Merge tag 'fscache-fixes-for-ceph' into wip-fscache

Patches for Ceph FS-Cache support

134 files changed, 1220 insertions, 686 deletions

diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index e1284b8dc6ee..3270d3c8ba4e 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -908,9 +908,6 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
                 device->cap._DDC = 1;
         }
 
-        if (acpi_video_init_brightness(device))
-                return;
-
         if (acpi_video_backlight_support()) {
                 struct backlight_properties props;
                 struct pci_dev *pdev;
@@ -920,6 +917,9 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
                 static int count = 0;
                 char *name;
 
+                result = acpi_video_init_brightness(device);
+                if (result)
+                        return;
                 name = kasprintf(GFP_KERNEL, "acpi_video%d", count);
                 if (!name)
                         return;
@@ -979,11 +979,6 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
                 if (result)
                         printk(KERN_ERR PREFIX "Create sysfs link\n");
 
-        } else {
-                /* Remove the brightness object. */
-                kfree(device->brightness->levels);
-                kfree(device->brightness);
-                device->brightness = NULL;
         }
 }
 
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index 1c41722bb7e2..20fd337a5731 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -289,24 +289,24 @@ static int sata_pmp_configure(struct ata_device *dev, int print_info)
 
         /* Disable sending Early R_OK.
          * With "cached read" HDD testing and multiple ports busy on a SATA
-         * host controller, 3726 PMP will very rarely drop a deferred
+         * host controller, 3x26 PMP will very rarely drop a deferred
          * R_OK that was intended for the host. Symptom will be all
          * 5 drives under test will timeout, get reset, and recover.
          */
-        if (vendor == 0x1095 && devid == 0x3726) {
+        if (vendor == 0x1095 && (devid == 0x3726 || devid == 0x3826)) {
                 u32 reg;
 
                 err_mask = sata_pmp_read(&ap->link, PMP_GSCR_SII_POL, &reg);
                 if (err_mask) {
                         rc = -EIO;
-                        reason = "failed to read Sil3726 Private Register";
+                        reason = "failed to read Sil3x26 Private Register";
                         goto fail;
                 }
                 reg &= ~0x1;
                 err_mask = sata_pmp_write(&ap->link, PMP_GSCR_SII_POL, reg);
                 if (err_mask) {
                         rc = -EIO;
-                        reason = "failed to write Sil3726 Private Register";
+                        reason = "failed to write Sil3x26 Private Register";
                         goto fail;
                 }
         }
@@ -383,8 +383,8 @@ static void sata_pmp_quirks(struct ata_port *ap)
         u16 devid = sata_pmp_gscr_devid(gscr);
         struct ata_link *link;
 
-        if (vendor == 0x1095 && devid == 0x3726) {
-                /* sil3726 quirks */
+        if (vendor == 0x1095 && (devid == 0x3726 || devid == 0x3826)) {
+                /* sil3x26 quirks */
                 ata_for_each_link(link, ap, EDGE) {
                         /* link reports offline after LPM */
                         link->flags |= ATA_LFLAG_NO_LPM;
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 19720a0a4a65..851bd3f43ac6 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -293,6 +293,7 @@ static void fsl_sata_set_irq_coalescing(struct ata_host *host,
 {
         struct sata_fsl_host_priv *host_priv = host->private_data;
         void __iomem *hcr_base = host_priv->hcr_base;
+        unsigned long flags;
 
         if (count > ICC_MAX_INT_COUNT_THRESHOLD)
                 count = ICC_MAX_INT_COUNT_THRESHOLD;
@@ -305,12 +306,12 @@ static void fsl_sata_set_irq_coalescing(struct ata_host *host,
                         (count > ICC_MIN_INT_COUNT_THRESHOLD))
                 ticks = ICC_SAFE_INT_TICKS;
 
-        spin_lock(&host->lock);
+        spin_lock_irqsave(&host->lock, flags);
         iowrite32((count << 24 | ticks), hcr_base + ICC);
 
         intr_coalescing_count = count;
         intr_coalescing_ticks = ticks;
-        spin_unlock(&host->lock);
+        spin_unlock_irqrestore(&host->lock, flags);
 
         DPRINTK("interrupt coalescing, count = 0x%x, ticks = %x\n",
                         intr_coalescing_count, intr_coalescing_ticks);
diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c
index d047d92a456f..e9a4f46d962e 100644
--- a/drivers/ata/sata_highbank.c
+++ b/drivers/ata/sata_highbank.c
@@ -86,11 +86,11 @@ struct ecx_plat_data {
 
 #define SGPIO_SIGNALS                   3
 #define ECX_ACTIVITY_BITS               0x300000
-#define ECX_ACTIVITY_SHIFT              2
+#define ECX_ACTIVITY_SHIFT              0
 #define ECX_LOCATE_BITS                 0x80000
 #define ECX_LOCATE_SHIFT                1
 #define ECX_FAULT_BITS                  0x400000
-#define ECX_FAULT_SHIFT                 0
+#define ECX_FAULT_SHIFT                 2
 static inline int sgpio_bit_shift(struct ecx_plat_data *pdata, u32 port,
                                 u32 shift)
 {
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 2b7813ec6d02..ec386ee9cb22 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -141,6 +141,8 @@ static ssize_t show_mem_removable(struct device *dev,
                 container_of(dev, struct memory_block, dev);
 
         for (i = 0; i < sections_per_block; i++) {
+                if (!present_section_nr(mem->start_section_nr + i))
+                        continue;
                 pfn = section_nr_to_pfn(mem->start_section_nr + i);
                 ret &= is_mem_section_removable(pfn, PAGES_PER_SECTION);
         }
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index 5c1435c4e210..0fccc99881fd 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -332,7 +332,7 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg)
         }
 
         if (!rbnode->blklen) {
-                rbnode->blklen = sizeof(*rbnode);
+                rbnode->blklen = 1;
                 rbnode->base_reg = reg;
         }
 
diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index 1bdb882c845b..4e5739773c33 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -581,11 +581,15 @@ struct samsung_div_clock exynos4x12_div_clks[] __initdata = {
         DIV(none, "div_spi1_isp", "mout_spi1_isp", E4X12_DIV_ISP, 16, 4),
         DIV(none, "div_spi1_isp_pre", "div_spi1_isp", E4X12_DIV_ISP, 20, 8),
         DIV(none, "div_uart_isp", "mout_uart_isp", E4X12_DIV_ISP, 28, 4),
-        DIV(div_isp0, "div_isp0", "aclk200", E4X12_DIV_ISP0, 0, 3),
-        DIV(div_isp1, "div_isp1", "aclk200", E4X12_DIV_ISP0, 4, 3),
+        DIV_F(div_isp0, "div_isp0", "aclk200", E4X12_DIV_ISP0, 0, 3,
+                                                CLK_GET_RATE_NOCACHE, 0),
+        DIV_F(div_isp1, "div_isp1", "aclk200", E4X12_DIV_ISP0, 4, 3,
+                                                CLK_GET_RATE_NOCACHE, 0),
         DIV(none, "div_mpwm", "div_isp1", E4X12_DIV_ISP1, 0, 3),
-        DIV(div_mcuisp0, "div_mcuisp0", "aclk400_mcuisp", E4X12_DIV_ISP1, 4, 3),
-        DIV(div_mcuisp1, "div_mcuisp1", "div_mcuisp0", E4X12_DIV_ISP1, 8, 3),
+        DIV_F(div_mcuisp0, "div_mcuisp0", "aclk400_mcuisp", E4X12_DIV_ISP1,
+                                                4, 3, CLK_GET_RATE_NOCACHE, 0),
+        DIV_F(div_mcuisp1, "div_mcuisp1", "div_mcuisp0", E4X12_DIV_ISP1,
+                                                8, 3, CLK_GET_RATE_NOCACHE, 0),
         DIV(sclk_fimg2d, "sclk_fimg2d", "mout_g2d", DIV_DMC1, 0, 4),
 };
 
@@ -863,57 +867,57 @@ struct samsung_gate_clock exynos4x12_gate_clks[] __initdata = {
         GATE_DA(i2s0, "samsung-i2s.0", "i2s0", "aclk100",
                         E4X12_GATE_IP_MAUDIO, 3, 0, 0, "iis"),
         GATE(fimc_isp, "isp", "aclk200", E4X12_GATE_ISP0, 0,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(fimc_drc, "drc", "aclk200", E4X12_GATE_ISP0, 1,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(fimc_fd, "fd", "aclk200", E4X12_GATE_ISP0, 2,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(fimc_lite0, "lite0", "aclk200", E4X12_GATE_ISP0, 3,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(fimc_lite1, "lite1", "aclk200", E4X12_GATE_ISP0, 4,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(mcuisp, "mcuisp", "aclk200", E4X12_GATE_ISP0, 5,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(gicisp, "gicisp", "aclk200", E4X12_GATE_ISP0, 7,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(smmu_isp, "smmu_isp", "aclk200", E4X12_GATE_ISP0, 8,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(smmu_drc, "smmu_drc", "aclk200", E4X12_GATE_ISP0, 9,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(smmu_fd, "smmu_fd", "aclk200", E4X12_GATE_ISP0, 10,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(smmu_lite0, "smmu_lite0", "aclk200", E4X12_GATE_ISP0, 11,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(smmu_lite1, "smmu_lite1", "aclk200", E4X12_GATE_ISP0, 12,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(ppmuispmx, "ppmuispmx", "aclk200", E4X12_GATE_ISP0, 20,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(ppmuispx, "ppmuispx", "aclk200", E4X12_GATE_ISP0, 21,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(mcuctl_isp, "mcuctl_isp", "aclk200", E4X12_GATE_ISP0, 23,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(mpwm_isp, "mpwm_isp", "aclk200", E4X12_GATE_ISP0, 24,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(i2c0_isp, "i2c0_isp", "aclk200", E4X12_GATE_ISP0, 25,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(i2c1_isp, "i2c1_isp", "aclk200", E4X12_GATE_ISP0, 26,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(mtcadc_isp, "mtcadc_isp", "aclk200", E4X12_GATE_ISP0, 27,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(pwm_isp, "pwm_isp", "aclk200", E4X12_GATE_ISP0, 28,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(wdt_isp, "wdt_isp", "aclk200", E4X12_GATE_ISP0, 30,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(uart_isp, "uart_isp", "aclk200", E4X12_GATE_ISP0, 31,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(asyncaxim, "asyncaxim", "aclk200", E4X12_GATE_ISP1, 0,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(smmu_ispcx, "smmu_ispcx", "aclk200", E4X12_GATE_ISP1, 4,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(spi0_isp, "spi0_isp", "aclk200", E4X12_GATE_ISP1, 12,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(spi1_isp, "spi1_isp", "aclk200", E4X12_GATE_ISP1, 13,
-                        CLK_IGNORE_UNUSED, 0),
+                        CLK_IGNORE_UNUSED | CLK_GET_RATE_NOCACHE, 0),
         GATE(g2d, "g2d", "aclk200", GATE_IP_DMC, 23, 0, 0),
 };
 
diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c
index 5c205b60a82a..089d3e30e221 100644
--- a/drivers/clk/zynq/clkc.c
+++ b/drivers/clk/zynq/clkc.c
@@ -71,6 +71,7 @@ static DEFINE_SPINLOCK(armpll_lock);
 static DEFINE_SPINLOCK(ddrpll_lock);
 static DEFINE_SPINLOCK(iopll_lock);
 static DEFINE_SPINLOCK(armclk_lock);
+static DEFINE_SPINLOCK(swdtclk_lock);
 static DEFINE_SPINLOCK(ddrclk_lock);
 static DEFINE_SPINLOCK(dciclk_lock);
 static DEFINE_SPINLOCK(gem0clk_lock);
@@ -293,7 +294,7 @@ static void __init zynq_clk_setup(struct device_node *np)
         }
         clks[swdt] = clk_register_mux(NULL, clk_output_name[swdt],
                         swdt_ext_clk_mux_parents, 2, CLK_SET_RATE_PARENT,
-                        SLCR_SWDT_CLK_SEL, 0, 1, 0, &gem0clk_lock);
+                        SLCR_SWDT_CLK_SEL, 0, 1, 0, &swdtclk_lock);
 
         /* DDR clocks */
         clk = clk_register_divider(NULL, "ddr2x_div", "ddrpll", 0,
@@ -364,8 +365,9 @@ static void __init zynq_clk_setup(struct device_node *np)
                         CLK_SET_RATE_PARENT, SLCR_GEM0_CLK_CTRL, 20, 6,
                         CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
                         &gem0clk_lock);
-        clk = clk_register_mux(NULL, "gem0_emio_mux", gem0_mux_parents, 2, 0,
-                        SLCR_GEM0_CLK_CTRL, 6, 1, 0, &gem0clk_lock);
+        clk = clk_register_mux(NULL, "gem0_emio_mux", gem0_mux_parents, 2,
+                        CLK_SET_RATE_PARENT, SLCR_GEM0_CLK_CTRL, 6, 1, 0,
+                        &gem0clk_lock);
         clks[gem0] = clk_register_gate(NULL, clk_output_name[gem0],
                         "gem0_emio_mux", CLK_SET_RATE_PARENT,
                         SLCR_GEM0_CLK_CTRL, 0, 0, &gem0clk_lock);
@@ -386,8 +388,9 @@ static void __init zynq_clk_setup(struct device_node *np)
                         CLK_SET_RATE_PARENT, SLCR_GEM1_CLK_CTRL, 20, 6,
                         CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
                         &gem1clk_lock);
-        clk = clk_register_mux(NULL, "gem1_emio_mux", gem1_mux_parents, 2, 0,
-                        SLCR_GEM1_CLK_CTRL, 6, 1, 0, &gem1clk_lock);
+        clk = clk_register_mux(NULL, "gem1_emio_mux", gem1_mux_parents, 2,
+                        CLK_SET_RATE_PARENT, SLCR_GEM1_CLK_CTRL, 6, 1, 0,
+                        &gem1clk_lock);
         clks[gem1] = clk_register_gate(NULL, clk_output_name[gem1],
                         "gem1_emio_mux", CLK_SET_RATE_PARENT,
                         SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock);
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 6825957c97fb..643d7c7a0d8e 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -194,7 +194,7 @@ config SIRF_DMA
           Enable support for the CSR SiRFprimaII DMA engine.
 
 config TI_EDMA
-        tristate "TI EDMA support"
+        bool "TI EDMA support"
         depends on ARCH_DAVINCI || ARCH_OMAP
         select DMA_ENGINE
         select DMA_VIRTUAL_CHANNELS
diff --git a/drivers/gpu/drm/gma500/psb_intel_sdvo.c b/drivers/gpu/drm/gma500/psb_intel_sdvo.c
index 19e36603b23b..3bc8414533c9 100644
--- a/drivers/gpu/drm/gma500/psb_intel_sdvo.c
+++ b/drivers/gpu/drm/gma500/psb_intel_sdvo.c
@@ -500,7 +500,8 @@ static bool psb_intel_sdvo_read_response(struct psb_intel_sdvo *psb_intel_sdvo,
                                   &status))
                 goto log_fail;
 
-        while (status == SDVO_CMD_STATUS_PENDING && retry--) {
+        while ((status == SDVO_CMD_STATUS_PENDING ||
+                status == SDVO_CMD_STATUS_TARGET_NOT_SPECIFIED) && retry--) {
                 udelay(15);
                 if (!psb_intel_sdvo_read_byte(psb_intel_sdvo,
                                           SDVO_I2C_CMD_STATUS,
diff --git a/drivers/gpu/drm/i915/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
index dc53a527126b..9e6578330801 100644
--- a/drivers/gpu/drm/i915/i915_gem_dmabuf.c
+++ b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
@@ -85,9 +85,17 @@ static void i915_gem_unmap_dma_buf(struct dma_buf_attachment *attachment,
                                    struct sg_table *sg,
                                    enum dma_data_direction dir)
 {
+        struct drm_i915_gem_object *obj = attachment->dmabuf->priv;
+
+        mutex_lock(&obj->base.dev->struct_mutex);
+
         dma_unmap_sg(attachment->dev, sg->sgl, sg->nents, dir);
         sg_free_table(sg);
         kfree(sg);
+
+        i915_gem_object_unpin_pages(obj);
+
+        mutex_unlock(&obj->base.dev->struct_mutex);
 }
 
 static void i915_gem_dmabuf_release(struct dma_buf *dma_buf)
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 6f514297c483..342f1f336168 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -752,6 +752,8 @@
                                         will not assert AGPBUSY# and will only
                                         be delivered when out of C3. */
 #define   INSTPM_FORCE_ORDERING                         (1<<7) /* GEN6+ */
+#define   INSTPM_TLB_INVALIDATE (1<<9)
+#define   INSTPM_SYNC_FLUSH     (1<<5)
 #define ACTHD           0x020c8
 #define FW_BLC          0x020d8
 #define FW_BLC2         0x020dc
@@ -4438,7 +4440,7 @@
 #define EDP_LINK_TRAIN_600MV_0DB_IVB            (0x30 <<22)
 #define EDP_LINK_TRAIN_600MV_3_5DB_IVB          (0x36 <<22)
 #define EDP_LINK_TRAIN_800MV_0DB_IVB            (0x38 <<22)
-#define EDP_LINK_TRAIN_800MV_3_5DB_IVB          (0x33 <<22)
+#define EDP_LINK_TRAIN_800MV_3_5DB_IVB          (0x3e <<22)
 
 /* legacy values */
 #define EDP_LINK_TRAIN_500MV_0DB_IVB            (0x00 <<22)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e38b45786653..be79f477a38f 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -10042,6 +10042,8 @@ struct intel_display_error_state {
 
         u32 power_well_driver;
 
+        int num_transcoders;
+
         struct intel_cursor_error_state {
                 u32 control;
                 u32 position;
@@ -10050,16 +10052,7 @@ struct intel_display_error_state {
         } cursor[I915_MAX_PIPES];
 
         struct intel_pipe_error_state {
-                enum transcoder cpu_transcoder;
-                u32 conf;
                 u32 source;
-
-                u32 htotal;
-                u32 hblank;
-                u32 hsync;
-                u32 vtotal;
-                u32 vblank;
-                u32 vsync;
         } pipe[I915_MAX_PIPES];
 
         struct intel_plane_error_state {
@@ -10071,6 +10064,19 @@ struct intel_display_error_state {
                 u32 surface;
                 u32 tile_offset;
         } plane[I915_MAX_PIPES];
+
+        struct intel_transcoder_error_state {
+                enum transcoder cpu_transcoder;
+
+                u32 conf;
+
+                u32 htotal;
+                u32 hblank;
+                u32 hsync;
+                u32 vtotal;
+                u32 vblank;
+                u32 vsync;
+        } transcoder[4];
 };
 
 struct intel_display_error_state *
@@ -10078,9 +10084,17 @@ intel_display_capture_error_state(struct drm_device *dev)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
         struct intel_display_error_state *error;
-        enum transcoder cpu_transcoder;
+        int transcoders[] = {
+                TRANSCODER_A,
+                TRANSCODER_B,
+                TRANSCODER_C,
+                TRANSCODER_EDP,
+        };
         int i;
 
+        if (INTEL_INFO(dev)->num_pipes == 0)
+                return NULL;
+
         error = kmalloc(sizeof(*error), GFP_ATOMIC);
         if (error == NULL)
                 return NULL;
@@ -10089,9 +10103,6 @@ intel_display_capture_error_state(struct drm_device *dev)
                 error->power_well_driver = I915_READ(HSW_PWR_WELL_DRIVER);
 
         for_each_pipe(i) {
-                cpu_transcoder = intel_pipe_to_cpu_transcoder(dev_priv, i);
-                error->pipe[i].cpu_transcoder = cpu_transcoder;
-
                 if (INTEL_INFO(dev)->gen <= 6 || IS_VALLEYVIEW(dev)) {
                         error->cursor[i].control = I915_READ(CURCNTR(i));
                         error->cursor[i].position = I915_READ(CURPOS(i));
@@ -10115,14 +10126,25 @@ intel_display_capture_error_state(struct drm_device *dev)
                         error->plane[i].tile_offset = I915_READ(DSPTILEOFF(i));
                 }
 
-                error->pipe[i].conf = I915_READ(PIPECONF(cpu_transcoder));
                 error->pipe[i].source = I915_READ(PIPESRC(i));
-                error->pipe[i].htotal = I915_READ(HTOTAL(cpu_transcoder));
-                error->pipe[i].hblank = I915_READ(HBLANK(cpu_transcoder));
-                error->pipe[i].hsync = I915_READ(HSYNC(cpu_transcoder));
-                error->pipe[i].vtotal = I915_READ(VTOTAL(cpu_transcoder));
-                error->pipe[i].vblank = I915_READ(VBLANK(cpu_transcoder));
-                error->pipe[i].vsync = I915_READ(VSYNC(cpu_transcoder));
+        }
+
+        error->num_transcoders = INTEL_INFO(dev)->num_pipes;
+        if (HAS_DDI(dev_priv->dev))
+                error->num_transcoders++; /* Account for eDP. */
+
+        for (i = 0; i < error->num_transcoders; i++) {
+                enum transcoder cpu_transcoder = transcoders[i];
+
+                error->transcoder[i].cpu_transcoder = cpu_transcoder;
+
+                error->transcoder[i].conf = I915_READ(PIPECONF(cpu_transcoder));
+                error->transcoder[i].htotal = I915_READ(HTOTAL(cpu_transcoder));
+                error->transcoder[i].hblank = I915_READ(HBLANK(cpu_transcoder));
+                error->transcoder[i].hsync = I915_READ(HSYNC(cpu_transcoder));
+                error->transcoder[i].vtotal = I915_READ(VTOTAL(cpu_transcoder));
+                error->transcoder[i].vblank = I915_READ(VBLANK(cpu_transcoder));
+                error->transcoder[i].vsync = I915_READ(VSYNC(cpu_transcoder));
         }
 
