }
 
         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
                 n_channels = validate_scan_freqs(
                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
-                if (!n_channels)
-                        return -EINVAL;
+                if (!n_channels) {
+                        err = -EINVAL;
+                        goto unlock;
+                }
         } else {
                 enum ieee80211_band band;
                 n_channels = 0;
@@ -4723,23 +4728,29 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
                         n_ssids++;
 
-        if (n_ssids > wiphy->max_scan_ssids)
-                return -EINVAL;
+        if (n_ssids > wiphy->max_scan_ssids) {
+                err = -EINVAL;
+                goto unlock;
+        }
 
         if (info->attrs[NL80211_ATTR_IE])
                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         else
                 ie_len = 0;
 
-        if (ie_len > wiphy->max_scan_ie_len)
-                return -EINVAL;
+        if (ie_len > wiphy->max_scan_ie_len) {
+                err = -EINVAL;
+                goto unlock;
+        }
 
         request = kzalloc(sizeof(*request)
                         + sizeof(*request->ssids) * n_ssids
                         + sizeof(*request->channels) * n_channels
                         + ie_len, GFP_KERNEL);
-        if (!request)
-                return -ENOMEM;
+        if (!request) {
+                err = -ENOMEM;
+                goto unlock;
+        }
 
         if (n_ssids)
                 request->ssids = (void *)&request->channels[n_channels];
@@ -4876,6 +4887,8 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 kfree(request);
         }
 
+ unlock:
+        mutex_unlock(&rdev->sched_scan_mtx);
         return err;
 }
 
@@ -7749,20 +7762,9 @@ static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->stop_p2p_device)
                 return -EOPNOTSUPP;
 
-        if (!wdev->p2p_started)
-                return 0;
-
-        rdev_stop_p2p_device(rdev, wdev);
-        wdev->p2p_started = false;
-
-        mutex_lock(&rdev->devlist_mtx);
-        rdev->opencount--;
-        mutex_unlock(&rdev->devlist_mtx);
-
-        if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
-                rdev->scan_req->aborted = true;
-                ___cfg80211_scan_done(rdev, true);
-        }
+        mutex_lock(&rdev->sched_scan_mtx);
+        cfg80211_stop_p2p_device(rdev, wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 
         return 0;
 }
@@ -8486,7 +8488,7 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
         struct nlattr *nest;
         int i;
 
-        ASSERT_RDEV_LOCK(rdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         if (WARN_ON(!req))
                 return 0;
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 674aadca0079..fd99ea495b7e 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -169,7 +169,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
         union iwreq_data wrqu;
 #endif
 
-        ASSERT_RDEV_LOCK(rdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         request = rdev->scan_req;
 
@@ -230,9 +230,9 @@ void __cfg80211_scan_done(struct work_struct *wk)
         rdev = container_of(wk, struct cfg80211_registered_device,
                             scan_done_wk);
 
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
         ___cfg80211_scan_done(rdev, false);
-        cfg80211_unlock_rdev(rdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 }
 
 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
@@ -698,11 +698,6 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
         found = rb_find_bss(dev, tmp, BSS_CMP_REGULAR);
 
         if (found) {
-                found->pub.beacon_interval = tmp->pub.beacon_interval;
-                found->pub.signal = tmp->pub.signal;
-                found->pub.capability = tmp->pub.capability;
-                found->ts = tmp->ts;
-
                 /* Update IEs */
                 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
                         const struct cfg80211_bss_ies *old;
@@ -723,6 +718,8 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
 
                         if (found->pub.hidden_beacon_bss &&
                             !list_empty(&found->hidden_list)) {
+                                const struct cfg80211_bss_ies *f;
+
                                 /*
                                  * The found BSS struct is one of the probe
                                  * response members of a group, but we're
@@ -732,6 +729,10 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                                  * SSID to showing it, which is confusing so
                                  * drop this information.
                                  */
+
+                                f = rcu_access_pointer(tmp->pub.beacon_ies);
+                                kfree_rcu((struct cfg80211_bss_ies *)f,
+                                          rcu_head);
                                 goto drop;
                         }
 
@@ -761,6 +762,11 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                                 kfree_rcu((struct cfg80211_bss_ies *)old,
                                           rcu_head);
                 }
+
+                found->pub.beacon_interval = tmp->pub.beacon_interval;
+                found->pub.signal = tmp->pub.signal;
+                found->pub.capability = tmp->pub.capability;
+                found->ts = tmp->ts;
         } else {
                 struct cfg80211_internal_bss *new;
                 struct cfg80211_internal_bss *hidden;
@@ -1056,6 +1062,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
 
+        mutex_lock(&rdev->sched_scan_mtx);
         if (rdev->scan_req) {
                 err = -EBUSY;
                 goto out;
@@ -1162,6 +1169,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
                 dev_hold(dev);
         }
  out:
+        mutex_unlock(&rdev->sched_scan_mtx);
         kfree(creq);
         cfg80211_unlock_rdev(rdev);
         return err;
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index f432bd3755b1..482c70e70127 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -85,6 +85,7 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         ASSERT_RTNL();
         ASSERT_RDEV_LOCK(rdev);
         ASSERT_WDEV_LOCK(wdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         if (rdev->scan_req)
                 return -EBUSY;
@@ -223,6 +224,7 @@ void cfg80211_conn_work(struct work_struct *work)
         rtnl_lock();
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
 
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 wdev_lock(wdev);
@@ -247,6 +249,7 @@ void cfg80211_conn_work(struct work_struct *work)
                 wdev_unlock(wdev);
         }
 
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         rtnl_unlock();
@@ -320,11 +323,9 @@ void cfg80211_sme_scan_done(struct net_device *dev)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
-        mutex_lock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
         wdev_lock(wdev);
         __cfg80211_sme_scan_done(dev);
         wdev_unlock(wdev);
-        mutex_unlock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
 }
 
 void cfg80211_sme_rx_auth(struct net_device *dev,
@@ -924,9 +925,12 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
         int err;
 
         mutex_lock(&rdev->devlist_mtx);
+        /* might request scan - scan_mtx -> wdev_mtx dependency */
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(dev->ieee80211_ptr);
         err = __cfg80211_connect(rdev, dev, connect, connkeys, NULL);
         wdev_unlock(dev->ieee80211_ptr);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
 
         return err;
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index b7a531380e19..7586de77a2f8 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -27,7 +27,8 @@
 #define WIPHY_PR_ARG    __entry->wiphy_name
 
 #define WDEV_ENTRY      __field(u32, id)
-#define WDEV_ASSIGN     (__entry->id) = (wdev ? wdev->identifier : 0)
+#define WDEV_ASSIGN     (__entry->id) = (!IS_ERR_OR_NULL(wdev)  \
+                                         ? wdev->identifier : 0)
 #define WDEV_PR_FMT     "wdev(%u)"
 #define WDEV_PR_ARG     (__entry->id)
 
@@ -1778,7 +1779,7 @@ TRACE_EVENT(rdev_set_mac_acl,
         ),
         TP_fast_assign(
                 WIPHY_ASSIGN;
-                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
                 __entry->acl_policy = params->acl_policy;
         ),
         TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", acl policy: %d",
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index fb9622f6d99c..e79cb5c0655a 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -89,6 +89,7 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
 
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -135,6 +136,7 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;
@@ -190,6 +192,7 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
 
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         err = 0;
@@ -223,6 +226,7 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;
@@ -285,6 +289,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
 
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -313,6 +318,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 35754cc8a9e5..8dafe6d3c6e4 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -334,6 +334,70 @@ static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
                 x->xflags &= ~XFRM_TIME_DEFER;
 }
 
+static void xfrm_replay_notify_esn(struct xfrm_state *x, int event)
+{
+        u32 seq_diff, oseq_diff;
+        struct km_event c;
+        struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
+        struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;
+
+        /* we send notify messages in case
+         *  1. we updated on of the sequence numbers, and the seqno difference
+         *     is at least x->replay_maxdiff, in this case we also update the
+         *     timeout of our timer function
+         *  2. if x->replay_maxage has elapsed since last update,
+         *     and there were changes
+         *
+         *  The state structure must be locked!
+         */
+
+        switch (event) {
+        case XFRM_REPLAY_UPDATE:
+                if (!x->replay_maxdiff)
+                        break;
+
+                if (replay_esn->seq_hi == preplay_esn->seq_hi)
+                        seq_diff = replay_esn->seq - preplay_esn->seq;
+                else
+                        seq_diff = ~preplay_esn->seq + replay_esn->seq + 1;
+
+                if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
+                        oseq_diff = replay_esn->oseq - preplay_esn->oseq;
+                else
+                        oseq_diff = ~preplay_esn->oseq + replay_esn->oseq + 1;
+
+                if (seq_diff < x->replay_maxdiff &&
+                    oseq_diff < x->replay_maxdiff) {
+
+                        if (x->xflags & XFRM_TIME_DEFER)
+                                event = XFRM_REPLAY_TIMEOUT;
+                        else
+                                return;
+                }
+
+                break;
+
+        case XFRM_REPLAY_TIMEOUT:
+                if (memcmp(x->replay_esn, x->preplay_esn,
+                           xfrm_replay_state_esn_len(replay_esn)) == 0) {
+                        x->xflags |= XFRM_TIME_DEFER;
+                        return;
+                }
+
+                break;
+        }
+
+        memcpy(x->preplay_esn, x->replay_esn,
+               xfrm_replay_state_esn_len(replay_esn));
+        c.event = XFRM_MSG_NEWAE;
+        c.data.aevent = event;
+        km_state_notify(x, &c);
+
+        if (x->replay_maxage &&
+            !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
+                x->xflags &= ~XFRM_TIME_DEFER;
+}
+
 static int xfrm_replay_overflow_esn(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err = 0;
@@ -510,7 +574,7 @@ static struct xfrm_replay xfrm_replay_esn = {
         .advance        = xfrm_replay_advance_esn,
         .check          = xfrm_replay_check_esn,
         .recheck        = xfrm_replay_recheck_esn,
-        .notify         = xfrm_replay_notify_bmp,
+        .notify         = xfrm_replay_notify_esn,
         .overflow       = xfrm_replay_overflow_esn,
 };
 