         /* In the code above we read the registers without checking if the power
@@ -10144,22 +10166,16 @@ intel_display_print_error_state(struct drm_i915_error_state_buf *m,
 {
         int i;
 
+        if (!error)
+                return;
+
         err_printf(m, "Num Pipes: %d\n", INTEL_INFO(dev)->num_pipes);
         if (HAS_POWER_WELL(dev))
                 err_printf(m, "PWR_WELL_CTL2: %08x\n",
                            error->power_well_driver);
         for_each_pipe(i) {
                 err_printf(m, "Pipe [%d]:\n", i);
-                err_printf(m, "  CPU transcoder: %c\n",
-                           transcoder_name(error->pipe[i].cpu_transcoder));
-                err_printf(m, "  CONF: %08x\n", error->pipe[i].conf);
                 err_printf(m, "  SRC: %08x\n", error->pipe[i].source);
-                err_printf(m, "  HTOTAL: %08x\n", error->pipe[i].htotal);
-                err_printf(m, "  HBLANK: %08x\n", error->pipe[i].hblank);
-                err_printf(m, "  HSYNC: %08x\n", error->pipe[i].hsync);
-                err_printf(m, "  VTOTAL: %08x\n", error->pipe[i].vtotal);
-                err_printf(m, "  VBLANK: %08x\n", error->pipe[i].vblank);
-                err_printf(m, "  VSYNC: %08x\n", error->pipe[i].vsync);
 
                 err_printf(m, "Plane [%d]:\n", i);
                 err_printf(m, "  CNTR: %08x\n", error->plane[i].control);
@@ -10180,5 +10196,17 @@ intel_display_print_error_state(struct drm_i915_error_state_buf *m,
                 err_printf(m, "  POS: %08x\n", error->cursor[i].position);
                 err_printf(m, "  BASE: %08x\n", error->cursor[i].base);
         }
+
+        for (i = 0; i < error->num_transcoders; i++) {
+                err_printf(m, "  CPU transcoder: %c\n",
+                           transcoder_name(error->transcoder[i].cpu_transcoder));
+                err_printf(m, "  CONF: %08x\n", error->transcoder[i].conf);
+                err_printf(m, "  HTOTAL: %08x\n", error->transcoder[i].htotal);
+                err_printf(m, "  HBLANK: %08x\n", error->transcoder[i].hblank);
+                err_printf(m, "  HSYNC: %08x\n", error->transcoder[i].hsync);
+                err_printf(m, "  VTOTAL: %08x\n", error->transcoder[i].vtotal);
+                err_printf(m, "  VBLANK: %08x\n", error->transcoder[i].vblank);
+                err_printf(m, "  VSYNC: %08x\n", error->transcoder[i].vsync);
+        }
 }
 #endif
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 664118d8c1d6..079ef0129e74 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -968,6 +968,18 @@ void intel_ring_setup_status_page(struct intel_ring_buffer *ring)
 
         I915_WRITE(mmio, (u32)ring->status_page.gfx_addr);
         POSTING_READ(mmio);
+
+        /* Flush the TLB for this page */
+        if (INTEL_INFO(dev)->gen >= 6) {
+                u32 reg = RING_INSTPM(ring->mmio_base);
+                I915_WRITE(reg,
+                           _MASKED_BIT_ENABLE(INSTPM_TLB_INVALIDATE |
+                                              INSTPM_SYNC_FLUSH));
+                if (wait_for((I915_READ(reg) & INSTPM_SYNC_FLUSH) == 0,
+                             1000))
+                        DRM_ERROR("%s: wait for SyncFlush to complete for TLB invalidation timed out\n",
+                                  ring->name);
+        }
 }
 
 static int
diff --git a/drivers/gpu/drm/nouveau/core/core/mm.c b/drivers/gpu/drm/nouveau/core/core/mm.c
index d8291724dbd4..7a4e0891c5f8 100644
--- a/drivers/gpu/drm/nouveau/core/core/mm.c
+++ b/drivers/gpu/drm/nouveau/core/core/mm.c
@@ -98,6 +98,8 @@ nouveau_mm_head(struct nouveau_mm *mm, u8 type, u32 size_max, u32 size_min,
         u32 splitoff;
         u32 s, e;
 
+        BUG_ON(!type);
+
         list_for_each_entry(this, &mm->free, fl_entry) {
                 e = this->offset + this->length;
                 s = this->offset;
@@ -162,6 +164,8 @@ nouveau_mm_tail(struct nouveau_mm *mm, u8 type, u32 size_max, u32 size_min,
         struct nouveau_mm_node *prev, *this, *next;
         u32 mask = align - 1;
 
+        BUG_ON(!type);
+
         list_for_each_entry_reverse(this, &mm->free, fl_entry) {
                 u32 e = this->offset + this->length;
                 u32 s = this->offset;
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
index d5502267c30f..9d2cd2006250 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
@@ -20,8 +20,8 @@ nouveau_mc(void *obj)
         return (void *)nv_device(obj)->subdev[NVDEV_SUBDEV_MC];
 }
 
-#define nouveau_mc_create(p,e,o,d)                                             \
-        nouveau_mc_create_((p), (e), (o), sizeof(**d), (void **)d)
+#define nouveau_mc_create(p,e,o,m,d)                                           \
+        nouveau_mc_create_((p), (e), (o), (m), sizeof(**d), (void **)d)
 #define nouveau_mc_destroy(p) ({                                               \
         struct nouveau_mc *pmc = (p); _nouveau_mc_dtor(nv_object(pmc));        \
 })
@@ -33,7 +33,8 @@ nouveau_mc(void *obj)
 })
 
 int  nouveau_mc_create_(struct nouveau_object *, struct nouveau_object *,
-                        struct nouveau_oclass *, int, void **);
+                        struct nouveau_oclass *, const struct nouveau_mc_intr *,
+                        int, void **);
 void _nouveau_mc_dtor(struct nouveau_object *);
 int  _nouveau_mc_init(struct nouveau_object *);
 int  _nouveau_mc_fini(struct nouveau_object *, bool);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv49.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv49.c
index 19e3a9a63a02..ab7ef0ac9e34 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv49.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv49.c
@@ -40,15 +40,15 @@ nv49_ram_create(struct nouveau_object *parent, struct nouveau_object *engine,
                 return ret;
 
         switch (pfb914 & 0x00000003) {
-        case 0x00000000: pfb->ram->type = NV_MEM_TYPE_DDR1; break;
-        case 0x00000001: pfb->ram->type = NV_MEM_TYPE_DDR2; break;
-        case 0x00000002: pfb->ram->type = NV_MEM_TYPE_GDDR3; break;
+        case 0x00000000: ram->type = NV_MEM_TYPE_DDR1; break;
+        case 0x00000001: ram->type = NV_MEM_TYPE_DDR2; break;
+        case 0x00000002: ram->type = NV_MEM_TYPE_GDDR3; break;
         case 0x00000003: break;
         }
 
-        pfb->ram->size  =  nv_rd32(pfb, 0x10020c) & 0xff000000;
-        pfb->ram->parts = (nv_rd32(pfb, 0x100200) & 0x00000003) + 1;
-        pfb->ram->tags  =  nv_rd32(pfb, 0x100320);
+        ram->size  =  nv_rd32(pfb, 0x10020c) & 0xff000000;
+        ram->parts = (nv_rd32(pfb, 0x100200) & 0x00000003) + 1;
+        ram->tags  =  nv_rd32(pfb, 0x100320);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv4e.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv4e.c
index 7192aa6e5577..63a6aab86028 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv4e.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv4e.c
@@ -38,8 +38,8 @@ nv4e_ram_create(struct nouveau_object *parent, struct nouveau_object *engine,
         if (ret)
                 return ret;
 
-        pfb->ram->size = nv_rd32(pfb, 0x10020c) & 0xff000000;
-        pfb->ram->type = NV_MEM_TYPE_STOLEN;
+        ram->size = nv_rd32(pfb, 0x10020c) & 0xff000000;
+        ram->type = NV_MEM_TYPE_STOLEN;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c
index bcca883018f4..cce65cc56514 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/ltcg/nvc0.c
@@ -30,8 +30,9 @@ struct nvc0_ltcg_priv {
         struct nouveau_ltcg base;
         u32 part_nr;
         u32 subp_nr;
-        struct nouveau_mm tags;
         u32 num_tags;
+        u32 tag_base;
+        struct nouveau_mm tags;
         struct nouveau_mm_node *tag_ram;
 };
 
@@ -117,10 +118,6 @@ nvc0_ltcg_init_tag_ram(struct nouveau_fb *pfb, struct nvc0_ltcg_priv *priv)
         u32 tag_size, tag_margin, tag_align;
         int ret;
 
-        nv_wr32(priv, 0x17e8d8, priv->part_nr);
-        if (nv_device(pfb)->card_type >= NV_E0)
-                nv_wr32(priv, 0x17e000, priv->part_nr);
-
         /* tags for 1/4 of VRAM should be enough (8192/4 per GiB of VRAM) */
         priv->num_tags = (pfb->ram->size >> 17) / 4;
         if (priv->num_tags > (1 << 17))
@@ -142,7 +139,7 @@ nvc0_ltcg_init_tag_ram(struct nouveau_fb *pfb, struct nvc0_ltcg_priv *priv)
         tag_size += tag_align;
         tag_size  = (tag_size + 0xfff) >> 12; /* round up */
 
-        ret = nouveau_mm_tail(&pfb->vram, 0, tag_size, tag_size, 1,
+        ret = nouveau_mm_tail(&pfb->vram, 1, tag_size, tag_size, 1,
                               &priv->tag_ram);
         if (ret) {
                 priv->num_tags = 0;
@@ -152,7 +149,7 @@ nvc0_ltcg_init_tag_ram(struct nouveau_fb *pfb, struct nvc0_ltcg_priv *priv)
                 tag_base += tag_align - 1;
                 ret = do_div(tag_base, tag_align);
 
-                nv_wr32(priv, 0x17e8d4, tag_base);
+                priv->tag_base = tag_base;
         }
         ret = nouveau_mm_init(&priv->tags, 0, priv->num_tags, 1);
 
@@ -182,8 +179,6 @@ nvc0_ltcg_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         }
         priv->subp_nr = nv_rd32(priv, 0x17e8dc) >> 28;
 
-        nv_mask(priv, 0x17e820, 0x00100000, 0x00000000); /* INTR_EN &= ~0x10 */
-
         ret = nvc0_ltcg_init_tag_ram(pfb, priv);
         if (ret)
                 return ret;
@@ -209,13 +204,32 @@ nvc0_ltcg_dtor(struct nouveau_object *object)
         nouveau_ltcg_destroy(ltcg);
 }
 
+static int
+nvc0_ltcg_init(struct nouveau_object *object)
+{
+        struct nouveau_ltcg *ltcg = (struct nouveau_ltcg *)object;
+        struct nvc0_ltcg_priv *priv = (struct nvc0_ltcg_priv *)ltcg;
+        int ret;
+
+        ret = nouveau_ltcg_init(ltcg);
+        if (ret)
+                return ret;
+
+        nv_mask(priv, 0x17e820, 0x00100000, 0x00000000); /* INTR_EN &= ~0x10 */
+        nv_wr32(priv, 0x17e8d8, priv->part_nr);
+        if (nv_device(ltcg)->card_type >= NV_E0)
+                nv_wr32(priv, 0x17e000, priv->part_nr);
+        nv_wr32(priv, 0x17e8d4, priv->tag_base);
+        return 0;
+}
+
 struct nouveau_oclass
 nvc0_ltcg_oclass = {
         .handle = NV_SUBDEV(LTCG, 0xc0),
         .ofuncs = &(struct nouveau_ofuncs) {
                 .ctor = nvc0_ltcg_ctor,
                 .dtor = nvc0_ltcg_dtor,
-                .init = _nouveau_ltcg_init,
+                .init = nvc0_ltcg_init,
                 .fini = _nouveau_ltcg_fini,
         },
 };
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
index 1c0330b8c9a4..ec9cd6f10f91 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
@@ -80,7 +80,9 @@ _nouveau_mc_dtor(struct nouveau_object *object)
 
 int
 nouveau_mc_create_(struct nouveau_object *parent, struct nouveau_object *engine,
-                   struct nouveau_oclass *oclass, int length, void **pobject)
+                   struct nouveau_oclass *oclass,
+                   const struct nouveau_mc_intr *intr_map,
+                   int length, void **pobject)
 {
         struct nouveau_device *device = nv_device(parent);
         struct nouveau_mc *pmc;
@@ -92,6 +94,8 @@ nouveau_mc_create_(struct nouveau_object *parent, struct nouveau_object *engine,
         if (ret)
                 return ret;
 
+        pmc->intr_map = intr_map;
+
         ret = request_irq(device->pdev->irq, nouveau_mc_intr,
                           IRQF_SHARED, "nouveau", pmc);
         if (ret < 0)
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
index 8c769715227b..64aa4edb0d9d 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
@@ -50,12 +50,11 @@ nv04_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         struct nv04_mc_priv *priv;
         int ret;
 
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nv04_mc_intr, &priv);
         *pobject = nv_object(priv);
         if (ret)
                 return ret;
 
-        priv->base.intr_map = nv04_mc_intr;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
index 51919371810f..d9891782bf28 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
@@ -36,12 +36,11 @@ nv44_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         struct nv44_mc_priv *priv;
         int ret;
 
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nv04_mc_intr, &priv);
         *pobject = nv_object(priv);
         if (ret)
                 return ret;
 
-        priv->base.intr_map = nv04_mc_intr;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
index f25fc5fc7dd1..2b1afe225db8 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
@@ -53,12 +53,11 @@ nv50_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         struct nv50_mc_priv *priv;
         int ret;
 
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nv50_mc_intr, &priv);
         *pobject = nv_object(priv);
         if (ret)
                 return ret;
 
-        priv->base.intr_map = nv50_mc_intr;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
index e82fd21b5041..0d57b4d3e001 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
@@ -54,12 +54,11 @@ nv98_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         struct nv98_mc_priv *priv;
         int ret;
 
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nv98_mc_intr, &priv);
         *pobject = nv_object(priv);
         if (ret)
                 return ret;
 
-        priv->base.intr_map = nv98_mc_intr;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
index c5da3babbc62..104175c5a2dd 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
@@ -57,12 +57,11 @@ nvc0_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         struct nvc0_mc_priv *priv;
         int ret;
 
-        ret = nouveau_mc_create(parent, engine, oclass, &priv);
+        ret = nouveau_mc_create(parent, engine, oclass, nvc0_mc_intr, &priv);
         *pobject = nv_object(priv);
         if (ret)
                 return ret;
 
-        priv->base.intr_map = nvc0_mc_intr;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/dispnv04/crtc.c b/drivers/gpu/drm/nouveau/dispnv04/crtc.c
index 0782bd2f1e04..6a13ffb53bdb 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/crtc.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/crtc.c
@@ -606,6 +606,24 @@ nv_crtc_mode_set_regs(struct drm_crtc *crtc, struct drm_display_mode * mode)
         regp->ramdac_a34 = 0x1;
 }
 
+static int
+nv_crtc_swap_fbs(struct drm_crtc *crtc, struct drm_framebuffer *old_fb)
+{
+        struct nv04_display *disp = nv04_display(crtc->dev);
+        struct nouveau_framebuffer *nvfb = nouveau_framebuffer(crtc->fb);
+        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+        int ret;
+
+        ret = nouveau_bo_pin(nvfb->nvbo, TTM_PL_FLAG_VRAM);
+        if (ret == 0) {
+                if (disp->image[nv_crtc->index])
+                        nouveau_bo_unpin(disp->image[nv_crtc->index]);
+                nouveau_bo_ref(nvfb->nvbo, &disp->image[nv_crtc->index]);
+        }
+
+        return ret;
+}
+
 /**
  * Sets up registers for the given mode/adjusted_mode pair.
  *
@@ -622,10 +640,15 @@ nv_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *mode,
         struct drm_device *dev = crtc->dev;
         struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
         struct nouveau_drm *drm = nouveau_drm(dev);
+        int ret;
 
         NV_DEBUG(drm, "CTRC mode on CRTC %d:\n", nv_crtc->index);
         drm_mode_debug_printmodeline(adjusted_mode);
 
+        ret = nv_crtc_swap_fbs(crtc, old_fb);
+        if (ret)
+                return ret;
+
         /* unlock must come after turning off FP_TG_CONTROL in output_prepare */
         nv_lock_vga_crtc_shadow(dev, nv_crtc->index, -1);
 
@@ -722,6 +745,7 @@ static void nv_crtc_commit(struct drm_crtc *crtc)
 
 static void nv_crtc_destroy(struct drm_crtc *crtc)
 {
+        struct nv04_display *disp = nv04_display(crtc->dev);
         struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
 
         if (!nv_crtc)
@@ -729,6 +753,10 @@ static void nv_crtc_destroy(struct drm_crtc *crtc)
 
         drm_crtc_cleanup(crtc);
 
+        if (disp->image[nv_crtc->index])
+                nouveau_bo_unpin(disp->image[nv_crtc->index]);
+        nouveau_bo_ref(NULL, &disp->image[nv_crtc->index]);
+
         nouveau_bo_unmap(nv_crtc->cursor.nvbo);
         nouveau_bo_unpin(nv_crtc->cursor.nvbo);
         nouveau_bo_ref(NULL, &nv_crtc->cursor.nvbo);
@@ -754,6 +782,16 @@ nv_crtc_gamma_load(struct drm_crtc *crtc)
 }
 
 static void
+nv_crtc_disable(struct drm_crtc *crtc)
+{
+        struct nv04_display *disp = nv04_display(crtc->dev);
+        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+        if (disp->image[nv_crtc->index])
+                nouveau_bo_unpin(disp->image[nv_crtc->index]);
+        nouveau_bo_ref(NULL, &disp->image[nv_crtc->index]);
+}
+
+static void
 nv_crtc_gamma_set(struct drm_crtc *crtc, u16 *r, u16 *g, u16 *b, uint32_t start,
                   uint32_t size)
 {
@@ -791,7 +829,6 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc,
         struct drm_framebuffer *drm_fb;
         struct nouveau_framebuffer *fb;
         int arb_burst, arb_lwm;
-        int ret;
 
         NV_DEBUG(drm, "index %d\n", nv_crtc->index);
 
@@ -801,10 +838,8 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc,
                 return 0;
         }
 
-
         /* If atomic, we want to switch to the fb we were passed, so
-         * now we update pointers to do that.  (We don't pin; just
-         * assume we're already pinned and update the base address.)
+         * now we update pointers to do that.
          */
         if (atomic) {
                 drm_fb = passed_fb;
@@ -812,17 +847,6 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc,
         } else {
                 drm_fb = crtc->fb;
                 fb = nouveau_framebuffer(crtc->fb);
-                /* If not atomic, we can go ahead and pin, and unpin the
-                 * old fb we were passed.
-                 */
-                ret = nouveau_bo_pin(fb->nvbo, TTM_PL_FLAG_VRAM);
-                if (ret)
-                        return ret;
-
-                if (passed_fb) {
-                        struct nouveau_framebuffer *ofb = nouveau_framebuffer(passed_fb);
-                        nouveau_bo_unpin(ofb->nvbo);
-                }
         }
 
         nv_crtc->fb.offset = fb->nvbo->bo.offset;
@@ -877,6 +901,9 @@ static int
 nv04_crtc_mode_set_base(struct drm_crtc *crtc, int x, int y,
                         struct drm_framebuffer *old_fb)
 {
+        int ret = nv_crtc_swap_fbs(crtc, old_fb);
+        if (ret)
+                return ret;
         return nv04_crtc_do_mode_set_base(crtc, old_fb, x, y, false);
 }
 
@@ -1027,6 +1054,7 @@ static const struct drm_crtc_helper_funcs nv04_crtc_helper_funcs = {
         .mode_set_base = nv04_crtc_mode_set_base,
         .mode_set_base_atomic = nv04_crtc_mode_set_base_atomic,
         .load_lut = nv_crtc_gamma_load,
+        .disable = nv_crtc_disable,
 };
 
 int
diff --git a/drivers/gpu/drm/nouveau/dispnv04/disp.h b/drivers/gpu/drm/nouveau/dispnv04/disp.h
index a0a031dad13f..9928187f0a7d 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/disp.h
+++ b/drivers/gpu/drm/nouveau/dispnv04/disp.h
@@ -81,6 +81,7 @@ struct nv04_display {
         uint32_t saved_vga_font[4][16384];
         uint32_t dac_users[4];
         struct nouveau_object *core;
+        struct nouveau_bo *image[2];
 };
 
 static inline struct nv04_display *
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 907d20ef6d4d..a03e75deacaf 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -577,6 +577,9 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
                 ret = nv50_display_flip_next(crtc, fb, chan, 0);
                 if (ret)
                         goto fail_unreserve;
+        } else {
+                struct nv04_display *dispnv04 = nv04_display(dev);
+                nouveau_bo_ref(new_bo, &dispnv04->image[nouveau_crtc(crtc)->index]);
         }
 
         ret = nouveau_page_flip_emit(chan, old_bo, new_bo, s, &fence);
diff --git a/drivers/gpu/drm/nouveau/nv40_pm.c b/drivers/gpu/drm/nouveau/nv40_pm.c
index 3af5bcd0b203..625f80d53dc2 100644
--- a/drivers/gpu/drm/nouveau/nv40_pm.c
+++ b/drivers/gpu/drm/nouveau/nv40_pm.c
@@ -131,7 +131,7 @@ nv40_calc_pll(struct drm_device *dev, u32 reg, struct nvbios_pll *pll,
         if (clk < pll->vco1.max_freq)
                 pll->vco2.max_freq = 0;
 