diff --git a/security/capability.c b/security/capability.c
index 579775088967..6783c3e6c88e 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -737,6 +737,11 @@ static int cap_tun_dev_open(void *security)
 {
         return 0;
 }
+
+static void cap_skb_owned_by(struct sk_buff *skb, struct sock *sk)
+{
+}
+
 #endif  /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
@@ -1071,6 +1076,7 @@ void __init security_fixup_ops(struct security_operations *ops)
         set_to_cap_if_null(ops, tun_dev_open);
         set_to_cap_if_null(ops, tun_dev_attach_queue);
         set_to_cap_if_null(ops, tun_dev_attach);
+        set_to_cap_if_null(ops, skb_owned_by);
 #endif  /* CONFIG_SECURITY_NETWORK */
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
         set_to_cap_if_null(ops, xfrm_policy_alloc_security);
diff --git a/security/security.c b/security/security.c
index 7b88c6aeaed4..03f248b84e9f 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1290,6 +1290,11 @@ int security_tun_dev_open(void *security)
 }
 EXPORT_SYMBOL(security_tun_dev_open);
 
+void security_skb_owned_by(struct sk_buff *skb, struct sock *sk)
+{
+        security_ops->skb_owned_by(skb, sk);
+}
+
 #endif  /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 2fa28c88900c..7171a957b933 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -51,6 +51,7 @@
 #include <linux/tty.h>
 #include <net/icmp.h>
 #include <net/ip.h>             /* for local_port_range[] */
+#include <net/sock.h>
 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
 #include <net/net_namespace.h>
 #include <net/netlabel.h>
@@ -4363,6 +4364,11 @@ static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
 }
 
+static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
+{
+        skb_set_owner_w(skb, sk);
+}
+
 static int selinux_secmark_relabel_packet(u32 sid)
 {
         const struct task_security_struct *__tsec;
@@ -5664,6 +5670,7 @@ static struct security_operations selinux_ops = {
         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
         .tun_dev_attach =               selinux_tun_dev_attach,
         .tun_dev_open =                 selinux_tun_dev_open,
+        .skb_owned_by =                 selinux_skb_owned_by,
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index 23414b93771f..13c88fbcf037 100644
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -347,10 +347,8 @@ int yama_ptrace_traceme(struct task_struct *parent)
         /* Only disallow PTRACE_TRACEME on more aggressive settings. */
         switch (ptrace_scope) {
         case YAMA_SCOPE_CAPABILITY:
-                rcu_read_lock();
-                if (!ns_capable(__task_cred(parent)->user_ns, CAP_SYS_PTRACE))
+                if (!has_ns_capability(parent, current_user_ns(), CAP_SYS_PTRACE))
                         rc = -EPERM;
-                rcu_read_unlock();
                 break;
         case YAMA_SCOPE_NO_ATTACH:
                 rc = -EPERM;
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index ecdf30eb5879..4aba7646dd9c 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -173,7 +173,7 @@ const char *snd_hda_get_jack_type(u32 cfg)
                 "Line Out", "Speaker", "HP Out", "CD",
                 "SPDIF Out", "Digital Out", "Modem Line", "Modem Hand",
                 "Line In", "Aux", "Mic", "Telephony",
-                "SPDIF In", "Digitial In", "Reserved", "Other"
+                "SPDIF In", "Digital In", "Reserved", "Other"
         };
 
         return jack_types[(cfg & AC_DEFCFG_DEVICE)
diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
index 7dd846380a50..d0d7ac1e99d2 100644
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -320,7 +320,7 @@ int snd_hdmi_get_eld(struct hda_codec *codec, hda_nid_t nid,
                      unsigned char *buf, int *eld_size)
 {
         int i;
-        int ret;
+        int ret = 0;
         int size;
 
         /*
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 43c2ea539561..2dbe767be16b 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -740,7 +740,7 @@ EXPORT_SYMBOL_HDA(snd_hda_activate_path);
 static void path_power_down_sync(struct hda_codec *codec, struct nid_path *path)
 {
         struct hda_gen_spec *spec = codec->spec;
-        bool changed;
+        bool changed = false;
         int i;
 
         if (!spec->power_down_unused || path->active)
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 418bfc0eb0a3..bcd40ee488e3 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -134,8 +134,8 @@ MODULE_PARM_DESC(power_save, "Automatic power-saving timeout "
  * this may give more power-saving, but will take longer time to
  * wake up.
  */
-static int power_save_controller = -1;
-module_param(power_save_controller, bint, 0644);
+static bool power_save_controller = 1;
+module_param(power_save_controller, bool, 0644);
 MODULE_PARM_DESC(power_save_controller, "Reset controller in power save mode.");
 #endif /* CONFIG_PM */
 
@@ -2931,8 +2931,6 @@ static int azx_runtime_idle(struct device *dev)
         struct snd_card *card = dev_get_drvdata(dev);
         struct azx *chip = card->private_data;
 
-        if (power_save_controller > 0)
-                return 0;
         if (!power_save_controller ||
             !(chip->driver_caps & AZX_DCAPS_PM_RUNTIME))
                 return -EBUSY;
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 78e1827d0a95..de8ac5c07fd0 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1196,7 +1196,7 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
 
         _snd_printd(SND_PR_VERBOSE,
                 "HDMI status: Codec=%d Pin=%d Presence_Detect=%d ELD_Valid=%d\n",
-                codec->addr, pin_nid, eld->monitor_present, eld->eld_valid);
+                codec->addr, pin_nid, pin_eld->monitor_present, eld->eld_valid);
 
         if (eld->eld_valid) {
                 if (snd_hdmi_get_eld(codec, pin_nid, eld->eld_buffer,
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 563c24df4d6f..f15c36bde540 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3440,7 +3440,8 @@ static int alc662_parse_auto_config(struct hda_codec *codec)
         const hda_nid_t *ssids;
 
         if (codec->vendor_id == 0x10ec0272 || codec->vendor_id == 0x10ec0663 ||
-            codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670)
+            codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670 ||
+            codec->vendor_id == 0x10ec0671)
                 ssids = alc663_ssids;
         else
                 ssids = alc662_ssids;
@@ -3894,6 +3895,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
         { .id = 0x10ec0665, .name = "ALC665", .patch = patch_alc662 },
         { .id = 0x10ec0668, .name = "ALC668", .patch = patch_alc662 },
         { .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
+        { .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 },
         { .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 },
         { .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
         { .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 },
diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
index fc176044994d..fc176044994d 100755..100644
--- a/sound/soc/codecs/max98090.c
+++ b/sound/soc/codecs/max98090.c
diff --git a/sound/soc/codecs/max98090.h b/sound/soc/codecs/max98090.h
index 7e103f249053..7e103f249053 100755..100644
--- a/sound/soc/codecs/max98090.h
+++ b/sound/soc/codecs/max98090.h
diff --git a/sound/soc/codecs/si476x.c b/sound/soc/codecs/si476x.c
index f2d61a187830..566ea3256e2d 100644
--- a/sound/soc/codecs/si476x.c
+++ b/sound/soc/codecs/si476x.c
@@ -159,6 +159,7 @@ static int si476x_codec_hw_params(struct snd_pcm_substream *substream,
         switch (params_format(params)) {
         case SNDRV_PCM_FORMAT_S8:
                 width = SI476X_PCM_FORMAT_S8;
+                break;
         case SNDRV_PCM_FORMAT_S16_LE:
                 width = SI476X_PCM_FORMAT_S16_LE;
                 break;
diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
index b82bbf584146..34d0201d6a78 100644
--- a/sound/soc/codecs/wm5102.c
+++ b/sound/soc/codecs/wm5102.c
@@ -584,7 +584,7 @@ static int wm5102_sysclk_ev(struct snd_soc_dapm_widget *w,
                             struct snd_kcontrol *kcontrol, int event)
 {
         struct snd_soc_codec *codec = w->codec;
-        struct arizona *arizona = dev_get_drvdata(codec->dev);
+        struct arizona *arizona = dev_get_drvdata(codec->dev->parent);
         struct regmap *regmap = codec->control_data;
         const struct reg_default *patch = NULL;
         int i, patch_size;
diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
index 134e41c870b9..f8a31ad0b203 100644
--- a/sound/soc/codecs/wm8903.c
+++ b/sound/soc/codecs/wm8903.c
@@ -1083,6 +1083,8 @@ static const struct snd_soc_dapm_route wm8903_intercon[] = {
         { "ROP", NULL, "Right Speaker PGA" },
         { "RON", NULL, "Right Speaker PGA" },
 
+        { "Charge Pump", NULL, "CLK_DSP" },
+
         { "Left Headphone Output PGA", NULL, "Charge Pump" },
         { "Right Headphone Output PGA", NULL, "Charge Pump" },
         { "Left Line Output PGA", NULL, "Charge Pump" },
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index f3f7e75f8628..9af1bddc4c62 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -828,7 +828,8 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp)
                                                 &buf_list);
                         if (!buf) {
                                 adsp_err(dsp, "Out of memory\n");
-                                return -ENOMEM;
+                                ret = -ENOMEM;
+                                goto out_fw;
                         }
 
                         adsp_dbg(dsp, "%s.%d: Writing %d bytes at %x\n",
@@ -865,7 +866,7 @@ out_fw:
         wm_adsp_buf_free(&buf_list);
 out:
         kfree(file);
-        return 0;
+        return ret;
 }
 
 int wm_adsp1_init(struct wm_adsp *adsp)
diff --git a/sound/soc/fsl/imx-ssi.c b/sound/soc/fsl/imx-ssi.c
index dce05b613bd3..7c84eb123d76 100644
--- a/sound/soc/fsl/imx-ssi.c
+++ b/sound/soc/fsl/imx-ssi.c
@@ -496,6 +496,8 @@ static void imx_ssi_ac97_reset(struct snd_ac97 *ac97)
 
         if (imx_ssi->ac97_reset)
                 imx_ssi->ac97_reset(ac97);
+        /* First read sometimes fails, do a dummy read */
+        imx_ssi_ac97_read(ac97, 0);
 }
 
 static void imx_ssi_ac97_warm_reset(struct snd_ac97 *ac97)
@@ -504,6 +506,9 @@ static void imx_ssi_ac97_warm_reset(struct snd_ac97 *ac97)
 