-        pclk->pll_calc(pclk, pll, clk, &coef);
+        ret = pclk->pll_calc(pclk, pll, clk, &coef);
         if (ret == 0)
                 return -ERANGE;
 
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 274b8e1b889f..9f19259667df 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -2163,7 +2163,7 @@ void cik_mm_wdoorbell(struct radeon_device *rdev, u32 offset, u32 v);
                 WREG32(reg, tmp_);                              \
         } while (0)
 #define WREG32_AND(reg, and) WREG32_P(reg, 0, and)
-#define WREG32_OR(reg, or) WREG32_P(reg, or, ~or)
+#define WREG32_OR(reg, or) WREG32_P(reg, or, ~(or))
 #define WREG32_PLL_P(reg, val, mask)                            \
         do {                                                    \
                 uint32_t tmp_ = RREG32_PLL(reg);                \
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index f1c15754e73c..b79f4f5cdd62 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -356,6 +356,14 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
                 return -EINVAL;
         }
 
+        if (bo->tbo.sync_obj) {
+                r = radeon_fence_wait(bo->tbo.sync_obj, false);
+                if (r) {
+                        DRM_ERROR("Failed waiting for UVD message (%d)!\n", r);
+                        return r;
+                }
+        }
+
         r = radeon_bo_kmap(bo, &ptr);
         if (r) {
                 DRM_ERROR("Failed mapping the UVD message (%d)!\n", r);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index bcc68ec204ad..f5e92cfcc140 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -744,10 +744,10 @@ static void rv770_init_golden_registers(struct radeon_device *rdev)
                                                  (const u32)ARRAY_SIZE(r7xx_golden_dyn_gpr_registers));
                 radeon_program_register_sequence(rdev,
                                                  rv730_golden_registers,
-                                                 (const u32)ARRAY_SIZE(rv770_golden_registers));
+                                                 (const u32)ARRAY_SIZE(rv730_golden_registers));
                 radeon_program_register_sequence(rdev,
                                                  rv730_mgcg_init,
-                                                 (const u32)ARRAY_SIZE(rv770_mgcg_init));
+                                                 (const u32)ARRAY_SIZE(rv730_mgcg_init));
                 break;
         case CHIP_RV710:
                 radeon_program_register_sequence(rdev,
@@ -758,18 +758,18 @@ static void rv770_init_golden_registers(struct radeon_device *rdev)
                                                  (const u32)ARRAY_SIZE(r7xx_golden_dyn_gpr_registers));
                 radeon_program_register_sequence(rdev,
                                                  rv710_golden_registers,
-                                                 (const u32)ARRAY_SIZE(rv770_golden_registers));
+                                                 (const u32)ARRAY_SIZE(rv710_golden_registers));
                 radeon_program_register_sequence(rdev,
                                                  rv710_mgcg_init,
-                                                 (const u32)ARRAY_SIZE(rv770_mgcg_init));
+                                                 (const u32)ARRAY_SIZE(rv710_mgcg_init));
                 break;
         case CHIP_RV740:
                 radeon_program_register_sequence(rdev,
                                                  rv740_golden_registers,
-                                                 (const u32)ARRAY_SIZE(rv770_golden_registers));
+                                                 (const u32)ARRAY_SIZE(rv740_golden_registers));
                 radeon_program_register_sequence(rdev,
                                                  rv740_mgcg_init,
-                                                 (const u32)ARRAY_SIZE(rv770_mgcg_init));
+                                                 (const u32)ARRAY_SIZE(rv740_mgcg_init));
                 break;
         default:
                 break;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
index 3751730764a5..1a0bf07fe54b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
@@ -29,7 +29,9 @@
 #include <drm/drmP.h>
 #include <drm/ttm/ttm_bo_driver.h>
 
-#define VMW_PPN_SIZE sizeof(unsigned long)
+#define VMW_PPN_SIZE (sizeof(unsigned long))
+/* A future safe maximum remap size. */
+#define VMW_PPN_PER_REMAP ((31 * 1024) / VMW_PPN_SIZE)
 
 static int vmw_gmr2_bind(struct vmw_private *dev_priv,
                          struct page *pages[],
@@ -38,43 +40,61 @@ static int vmw_gmr2_bind(struct vmw_private *dev_priv,
 {
         SVGAFifoCmdDefineGMR2 define_cmd;
         SVGAFifoCmdRemapGMR2 remap_cmd;
-        uint32_t define_size = sizeof(define_cmd) + 4;
-        uint32_t remap_size = VMW_PPN_SIZE * num_pages + sizeof(remap_cmd) + 4;
         uint32_t *cmd;
         uint32_t *cmd_orig;
+        uint32_t define_size = sizeof(define_cmd) + sizeof(*cmd);
+        uint32_t remap_num = num_pages / VMW_PPN_PER_REMAP + ((num_pages % VMW_PPN_PER_REMAP) > 0);
+        uint32_t remap_size = VMW_PPN_SIZE * num_pages + (sizeof(remap_cmd) + sizeof(*cmd)) * remap_num;
+        uint32_t remap_pos = 0;
+        uint32_t cmd_size = define_size + remap_size;
         uint32_t i;
 
-        cmd_orig = cmd = vmw_fifo_reserve(dev_priv, define_size + remap_size);
+        cmd_orig = cmd = vmw_fifo_reserve(dev_priv, cmd_size);
         if (unlikely(cmd == NULL))
                 return -ENOMEM;
 
         define_cmd.gmrId = gmr_id;
         define_cmd.numPages = num_pages;
 
+        *cmd++ = SVGA_CMD_DEFINE_GMR2;
+        memcpy(cmd, &define_cmd, sizeof(define_cmd));
+        cmd += sizeof(define_cmd) / sizeof(*cmd);
+
+        /*
+         * Need to split the command if there are too many
+         * pages that goes into the gmr.
+         */
+
         remap_cmd.gmrId = gmr_id;
         remap_cmd.flags = (VMW_PPN_SIZE > sizeof(*cmd)) ?
                 SVGA_REMAP_GMR2_PPN64 : SVGA_REMAP_GMR2_PPN32;
-        remap_cmd.offsetPages = 0;
-        remap_cmd.numPages = num_pages;
 
-        *cmd++ = SVGA_CMD_DEFINE_GMR2;
-        memcpy(cmd, &define_cmd, sizeof(define_cmd));
-        cmd += sizeof(define_cmd) / sizeof(uint32);
+        while (num_pages > 0) {
+                unsigned long nr = min(num_pages, (unsigned long)VMW_PPN_PER_REMAP);
+
+                remap_cmd.offsetPages = remap_pos;
+                remap_cmd.numPages = nr;
 
-        *cmd++ = SVGA_CMD_REMAP_GMR2;
-        memcpy(cmd, &remap_cmd, sizeof(remap_cmd));
-        cmd += sizeof(remap_cmd) / sizeof(uint32);
+                *cmd++ = SVGA_CMD_REMAP_GMR2;
+                memcpy(cmd, &remap_cmd, sizeof(remap_cmd));
+                cmd += sizeof(remap_cmd) / sizeof(*cmd);
 
-        for (i = 0; i < num_pages; ++i) {
-                if (VMW_PPN_SIZE <= 4)
-                        *cmd = page_to_pfn(*pages++);
-                else
-                        *((uint64_t *)cmd) = page_to_pfn(*pages++);
+                for (i = 0; i < nr; ++i) {
+                        if (VMW_PPN_SIZE <= 4)
+                                *cmd = page_to_pfn(*pages++);
+                        else
+                                *((uint64_t *)cmd) = page_to_pfn(*pages++);
 
-                cmd += VMW_PPN_SIZE / sizeof(*cmd);
+                        cmd += VMW_PPN_SIZE / sizeof(*cmd);
+                }
+
+                num_pages -= nr;
+                remap_pos += nr;
         }
 
-        vmw_fifo_commit(dev_priv, define_size + remap_size);
+        BUG_ON(cmd != cmd_orig + cmd_size / sizeof(*cmd));
+
+        vmw_fifo_commit(dev_priv, cmd_size);
 
         return 0;
 }
diff --git a/drivers/iio/light/adjd_s311.c b/drivers/iio/light/adjd_s311.c
index 5f4749e60b04..c1cd5698b8ae 100644
--- a/drivers/iio/light/adjd_s311.c
+++ b/drivers/iio/light/adjd_s311.c
@@ -232,7 +232,8 @@ static int adjd_s311_read_raw(struct iio_dev *indio_dev,
 
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
-                ret = adjd_s311_read_data(indio_dev, chan->address, val);
+                ret = adjd_s311_read_data(indio_dev,
+                        ADJD_S311_DATA_REG(chan->address), val);
                 if (ret < 0)
                         return ret;
                 return IIO_VAL_INT;
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index fa061d46527f..75e3b102ce45 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -167,6 +167,7 @@ static const struct xpad_device {
         { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
         { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 },
         { 0x1689, 0xfd00, "Razer Onza Tournament Edition", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+        { 0x1689, 0xfd01, "Razer Onza Classic Edition", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
         { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 },
         { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
         { 0x1bad, 0xf016, "Mad Catz Xbox 360 Controller", 0, XTYPE_XBOX360 },
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 57b2637e153a..8551dcaf24db 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -672,6 +672,7 @@ static int elantech_packet_check_v2(struct psmouse *psmouse)
  */
 static int elantech_packet_check_v3(struct psmouse *psmouse)
 {
+        struct elantech_data *etd = psmouse->private;
         const u8 debounce_packet[] = { 0xc4, 0xff, 0xff, 0x02, 0xff, 0xff };
         unsigned char *packet = psmouse->packet;
 
@@ -682,19 +683,48 @@ static int elantech_packet_check_v3(struct psmouse *psmouse)
         if (!memcmp(packet, debounce_packet, sizeof(debounce_packet)))
                 return PACKET_DEBOUNCE;
 
-        if ((packet[0] & 0x0c) == 0x04 && (packet[3] & 0xcf) == 0x02)
-                return PACKET_V3_HEAD;
+        /*
+         * If the hardware flag 'crc_enabled' is set the packets have
+         * different signatures.
+         */
+        if (etd->crc_enabled) {
+                if ((packet[3] & 0x09) == 0x08)
+                        return PACKET_V3_HEAD;
+
+                if ((packet[3] & 0x09) == 0x09)
+                        return PACKET_V3_TAIL;
+        } else {
+                if ((packet[0] & 0x0c) == 0x04 && (packet[3] & 0xcf) == 0x02)
+                        return PACKET_V3_HEAD;
 
-        if ((packet[0] & 0x0c) == 0x0c && (packet[3] & 0xce) == 0x0c)
-                return PACKET_V3_TAIL;
+                if ((packet[0] & 0x0c) == 0x0c && (packet[3] & 0xce) == 0x0c)
+                        return PACKET_V3_TAIL;
+        }
 
         return PACKET_UNKNOWN;
 }
 
 static int elantech_packet_check_v4(struct psmouse *psmouse)
 {
+        struct elantech_data *etd = psmouse->private;
         unsigned char *packet = psmouse->packet;
         unsigned char packet_type = packet[3] & 0x03;
+        bool sanity_check;
+
+        /*
+         * Sanity check based on the constant bits of a packet.
+         * The constant bits change depending on the value of
+         * the hardware flag 'crc_enabled' but are the same for
+         * every packet, regardless of the type.
+         */
+        if (etd->crc_enabled)
+                sanity_check = ((packet[3] & 0x08) == 0x00);
+        else
+                sanity_check = ((packet[0] & 0x0c) == 0x04 &&
+                                (packet[3] & 0x1c) == 0x10);
+
+        if (!sanity_check)
+                return PACKET_UNKNOWN;
 
         switch (packet_type) {
         case 0:
@@ -1313,6 +1343,12 @@ static int elantech_set_properties(struct elantech_data *etd)
                         etd->reports_pressure = true;
         }
 
+        /*
+         * The signatures of v3 and v4 packets change depending on the
+         * value of this hardware flag.
+         */
+        etd->crc_enabled = ((etd->fw_version & 0x4000) == 0x4000);
+
         return 0;
 }
 
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index 46db3be45ac9..036a04abaef7 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -129,6 +129,7 @@ struct elantech_data {
         bool paritycheck;
         bool jumpy_cursor;
         bool reports_pressure;
+        bool crc_enabled;
         unsigned char hw_version;
         unsigned int fw_version;
         unsigned int single_finger_reports;
diff --git a/drivers/input/serio/Kconfig b/drivers/input/serio/Kconfig
index 94c17c28d268..1e691a3a79cb 100644
--- a/drivers/input/serio/Kconfig
+++ b/drivers/input/serio/Kconfig
@@ -22,7 +22,8 @@ config SERIO_I8042
         tristate "i8042 PC Keyboard controller" if EXPERT || !X86
         default y
         depends on !PARISC && (!ARM || ARCH_SHARK || FOOTBRIDGE_HOST) && \
-                   (!SUPERH || SH_CAYMAN) && !M68K && !BLACKFIN && !S390
+                   (!SUPERH || SH_CAYMAN) && !M68K && !BLACKFIN && !S390 && \
+                   !ARC
         help
           i8042 is the chip over which the standard AT keyboard and PS/2
           mouse are connected to the computer. If you use these devices,
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 384fbcd0cee0..f3e91f0b57ae 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -2112,7 +2112,7 @@ static const struct wacom_features wacom_features_0xDA =
         { "Wacom Bamboo 2FG 4x5 SE", WACOM_PKGLEN_BBFUN,  14720,  9200, 1023,
           31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES,
           .touch_max = 2 };
-static struct wacom_features wacom_features_0xDB =
+static const struct wacom_features wacom_features_0xDB =
         { "Wacom Bamboo 2FG 6x8 SE", WACOM_PKGLEN_BBFUN,  21648, 13700, 1023,
           31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES,
           .touch_max = 2 };
@@ -2127,6 +2127,12 @@ static const struct wacom_features wacom_features_0xDF =
         { "Wacom Bamboo 16FG 6x8", WACOM_PKGLEN_BBPEN,    21648, 13700, 1023,
           31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES,
           .touch_max = 16 };
+static const struct wacom_features wacom_features_0x300 =
+        { "Wacom Bamboo One S",    WACOM_PKGLEN_BBPEN,    14720,  9225, 1023,
+          31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
+static const struct wacom_features wacom_features_0x301 =
+        { "Wacom Bamboo One M",    WACOM_PKGLEN_BBPEN,    21648, 13530, 1023,
+          31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
 static const struct wacom_features wacom_features_0x6004 =
         { "ISD-V4",               WACOM_PKGLEN_GRAPHIRE,  12800,  8000,  255,
           0, TABLETPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
@@ -2253,6 +2259,8 @@ const struct usb_device_id wacom_ids[] = {
         { USB_DEVICE_WACOM(0x100) },
         { USB_DEVICE_WACOM(0x101) },
         { USB_DEVICE_WACOM(0x10D) },
+        { USB_DEVICE_WACOM(0x300) },
+        { USB_DEVICE_WACOM(0x301) },
         { USB_DEVICE_WACOM(0x304) },
         { USB_DEVICE_WACOM(0x4001) },
         { USB_DEVICE_WACOM(0x47) },
diff --git a/drivers/irqchip/irq-sirfsoc.c b/drivers/irqchip/irq-sirfsoc.c
index 69ea44ebcf61..4851afae38dc 100644
--- a/drivers/irqchip/irq-sirfsoc.c
+++ b/drivers/irqchip/irq-sirfsoc.c
@@ -23,7 +23,7 @@
 #define SIRFSOC_INT_RISC_LEVEL1         0x0024
 #define SIRFSOC_INIT_IRQ_ID             0x0038
 
-#define SIRFSOC_NUM_IRQS                128
+#define SIRFSOC_NUM_IRQS                64
 
 static struct irq_domain *sirfsoc_irqdomain;
 
@@ -32,15 +32,18 @@ sirfsoc_alloc_gc(void __iomem *base, unsigned int irq_start, unsigned int num)
 {
         struct irq_chip_generic *gc;
         struct irq_chip_type *ct;
+        int ret;
+        unsigned int clr = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
 
-        gc = irq_alloc_generic_chip("SIRFINTC", 1, irq_start, base, handle_level_irq);
-        ct = gc->chip_types;
+        ret = irq_alloc_domain_generic_chips(sirfsoc_irqdomain, num, 1, "irq_sirfsoc",
+                handle_level_irq, clr, 0, IRQ_GC_INIT_MASK_CACHE);
 
+        gc = irq_get_domain_generic_chip(sirfsoc_irqdomain, irq_start);
+        gc->reg_base = base;
+        ct = gc->chip_types;
         ct->chip.irq_mask = irq_gc_mask_clr_bit;
         ct->chip.irq_unmask = irq_gc_mask_set_bit;
         ct->regs.mask = SIRFSOC_INT_RISC_MASK0;
-
-        irq_setup_generic_chip(gc, IRQ_MSK(num), IRQ_GC_INIT_MASK_CACHE, IRQ_NOREQUEST, 0);
 }
 
 static asmlinkage void __exception_irq_entry sirfsoc_handle_irq(struct pt_regs *regs)
@@ -60,9 +63,8 @@ static int __init sirfsoc_irq_init(struct device_node *np, struct device_node *p
         if (!base)
                 panic("unable to map intc cpu registers\n");
 
-        /* using legacy because irqchip_generic does not work with linear */
-        sirfsoc_irqdomain = irq_domain_add_legacy(np, SIRFSOC_NUM_IRQS, 0, 0,
-                                 &irq_domain_simple_ops, base);
+        sirfsoc_irqdomain = irq_domain_add_linear(np, SIRFSOC_NUM_IRQS,
+                &irq_generic_chip_ops, base);
 
         sirfsoc_alloc_gc(base, 0, 32);
         sirfsoc_alloc_gc(base + 4, 32, SIRFSOC_NUM_IRQS - 32);
diff --git a/drivers/isdn/mISDN/dsp_core.c b/drivers/isdn/mISDN/dsp_core.c
index 22b720ec80cb..77025f5cb57d 100644
--- a/drivers/isdn/mISDN/dsp_core.c
+++ b/drivers/isdn/mISDN/dsp_core.c
@@ -288,8 +288,10 @@ dsp_control_req(struct dsp *dsp, struct mISDNhead *hh, struct sk_buff *skb)
         u8 *data;
         int len;
 
-        if (skb->len < sizeof(int))
+        if (skb->len < sizeof(int)) {
                 printk(KERN_ERR "%s: PH_CONTROL message too short\n", __func__);
+                return -EINVAL;
+        }
         cont = *((int *)skb->data);
         len = skb->len - sizeof(int);
         data = skb->data + sizeof(int);
diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
index dc112a7137fe..4296155090b2 100644
--- a/drivers/md/dm-cache-policy-mq.c
+++ b/drivers/md/dm-cache-policy-mq.c
@@ -959,23 +959,21 @@ out:
         return r;
 }
 
-static void remove_mapping(struct mq_policy *mq, dm_oblock_t oblock)
+static void mq_remove_mapping(struct dm_cache_policy *p, dm_oblock_t oblock)
 {
-        struct entry *e = hash_lookup(mq, oblock);
+        struct mq_policy *mq = to_mq_policy(p);
+        struct entry *e;
+
+        mutex_lock(&mq->lock);
+
+        e = hash_lookup(mq, oblock);
 
         BUG_ON(!e || !e->in_cache);
 
         del(mq, e);
         e->in_cache = false;
         push(mq, e);
-}
 
-static void mq_remove_mapping(struct dm_cache_policy *p, dm_oblock_t oblock)
-{
-        struct mq_policy *mq = to_mq_policy(p);
-
-        mutex_lock(&mq->lock);
-        remove_mapping(mq, oblock);
         mutex_unlock(&mq->lock);
 }
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 07f257d44a1e..e48cb339c0c6 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3714,11 +3714,17 @@ static int bond_neigh_init(struct neighbour *n)
  * The bonding ndo_neigh_setup is called at init time beofre any
  * slave exists. So we must declare proxy setup function which will
  * be used at run time to resolve the actual slave neigh param setup.
+ *
+ * It's also called by master devices (such as vlans) to setup their
+ * underlying devices. In that case - do nothing, we're already set up from
+ * our init.
  */
 static int bond_neigh_setup(struct net_device *dev,
                             struct neigh_parms *parms)
 {
-        parms->neigh_setup   = bond_neigh_init;
+        /* modify only our neigh_parms */
+        if (parms->dev == dev)
+                parms->neigh_setup = bond_neigh_init;
 
         return 0;
 }
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
index 25723d8ee201..925ab8ec9329 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
@@ -649,7 +649,7 @@ static int pcan_usb_decode_data(struct pcan_usb_msg_context *mc, u8 status_len)
                 if ((mc->ptr + rec_len) > mc->end)
                         goto decode_failed;
 