         if (imx_ssi->ac97_warm_reset)
                 imx_ssi->ac97_warm_reset(ac97);
+
+        /* First read sometimes fails, do a dummy read */
+        imx_ssi_ac97_read(ac97, 0);
 }
 
 struct snd_ac97_bus_ops soc_ac97_ops = {
diff --git a/sound/soc/fsl/pcm030-audio-fabric.c b/sound/soc/fsl/pcm030-audio-fabric.c
index 8e52c1485df3..eb4373840bb6 100644
--- a/sound/soc/fsl/pcm030-audio-fabric.c
+++ b/sound/soc/fsl/pcm030-audio-fabric.c
@@ -51,7 +51,7 @@ static struct snd_soc_card pcm030_card = {
         .num_links = ARRAY_SIZE(pcm030_fabric_dai),
 };
 
-static int __init pcm030_fabric_probe(struct platform_device *op)
+static int pcm030_fabric_probe(struct platform_device *op)
 {
         struct device_node *np = op->dev.of_node;
         struct device_node *platform_np;
diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
index d7231e336a7c..6bbeb0bf1a73 100644
--- a/sound/soc/samsung/i2s.c
+++ b/sound/soc/samsung/i2s.c
@@ -972,6 +972,7 @@ static const struct snd_soc_dai_ops samsung_i2s_dai_ops = {
 static struct i2s_dai *i2s_alloc_dai(struct platform_device *pdev, bool sec)
 {
         struct i2s_dai *i2s;
+        int ret;
 
         i2s = devm_kzalloc(&pdev->dev, sizeof(struct i2s_dai), GFP_KERNEL);
         if (i2s == NULL)
@@ -996,15 +997,17 @@ static struct i2s_dai *i2s_alloc_dai(struct platform_device *pdev, bool sec)
                 i2s->i2s_dai_drv.capture.channels_max = 2;
                 i2s->i2s_dai_drv.capture.rates = SAMSUNG_I2S_RATES;
                 i2s->i2s_dai_drv.capture.formats = SAMSUNG_I2S_FMTS;
+                dev_set_drvdata(&i2s->pdev->dev, i2s);
         } else {        /* Create a new platform_device for Secondary */
-                i2s->pdev = platform_device_register_resndata(NULL,
-                                "samsung-i2s-sec", -1, NULL, 0, NULL, 0);
+                i2s->pdev = platform_device_alloc("samsung-i2s-sec", -1);
                 if (IS_ERR(i2s->pdev))
                         return NULL;
-        }
 
-        /* Pre-assign snd_soc_dai_set_drvdata */
-        dev_set_drvdata(&i2s->pdev->dev, i2s);
+                platform_set_drvdata(i2s->pdev, i2s);
+                ret = platform_device_add(i2s->pdev);
+                if (ret < 0)
+                        return NULL;
+        }
 
         return i2s;
 }
@@ -1107,6 +1110,10 @@ static int samsung_i2s_probe(struct platform_device *pdev)
 
         if (samsung_dai_type == TYPE_SEC) {
                 sec_dai = dev_get_drvdata(&pdev->dev);
+                if (!sec_dai) {
+                        dev_err(&pdev->dev, "Unable to get drvdata\n");
+                        return -EFAULT;
+                }
                 snd_soc_register_dai(&sec_dai->pdev->dev,
                         &sec_dai->i2s_dai_drv);
                 asoc_dma_platform_register(&pdev->dev);
diff --git a/sound/soc/sh/dma-sh7760.c b/sound/soc/sh/dma-sh7760.c
index 19eff8fc4fdd..1a8b03e4b41b 100644
--- a/sound/soc/sh/dma-sh7760.c
+++ b/sound/soc/sh/dma-sh7760.c
@@ -342,8 +342,8 @@ static int camelot_pcm_new(struct snd_soc_pcm_runtime *rtd)
         return 0;
 }
 
-static struct snd_soc_platform sh7760_soc_platform = {
-        .pcm_ops        = &camelot_pcm_ops,
+static struct snd_soc_platform_driver sh7760_soc_platform = {
+        .ops            = &camelot_pcm_ops,
         .pcm_new        = camelot_pcm_new,
         .pcm_free       = camelot_pcm_free,
 };
diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
index b5b3db71e253..ed0bfb0ddb96 100644
--- a/sound/soc/soc-compress.c
+++ b/sound/soc/soc-compress.c
@@ -211,19 +211,27 @@ static int soc_compr_set_params(struct snd_compr_stream *cstream,
         if (platform->driver->compr_ops && platform->driver->compr_ops->set_params) {
                 ret = platform->driver->compr_ops->set_params(cstream, params);
                 if (ret < 0)
-                        goto out;
+                        goto err;
         }
 
         if (rtd->dai_link->compr_ops && rtd->dai_link->compr_ops->set_params) {
                 ret = rtd->dai_link->compr_ops->set_params(cstream);
                 if (ret < 0)
-                        goto out;
+                        goto err;
         }
 
         snd_soc_dapm_stream_event(rtd, SNDRV_PCM_STREAM_PLAYBACK,
                                 SND_SOC_DAPM_STREAM_START);
 