-                memcpy(cf->data, mc->ptr, rec_len);
+                memcpy(cf->data, mc->ptr, cf->can_dlc);
                 mc->ptr += rec_len;
         }
 
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index f1b121ee5525..55d79cb53a79 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -199,7 +199,7 @@ static int arc_emac_rx(struct net_device *ndev, int budget)
         struct arc_emac_priv *priv = netdev_priv(ndev);
         unsigned int work_done;
 
-        for (work_done = 0; work_done <= budget; work_done++) {
+        for (work_done = 0; work_done < budget; work_done++) {
                 unsigned int *last_rx_bd = &priv->last_rx_bd;
                 struct net_device_stats *stats = &priv->stats;
                 struct buffer_state *rx_buff = &priv->rx_buff[*last_rx_bd];
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index d80e34b8285f..00b88cbfde25 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1333,6 +1333,8 @@ enum {
         BNX2X_SP_RTNL_VFPF_CHANNEL_DOWN,
         BNX2X_SP_RTNL_VFPF_STORM_RX_MODE,
         BNX2X_SP_RTNL_HYPERVISOR_VLAN,
+        BNX2X_SP_RTNL_TX_STOP,
+        BNX2X_SP_RTNL_TX_RESUME,
 };
 
 struct bnx2x_prev_path_list {
@@ -1502,6 +1504,7 @@ struct bnx2x {
 #define BC_SUPPORTS_DCBX_MSG_NON_PMF    (1 << 21)
 #define IS_VF_FLAG                      (1 << 22)
 #define INTERRUPTS_ENABLED_FLAG         (1 << 23)
+#define BC_SUPPORTS_RMMOD_CMD           (1 << 24)
 
 #define BP_NOMCP(bp)                    ((bp)->flags & NO_MCP_FLAG)
 
@@ -1830,6 +1833,8 @@ struct bnx2x {
 
         int fp_array_size;
         u32 dump_preset_idx;
+        bool                                    stats_started;
+        struct semaphore                        stats_sema;
 };
 
 /* Tx queues may be less or equal to Rx queues */
@@ -2451,4 +2456,6 @@ enum bnx2x_pci_bus_speed {
         BNX2X_PCI_LINK_SPEED_5000 = 5000,
         BNX2X_PCI_LINK_SPEED_8000 = 8000
 };
+
+void bnx2x_set_local_cmng(struct bnx2x *bp);
 #endif /* bnx2x.h */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index f2d1ff10054b..0cc26110868d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -53,6 +53,7 @@ static inline void bnx2x_move_fp(struct bnx2x *bp, int from, int to)
         struct bnx2x_fp_stats *to_fp_stats = &bp->fp_stats[to];
         int old_max_eth_txqs, new_max_eth_txqs;
         int old_txdata_index = 0, new_txdata_index = 0;
+        struct bnx2x_agg_info *old_tpa_info = to_fp->tpa_info;
 
         /* Copy the NAPI object as it has been already initialized */
         from_fp->napi = to_fp->napi;
@@ -61,6 +62,11 @@ static inline void bnx2x_move_fp(struct bnx2x *bp, int from, int to)
         memcpy(to_fp, from_fp, sizeof(*to_fp));
         to_fp->index = to;
 
+        /* Retain the tpa_info of the original `to' version as we don't want
+         * 2 FPs to contain the same tpa_info pointer.
+         */
+        to_fp->tpa_info = old_tpa_info;
+
         /* move sp_objs contents as well, as their indices match fp ones */
         memcpy(to_sp_objs, from_sp_objs, sizeof(*to_sp_objs));
 
@@ -2956,8 +2962,9 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link)
         if (IS_PF(bp)) {
                 if (CNIC_LOADED(bp))
                         bnx2x_free_mem_cnic(bp);
-                bnx2x_free_mem(bp);
         }
+        bnx2x_free_mem(bp);
+
         bp->state = BNX2X_STATE_CLOSED;
         bp->cnic_loaded = false;
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
index 0c94df47e0e8..fcf2761d8828 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
@@ -30,10 +30,8 @@
 #include "bnx2x_dcb.h"
 
 /* forward declarations of dcbx related functions */
-static int bnx2x_dcbx_stop_hw_tx(struct bnx2x *bp);
 static void bnx2x_pfc_set_pfc(struct bnx2x *bp);
 static void bnx2x_dcbx_update_ets_params(struct bnx2x *bp);
-static int bnx2x_dcbx_resume_hw_tx(struct bnx2x *bp);
 static void bnx2x_dcbx_get_ets_pri_pg_tbl(struct bnx2x *bp,
                                           u32 *set_configuration_ets_pg,
                                           u32 *pri_pg_tbl);
@@ -425,30 +423,52 @@ static void bnx2x_pfc_set_pfc(struct bnx2x *bp)
                 bnx2x_pfc_clear(bp);
 }
 
-static int bnx2x_dcbx_stop_hw_tx(struct bnx2x *bp)
+int bnx2x_dcbx_stop_hw_tx(struct bnx2x *bp)
 {
         struct bnx2x_func_state_params func_params = {NULL};
+        int rc;
 
         func_params.f_obj = &bp->func_obj;
         func_params.cmd = BNX2X_F_CMD_TX_STOP;
 
+        __set_bit(RAMROD_COMP_WAIT, &func_params.ramrod_flags);
+        __set_bit(RAMROD_RETRY, &func_params.ramrod_flags);
+
         DP(BNX2X_MSG_DCB, "STOP TRAFFIC\n");
-        return bnx2x_func_state_change(bp, &func_params);
+
+        rc = bnx2x_func_state_change(bp, &func_params);
+        if (rc) {
+                BNX2X_ERR("Unable to hold traffic for HW configuration\n");
+                bnx2x_panic();
+        }
+
+        return rc;
 }
 
-static int bnx2x_dcbx_resume_hw_tx(struct bnx2x *bp)
+int bnx2x_dcbx_resume_hw_tx(struct bnx2x *bp)
 {
         struct bnx2x_func_state_params func_params = {NULL};
         struct bnx2x_func_tx_start_params *tx_params =
                 &func_params.params.tx_start;
+        int rc;
 
         func_params.f_obj = &bp->func_obj;
         func_params.cmd = BNX2X_F_CMD_TX_START;
 
+        __set_bit(RAMROD_COMP_WAIT, &func_params.ramrod_flags);
+        __set_bit(RAMROD_RETRY, &func_params.ramrod_flags);
+
         bnx2x_dcbx_fw_struct(bp, tx_params);
 
         DP(BNX2X_MSG_DCB, "START TRAFFIC\n");
-        return bnx2x_func_state_change(bp, &func_params);
+
+        rc = bnx2x_func_state_change(bp, &func_params);
+        if (rc) {
+                BNX2X_ERR("Unable to resume traffic after HW configuration\n");
+                bnx2x_panic();
+        }
+
+        return rc;
 }
 
 static void bnx2x_dcbx_2cos_limit_update_ets_config(struct bnx2x *bp)
@@ -744,7 +764,9 @@ void bnx2x_dcbx_set_params(struct bnx2x *bp, u32 state)
                         if (IS_MF(bp))
                                 bnx2x_link_sync_notify(bp);
 
-                        bnx2x_dcbx_stop_hw_tx(bp);
+                        set_bit(BNX2X_SP_RTNL_TX_STOP, &bp->sp_rtnl_state);
+
+                        schedule_delayed_work(&bp->sp_rtnl_task, 0);
 
                         return;
                 }
@@ -753,7 +775,13 @@ void bnx2x_dcbx_set_params(struct bnx2x *bp, u32 state)
                 bnx2x_pfc_set_pfc(bp);
 
                 bnx2x_dcbx_update_ets_params(bp);
-                bnx2x_dcbx_resume_hw_tx(bp);
+
+                /* ets may affect cmng configuration: reinit it in hw */
+                bnx2x_set_local_cmng(bp);
+
+                set_bit(BNX2X_SP_RTNL_TX_RESUME, &bp->sp_rtnl_state);
+
+                schedule_delayed_work(&bp->sp_rtnl_task, 0);
 
                 return;
         case BNX2X_DCBX_STATE_TX_RELEASED:
@@ -2363,21 +2391,24 @@ static u8 bnx2x_dcbnl_get_featcfg(struct net_device *netdev, int featid,
                 case DCB_FEATCFG_ATTR_PG:
                         if (bp->dcbx_local_feat.ets.enabled)
                                 *flags |= DCB_FEATCFG_ENABLE;
-                        if (bp->dcbx_error & DCBX_LOCAL_ETS_ERROR)
+                        if (bp->dcbx_error & (DCBX_LOCAL_ETS_ERROR |
+                                              DCBX_REMOTE_MIB_ERROR))
                                 *flags |= DCB_FEATCFG_ERROR;
                         break;
                 case DCB_FEATCFG_ATTR_PFC:
                         if (bp->dcbx_local_feat.pfc.enabled)
                                 *flags |= DCB_FEATCFG_ENABLE;
                         if (bp->dcbx_error & (DCBX_LOCAL_PFC_ERROR |
-                            DCBX_LOCAL_PFC_MISMATCH))
+                                              DCBX_LOCAL_PFC_MISMATCH |
+                                              DCBX_REMOTE_MIB_ERROR))
                                 *flags |= DCB_FEATCFG_ERROR;
                         break;
                 case DCB_FEATCFG_ATTR_APP:
                         if (bp->dcbx_local_feat.app.enabled)
                                 *flags |= DCB_FEATCFG_ENABLE;
                         if (bp->dcbx_error & (DCBX_LOCAL_APP_ERROR |
-                            DCBX_LOCAL_APP_MISMATCH))
+                                              DCBX_LOCAL_APP_MISMATCH |
+                                              DCBX_REMOTE_MIB_ERROR))
                                 *flags |= DCB_FEATCFG_ERROR;
                         break;
                 default:
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.h
index 125bd1b6586f..804b8f64463e 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.h
@@ -199,4 +199,7 @@ extern const struct dcbnl_rtnl_ops bnx2x_dcbnl_ops;
 int bnx2x_dcbnl_update_applist(struct bnx2x *bp, bool delall);
 #endif /* BCM_DCBNL */
 
+int bnx2x_dcbx_stop_hw_tx(struct bnx2x *bp);
+int bnx2x_dcbx_resume_hw_tx(struct bnx2x *bp);
+
 #endif /* BNX2X_DCB_H */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
index 5018e52ae2ad..32767f6aa33f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_hsi.h
@@ -1300,6 +1300,9 @@ struct drv_func_mb {
 
         #define DRV_MSG_CODE_EEE_RESULTS_ACK            0xda000000
 
+        #define DRV_MSG_CODE_RMMOD                      0xdb000000
+        #define REQ_BC_VER_4_RMMOD_CMD                  0x0007080f
+
         #define DRV_MSG_CODE_SET_MF_BW                  0xe0000000
         #define REQ_BC_VER_4_SET_MF_BW                  0x00060202
         #define DRV_MSG_CODE_SET_MF_BW_ACK              0xe1000000
@@ -1372,6 +1375,8 @@ struct drv_func_mb {
 
         #define FW_MSG_CODE_EEE_RESULS_ACK              0xda100000
 
+        #define FW_MSG_CODE_RMMOD_ACK                   0xdb100000
+
         #define FW_MSG_CODE_SET_MF_BW_SENT              0xe0000000
         #define FW_MSG_CODE_SET_MF_BW_DONE              0xe1000000
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index e06186c305d8..1627a4e09c32 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -2261,6 +2261,23 @@ static void bnx2x_set_requested_fc(struct bnx2x *bp)
                 bp->link_params.req_fc_auto_adv = BNX2X_FLOW_CTRL_BOTH;
 }
 
+static void bnx2x_init_dropless_fc(struct bnx2x *bp)
+{
+        u32 pause_enabled = 0;
+
+        if (!CHIP_IS_E1(bp) && bp->dropless_fc && bp->link_vars.link_up) {
+                if (bp->link_vars.flow_ctrl & BNX2X_FLOW_CTRL_TX)
+                        pause_enabled = 1;
+
+                REG_WR(bp, BAR_USTRORM_INTMEM +
+                           USTORM_ETH_PAUSE_ENABLED_OFFSET(BP_PORT(bp)),
+                       pause_enabled);
+        }
+
+        DP(NETIF_MSG_IFUP | NETIF_MSG_LINK, "dropless_fc is %s\n",
+           pause_enabled ? "enabled" : "disabled");
+}
+
 int bnx2x_initial_phy_init(struct bnx2x *bp, int load_mode)
 {
         int rc, cfx_idx = bnx2x_get_link_cfg_idx(bp);
@@ -2294,6 +2311,8 @@ int bnx2x_initial_phy_init(struct bnx2x *bp, int load_mode)
 
                 bnx2x_release_phy_lock(bp);
 
+                bnx2x_init_dropless_fc(bp);
+
                 bnx2x_calc_fc_adv(bp);
 
                 if (bp->link_vars.link_up) {
@@ -2315,6 +2334,8 @@ void bnx2x_link_set(struct bnx2x *bp)
                 bnx2x_phy_init(&bp->link_params, &bp->link_vars);
                 bnx2x_release_phy_lock(bp);
 
+                bnx2x_init_dropless_fc(bp);
+
                 bnx2x_calc_fc_adv(bp);
         } else
                 BNX2X_ERR("Bootcode is missing - can not set link\n");
@@ -2476,7 +2497,7 @@ static void bnx2x_cmng_fns_init(struct bnx2x *bp, u8 read_cfg, u8 cmng_type)
 
         input.port_rate = bp->link_vars.line_speed;
 
-        if (cmng_type == CMNG_FNS_MINMAX) {
+        if (cmng_type == CMNG_FNS_MINMAX && input.port_rate) {
                 int vn;
 
                 /* read mf conf from shmem */
@@ -2533,6 +2554,21 @@ static void storm_memset_cmng(struct bnx2x *bp,
         }
 }
 
+/* init cmng mode in HW according to local configuration */
+void bnx2x_set_local_cmng(struct bnx2x *bp)
+{
+        int cmng_fns = bnx2x_get_cmng_fns_mode(bp);
+
+        if (cmng_fns != CMNG_FNS_NONE) {
+                bnx2x_cmng_fns_init(bp, false, cmng_fns);
+                storm_memset_cmng(bp, &bp->cmng, BP_PORT(bp));
+        } else {
+                /* rate shaping and fairness are disabled */
+                DP(NETIF_MSG_IFUP,
+                   "single function mode without fairness\n");
+        }
+}
+
 /* This function is called upon link interrupt */
 static void bnx2x_link_attn(struct bnx2x *bp)
 {
@@ -2541,20 +2577,9 @@ static void bnx2x_link_attn(struct bnx2x *bp)
 
         bnx2x_link_update(&bp->link_params, &bp->link_vars);
 
-        if (bp->link_vars.link_up) {
-
-                /* dropless flow control */
-                if (!CHIP_IS_E1(bp) && bp->dropless_fc) {
-                        int port = BP_PORT(bp);
-                        u32 pause_enabled = 0;
+        bnx2x_init_dropless_fc(bp);
 
-                        if (bp->link_vars.flow_ctrl & BNX2X_FLOW_CTRL_TX)
-                                pause_enabled = 1;
-
-                        REG_WR(bp, BAR_USTRORM_INTMEM +
-                               USTORM_ETH_PAUSE_ENABLED_OFFSET(port),
-                               pause_enabled);
-                }
+        if (bp->link_vars.link_up) {
 
                 if (bp->link_vars.mac_type != MAC_TYPE_EMAC) {
                         struct host_port_stats *pstats;
@@ -2568,17 +2593,8 @@ static void bnx2x_link_attn(struct bnx2x *bp)
                         bnx2x_stats_handle(bp, STATS_EVENT_LINK_UP);
         }
 
-        if (bp->link_vars.link_up && bp->link_vars.line_speed) {
-                int cmng_fns = bnx2x_get_cmng_fns_mode(bp);
-
-                if (cmng_fns != CMNG_FNS_NONE) {
-                        bnx2x_cmng_fns_init(bp, false, cmng_fns);
-                        storm_memset_cmng(bp, &bp->cmng, BP_PORT(bp));
-                } else
-                        /* rate shaping and fairness are disabled */
-                        DP(NETIF_MSG_IFUP,
-                           "single function mode without fairness\n");
-        }
+        if (bp->link_vars.link_up && bp->link_vars.line_speed)
+                bnx2x_set_local_cmng(bp);
 
         __bnx2x_link_report(bp);
 
@@ -7839,12 +7855,15 @@ void bnx2x_free_mem(struct bnx2x *bp)
 {
         int i;
 
-        BNX2X_PCI_FREE(bp->def_status_blk, bp->def_status_blk_mapping,
-                       sizeof(struct host_sp_status_block));
-
         BNX2X_PCI_FREE(bp->fw_stats, bp->fw_stats_mapping,
                        bp->fw_stats_data_sz + bp->fw_stats_req_sz);
 
+        if (IS_VF(bp))
+                return;
+
+        BNX2X_PCI_FREE(bp->def_status_blk, bp->def_status_blk_mapping,
+                       sizeof(struct host_sp_status_block));
+
         BNX2X_PCI_FREE(bp->slowpath, bp->slowpath_mapping,
                        sizeof(struct bnx2x_slowpath));
 
@@ -9639,6 +9658,12 @@ sp_rtnl_not_reset:
                                &bp->sp_rtnl_state))
                 bnx2x_pf_set_vfs_vlan(bp);
 
+        if (test_and_clear_bit(BNX2X_SP_RTNL_TX_STOP, &bp->sp_rtnl_state))
+                bnx2x_dcbx_stop_hw_tx(bp);
+
+        if (test_and_clear_bit(BNX2X_SP_RTNL_TX_RESUME, &bp->sp_rtnl_state))
+                bnx2x_dcbx_resume_hw_tx(bp);
+
         /* work which needs rtnl lock not-taken (as it takes the lock itself and
          * can be called from other contexts as well)
          */
@@ -10362,6 +10387,10 @@ static void bnx2x_get_common_hwinfo(struct bnx2x *bp)
 
         bp->flags |= (val >= REQ_BC_VER_4_DCBX_ADMIN_MSG_NON_PMF) ?
                         BC_SUPPORTS_DCBX_MSG_NON_PMF : 0;
+
+        bp->flags |= (val >= REQ_BC_VER_4_RMMOD_CMD) ?
+                        BC_SUPPORTS_RMMOD_CMD : 0;
+
         boot_mode = SHMEM_RD(bp,
                         dev_info.port_feature_config[BP_PORT(bp)].mba_config) &
                         PORT_FEATURE_MBA_BOOT_AGENT_TYPE_MASK;
@@ -11137,6 +11166,9 @@ static bool bnx2x_get_dropless_info(struct bnx2x *bp)
         int tmp;
         u32 cfg;
 
+        if (IS_VF(bp))
+                return 0;
+
         if (IS_MF(bp) && !CHIP_IS_E1x(bp)) {
                 /* Take function: tmp = func */
                 tmp = BP_ABS_FUNC(bp);
@@ -11524,6 +11556,7 @@ static int bnx2x_init_bp(struct bnx2x *bp)
         mutex_init(&bp->port.phy_mutex);
         mutex_init(&bp->fw_mb_mutex);
         spin_lock_init(&bp->stats_lock);
+        sema_init(&bp->stats_sema, 1);
 
         INIT_DELAYED_WORK(&bp->sp_task, bnx2x_sp_task);
         INIT_DELAYED_WORK(&bp->sp_rtnl_task, bnx2x_sp_rtnl_task);
@@ -12817,13 +12850,17 @@ static void __bnx2x_remove(struct pci_dev *pdev,
         bnx2x_dcbnl_update_applist(bp, true);
 #endif
 
+        if (IS_PF(bp) &&
+            !BP_NOMCP(bp) &&
+            (bp->flags & BC_SUPPORTS_RMMOD_CMD))
+                bnx2x_fw_command(bp, DRV_MSG_CODE_RMMOD, 0);
+
         /* Close the interface - either directly or implicitly */
         if (remove_netdev) {
                 unregister_netdev(dev);
         } else {
                 rtnl_lock();
-                if (netif_running(dev))
-                        bnx2x_close(dev);
+                dev_close(dev);
                 rtnl_unlock();
         }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 95861efb5051..e8706e19f96f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -522,23 +522,6 @@ static int bnx2x_vfop_set_user_req(struct bnx2x *bp,
         return 0;
 }
 
-static int
-bnx2x_vfop_config_vlan0(struct bnx2x *bp,
-                        struct bnx2x_vlan_mac_ramrod_params *vlan_mac,
-                        bool add)
-{
-        int rc;
-
-        vlan_mac->user_req.cmd = add ? BNX2X_VLAN_MAC_ADD :
-                BNX2X_VLAN_MAC_DEL;
-        vlan_mac->user_req.u.vlan.vlan = 0;
-
-        rc = bnx2x_config_vlan_mac(bp, vlan_mac);
-        if (rc == -EEXIST)
-                rc = 0;
-        return rc;
-}
-
 static int bnx2x_vfop_config_list(struct bnx2x *bp,
                                   struct bnx2x_vfop_filters *filters,
                                   struct bnx2x_vlan_mac_ramrod_params *vlan_mac)
@@ -643,30 +626,14 @@ static void bnx2x_vfop_vlan_mac(struct bnx2x *bp, struct bnx2x_virtf *vf)
 
         case BNX2X_VFOP_VLAN_CONFIG_LIST:
                 /* next state */
-                vfop->state = BNX2X_VFOP_VLAN_CONFIG_LIST_0;
-
-                /* remove vlan0 - could be no-op */
-                vfop->rc = bnx2x_vfop_config_vlan0(bp, vlan_mac, false);
-                if (vfop->rc)
-                        goto op_err;
+                vfop->state = BNX2X_VFOP_VLAN_MAC_CHK_DONE;
 
-                /* Do vlan list config. if this operation fails we try to
-                 * restore vlan0 to keep the queue is working order
-                 */
+                /* do list config */
                 vfop->rc = bnx2x_vfop_config_list(bp, filters, vlan_mac);
                 if (!vfop->rc) {
                         set_bit(RAMROD_CONT, &vlan_mac->ramrod_flags);
                         vfop->rc = bnx2x_config_vlan_mac(bp, vlan_mac);
                 }
-                bnx2x_vfop_finalize(vf, vfop->rc, VFOP_CONT); /* fall-through */
-
-        case BNX2X_VFOP_VLAN_CONFIG_LIST_0:
-                /* next state */
-                vfop->state = BNX2X_VFOP_VLAN_MAC_CHK_DONE;
-
-                if (list_empty(&obj->head))
-                        /* add vlan0 */
-                        vfop->rc = bnx2x_vfop_config_vlan0(bp, vlan_mac, true);
                 bnx2x_vfop_finalize(vf, vfop->rc, VFOP_DONE);
 
         default:
@@ -1747,11 +1714,8 @@ void bnx2x_iov_init_dq(struct bnx2x *bp)
 
 void bnx2x_iov_init_dmae(struct bnx2x *bp)
 {
-        DP(BNX2X_MSG_IOV, "SRIOV is %s\n", IS_SRIOV(bp) ? "ON" : "OFF");
-        if (!IS_SRIOV(bp))
-                return;
-
-        REG_WR(bp, DMAE_REG_BACKWARD_COMP_EN, 0);
+        if (pci_find_ext_capability(bp->pdev, PCI_EXT_CAP_ID_SRIOV))
+                REG_WR(bp, DMAE_REG_BACKWARD_COMP_EN, 0);
 }
 
 static int bnx2x_vf_bus(struct bnx2x *bp, int vfid)
@@ -2822,6 +2786,18 @@ int bnx2x_vf_init(struct bnx2x *bp, struct bnx2x_virtf *vf, dma_addr_t *sb_map)
         return 0;
 }
 
+struct set_vf_state_cookie {
+        struct bnx2x_virtf *vf;
+        u8 state;
+};
+
+void bnx2x_set_vf_state(void *cookie)
+{
+        struct set_vf_state_cookie *p = (struct set_vf_state_cookie *)cookie;
+
+        p->vf->state = p->state;
+}
+
 /* VFOP close (teardown the queues, delete mcasts and close HW) */
 static void bnx2x_vfop_close(struct bnx2x *bp, struct bnx2x_virtf *vf)
 {
@@ -2872,7 +2848,19 @@ static void bnx2x_vfop_close(struct bnx2x *bp, struct bnx2x_virtf *vf)
 op_err:
         BNX2X_ERR("VF[%d] CLOSE error: rc %d\n", vf->abs_vfid, vfop->rc);
 op_done:
-        vf->state = VF_ACQUIRED;
+
+        /* need to make sure there are no outstanding stats ramrods which may
+         * cause the device to access the VF's stats buffer which it will free
+         * as soon as we return from the close flow.
+         */
+        {
+                struct set_vf_state_cookie cookie;
+
+                cookie.vf = vf;
+                cookie.state = VF_ACQUIRED;
+                bnx2x_stats_safe_exec(bp, bnx2x_set_vf_state, &cookie);
+        }
+
         DP(BNX2X_MSG_IOV, "set state to acquired\n");
         bnx2x_vfop_end(bp, vf, vfop);
 }
@@ -3084,8 +3072,9 @@ void bnx2x_disable_sriov(struct bnx2x *bp)
         pci_disable_sriov(bp->pdev);
 }
 
-static int bnx2x_vf_ndo_sanity(struct bnx2x *bp, int vfidx,
-                               struct bnx2x_virtf *vf)
+static int bnx2x_vf_ndo_prep(struct bnx2x *bp, int vfidx,
+                             struct bnx2x_virtf **vf,
+                             struct pf_vf_bulletin_content **bulletin)
 {
         if (bp->state != BNX2X_STATE_OPEN) {
                 BNX2X_ERR("vf ndo called though PF is down\n");
@@ -3103,12 +3092,22 @@ static int bnx2x_vf_ndo_sanity(struct bnx2x *bp, int vfidx,
                 return -EINVAL;
         }
 
-        if (!vf) {
+        /* init members */
+        *vf = BP_VF(bp, vfidx);
+        *bulletin = BP_VF_BULLETIN(bp, vfidx);
+
+        if (!*vf) {
                 BNX2X_ERR("vf ndo called but vf was null. vfidx was %d\n",
                           vfidx);
                 return -EINVAL;
         }
 
+        if (!*bulletin) {
+                BNX2X_ERR("vf ndo called but Bulletin Board struct is null. vfidx was %d\n",
+                          vfidx);
+                return -EINVAL;
+        }
+
         return 0;
 }
 
@@ -3116,17 +3115,19 @@ int bnx2x_get_vf_config(struct net_device *dev, int vfidx,
                         struct ifla_vf_info *ivi)
 {
         struct bnx2x *bp = netdev_priv(dev);
-        struct bnx2x_virtf *vf = BP_VF(bp, vfidx);
-        struct bnx2x_vlan_mac_obj *mac_obj = &bnx2x_vfq(vf, 0, mac_obj);
-        struct bnx2x_vlan_mac_obj *vlan_obj = &bnx2x_vfq(vf, 0, vlan_obj);
-        struct pf_vf_bulletin_content *bulletin = BP_VF_BULLETIN(bp, vfidx);
+        struct bnx2x_virtf *vf = NULL;
+        struct pf_vf_bulletin_content *bulletin = NULL;
+        struct bnx2x_vlan_mac_obj *mac_obj;
+        struct bnx2x_vlan_mac_obj *vlan_obj;
         int rc;
 
-        /* sanity */
-        rc = bnx2x_vf_ndo_sanity(bp, vfidx, vf);
+        /* sanity and init */
+        rc = bnx2x_vf_ndo_prep(bp, vfidx, &vf, &bulletin);
         if (rc)
                 return rc;
-        if (!mac_obj || !vlan_obj || !bulletin) {
+        mac_obj = &bnx2x_vfq(vf, 0, mac_obj);
+        vlan_obj = &bnx2x_vfq(vf, 0, vlan_obj);
+        if (!mac_obj || !vlan_obj) {
                 BNX2X_ERR("VF partially initialized\n");
                 return -EINVAL;
         }
@@ -3183,11 +3184,11 @@ int bnx2x_set_vf_mac(struct net_device *dev, int vfidx, u8 *mac)
 {
         struct bnx2x *bp = netdev_priv(dev);
         int rc, q_logical_state;
-        struct bnx2x_virtf *vf = BP_VF(bp, vfidx);
-        struct pf_vf_bulletin_content *bulletin = BP_VF_BULLETIN(bp, vfidx);
+        struct bnx2x_virtf *vf = NULL;
+        struct pf_vf_bulletin_content *bulletin = NULL;
 
-        /* sanity */
-        rc = bnx2x_vf_ndo_sanity(bp, vfidx, vf);
+        /* sanity and init */
+        rc = bnx2x_vf_ndo_prep(bp, vfidx, &vf, &bulletin);
         if (rc)
                 return rc;
         if (!is_valid_ether_addr(mac)) {
@@ -3249,11 +3250,11 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
 {
         struct bnx2x *bp = netdev_priv(dev);
         int rc, q_logical_state;
-        struct bnx2x_virtf *vf = BP_VF(bp, vfidx);
-        struct pf_vf_bulletin_content *bulletin = BP_VF_BULLETIN(bp, vfidx);
+        struct bnx2x_virtf *vf = NULL;
+        struct pf_vf_bulletin_content *bulletin = NULL;
 
-        /* sanity */
-        rc = bnx2x_vf_ndo_sanity(bp, vfidx, vf);
+        /* sanity and init */
+        rc = bnx2x_vf_ndo_prep(bp, vfidx, &vf, &bulletin);
         if (rc)
                 return rc;
 
@@ -3463,7 +3464,7 @@ int bnx2x_vf_pci_alloc(struct bnx2x *bp)
 alloc_mem_err:
         BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->vf2pf_mbox_mapping,
                        sizeof(struct bnx2x_vf_mbx_msg));
-        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->vf2pf_mbox_mapping,
+        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->pf2vf_bulletin_mapping,
                        sizeof(union pf_vf_bulletin));
         return -ENOMEM;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index 98366abd02bd..86436c77af03 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -221,7 +221,8 @@ static int bnx2x_stats_comp(struct bnx2x *bp)
  * Statistics service functions
  */
 
-static void bnx2x_stats_pmf_update(struct bnx2x *bp)
+/* should be called under stats_sema */
+static void __bnx2x_stats_pmf_update(struct bnx2x *bp)
 {
         struct dmae_command *dmae;
         u32 opcode;
@@ -518,29 +519,47 @@ static void bnx2x_func_stats_init(struct bnx2x *bp)
         *stats_comp = 0;
 }
 
-static void bnx2x_stats_start(struct bnx2x *bp)
+/* should be called under stats_sema */
+static void __bnx2x_stats_start(struct bnx2x *bp)
 {
-        /* vfs travel through here as part of the statistics FSM, but no action
-         * is required
-         */
-        if (IS_VF(bp))
-                return;
+        if (IS_PF(bp)) {
+                if (bp->port.pmf)
+                        bnx2x_port_stats_init(bp);
 
-        if (bp->port.pmf)
-                bnx2x_port_stats_init(bp);
+                else if (bp->func_stx)
+                        bnx2x_func_stats_init(bp);
 
-        else if (bp->func_stx)
-                bnx2x_func_stats_init(bp);
+                bnx2x_hw_stats_post(bp);
+                bnx2x_storm_stats_post(bp);
+        }
 
-        bnx2x_hw_stats_post(bp);
-        bnx2x_storm_stats_post(bp);
+        bp->stats_started = true;
+}
+
+static void bnx2x_stats_start(struct bnx2x *bp)
+{
+        if (down_timeout(&bp->stats_sema, HZ/10))
+                BNX2X_ERR("Unable to acquire stats lock\n");
+        __bnx2x_stats_start(bp);
+        up(&bp->stats_sema);
 }
 
 static void bnx2x_stats_pmf_start(struct bnx2x *bp)
 {
+        if (down_timeout(&bp->stats_sema, HZ/10))
+                BNX2X_ERR("Unable to acquire stats lock\n");
         bnx2x_stats_comp(bp);
-        bnx2x_stats_pmf_update(bp);
-        bnx2x_stats_start(bp);
+        __bnx2x_stats_pmf_update(bp);
+        __bnx2x_stats_start(bp);
+        up(&bp->stats_sema);
+}
+
+static void bnx2x_stats_pmf_update(struct bnx2x *bp)
+{
+        if (down_timeout(&bp->stats_sema, HZ/10))
+                BNX2X_ERR("Unable to acquire stats lock\n");
+        __bnx2x_stats_pmf_update(bp);
+        up(&bp->stats_sema);
 }
 
 static void bnx2x_stats_restart(struct bnx2x *bp)
@@ -550,8 +569,11 @@ static void bnx2x_stats_restart(struct bnx2x *bp)
          */
         if (IS_VF(bp))
                 return;
+        if (down_timeout(&bp->stats_sema, HZ/10))
+                BNX2X_ERR("Unable to acquire stats lock\n");
         bnx2x_stats_comp(bp);
-        bnx2x_stats_start(bp);
+        __bnx2x_stats_start(bp);
+        up(&bp->stats_sema);
 }
 
 static void bnx2x_bmac_stats_update(struct bnx2x *bp)
@@ -888,9 +910,7 @@ static int bnx2x_storm_stats_validate_counters(struct bnx2x *bp)
         /* Make sure we use the value of the counter
          * used for sending the last stats ramrod.
          */
-        spin_lock_bh(&bp->stats_lock);
         cur_stats_counter = bp->stats_counter - 1;
-        spin_unlock_bh(&bp->stats_lock);
 
         /* are storm stats valid? */
         if (le16_to_cpu(counters->xstats_counter) != cur_stats_counter) {
@@ -1227,12 +1247,18 @@ static void bnx2x_stats_update(struct bnx2x *bp)
 {
         u32 *stats_comp = bnx2x_sp(bp, stats_comp);
 
-        if (bnx2x_edebug_stats_stopped(bp))
+        /* we run update from timer context, so give up
+         * if somebody is in the middle of transition
+         */
+        if (down_trylock(&bp->stats_sema))
                 return;
 
+        if (bnx2x_edebug_stats_stopped(bp) || !bp->stats_started)
+                goto out;
+
         if (IS_PF(bp)) {
                 if (*stats_comp != DMAE_COMP_VAL)
-                        return;
+                        goto out;
 
                 if (bp->port.pmf)
                         bnx2x_hw_stats_update(bp);
@@ -1242,7 +1268,7 @@ static void bnx2x_stats_update(struct bnx2x *bp)
                                 BNX2X_ERR("storm stats were not updated for 3 times\n");
                                 bnx2x_panic();
                         }
-                        return;
+                        goto out;
                 }
         } else {
                 /* vf doesn't collect HW statistics, and doesn't get completions
@@ -1256,7 +1282,7 @@ static void bnx2x_stats_update(struct bnx2x *bp)
 
         /* vf is done */
         if (IS_VF(bp))
-                return;
+                goto out;
 
         if (netif_msg_timer(bp)) {
                 struct bnx2x_eth_stats *estats = &bp->eth_stats;
@@ -1267,6 +1293,9 @@ static void bnx2x_stats_update(struct bnx2x *bp)
 
         bnx2x_hw_stats_post(bp);
         bnx2x_storm_stats_post(bp);
+
+out:
+        up(&bp->stats_sema);
 }
 
 static void bnx2x_port_stats_stop(struct bnx2x *bp)
@@ -1332,6 +1361,11 @@ static void bnx2x_stats_stop(struct bnx2x *bp)
 {
         int update = 0;
 
+        if (down_timeout(&bp->stats_sema, HZ/10))
+                BNX2X_ERR("Unable to acquire stats lock\n");
+
+        bp->stats_started = false;
+
         bnx2x_stats_comp(bp);
 
         if (bp->port.pmf)
@@ -1348,6 +1382,8 @@ static void bnx2x_stats_stop(struct bnx2x *bp)
                 bnx2x_hw_stats_post(bp);
                 bnx2x_stats_comp(bp);
         }
+
+        up(&bp->stats_sema);
 }
 
 static void bnx2x_stats_do_nothing(struct bnx2x *bp)
@@ -1376,15 +1412,17 @@ static const struct {
 void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event)
 {
         enum bnx2x_stats_state state;
+        void (*action)(struct bnx2x *bp);
         if (unlikely(bp->panic))
                 return;
 
         spin_lock_bh(&bp->stats_lock);
         state = bp->stats_state;
         bp->stats_state = bnx2x_stats_stm[state][event].next_state;
+        action = bnx2x_stats_stm[state][event].action;
         spin_unlock_bh(&bp->stats_lock);
 
-        bnx2x_stats_stm[state][event].action(bp);
+        action(bp);
 
         if ((event != STATS_EVENT_UPDATE) || netif_msg_timer(bp))
                 DP(BNX2X_MSG_STATS, "state %d -> event %d -> state %d\n",
@@ -1955,3 +1993,14 @@ void bnx2x_afex_collect_stats(struct bnx2x *bp, void *void_afex_stats,
                        estats->mac_discard);
         }
 }
+
+void bnx2x_stats_safe_exec(struct bnx2x *bp,
+                           void (func_to_exec)(void *cookie),
+                           void *cookie){
+        if (down_timeout(&bp->stats_sema, HZ/10))
+                BNX2X_ERR("Unable to acquire stats lock\n");
+        bnx2x_stats_comp(bp);
+        func_to_exec(cookie);
+        __bnx2x_stats_start(bp);
+        up(&bp->stats_sema);
+}
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
index 853824d258e8..f35845006cdd 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
@@ -539,6 +539,9 @@ struct bnx2x;
 void bnx2x_memset_stats(struct bnx2x *bp);
 void bnx2x_stats_init(struct bnx2x *bp);
 void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event);
+void bnx2x_stats_safe_exec(struct bnx2x *bp,
+                           void (func_to_exec)(void *cookie),
+                           void *cookie);
 
 /**
  * bnx2x_save_statistics - save statistics when unloading.
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index ddebc7a5dda0..0da2214ef1b9 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -17796,8 +17796,10 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
 
 done:
         if (state == pci_channel_io_perm_failure) {
-                tg3_napi_enable(tp);
-                dev_close(netdev);
+                if (netdev) {
+                        tg3_napi_enable(tp);
+                        dev_close(netdev);
+                }
                 err = PCI_ERS_RESULT_DISCONNECT;
         } else {
                 pci_disable_device(pdev);
@@ -17827,7 +17829,8 @@ static pci_ers_result_t tg3_io_slot_reset(struct pci_dev *pdev)
         rtnl_lock();
 
         if (pci_enable_device(pdev)) {
-                netdev_err(netdev, "Cannot re-enable PCI device after reset.\n");
+                dev_err(&pdev->dev,
+                        "Cannot re-enable PCI device after reset.\n");
                 goto done;
         }
 
@@ -17835,7 +17838,7 @@ static pci_ers_result_t tg3_io_slot_reset(struct pci_dev *pdev)
         pci_restore_state(pdev);
         pci_save_state(pdev);
 
-        if (!netif_running(netdev)) {
+        if (!netdev || !netif_running(netdev)) {
                 rc = PCI_ERS_RESULT_RECOVERED;
                 goto done;
         }
@@ -17847,7 +17850,7 @@ static pci_ers_result_t tg3_io_slot_reset(struct pci_dev *pdev)
         rc = PCI_ERS_RESULT_RECOVERED;
 
 done:
-        if (rc != PCI_ERS_RESULT_RECOVERED && netif_running(netdev)) {
+        if (rc != PCI_ERS_RESULT_RECOVERED && netdev && netif_running(netdev)) {
                 tg3_napi_enable(tp);
                 dev_close(netdev);
         }
diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c
index 687ec4a8bb48..9c89dc8fe105 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c
@@ -455,11 +455,6 @@ static int alloc_pg_chunk(struct adapter *adapter, struct sge_fl *q,
                 q->pg_chunk.offset = 0;
                 mapping = pci_map_page(adapter->pdev, q->pg_chunk.page,
                                        0, q->alloc_size, PCI_DMA_FROMDEVICE);
-                if (unlikely(pci_dma_mapping_error(adapter->pdev, mapping))) {
-                        __free_pages(q->pg_chunk.page, order);
-                        q->pg_chunk.page = NULL;
-                        return -EIO;
-                }
                 q->pg_chunk.mapping = mapping;
         }
         sd->pg_chunk = q->pg_chunk;
@@ -954,75 +949,40 @@ static inline unsigned int calc_tx_descs(const struct sk_buff *skb)
         return flits_to_desc(flits);
 }
 