-out:
+        /* cancel any delayed stream shutdown that is pending */
+        rtd->pop_wait = 0;
+        mutex_unlock(&rtd->pcm_mutex);
+
+        cancel_delayed_work_sync(&rtd->delayed_work);
+
+        return ret;
+
+err:
         mutex_unlock(&rtd->pcm_mutex);
         return ret;
 }
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 0e64af1a7df9..78468c64dd86 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -2963,7 +2963,7 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
         val = val << shift;
 
         ret = snd_soc_update_bits_locked(codec, reg, val_mask, val);
-        if (ret != 0)
+        if (ret < 0)
                 return ret;
 
         if (snd_soc_volsw_is_stereo(mc)) {
@@ -3140,7 +3140,7 @@ int snd_soc_bytes_put(struct snd_kcontrol *kcontrol,
         if (params->mask) {
                 ret = regmap_read(codec->control_data, params->base, &val);
                 if (ret != 0)
-                        return ret;
+                        goto out;
 
                 val &= params->mask;
 
@@ -3158,13 +3158,15 @@ int snd_soc_bytes_put(struct snd_kcontrol *kcontrol,
                         ((u32 *)data)[0] |= cpu_to_be32(val);
                         break;
                 default:
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto out;
                 }
         }
 
         ret = regmap_raw_write(codec->control_data, params->base,
                                data, len);
 
+out:
         kfree(data);
 
         return ret;
@@ -4237,7 +4239,6 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card,
                         dev_err(card->dev,
                                 "ASoC: Property '%s' index %d could not be read: %d\n",
                                 propname, 2 * i, ret);
-                        kfree(routes);
                         return -EINVAL;
                 }
                 ret = of_property_read_string_index(np, propname,
@@ -4246,7 +4247,6 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card,
                         dev_err(card->dev,
                                 "ASoC: Property '%s' index %d could not be read: %d\n",
                                 propname, (2 * i) + 1, ret);
-                        kfree(routes);
                         return -EINVAL;
                 }
         }
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 625d4824abbb..33acd8b892dc 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -831,6 +831,9 @@ static int is_connected_output_ep(struct snd_soc_dapm_widget *widget,
                 if (path->weak)
                         continue;
 
+                if (path->walking)
+                        return 1;
+
                 if (path->walked)
                         continue;
 
@@ -838,6 +841,7 @@ static int is_connected_output_ep(struct snd_soc_dapm_widget *widget,
 
                 if (path->sink && path->connect) {
                         path->walked = 1;
+                        path->walking = 1;
 
                         /* do we need to add this widget to the list ? */
                         if (list) {
@@ -847,11 +851,14 @@ static int is_connected_output_ep(struct snd_soc_dapm_widget *widget,
                                         dev_err(widget->dapm->dev,
                                                 "ASoC: could not add widget %s\n",
                                                 widget->name);
+                                        path->walking = 0;
                                         return con;
                                 }
                         }
 
                         con += is_connected_output_ep(path->sink, list);
+
+                        path->walking = 0;
                 }
         }
 
@@ -931,6 +938,9 @@ static int is_connected_input_ep(struct snd_soc_dapm_widget *widget,
                 if (path->weak)
                         continue;
 
+                if (path->walking)
+                        return 1;
+
                 if (path->walked)
                         continue;
 
@@ -938,6 +948,7 @@ static int is_connected_input_ep(struct snd_soc_dapm_widget *widget,
 
                 if (path->source && path->connect) {
                         path->walked = 1;
+                        path->walking = 1;
 
                         /* do we need to add this widget to the list ? */
                         if (list) {
@@ -947,11 +958,14 @@ static int is_connected_input_ep(struct snd_soc_dapm_widget *widget,
                                         dev_err(widget->dapm->dev,
                                                 "ASoC: could not add widget %s\n",
                                                 widget->name);
+                                        path->walking = 0;
                                         return con;
                                 }
                         }
 
                         con += is_connected_input_ep(path->source, list);
+
+                        path->walking = 0;
                 }
         }
 
diff --git a/sound/soc/spear/spear_pcm.c b/sound/soc/spear/spear_pcm.c
index ba66a3f370a3..d653763f83b7 100644
--- a/sound/soc/spear/spear_pcm.c
+++ b/sound/soc/spear/spear_pcm.c
@@ -136,9 +136,9 @@ static void spear_pcm_free(struct snd_pcm *pcm)
 
 static u64 spear_pcm_dmamask = DMA_BIT_MASK(32);
 
-static int spear_pcm_new(struct snd_card *card,
-                struct snd_soc_dai *dai, struct snd_pcm *pcm)
+static int spear_pcm_new(struct snd_soc_pcm_runtime *rtd)
 {
+        struct snd_card *card = rtd->card->snd_card;
         int ret;
 
         if (!card->dev->dma_mask)
@@ -146,16 +146,16 @@ static int spear_pcm_new(struct snd_card *card,
         if (!card->dev->coherent_dma_mask)
                 card->dev->coherent_dma_mask = DMA_BIT_MASK(32);
 