-
-/*      map_skb - map a packet main body and its page fragments
- *      @pdev: the PCI device
- *      @skb: the packet
- *      @addr: placeholder to save the mapped addresses
- *
- *      map the main body of an sk_buff and its page fragments, if any.
- */
-static int map_skb(struct pci_dev *pdev, const struct sk_buff *skb,
-                   dma_addr_t *addr)
-{
-        const skb_frag_t *fp, *end;
-        const struct skb_shared_info *si;
-
-        *addr = pci_map_single(pdev, skb->data, skb_headlen(skb),
-                               PCI_DMA_TODEVICE);
-        if (pci_dma_mapping_error(pdev, *addr))
-                goto out_err;
-
-        si = skb_shinfo(skb);
-        end = &si->frags[si->nr_frags];
-
-        for (fp = si->frags; fp < end; fp++) {
-                *++addr = skb_frag_dma_map(&pdev->dev, fp, 0, skb_frag_size(fp),
-                                           DMA_TO_DEVICE);
-                if (pci_dma_mapping_error(pdev, *addr))
-                        goto unwind;
-        }
-        return 0;
-
-unwind:
-        while (fp-- > si->frags)
-                dma_unmap_page(&pdev->dev, *--addr, skb_frag_size(fp),
-                               DMA_TO_DEVICE);
-
-        pci_unmap_single(pdev, addr[-1], skb_headlen(skb), PCI_DMA_TODEVICE);
-out_err:
-        return -ENOMEM;
-}
-
 /**
- *      write_sgl - populate a scatter/gather list for a packet
+ *      make_sgl - populate a scatter/gather list for a packet
  *      @skb: the packet
  *      @sgp: the SGL to populate
  *      @start: start address of skb main body data to include in the SGL
  *      @len: length of skb main body data to include in the SGL
- *      @addr: the list of the mapped addresses
+ *      @pdev: the PCI device
  *
- *      Copies the scatter/gather list for the buffers that make up a packet
+ *      Generates a scatter/gather list for the buffers that make up a packet
  *      and returns the SGL size in 8-byte words.  The caller must size the SGL
  *      appropriately.
  */
-static inline unsigned int write_sgl(const struct sk_buff *skb,
+static inline unsigned int make_sgl(const struct sk_buff *skb,
                                     struct sg_ent *sgp, unsigned char *start,
-                                    unsigned int len, const dma_addr_t *addr)
+                                    unsigned int len, struct pci_dev *pdev)
 {
-        unsigned int i, j = 0, k = 0, nfrags;
+        dma_addr_t mapping;
+        unsigned int i, j = 0, nfrags;
 
         if (len) {
+                mapping = pci_map_single(pdev, start, len, PCI_DMA_TODEVICE);
                 sgp->len[0] = cpu_to_be32(len);
-                sgp->addr[j++] = cpu_to_be64(addr[k++]);
+                sgp->addr[0] = cpu_to_be64(mapping);
+                j = 1;
         }
 
         nfrags = skb_shinfo(skb)->nr_frags;
         for (i = 0; i < nfrags; i++) {
                 const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 
+                mapping = skb_frag_dma_map(&pdev->dev, frag, 0, skb_frag_size(frag),
+                                           DMA_TO_DEVICE);
                 sgp->len[j] = cpu_to_be32(skb_frag_size(frag));
-                sgp->addr[j] = cpu_to_be64(addr[k++]);
+                sgp->addr[j] = cpu_to_be64(mapping);
                 j ^= 1;
                 if (j == 0)
                         ++sgp;
@@ -1178,7 +1138,7 @@ static void write_tx_pkt_wr(struct adapter *adap, struct sk_buff *skb,
                             const struct port_info *pi,
                             unsigned int pidx, unsigned int gen,
                             struct sge_txq *q, unsigned int ndesc,
-                            unsigned int compl, const dma_addr_t *addr)
+                            unsigned int compl)
 {
         unsigned int flits, sgl_flits, cntrl, tso_info;
         struct sg_ent *sgp, sgl[MAX_SKB_FRAGS / 2 + 1];
@@ -1236,7 +1196,7 @@ static void write_tx_pkt_wr(struct adapter *adap, struct sk_buff *skb,
         }
 
         sgp = ndesc == 1 ? (struct sg_ent *)&d->flit[flits] : sgl;
-        sgl_flits = write_sgl(skb, sgp, skb->data, skb_headlen(skb), addr);
+        sgl_flits = make_sgl(skb, sgp, skb->data, skb_headlen(skb), adap->pdev);
 
         write_wr_hdr_sgl(ndesc, skb, d, pidx, q, sgl, flits, sgl_flits, gen,
                          htonl(V_WR_OP(FW_WROPCODE_TUNNEL_TX_PKT) | compl),
@@ -1267,7 +1227,6 @@ netdev_tx_t t3_eth_xmit(struct sk_buff *skb, struct net_device *dev)
         struct netdev_queue *txq;
         struct sge_qset *qs;
         struct sge_txq *q;
-        dma_addr_t addr[MAX_SKB_FRAGS + 1];
 
         /*
          * The chip min packet length is 9 octets but play safe and reject
@@ -1296,11 +1255,6 @@ netdev_tx_t t3_eth_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
         }
 
-        if (unlikely(map_skb(adap->pdev, skb, addr) < 0)) {
-                dev_kfree_skb(skb);
-                return NETDEV_TX_OK;
-        }
-
         q->in_use += ndesc;
         if (unlikely(credits - ndesc < q->stop_thres)) {
                 t3_stop_tx_queue(txq, qs, q);
@@ -1358,7 +1312,7 @@ netdev_tx_t t3_eth_xmit(struct sk_buff *skb, struct net_device *dev)
         if (likely(!skb_shared(skb)))
                 skb_orphan(skb);
 
-        write_tx_pkt_wr(adap, skb, pi, pidx, gen, q, ndesc, compl, addr);
+        write_tx_pkt_wr(adap, skb, pi, pidx, gen, q, ndesc, compl);
         check_ring_tx_db(adap, q);
         return NETDEV_TX_OK;
 }
@@ -1623,8 +1577,7 @@ static void setup_deferred_unmapping(struct sk_buff *skb, struct pci_dev *pdev,
  */
 static void write_ofld_wr(struct adapter *adap, struct sk_buff *skb,
                           struct sge_txq *q, unsigned int pidx,
-                          unsigned int gen, unsigned int ndesc,
-                          const dma_addr_t *addr)
+                          unsigned int gen, unsigned int ndesc)
 {
         unsigned int sgl_flits, flits;
         struct work_request_hdr *from;
@@ -1645,9 +1598,9 @@ static void write_ofld_wr(struct adapter *adap, struct sk_buff *skb,
 
         flits = skb_transport_offset(skb) / 8;
         sgp = ndesc == 1 ? (struct sg_ent *)&d->flit[flits] : sgl;
-        sgl_flits = write_sgl(skb, sgp, skb_transport_header(skb),
-                             skb_tail_pointer(skb) -
-                             skb_transport_header(skb), addr);
+        sgl_flits = make_sgl(skb, sgp, skb_transport_header(skb),
+                             skb->tail - skb->transport_header,
+                             adap->pdev);
         if (need_skb_unmap()) {
                 setup_deferred_unmapping(skb, adap->pdev, sgp, sgl_flits);
                 skb->destructor = deferred_unmap_destructor;
@@ -1705,11 +1658,6 @@ again:	reclaim_completed_tx(adap, q, TX_RECLAIM_CHUNK);
                 goto again;
         }
 
-        if (map_skb(adap->pdev, skb, (dma_addr_t *)skb->head)) {
-                spin_unlock(&q->lock);
-                return NET_XMIT_SUCCESS;
-        }
-
         gen = q->gen;
         q->in_use += ndesc;
         pidx = q->pidx;
@@ -1720,7 +1668,7 @@ again:	reclaim_completed_tx(adap, q, TX_RECLAIM_CHUNK);
         }
         spin_unlock(&q->lock);
 
-        write_ofld_wr(adap, skb, q, pidx, gen, ndesc, (dma_addr_t *)skb->head);
+        write_ofld_wr(adap, skb, q, pidx, gen, ndesc);
         check_ring_tx_db(adap, q);
         return NET_XMIT_SUCCESS;
 }
@@ -1738,7 +1686,6 @@ static void restart_offloadq(unsigned long data)
         struct sge_txq *q = &qs->txq[TXQ_OFLD];
         const struct port_info *pi = netdev_priv(qs->netdev);
         struct adapter *adap = pi->adapter;
-        unsigned int written = 0;
 
         spin_lock(&q->lock);
 again:  reclaim_completed_tx(adap, q, TX_RECLAIM_CHUNK);
@@ -1758,14 +1705,10 @@ again:	reclaim_completed_tx(adap, q, TX_RECLAIM_CHUNK);
                         break;
                 }
 
-                if (map_skb(adap->pdev, skb, (dma_addr_t *)skb->head))
-                        break;
-
                 gen = q->gen;
                 q->in_use += ndesc;
                 pidx = q->pidx;
                 q->pidx += ndesc;
-                written += ndesc;
                 if (q->pidx >= q->size) {
                         q->pidx -= q->size;
                         q->gen ^= 1;
@@ -1773,8 +1716,7 @@ again:	reclaim_completed_tx(adap, q, TX_RECLAIM_CHUNK);
                 __skb_unlink(skb, &q->sendq);
                 spin_unlock(&q->lock);
 
-                write_ofld_wr(adap, skb, q, pidx, gen, ndesc,
-                             (dma_addr_t *)skb->head);
+                write_ofld_wr(adap, skb, q, pidx, gen, ndesc);
                 spin_lock(&q->lock);
         }
         spin_unlock(&q->lock);
@@ -1784,9 +1726,8 @@ again:	reclaim_completed_tx(adap, q, TX_RECLAIM_CHUNK);
         set_bit(TXQ_LAST_PKT_DB, &q->flags);
 #endif
         wmb();
-        if (likely(written))
-                t3_write_reg(adap, A_SG_KDOORBELL,
-                             F_SELEGRCNTX | V_EGRCNTX(q->cntxt_id));
+        t3_write_reg(adap, A_SG_KDOORBELL,
+                     F_SELEGRCNTX | V_EGRCNTX(q->cntxt_id));
 }
 
 /**
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 6e6e0a117ee2..8ec5d74ad44d 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -3048,6 +3048,9 @@ int be_cmd_get_func_config(struct be_adapter *adapter)
 
                 adapter->max_event_queues = le16_to_cpu(desc->eq_count);
                 adapter->if_cap_flags = le32_to_cpu(desc->cap_flags);
+
+                /* Clear flags that driver is not interested in */
+                adapter->if_cap_flags &=  BE_IF_CAP_FLAGS_WANT;
         }
 err:
         mutex_unlock(&adapter->mbox_lock);
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 5228d88c5a02..1b3b9e886412 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -563,6 +563,12 @@ enum be_if_flags {
         BE_IF_FLAGS_MULTICAST = 0x1000
 };
 
+#define BE_IF_CAP_FLAGS_WANT (BE_IF_FLAGS_RSS | BE_IF_FLAGS_PROMISCUOUS |\
+                         BE_IF_FLAGS_BROADCAST | BE_IF_FLAGS_VLAN_PROMISCUOUS |\
+                         BE_IF_FLAGS_VLAN | BE_IF_FLAGS_MCAST_PROMISCUOUS |\
+                         BE_IF_FLAGS_PASS_L3L4_ERRORS | BE_IF_FLAGS_MULTICAST |\
+                         BE_IF_FLAGS_UNTAGGED)
+
 /* An RX interface is an object with one or more MAC addresses and
  * filtering capabilities. */
 struct be_cmd_req_if_create {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 181edb522450..3d91a5ec61a4 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2563,8 +2563,8 @@ static int be_close(struct net_device *netdev)
         /* Wait for all pending tx completions to arrive so that
          * all tx skbs are freed.
          */
-        be_tx_compl_clean(adapter);
         netif_tx_disable(netdev);
+        be_tx_compl_clean(adapter);
 
         be_rx_qs_destroy(adapter);
 
@@ -4373,6 +4373,10 @@ static int be_resume(struct pci_dev *pdev)
         pci_set_power_state(pdev, PCI_D0);
         pci_restore_state(pdev);
 
+        status = be_fw_wait_ready(adapter);
+        if (status)
+                return status;
+
         /* tell fw we're ready to fire cmds */
         status = be_cmd_fw_init(adapter);
         if (status)
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 77ea0db0bbfc..c610a2716be4 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -971,8 +971,7 @@ fec_enet_rx(struct net_device *ndev, int budget)
                                                        htons(ETH_P_8021Q),
                                                        vlan_tag);
 
-                        if (!skb_defer_rx_timestamp(skb))
-                                napi_gro_receive(&fep->napi, skb);
+                        napi_gro_receive(&fep->napi, skb);
                 }
 
                 bdp->cbd_bufaddr = dma_map_single(&fep->pdev->dev, data,
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 7fbe6abf6054..23de82a9da82 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -3069,7 +3069,7 @@ jme_init_one(struct pci_dev *pdev,
                 jwrite32(jme, JME_APMC, apmc);
         }
 
-        NETIF_NAPI_SET(netdev, &jme->napi, jme_poll, jme->rx_ring_size >> 2)
+        NETIF_NAPI_SET(netdev, &jme->napi, jme_poll, NAPI_POLL_WEIGHT)
 
         spin_lock_init(&jme->phy_lock);
         spin_lock_init(&jme->macaddr_lock);
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index c896079728e1..ef94a591f9e5 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -931,17 +931,20 @@ static int skge_ring_alloc(struct skge_ring *ring, void *vaddr, u32 base)
 }
 
 /* Allocate and setup a new buffer for receiving */
-static void skge_rx_setup(struct skge_port *skge, struct skge_element *e,
-                          struct sk_buff *skb, unsigned int bufsize)
+static int skge_rx_setup(struct skge_port *skge, struct skge_element *e,
+                         struct sk_buff *skb, unsigned int bufsize)
 {
         struct skge_rx_desc *rd = e->desc;
-        u64 map;
+        dma_addr_t map;
 
         map = pci_map_single(skge->hw->pdev, skb->data, bufsize,
                              PCI_DMA_FROMDEVICE);
 
-        rd->dma_lo = map;
-        rd->dma_hi = map >> 32;
+        if (pci_dma_mapping_error(skge->hw->pdev, map))
+                return -1;
+
+        rd->dma_lo = lower_32_bits(map);
+        rd->dma_hi = upper_32_bits(map);
         e->skb = skb;
         rd->csum1_start = ETH_HLEN;
         rd->csum2_start = ETH_HLEN;
@@ -953,6 +956,7 @@ static void skge_rx_setup(struct skge_port *skge, struct skge_element *e,
         rd->control = BMU_OWN | BMU_STF | BMU_IRQ_EOF | BMU_TCP_CHECK | bufsize;
         dma_unmap_addr_set(e, mapaddr, map);
         dma_unmap_len_set(e, maplen, bufsize);
+        return 0;
 }
 
 /* Resume receiving using existing skb,
@@ -1014,7 +1018,10 @@ static int skge_rx_fill(struct net_device *dev)
                         return -ENOMEM;
 
                 skb_reserve(skb, NET_IP_ALIGN);
-                skge_rx_setup(skge, e, skb, skge->rx_buf_size);
+                if (skge_rx_setup(skge, e, skb, skge->rx_buf_size) < 0) {
+                        dev_kfree_skb(skb);
+                        return -EIO;
+                }
         } while ((e = e->next) != ring->start);
 
         ring->to_clean = ring->start;
@@ -2544,7 +2551,7 @@ static int skge_up(struct net_device *dev)
 
         BUG_ON(skge->dma & 7);
 
-        if ((u64)skge->dma >> 32 != ((u64) skge->dma + skge->mem_size) >> 32) {
+        if (upper_32_bits(skge->dma) != upper_32_bits(skge->dma + skge->mem_size)) {
                 dev_err(&hw->pdev->dev, "pci_alloc_consistent region crosses 4G boundary\n");
                 err = -EINVAL;
                 goto free_pci_mem;
@@ -2729,7 +2736,7 @@ static netdev_tx_t skge_xmit_frame(struct sk_buff *skb,
         struct skge_tx_desc *td;
         int i;
         u32 control, len;
-        u64 map;
+        dma_addr_t map;
 
         if (skb_padto(skb, ETH_ZLEN))
                 return NETDEV_TX_OK;
@@ -2743,11 +2750,14 @@ static netdev_tx_t skge_xmit_frame(struct sk_buff *skb,
         e->skb = skb;
         len = skb_headlen(skb);
         map = pci_map_single(hw->pdev, skb->data, len, PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(hw->pdev, map))
+                goto mapping_error;
+
         dma_unmap_addr_set(e, mapaddr, map);
         dma_unmap_len_set(e, maplen, len);
 
-        td->dma_lo = map;
-        td->dma_hi = map >> 32;
+        td->dma_lo = lower_32_bits(map);
+        td->dma_hi = upper_32_bits(map);
 
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 const int offset = skb_checksum_start_offset(skb);
@@ -2778,14 +2788,16 @@ static netdev_tx_t skge_xmit_frame(struct sk_buff *skb,
 
                         map = skb_frag_dma_map(&hw->pdev->dev, frag, 0,
                                                skb_frag_size(frag), DMA_TO_DEVICE);
+                        if (dma_mapping_error(&hw->pdev->dev, map))
+                                goto mapping_unwind;
 
                         e = e->next;
                         e->skb = skb;
                         tf = e->desc;
                         BUG_ON(tf->control & BMU_OWN);
 
-                        tf->dma_lo = map;
-                        tf->dma_hi = (u64) map >> 32;
+                        tf->dma_lo = lower_32_bits(map);
+                        tf->dma_hi = upper_32_bits(map);
                         dma_unmap_addr_set(e, mapaddr, map);
                         dma_unmap_len_set(e, maplen, skb_frag_size(frag));
 
@@ -2815,6 +2827,26 @@ static netdev_tx_t skge_xmit_frame(struct sk_buff *skb,
         }
 
         return NETDEV_TX_OK;
+
+mapping_unwind:
+        e = skge->tx_ring.to_use;
+        pci_unmap_single(hw->pdev,
+                         dma_unmap_addr(e, mapaddr),
+                         dma_unmap_len(e, maplen),
+                         PCI_DMA_TODEVICE);
+        while (i-- > 0) {
+                e = e->next;
+                pci_unmap_page(hw->pdev,
+                               dma_unmap_addr(e, mapaddr),
+                               dma_unmap_len(e, maplen),
+                               PCI_DMA_TODEVICE);
+        }
+
+mapping_error:
+        if (net_ratelimit())
+                dev_warn(&hw->pdev->dev, "%s: tx mapping error\n", dev->name);
+        dev_kfree_skb(skb);
+        return NETDEV_TX_OK;
 }
 
 
@@ -3045,11 +3077,13 @@ static struct sk_buff *skge_rx_get(struct net_device *dev,
 
                 pci_dma_sync_single_for_cpu(skge->hw->pdev,
                                             dma_unmap_addr(e, mapaddr),
-                                            len, PCI_DMA_FROMDEVICE);
+                                            dma_unmap_len(e, maplen),
+                                            PCI_DMA_FROMDEVICE);
                 skb_copy_from_linear_data(e->skb, skb->data, len);
                 pci_dma_sync_single_for_device(skge->hw->pdev,
                                                dma_unmap_addr(e, mapaddr),
-                                               len, PCI_DMA_FROMDEVICE);
+                                               dma_unmap_len(e, maplen),
+                                               PCI_DMA_FROMDEVICE);
                 skge_rx_reuse(e, skge->rx_buf_size);
         } else {
                 struct sk_buff *nskb;
@@ -3058,13 +3092,17 @@ static struct sk_buff *skge_rx_get(struct net_device *dev,
                 if (!nskb)
                         goto resubmit;
 
+                if (skge_rx_setup(skge, e, nskb, skge->rx_buf_size) < 0) {
+                        dev_kfree_skb(nskb);
+                        goto resubmit;
+                }
+
                 pci_unmap_single(skge->hw->pdev,
                                  dma_unmap_addr(e, mapaddr),
                                  dma_unmap_len(e, maplen),
                                  PCI_DMA_FROMDEVICE);
                 skb = e->skb;
                 prefetch(skb->data);
-                skge_rx_setup(skge, e, nskb, skge->rx_buf_size);
         }
 
         skb_put(skb, len);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index c571de85d0f9..5472cbd34028 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -46,7 +46,7 @@
 #include "mlx5_core.h"
 
 enum {
-        CMD_IF_REV = 4,
+        CMD_IF_REV = 5,
 };
 
 enum {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index c02cbcfd0fb8..443cc4d7b024 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -268,7 +268,7 @@ static int mlx5_eq_int(struct mlx5_core_dev *dev, struct mlx5_eq *eq)
                 case MLX5_EVENT_TYPE_PAGE_REQUEST:
                         {
                                 u16 func_id = be16_to_cpu(eqe->data.req_pages.func_id);
-                                s16 npages = be16_to_cpu(eqe->data.req_pages.num_pages);
+                                s32 npages = be32_to_cpu(eqe->data.req_pages.num_pages);
 
                                 mlx5_core_dbg(dev, "page request for func 0x%x, napges %d\n", func_id, npages);
                                 mlx5_core_req_pages_handler(dev, func_id, npages);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw.c b/drivers/net/ethernet/mellanox/mlx5/core/fw.c
index 72a5222447f5..f012658b6a92 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw.c
@@ -113,7 +113,7 @@ int mlx5_cmd_query_hca_cap(struct mlx5_core_dev *dev,
         caps->log_max_srq = out->hca_cap.log_max_srqs & 0x1f;
         caps->local_ca_ack_delay = out->hca_cap.local_ca_ack_delay & 0x1f;
         caps->log_max_mcg = out->hca_cap.log_max_mcg;
-        caps->max_qp_mcg = be16_to_cpu(out->hca_cap.max_qp_mcg);
+        caps->max_qp_mcg = be32_to_cpu(out->hca_cap.max_qp_mcg) & 0xffffff;
         caps->max_ra_res_qp = 1 << (out->hca_cap.log_max_ra_res_qp & 0x3f);
         caps->max_ra_req_qp = 1 << (out->hca_cap.log_max_ra_req_qp & 0x3f);
         caps->max_srq_wqes = 1 << out->hca_cap.log_max_srq_sz;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 748f10a155c4..3e6670c4a7cd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -55,33 +55,9 @@ enum {
 };
 
 static DEFINE_SPINLOCK(health_lock);
-
 static LIST_HEAD(health_list);
 static struct work_struct health_work;
 
-static health_handler_t reg_handler;
-int mlx5_register_health_report_handler(health_handler_t handler)
-{
-        spin_lock_irq(&health_lock);
-        if (reg_handler) {
-                spin_unlock_irq(&health_lock);
-                return -EEXIST;
-        }
-        reg_handler = handler;
-        spin_unlock_irq(&health_lock);
-
-        return 0;
-}
-EXPORT_SYMBOL(mlx5_register_health_report_handler);
-
-void mlx5_unregister_health_report_handler(void)
-{
-        spin_lock_irq(&health_lock);
-        reg_handler = NULL;
-        spin_unlock_irq(&health_lock);
-}
-EXPORT_SYMBOL(mlx5_unregister_health_report_handler);
-
 static void health_care(struct work_struct *work)
 {
         struct mlx5_core_health *health, *n;
@@ -98,11 +74,8 @@ static void health_care(struct work_struct *work)
                 priv = container_of(health, struct mlx5_priv, health);
                 dev = container_of(priv, struct mlx5_core_dev, priv);
                 mlx5_core_warn(dev, "handling bad device here\n");
+                /* nothing yet */
                 spin_lock_irq(&health_lock);
-                if (reg_handler)
-                        reg_handler(dev->pdev, health->health,
-                                    sizeof(health->health));
-
                 list_del_init(&health->list);
                 spin_unlock_irq(&health_lock);
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
index 4a3e137931a3..3a2408d44820 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -43,10 +43,16 @@ enum {
         MLX5_PAGES_TAKE         = 2
 };
 
+enum {
+        MLX5_BOOT_PAGES         = 1,
+        MLX5_INIT_PAGES         = 2,
+        MLX5_POST_INIT_PAGES    = 3
+};
+
 struct mlx5_pages_req {
         struct mlx5_core_dev *dev;
         u32     func_id;
-        s16     npages;
+        s32     npages;
         struct work_struct work;
 };
 
@@ -64,27 +70,23 @@ struct mlx5_query_pages_inbox {
 
 struct mlx5_query_pages_outbox {
         struct mlx5_outbox_hdr  hdr;
-        __be16                  num_boot_pages;
+        __be16                  rsvd;
         __be16                  func_id;
-        __be16                  init_pages;
-        __be16                  num_pages;
+        __be32                  num_pages;
 };
 
 struct mlx5_manage_pages_inbox {
         struct mlx5_inbox_hdr   hdr;
-        __be16                  rsvd0;
+        __be16                  rsvd;
         __be16                  func_id;
-        __be16                  rsvd1;
-        __be16                  num_entries;
-        u8                      rsvd2[16];
+        __be32                  num_entries;
         __be64                  pas[0];
 };
 
 struct mlx5_manage_pages_outbox {
         struct mlx5_outbox_hdr  hdr;
-        u8                      rsvd0[2];
-        __be16                  num_entries;
-        u8                      rsvd1[20];
+        __be32                  num_entries;
+        u8                      rsvd[4];
         __be64                  pas[0];
 };
 
@@ -146,7 +148,7 @@ static struct page *remove_page(struct mlx5_core_dev *dev, u64 addr)
 }
 
 static int mlx5_cmd_query_pages(struct mlx5_core_dev *dev, u16 *func_id,
-                                s16 *pages, s16 *init_pages, u16 *boot_pages)
+                                s32 *npages, int boot)
 {
         struct mlx5_query_pages_inbox   in;
         struct mlx5_query_pages_outbox  out;
@@ -155,6 +157,8 @@ static int mlx5_cmd_query_pages(struct mlx5_core_dev *dev, u16 *func_id,
         memset(&in, 0, sizeof(in));
         memset(&out, 0, sizeof(out));
         in.hdr.opcode = cpu_to_be16(MLX5_CMD_OP_QUERY_PAGES);
+        in.hdr.opmod = boot ? cpu_to_be16(MLX5_BOOT_PAGES) : cpu_to_be16(MLX5_INIT_PAGES);
+
         err = mlx5_cmd_exec(dev, &in, sizeof(in), &out, sizeof(out));
         if (err)
                 return err;
@@ -162,15 +166,7 @@ static int mlx5_cmd_query_pages(struct mlx5_core_dev *dev, u16 *func_id,
         if (out.hdr.status)
                 return mlx5_cmd_status_to_err(&out.hdr);
 
-        if (pages)
-                *pages = be16_to_cpu(out.num_pages);
-
-        if (init_pages)
-                *init_pages = be16_to_cpu(out.init_pages);
-
-        if (boot_pages)
-                *boot_pages = be16_to_cpu(out.num_boot_pages);
-
+        *npages = be32_to_cpu(out.num_pages);
         *func_id = be16_to_cpu(out.func_id);
 
         return err;
@@ -224,7 +220,7 @@ static int give_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
         in->hdr.opcode = cpu_to_be16(MLX5_CMD_OP_MANAGE_PAGES);
         in->hdr.opmod = cpu_to_be16(MLX5_PAGES_GIVE);
         in->func_id = cpu_to_be16(func_id);
-        in->num_entries = cpu_to_be16(npages);
+        in->num_entries = cpu_to_be32(npages);
         err = mlx5_cmd_exec(dev, in, inlen, &out, sizeof(out));
         mlx5_core_dbg(dev, "err %d\n", err);
         if (err) {
@@ -292,7 +288,7 @@ static int reclaim_pages(struct mlx5_core_dev *dev, u32 func_id, int npages,
         in.hdr.opcode = cpu_to_be16(MLX5_CMD_OP_MANAGE_PAGES);
         in.hdr.opmod = cpu_to_be16(MLX5_PAGES_TAKE);
         in.func_id = cpu_to_be16(func_id);
-        in.num_entries = cpu_to_be16(npages);
+        in.num_entries = cpu_to_be32(npages);
         mlx5_core_dbg(dev, "npages %d, outlen %d\n", npages, outlen);
         err = mlx5_cmd_exec(dev, &in, sizeof(in), out, outlen);
         if (err) {
@@ -306,7 +302,7 @@ static int reclaim_pages(struct mlx5_core_dev *dev, u32 func_id, int npages,
                 goto out_free;
         }
 
-        num_claimed = be16_to_cpu(out->num_entries);
+        num_claimed = be32_to_cpu(out->num_entries);
         if (nclaimed)
                 *nclaimed = num_claimed;
 
@@ -345,7 +341,7 @@ static void pages_work_handler(struct work_struct *work)
 }
 
 void mlx5_core_req_pages_handler(struct mlx5_core_dev *dev, u16 func_id,
-                                 s16 npages)
+                                 s32 npages)
 {
         struct mlx5_pages_req *req;
 
@@ -364,20 +360,18 @@ void mlx5_core_req_pages_handler(struct mlx5_core_dev *dev, u16 func_id,
 
 int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev, int boot)
 {
-        u16 uninitialized_var(boot_pages);
-        s16 uninitialized_var(init_pages);
         u16 uninitialized_var(func_id);
+        s32 uninitialized_var(npages);
         int err;
 
-        err = mlx5_cmd_query_pages(dev, &func_id, NULL, &init_pages,
-                                   &boot_pages);
+        err = mlx5_cmd_query_pages(dev, &func_id, &npages, boot);
         if (err)
                 return err;
 
+        mlx5_core_dbg(dev, "requested %d %s pages for func_id 0x%x\n",
+                      npages, boot ? "boot" : "init", func_id);
 
-        mlx5_core_dbg(dev, "requested %d init pages and %d boot pages for func_id 0x%x\n",
-                      init_pages, boot_pages, func_id);
-        return give_pages(dev, func_id, boot ? boot_pages : init_pages, 0);
+        return give_pages(dev, func_id, npages, 0);
 }
 
 static int optimal_reclaimed_pages(void)
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic.h b/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
index 3fe09ab2d7c9..32675e16021e 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic.h
@@ -1171,7 +1171,6 @@ typedef struct {
 
 #define NETXEN_DB_MAPSIZE_BYTES         0x1000
 
-#define NETXEN_NETDEV_WEIGHT 128
 #define NETXEN_ADAPTER_UP_MAGIC 777
 #define NETXEN_NIC_PEG_TUNE 0
 
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index c401b0b4353d..ec4cf7fd4123 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -197,7 +197,7 @@ netxen_napi_add(struct netxen_adapter *adapter, struct net_device *netdev)
         for (ring = 0; ring < adapter->max_sds_rings; ring++) {
                 sds_ring = &recv_ctx->sds_rings[ring];
                 netif_napi_add(netdev, &sds_ring->napi,
-                                netxen_nic_poll, NETXEN_NETDEV_WEIGHT);
+                                netxen_nic_poll, NAPI_POLL_WEIGHT);
         }
 
         return 0;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 92da9980a0a0..9d4bb7f83904 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -3266,6 +3266,11 @@ int qlcnic_83xx_interrupt_test(struct net_device *netdev)
         u8 val;
         int ret, max_sds_rings = adapter->max_sds_rings;
 
+        if (test_bit(__QLCNIC_RESETTING, &adapter->state)) {
+                netdev_info(netdev, "Device is resetting\n");
+                return -EBUSY;
+        }
+
         if (qlcnic_get_diag_lock(adapter)) {
                 netdev_info(netdev, "Device in diagnostics mode\n");
                 return -EBUSY;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index 9f4b8d5f0865..345d987aede4 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -629,7 +629,8 @@ int qlcnic_83xx_idc_reattach_driver(struct qlcnic_adapter *adapter)
                 return -EIO;
         }
 
-        qlcnic_set_drv_version(adapter);
+        if (adapter->portnum == 0)
+                qlcnic_set_drv_version(adapter);
         qlcnic_83xx_idc_attach_driver(adapter);
 
         return 0;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index ee013fcc3322..bc05d016c859 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -2165,7 +2165,8 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (err)
                 goto err_out_disable_mbx_intr;
 
-        qlcnic_set_drv_version(adapter);
+        if (adapter->portnum == 0)
+                qlcnic_set_drv_version(adapter);
 
         pci_set_drvdata(pdev, adapter);
 
@@ -3085,7 +3086,8 @@ done:
         adapter->fw_fail_cnt = 0;
         adapter->flags &= ~QLCNIC_FW_HANG;
         clear_bit(__QLCNIC_RESETTING, &adapter->state);
-        qlcnic_set_drv_version(adapter);
+        if (adapter->portnum == 0)
+                qlcnic_set_drv_version(adapter);
 
         if (!qlcnic_clr_drv_state(adapter))
                 qlcnic_schedule_work(adapter, qlcnic_fw_poll_work,
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
index 10ed82b3baca..660c3f5b2237 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
@@ -170,9 +170,9 @@ static int qlcnic_82xx_store_beacon(struct qlcnic_adapter *adapter,
 
         if (ahw->extra_capability[0] & QLCNIC_FW_CAPABILITY_2_BEACON) {
                 err = qlcnic_get_beacon_state(adapter, &h_beacon_state);
-                if (!err) {
-                        dev_info(&adapter->pdev->dev,
-                                 "Failed to get current beacon state\n");
+                if (err) {
+                        netdev_err(adapter->netdev,
+                                   "Failed to get current beacon state\n");
                 } else {
                         if (h_beacon_state == QLCNIC_BEACON_DISABLE)
                                 ahw->beacon_state = 0;
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index 6f35f8404d68..d2e591955bdd 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -524,6 +524,7 @@ rx_status_loop:
                                          PCI_DMA_FROMDEVICE);
                 if (dma_mapping_error(&cp->pdev->dev, new_mapping)) {
                         dev->stats.rx_dropped++;
+                        kfree_skb(new_skb);
                         goto rx_next;
                 }
 
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index b5eb4195fc99..85e5c97191dd 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -7088,7 +7088,7 @@ rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         RTL_W8(Cfg9346, Cfg9346_Unlock);
         RTL_W8(Config1, RTL_R8(Config1) | PMEnable);
-        RTL_W8(Config5, RTL_R8(Config5) & PMEStatus);
+        RTL_W8(Config5, RTL_R8(Config5) & (BWF | MWF | UWF | LanWake | PMEStatus));
         if ((RTL_R8(Config3) & (LinkUp | MagicPacket)) != 0)
                 tp->features |= RTL_FEATURE_WOL;
         if ((RTL_R8(Config5) & (UWF | BWF | MWF)) != 0)
diff --git a/drivers/net/ethernet/sfc/filter.c b/drivers/net/ethernet/sfc/filter.c
index 2a469b27a506..30d744235d27 100644
--- a/drivers/net/ethernet/sfc/filter.c
+++ b/drivers/net/ethernet/sfc/filter.c
@@ -675,7 +675,7 @@ s32 efx_filter_insert_filter(struct efx_nic *efx, struct efx_filter_spec *spec,
                 BUILD_BUG_ON(EFX_FILTER_INDEX_UC_DEF != 0);
                 BUILD_BUG_ON(EFX_FILTER_INDEX_MC_DEF !=
                              EFX_FILTER_MC_DEF - EFX_FILTER_UC_DEF);
-                rep_index = spec->type - EFX_FILTER_INDEX_UC_DEF;
+                rep_index = spec->type - EFX_FILTER_UC_DEF;
                 ins_index = rep_index;
 
                 spin_lock_bh(&state->lock);
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index c9d942a5c335..1ef9d8a555aa 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -33,10 +33,15 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
         struct stmmac_priv *priv = (struct stmmac_priv *)p;
         unsigned int txsize = priv->dma_tx_size;
         unsigned int entry = priv->cur_tx % txsize;
-        struct dma_desc *desc = priv->dma_tx + entry;
+        struct dma_desc *desc;
         unsigned int nopaged_len = skb_headlen(skb);
         unsigned int bmax, len;
 
+        if (priv->extend_desc)
+                desc = (struct dma_desc *)(priv->dma_etx + entry);
+        else
+                desc = priv->dma_tx + entry;
+
         if (priv->plat->enh_desc)
                 bmax = BUF_SIZE_8KiB;
         else
@@ -54,7 +59,11 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
                                                 STMMAC_RING_MODE);
                 wmb();
                 entry = (++priv->cur_tx) % txsize;
-                desc = priv->dma_tx + entry;
+
+                if (priv->extend_desc)
+                        desc = (struct dma_desc *)(priv->dma_etx + entry);
+                else
+                        desc = priv->dma_tx + entry;
 
                 desc->des2 = dma_map_single(priv->device, skb->data + bmax,
                                             len, DMA_TO_DEVICE);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index f2ccb36e8685..0a9bb9d30c3f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -939,15 +939,20 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
 
         skb = __netdev_alloc_skb(priv->dev, priv->dma_buf_sz + NET_IP_ALIGN,
                                  GFP_KERNEL);
-        if (unlikely(skb == NULL)) {
+        if (!skb) {
                 pr_err("%s: Rx init fails; skb is NULL\n", __func__);
-                return 1;
+                return -ENOMEM;
         }
         skb_reserve(skb, NET_IP_ALIGN);
         priv->rx_skbuff[i] = skb;
         priv->rx_skbuff_dma[i] = dma_map_single(priv->device, skb->data,
                                                 priv->dma_buf_sz,
                                                 DMA_FROM_DEVICE);
+        if (dma_mapping_error(priv->device, priv->rx_skbuff_dma[i])) {
+                pr_err("%s: DMA mapping error\n", __func__);
+                dev_kfree_skb_any(skb);
+                return -EINVAL;
+        }
 
         p->des2 = priv->rx_skbuff_dma[i];
 
@@ -958,6 +963,16 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
         return 0;
 }
 
+static void stmmac_free_rx_buffers(struct stmmac_priv *priv, int i)
+{
+        if (priv->rx_skbuff[i]) {
+                dma_unmap_single(priv->device, priv->rx_skbuff_dma[i],
+                                 priv->dma_buf_sz, DMA_FROM_DEVICE);
+                dev_kfree_skb_any(priv->rx_skbuff[i]);
+        }
+        priv->rx_skbuff[i] = NULL;
+}
+
 /**
  * init_dma_desc_rings - init the RX/TX descriptor rings
  * @dev: net device structure
@@ -965,13 +980,14 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
  * and allocates the socket buffers. It suppors the chained and ring
  * modes.
  */
-static void init_dma_desc_rings(struct net_device *dev)
+static int init_dma_desc_rings(struct net_device *dev)
 {
         int i;
         struct stmmac_priv *priv = netdev_priv(dev);
         unsigned int txsize = priv->dma_tx_size;
         unsigned int rxsize = priv->dma_rx_size;
         unsigned int bfsize = 0;
+        int ret = -ENOMEM;
 
         /* Set the max buffer size according to the DESC mode
          * and the MTU. Note that RING mode allows 16KiB bsize.
@@ -992,34 +1008,60 @@ static void init_dma_desc_rings(struct net_device *dev)
                                                           dma_extended_desc),
                                                    &priv->dma_rx_phy,
                                                    GFP_KERNEL);
+                if (!priv->dma_erx)
+                        goto err_dma;
+
                 priv->dma_etx = dma_alloc_coherent(priv->device, txsize *
                                                    sizeof(struct
                                                           dma_extended_desc),
                                                    &priv->dma_tx_phy,
                                                    GFP_KERNEL);
-                if ((!priv->dma_erx) || (!priv->dma_etx))
-                        return;
+                if (!priv->dma_etx) {
+                        dma_free_coherent(priv->device, priv->dma_rx_size *
+                                        sizeof(struct dma_extended_desc),
+                                        priv->dma_erx, priv->dma_rx_phy);
+                        goto err_dma;
+                }
         } else {
                 priv->dma_rx = dma_alloc_coherent(priv->device, rxsize *
                                                   sizeof(struct dma_desc),
                                                   &priv->dma_rx_phy,
                                                   GFP_KERNEL);
+                if (!priv->dma_rx)
+                        goto err_dma;
+
                 priv->dma_tx = dma_alloc_coherent(priv->device, txsize *
                                                   sizeof(struct dma_desc),
                                                   &priv->dma_tx_phy,
                                                   GFP_KERNEL);
-                if ((!priv->dma_rx) || (!priv->dma_tx))
-                        return;
+                if (!priv->dma_tx) {
+                        dma_free_coherent(priv->device, priv->dma_rx_size *
+                                        sizeof(struct dma_desc),
+                                        priv->dma_rx, priv->dma_rx_phy);
+                        goto err_dma;
+                }
         }
 
         priv->rx_skbuff_dma = kmalloc_array(rxsize, sizeof(dma_addr_t),
                                             GFP_KERNEL);
+        if (!priv->rx_skbuff_dma)
+                goto err_rx_skbuff_dma;
+
         priv->rx_skbuff = kmalloc_array(rxsize, sizeof(struct sk_buff *),
                                         GFP_KERNEL);
+        if (!priv->rx_skbuff)
+                goto err_rx_skbuff;
+
         priv->tx_skbuff_dma = kmalloc_array(txsize, sizeof(dma_addr_t),
                                             GFP_KERNEL);
+        if (!priv->tx_skbuff_dma)
+                goto err_tx_skbuff_dma;
+
         priv->tx_skbuff = kmalloc_array(txsize, sizeof(struct sk_buff *),
                                         GFP_KERNEL);
+        if (!priv->tx_skbuff)
+                goto err_tx_skbuff;
+
         if (netif_msg_probe(priv)) {
                 pr_debug("(%s) dma_rx_phy=0x%08x dma_tx_phy=0x%08x\n", __func__,
                          (u32) priv->dma_rx_phy, (u32) priv->dma_tx_phy);
@@ -1034,8 +1076,9 @@ static void init_dma_desc_rings(struct net_device *dev)
                 else
                         p = priv->dma_rx + i;
 
-                if (stmmac_init_rx_buffers(priv, p, i))
-                        break;
+                ret = stmmac_init_rx_buffers(priv, p, i);
+                if (ret)
+                        goto err_init_rx_buffers;
 
                 if (netif_msg_probe(priv))
                         pr_debug("[%p]\t[%p]\t[%x]\n", priv->rx_skbuff[i],
@@ -1081,20 +1124,44 @@ static void init_dma_desc_rings(struct net_device *dev)
 
         if (netif_msg_hw(priv))
                 stmmac_display_rings(priv);
+
+        return 0;
+err_init_rx_buffers:
+        while (--i >= 0)
+                stmmac_free_rx_buffers(priv, i);
+        kfree(priv->tx_skbuff);
+err_tx_skbuff:
+        kfree(priv->tx_skbuff_dma);
+err_tx_skbuff_dma:
+        kfree(priv->rx_skbuff);
+err_rx_skbuff:
+        kfree(priv->rx_skbuff_dma);
+err_rx_skbuff_dma:
+        if (priv->extend_desc) {
+                dma_free_coherent(priv->device, priv->dma_tx_size *
+                                  sizeof(struct dma_extended_desc),
+                                  priv->dma_etx, priv->dma_tx_phy);
+                dma_free_coherent(priv->device, priv->dma_rx_size *
+                                  sizeof(struct dma_extended_desc),
+                                  priv->dma_erx, priv->dma_rx_phy);
+        } else {
+                dma_free_coherent(priv->device,
+                                priv->dma_tx_size * sizeof(struct dma_desc),
+                                priv->dma_tx, priv->dma_tx_phy);
+                dma_free_coherent(priv->device,
+                                priv->dma_rx_size * sizeof(struct dma_desc),
+                                priv->dma_rx, priv->dma_rx_phy);
+        }
+err_dma:
+        return ret;
 }
 
 static void dma_free_rx_skbufs(struct stmmac_priv *priv)
 {
         int i;
 