-        if (dai->driver->playback.channels_min) {
-                ret = spear_pcm_preallocate_dma_buffer(pcm,
+        if (rtd->cpu_dai->driver->playback.channels_min) {
+                ret = spear_pcm_preallocate_dma_buffer(rtd->pcm,
                                 SNDRV_PCM_STREAM_PLAYBACK,
                                 spear_pcm_hardware.buffer_bytes_max);
                 if (ret)
                         return ret;
         }
 
-        if (dai->driver->capture.channels_min) {
-                ret = spear_pcm_preallocate_dma_buffer(pcm,
+        if (rtd->cpu_dai->driver->capture.channels_min) {
+                ret = spear_pcm_preallocate_dma_buffer(rtd->pcm,
                                 SNDRV_PCM_STREAM_CAPTURE,
                                 spear_pcm_hardware.buffer_bytes_max);
                 if (ret)
diff --git a/sound/soc/tegra/tegra_pcm.c b/sound/soc/tegra/tegra_pcm.c
index 32d08119dd87..f9f247c64c6d 100644
--- a/sound/soc/tegra/tegra_pcm.c
+++ b/sound/soc/tegra/tegra_pcm.c
@@ -43,8 +43,6 @@
 static const struct snd_pcm_hardware tegra_pcm_hardware = {
         .info                   = SNDRV_PCM_INFO_MMAP |
                                   SNDRV_PCM_INFO_MMAP_VALID |
-                                  SNDRV_PCM_INFO_PAUSE |
-                                  SNDRV_PCM_INFO_RESUME |
                                   SNDRV_PCM_INFO_INTERLEAVED,
         .formats                = SNDRV_PCM_FMTBIT_S16_LE,
         .channels_min           = 2,
@@ -111,26 +109,6 @@ static int tegra_pcm_hw_free(struct snd_pcm_substream *substream)
         return 0;
 }
 
-static int tegra_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
-{
-        switch (cmd) {
-        case SNDRV_PCM_TRIGGER_START:
-        case SNDRV_PCM_TRIGGER_RESUME:
-        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-                return snd_dmaengine_pcm_trigger(substream,
-                                        SNDRV_PCM_TRIGGER_START);
-
-        case SNDRV_PCM_TRIGGER_STOP:
-        case SNDRV_PCM_TRIGGER_SUSPEND:
-        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
-                return snd_dmaengine_pcm_trigger(substream,
-                                        SNDRV_PCM_TRIGGER_STOP);
-        default:
-                return -EINVAL;
-        }
-        return 0;
-}
-
 static int tegra_pcm_mmap(struct snd_pcm_substream *substream,
                                 struct vm_area_struct *vma)
 {
@@ -148,7 +126,7 @@ static struct snd_pcm_ops tegra_pcm_ops = {
         .ioctl          = snd_pcm_lib_ioctl,
         .hw_params      = tegra_pcm_hw_params,
         .hw_free        = tegra_pcm_hw_free,
-        .trigger        = tegra_pcm_trigger,
+        .trigger        = snd_dmaengine_pcm_trigger,
         .pointer        = snd_dmaengine_pcm_pointer,
         .mmap           = tegra_pcm_mmap,
 };
diff --git a/sound/usb/clock.c b/sound/usb/clock.c
index 5e634a2eb282..9e2703a25156 100644
--- a/sound/usb/clock.c
+++ b/sound/usb/clock.c
@@ -253,7 +253,7 @@ static int set_sample_rate_v2(struct snd_usb_audio *chip, int iface,
 {
         struct usb_device *dev = chip->dev;
         unsigned char data[4];
-        int err, crate;
+        int err, cur_rate, prev_rate;
         int clock = snd_usb_clock_find_source(chip, fmt->clock);
 
         if (clock < 0)
@@ -266,6 +266,19 @@ static int set_sample_rate_v2(struct snd_usb_audio *chip, int iface,
                 return -ENXIO;
         }
 
+        err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), UAC2_CS_CUR,
+                              USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN,
+                              UAC2_CS_CONTROL_SAM_FREQ << 8,
+                              snd_usb_ctrl_intf(chip) | (clock << 8),
+                              data, sizeof(data));
+        if (err < 0) {
+                snd_printk(KERN_WARNING "%d:%d:%d: cannot get freq (v2)\n",
+                           dev->devnum, iface, fmt->altsetting);
+                prev_rate = 0;
+        } else {
+                prev_rate = data[0] | (data[1] << 8) | (data[2] << 16) | (data[3] << 24);
+        }
+
         data[0] = rate;
         data[1] = rate >> 8;
         data[2] = rate >> 16;
@@ -280,19 +293,31 @@ static int set_sample_rate_v2(struct snd_usb_audio *chip, int iface,
                 return err;
         }
 
-        if ((err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), UAC2_CS_CUR,
-                                   USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN,
-                                   UAC2_CS_CONTROL_SAM_FREQ << 8,
-                                   snd_usb_ctrl_intf(chip) | (clock << 8),
-                                   data, sizeof(data))) < 0) {
+        err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), UAC2_CS_CUR,
+                              USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN,
+                              UAC2_CS_CONTROL_SAM_FREQ << 8,
+                              snd_usb_ctrl_intf(chip) | (clock << 8),
+                              data, sizeof(data));
+        if (err < 0) {
                 snd_printk(KERN_WARNING "%d:%d:%d: cannot get freq (v2)\n",
                            dev->devnum, iface, fmt->altsetting);
-                return err;
+                cur_rate = 0;
+        } else {
+                cur_rate = data[0] | (data[1] << 8) | (data[2] << 16) | (data[3] << 24);
         }
 
-        crate = data[0] | (data[1] << 8) | (data[2] << 16) | (data[3] << 24);
-        if (crate != rate)
-                snd_printd(KERN_WARNING "current rate %d is different from the runtime rate %d\n", crate, rate);
+        if (cur_rate != rate) {
+                snd_printd(KERN_WARNING
+                           "current rate %d is different from the runtime rate %d\n",
+                           cur_rate, rate);
+        }
+
+        /* Some devices doesn't respond to sample rate changes while the
+         * interface is active. */
+        if (rate != prev_rate) {
+                usb_set_interface(dev, iface, 0);
+                usb_set_interface(dev, iface, fmt->altsetting);
+        }
 
         return 0;
 }
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 497d2741d119..ebe91440a068 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -509,7 +509,7 @@ static int snd_nativeinstruments_control_get(struct snd_kcontrol *kcontrol,
         else
                 ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), bRequest,
                                   USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
-                                  0, cpu_to_le16(wIndex),
+                                  0, wIndex,
                                   &tmp, sizeof(tmp), 1000);
         up_read(&mixer->chip->shutdown_rwsem);
 
@@ -540,7 +540,7 @@ static int snd_nativeinstruments_control_put(struct snd_kcontrol *kcontrol,
         else
                 ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), bRequest,
                                   USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
-                                  cpu_to_le16(wValue), cpu_to_le16(wIndex),
+                                  wValue, wIndex,
                                   NULL, 0, 1000);
         up_read(&mixer->chip->shutdown_rwsem);
 
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 5325a3869bb7..9c5ab22358b1 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -486,7 +486,7 @@ static int snd_usb_nativeinstruments_boot_quirk(struct usb_device *dev)
 {
         int ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
                                   0xaf, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                                  cpu_to_le16(1), 0, NULL, 0, 1000);
+                                  1, 0, NULL, 0, 1000);
 
         if (ret < 0)
                 return ret;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index adc68feb5c5a..f18013f09e68 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1541,21 +1541,38 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
 }
 
 int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
-                              gpa_t gpa)
+                              gpa_t gpa, unsigned long len)
 {
         struct kvm_memslots *slots = kvm_memslots(kvm);
         int offset = offset_in_page(gpa);
-        gfn_t gfn = gpa >> PAGE_SHIFT;
+        gfn_t start_gfn = gpa >> PAGE_SHIFT;
+        gfn_t end_gfn = (gpa + len - 1) >> PAGE_SHIFT;
+        gfn_t nr_pages_needed = end_gfn - start_gfn + 1;
+        gfn_t nr_pages_avail;
 
         ghc->gpa = gpa;
         ghc->generation = slots->generation;
-        ghc->memslot = gfn_to_memslot(kvm, gfn);
-        ghc->hva = gfn_to_hva_many(ghc->memslot, gfn, NULL);
-        if (!kvm_is_error_hva(ghc->hva))
+        ghc->len = len;
+        ghc->memslot = gfn_to_memslot(kvm, start_gfn);
+        ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, &nr_pages_avail);
+        if (!kvm_is_error_hva(ghc->hva) && nr_pages_avail >= nr_pages_needed) {
                 ghc->hva += offset;
-        else
-                return -EFAULT;
-
+        } else {
+                /*
+                 * If the requested region crosses two memslots, we still
+                 * verify that the entire region is valid here.
+                 */
+                while (start_gfn <= end_gfn) {
+                        ghc->memslot = gfn_to_memslot(kvm, start_gfn);
+                        ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn,
+                                                   &nr_pages_avail);
+                        if (kvm_is_error_hva(ghc->hva))
+                                return -EFAULT;
+                        start_gfn += nr_pages_avail;
+                }
+                /* Use the slow path for cross page reads and writes. */
+                ghc->memslot = NULL;
+        }
         return 0;
 }
 EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
@@ -1566,8 +1583,13 @@ int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
         struct kvm_memslots *slots = kvm_memslots(kvm);
         int r;
 
+        BUG_ON(len > ghc->len);
+
         if (slots->generation != ghc->generation)
-                kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa);
+                kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
+
+        if (unlikely(!ghc->memslot))
+                return kvm_write_guest(kvm, ghc->gpa, data, len);
 
         if (kvm_is_error_hva(ghc->hva))
                 return -EFAULT;
@@ -1587,8 +1609,13 @@ int kvm_read_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
         struct kvm_memslots *slots = kvm_memslots(kvm);
         int r;
 
+        BUG_ON(len > ghc->len);
+
         if (slots->generation != ghc->generation)
-                kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa);
+                kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
+
+        if (unlikely(!ghc->memslot))
+                return kvm_read_guest(kvm, ghc->gpa, data, len);
 
         if (kvm_is_error_hva(ghc->hva))
                 return -EFAULT;