-        for (i = 0; i < priv->dma_rx_size; i++) {
-                if (priv->rx_skbuff[i]) {
-                        dma_unmap_single(priv->device, priv->rx_skbuff_dma[i],
-                                         priv->dma_buf_sz, DMA_FROM_DEVICE);
-                        dev_kfree_skb_any(priv->rx_skbuff[i]);
-                }
-                priv->rx_skbuff[i] = NULL;
-        }
+        for (i = 0; i < priv->dma_rx_size; i++)
+                stmmac_free_rx_buffers(priv, i);
 }
 
 static void dma_free_tx_skbufs(struct stmmac_priv *priv)
@@ -1560,12 +1627,17 @@ static int stmmac_open(struct net_device *dev)
         priv->dma_tx_size = STMMAC_ALIGN(dma_txsize);
         priv->dma_rx_size = STMMAC_ALIGN(dma_rxsize);
         priv->dma_buf_sz = STMMAC_ALIGN(buf_sz);
-        init_dma_desc_rings(dev);
+
+        ret = init_dma_desc_rings(dev);
+        if (ret < 0) {
+                pr_err("%s: DMA descriptors initialization failed\n", __func__);
+                goto dma_desc_error;
+        }
 
         /* DMA initialization and SW reset */
         ret = stmmac_init_dma_engine(priv);
         if (ret < 0) {
-                pr_err("%s: DMA initialization failed\n", __func__);
+                pr_err("%s: DMA engine initialization failed\n", __func__);
                 goto init_error;
         }
 
@@ -1672,6 +1744,7 @@ wolirq_error:
 
 init_error:
         free_dma_desc_resources(priv);
+dma_desc_error:
         if (priv->phydev)
                 phy_disconnect(priv->phydev);
 phy_error:
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 03de76c7a177..1c83a44c547b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -71,14 +71,18 @@ static int stmmac_probe_config_dt(struct platform_device *pdev,
                 plat->force_sf_dma_mode = 1;
         }
 
-        dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*dma_cfg), GFP_KERNEL);
-        if (!dma_cfg)
-                return -ENOMEM;
-
-        plat->dma_cfg = dma_cfg;
-        of_property_read_u32(np, "snps,pbl", &dma_cfg->pbl);
-        dma_cfg->fixed_burst = of_property_read_bool(np, "snps,fixed-burst");
-        dma_cfg->mixed_burst = of_property_read_bool(np, "snps,mixed-burst");
+        if (of_find_property(np, "snps,pbl", NULL)) {
+                dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*dma_cfg),
+                                       GFP_KERNEL);
+                if (!dma_cfg)
+                        return -ENOMEM;
+                plat->dma_cfg = dma_cfg;
+                of_property_read_u32(np, "snps,pbl", &dma_cfg->pbl);
+                dma_cfg->fixed_burst =
+                        of_property_read_bool(np, "snps,fixed-burst");
+                dma_cfg->mixed_burst =
+                        of_property_read_bool(np, "snps,mixed-burst");
+        }
 
         return 0;
 }
diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
index ad32af67e618..9c805e0c0cae 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
@@ -1466,8 +1466,7 @@ static void gelic_ether_setup_netdev_ops(struct net_device *netdev,
 {
         netdev->watchdog_timeo = GELIC_NET_WATCHDOG_TIMEOUT;
         /* NAPI */
-        netif_napi_add(netdev, napi,
-                       gelic_net_poll, GELIC_NET_NAPI_WEIGHT);
+        netif_napi_add(netdev, napi, gelic_net_poll, NAPI_POLL_WEIGHT);
         netdev->ethtool_ops = &gelic_ether_ethtool_ops;
         netdev->netdev_ops = &gelic_netdevice_ops;
 }
diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
index a93df6ac1909..309abb472aa2 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
@@ -37,7 +37,6 @@
 #define GELIC_NET_RXBUF_ALIGN           128
 #define GELIC_CARD_RX_CSUM_DEFAULT      1 /* hw chksum */
 #define GELIC_NET_WATCHDOG_TIMEOUT      5*HZ
-#define GELIC_NET_NAPI_WEIGHT           (GELIC_NET_RX_DESCRIPTORS)
 #define GELIC_NET_BROADCAST_ADDR        0xffffffffffffL
 
 #define GELIC_NET_MC_COUNT_MAX          32 /* multicast address list */
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
index 1d6dc41f755d..d01cacf8a7c2 100644
--- a/drivers/net/ethernet/via/via-velocity.c
+++ b/drivers/net/ethernet/via/via-velocity.c
@@ -2100,7 +2100,7 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx)
 
                 __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vid);
         }
-        netif_rx(skb);
+        netif_receive_skb(skb);
 
         stats->rx_bytes += pkt_len;
         stats->rx_packets++;
@@ -2884,6 +2884,7 @@ out:
         return ret;
 
 err_iounmap:
+        netif_napi_del(&vptr->napi);
         iounmap(regs);
 err_free_dev:
         free_netdev(netdev);
@@ -2904,6 +2905,7 @@ static int velocity_remove(struct device *dev)
         struct velocity_info *vptr = netdev_priv(netdev);
 
         unregister_netdev(netdev);
+        netif_napi_del(&vptr->napi);
         iounmap(vptr->mac_regs);
         free_netdev(netdev);
         velocity_nics--;
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c b/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
index e90e1f46121e..64b4639f43b6 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
@@ -175,6 +175,7 @@ int axienet_mdio_setup(struct axienet_local *lp, struct device_node *np)
                 printk(KERN_WARNING "Setting MDIO clock divisor to "
                        "default %d\n", DEFAULT_CLOCK_DIVISOR);
                 clk_div = DEFAULT_CLOCK_DIVISOR;
+                of_node_put(np1);
                 goto issue;
         }
 
diff --git a/drivers/net/irda/via-ircc.c b/drivers/net/irda/via-ircc.c
index 51f2bc376101..2dcc60fb37f1 100644
--- a/drivers/net/irda/via-ircc.c
+++ b/drivers/net/irda/via-ircc.c
@@ -210,8 +210,7 @@ static int via_init_one(struct pci_dev *pcidev, const struct pci_device_id *id)
                         pci_write_config_byte(pcidev,0x42,(bTmp | 0xf0));
                         pci_write_config_byte(pcidev,0x5a,0xc0);
                         WriteLPCReg(0x28, 0x70 );
-                        if (via_ircc_open(pcidev, &info, 0x3076) == 0)
-                                rc=0;
+                        rc = via_ircc_open(pcidev, &info, 0x3076);
                 } else
                         rc = -ENODEV; //IR not turn on   
         } else { //Not VT1211
@@ -249,8 +248,7 @@ static int via_init_one(struct pci_dev *pcidev, const struct pci_device_id *id)
                         info.irq=FirIRQ;
                         info.dma=FirDRQ1;
                         info.dma2=FirDRQ0;
-                        if (via_ircc_open(pcidev, &info, 0x3096) == 0)
-                                rc=0;
+                        rc = via_ircc_open(pcidev, &info, 0x3096);
                 } else
                         rc = -ENODEV; //IR not turn on !!!!!
         }//Not VT1211
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index d0f9c2fd1d4f..16b43bf544b7 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -739,6 +739,10 @@ static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[])
                         return -EADDRNOTAVAIL;
         }
 
+        if (data && data[IFLA_MACVLAN_FLAGS] &&
+            nla_get_u16(data[IFLA_MACVLAN_FLAGS]) & ~MACVLAN_FLAG_NOPROMISC)
+                return -EINVAL;
+
         if (data && data[IFLA_MACVLAN_MODE]) {
                 switch (nla_get_u32(data[IFLA_MACVLAN_MODE])) {
                 case MACVLAN_MODE_PRIVATE:
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index a98fb0ed6aef..ea53abb20988 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -68,6 +68,8 @@ static const struct proto_ops macvtap_socket_ops;
 #define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \
                       NETIF_F_TSO6 | NETIF_F_UFO)
 #define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO)
+#define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG)
+
 /*
  * RCU usage:
  * The macvtap_queue and the macvlan_dev are loosely coupled, the
@@ -278,7 +280,8 @@ static int macvtap_forward(struct net_device *dev, struct sk_buff *skb)
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
         struct macvtap_queue *q = macvtap_get_queue(dev, skb);
-        netdev_features_t features;
+        netdev_features_t features = TAP_FEATURES;
+
         if (!q)
                 goto drop;
 
@@ -287,9 +290,11 @@ static int macvtap_forward(struct net_device *dev, struct sk_buff *skb)
 
         skb->dev = dev;
         /* Apply the forward feature mask so that we perform segmentation
-         * according to users wishes.
+         * according to users wishes.  This only works if VNET_HDR is
+         * enabled.
          */
-        features = netif_skb_features(skb) & vlan->tap_features;
+        if (q->flags & IFF_VNET_HDR)
+                features |= vlan->tap_features;
         if (netif_needs_gso(skb, features)) {
                 struct sk_buff *segs = __skb_gso_segment(skb, features, false);
 
@@ -818,10 +823,13 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
                 skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
                 skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
         }
-        if (vlan)
+        if (vlan) {
+                local_bh_disable();
                 macvlan_start_xmit(skb, vlan->dev);
-        else
+                local_bh_enable();
+        } else {
                 kfree_skb(skb);
+        }
         rcu_read_unlock();
 
         return total_len;
@@ -912,8 +920,11 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
 done:
         rcu_read_lock();
         vlan = rcu_dereference(q->vlan);
-        if (vlan)
+        if (vlan) {
+                preempt_disable();
                 macvlan_count_rx(vlan, copied - vnet_hdr_len, ret == 0, 0);
+                preempt_enable();
+        }
         rcu_read_unlock();
 
         return ret ? ret : copied;
@@ -1058,8 +1069,7 @@ static int set_offload(struct macvtap_queue *q, unsigned long arg)
         /* tap_features are the same as features on tun/tap and
          * reflect user expectations.
          */
-        vlan->tap_features = vlan->dev->features &
-                            (feature_mask | ~TUN_OFFLOADS);
+        vlan->tap_features = feature_mask;
         vlan->set_features = features;
         netdev_update_features(vlan->dev);
 
@@ -1155,10 +1165,6 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
                             TUN_F_TSO_ECN | TUN_F_UFO))
                         return -EINVAL;
 
-                /* TODO: only accept frames with the features that
-                         got enabled for forwarded frames */
-                if (!(q->flags & IFF_VNET_HDR))
-                        return  -EINVAL;
                 rtnl_lock();
                 ret = set_offload(q, arg);
                 rtnl_unlock();
diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
index 8e7af8354342..138de837977f 100644
--- a/drivers/net/phy/realtek.c
+++ b/drivers/net/phy/realtek.c
@@ -23,7 +23,7 @@
 #define RTL821x_INER_INIT       0x6400
 #define RTL821x_INSR            0x13
 
-#define RTL8211E_INER_LINK_STAT 0x10
+#define RTL8211E_INER_LINK_STATUS       0x400
 
 MODULE_DESCRIPTION("Realtek PHY driver");
 MODULE_AUTHOR("Johnson Leung");
@@ -57,7 +57,7 @@ static int rtl8211e_config_intr(struct phy_device *phydev)
 
         if (phydev->interrupts == PHY_INTERRUPT_ENABLED)
                 err = phy_write(phydev, RTL821x_INER,
-                                RTL8211E_INER_LINK_STAT);
+                                RTL8211E_INER_LINK_STATUS);
         else
                 err = phy_write(phydev, RTL821x_INER, 0);
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index db690a372260..71af122edf2d 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1074,8 +1074,9 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
         u32 rxhash;
 
         if (!(tun->flags & TUN_NO_PI)) {
-                if ((len -= sizeof(pi)) > total_len)
+                if (len < sizeof(pi))
                         return -EINVAL;
+                len -= sizeof(pi);
 
                 if (memcpy_fromiovecend((void *)&pi, iv, 0, sizeof(pi)))
                         return -EFAULT;
@@ -1083,8 +1084,9 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
         }
 
         if (tun->flags & TUN_VNET_HDR) {
-                if ((len -= tun->vnet_hdr_sz) > total_len)
+                if (len < tun->vnet_hdr_sz)
                         return -EINVAL;
+                len -= tun->vnet_hdr_sz;
 
                 if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso)))
                         return -EFAULT;
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 872819851aef..25ba7eca9a13 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -400,6 +400,10 @@ static const struct usb_device_id mbim_devs[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68a2, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
           .driver_info = (unsigned long)&cdc_mbim_info_zlp,
         },
+        /* HP hs2434 Mobile Broadband Module needs ZLPs */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x3f0, 0x4b1d, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&cdc_mbim_info_zlp,
+        },
         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
           .driver_info = (unsigned long)&cdc_mbim_info,
         },
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index cba1d46e672e..86292e6aaf49 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2816,13 +2816,16 @@ exit:
 static int hso_get_config_data(struct usb_interface *interface)
 {
         struct usb_device *usbdev = interface_to_usbdev(interface);
-        u8 config_data[17];
+        u8 *config_data = kmalloc(17, GFP_KERNEL);
         u32 if_num = interface->altsetting->desc.bInterfaceNumber;
         s32 result;
 
+        if (!config_data)
+                return -ENOMEM;
         if (usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
                             0x86, 0xC0, 0, 0, config_data, 17,
                             USB_CTRL_SET_TIMEOUT) != 0x11) {
+                kfree(config_data);
                 return -EIO;
         }
 
@@ -2873,6 +2876,7 @@ static int hso_get_config_data(struct usb_interface *interface)
         if (config_data[16] & 0x1)
                 result |= HSO_INFO_CRC_BUG;
 
+        kfree(config_data);
         return result;
 }
 
@@ -2886,6 +2890,11 @@ static int hso_probe(struct usb_interface *interface,
         struct hso_shared_int *shared_int;
         struct hso_device *tmp_dev = NULL;
 
+        if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) {
+                dev_err(&interface->dev, "Not our interface\n");
+                return -ENODEV;
+        }
+
         if_num = interface->altsetting->desc.bInterfaceNumber;
 
         /* Get the interface/port specification from either driver_info or from
@@ -2895,10 +2904,6 @@ static int hso_probe(struct usb_interface *interface,
         else
                 port_spec = hso_get_config_data(interface);
 
-        if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) {
-                dev_err(&interface->dev, "Not our interface\n");
-                return -ENODEV;
-        }
         /* Check if we need to switch to alt interfaces prior to port
          * configuration */
         if (interface->num_altsetting > 1)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index f4c6db419ddb..767f7af3bd40 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1386,7 +1386,7 @@ static int vxlan_open(struct net_device *dev)
                 return -ENOTCONN;
 
         if (IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip)) &&
-            ! vxlan_group_used(vn, vxlan->default_dst.remote_ip)) {
+            vxlan_group_used(vn, vxlan->default_dst.remote_ip)) {
                 vxlan_sock_hold(vs);
                 dev_hold(dev);
                 queue_work(vxlan_wq, &vxlan->igmp_join);
@@ -1793,8 +1793,6 @@ static void vxlan_dellink(struct net_device *dev, struct list_head *head)
         struct vxlan_net *vn = net_generic(dev_net(dev), vxlan_net_id);
         struct vxlan_dev *vxlan = netdev_priv(dev);
 
-        flush_workqueue(vxlan_wq);
-
         spin_lock(&vn->sock_lock);
         hlist_del_rcu(&vxlan->hlist);
         spin_unlock(&vn->sock_lock);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index e602c9519709..c028df76b564 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -448,6 +448,7 @@ static void ath9k_htc_tx_process(struct ath9k_htc_priv *priv,
         struct ieee80211_conf *cur_conf = &priv->hw->conf;
         bool txok;
         int slot;
+        int hdrlen, padsize;
 
         slot = strip_drv_header(priv, skb);
         if (slot < 0) {
@@ -504,6 +505,15 @@ send_mac80211:
 
         ath9k_htc_tx_clear_slot(priv, slot);
 
+        /* Remove padding before handing frame back to mac80211 */
+        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+
+        padsize = hdrlen & 3;
+        if (padsize && skb->len > hdrlen + padsize) {
+                memmove(skb->data + padsize, skb->data, hdrlen);
+                skb_pull(skb, padsize);
+        }
+
         /* Send status to mac80211 */
         ieee80211_tx_status(priv->hw, skb);
 }
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 16f8b201642b..026a2a067b46 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -802,7 +802,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 IEEE80211_HW_PS_NULLFUNC_STACK |
                 IEEE80211_HW_SPECTRUM_MGMT |
                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
-                IEEE80211_HW_SUPPORTS_RC_TABLE;
+                IEEE80211_HW_SUPPORTS_RC_TABLE |
+                IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
                 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 1737a3e33685..cb5a65553ac7 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -173,8 +173,7 @@ static void ath_restart_work(struct ath_softc *sc)
 {
         ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
 
-        if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9485(sc->sc_ah) ||
-            AR_SREV_9550(sc->sc_ah))
+        if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9330(sc->sc_ah))
                 ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
                                      msecs_to_jiffies(ATH_PLL_WORK_INTERVAL));
 
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 4a33c6e39ca2..349fa22a921a 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1860,7 +1860,8 @@ void *carl9170_alloc(size_t priv_size)
                      IEEE80211_HW_PS_NULLFUNC_STACK |
                      IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC |
                      IEEE80211_HW_SUPPORTS_RC_TABLE |
-                     IEEE80211_HW_SIGNAL_DBM;
+                     IEEE80211_HW_SIGNAL_DBM |
+                     IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
 
         if (!modparam_noht) {
                 /*
diff --git a/drivers/net/wireless/cw1200/sta.c b/drivers/net/wireless/cw1200/sta.c
index 7365674366f4..010b252be584 100644
--- a/drivers/net/wireless/cw1200/sta.c
+++ b/drivers/net/wireless/cw1200/sta.c
@@ -1406,11 +1406,8 @@ static void cw1200_do_unjoin(struct cw1200_common *priv)
         if (!priv->join_status)
                 goto done;
 
-        if (priv->join_status > CW1200_JOIN_STATUS_IBSS) {
-                wiphy_err(priv->hw->wiphy, "Unexpected: join status: %d\n",
-                          priv->join_status);
-                BUG_ON(1);
-        }
+        if (priv->join_status == CW1200_JOIN_STATUS_AP)
+                goto done;
 
         cancel_work_sync(&priv->update_filtering_work);
         cancel_work_sync(&priv->set_beacon_wakeup_period_work);
diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
index ac074731335a..e5090309824e 100644
--- a/drivers/net/wireless/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
@@ -523,9 +523,9 @@ static int prism2_ioctl_giwaplist(struct net_device *dev,
 
         data->length = prism2_ap_get_sta_qual(local, addr, qual, IW_MAX_AP, 1);
 
-        memcpy(extra, &addr, sizeof(struct sockaddr) * data->length);
+        memcpy(extra, addr, sizeof(struct sockaddr) * data->length);
         data->flags = 1; /* has quality information */
-        memcpy(extra + sizeof(struct sockaddr) * data->length, &qual,
+        memcpy(extra + sizeof(struct sockaddr) * data->length, qual,
                sizeof(struct iw_quality) * data->length);
 
         kfree(addr);
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index b9b2bb51e605..7acf5ee23582 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -4460,13 +4460,13 @@ il4965_irq_tasklet(struct il_priv *il)
                  * is killed. Hence update the killswitch state here. The
                  * rfkill handler will care about restarting if needed.
                  */
-                if (!test_bit(S_ALIVE, &il->status)) {
-                        if (hw_rf_kill)
-                                set_bit(S_RFKILL, &il->status);
-                        else
-                                clear_bit(S_RFKILL, &il->status);
-                        wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill);
+                if (hw_rf_kill) {
+                        set_bit(S_RFKILL, &il->status);
+                } else {
+                        clear_bit(S_RFKILL, &il->status);
+                        il_force_reset(il, true);
                 }
+                wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill);
 
                 handled |= CSR_INT_BIT_RF_KILL;
         }
@@ -5334,6 +5334,9 @@ il4965_alive_start(struct il_priv *il)
 
         il->active_rate = RATES_MASK;
 
+        il_power_update_mode(il, true);
+        D_INFO("Updated power mode\n");
+
         if (il_is_associated(il)) {
                 struct il_rxon_cmd *active_rxon =
                     (struct il_rxon_cmd *)&il->active;
@@ -5364,9 +5367,6 @@ il4965_alive_start(struct il_priv *il)
         D_INFO("ALIVE processing complete.\n");
         wake_up(&il->wait_command_queue);
 
-        il_power_update_mode(il, true);
-        D_INFO("Updated power mode\n");
-
         return;
 
 restart:
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index 3195aad440dd..b03e22ef5462 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -4660,6 +4660,7 @@ il_force_reset(struct il_priv *il, bool external)
 
         return 0;
 }
+EXPORT_SYMBOL(il_force_reset);
 
 int
 il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 822f1a00efbb..319387263e12 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1068,7 +1068,10 @@ void iwl_chswitch_done(struct iwl_priv *priv, bool is_success)
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-        if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+        if (!test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+                return;
+
+        if (ctx->vif)
                 ieee80211_chswitch_done(ctx->vif, is_success);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index a70c7b9d9bad..ff8cc75c189d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -97,8 +97,6 @@
 
 #define APMG_PCIDEV_STT_VAL_L1_ACT_DIS          (0x00000800)
 
-#define APMG_RTC_INT_STT_RFKILL         (0x10000000)
-
 /* Device system time */
 #define DEVICE_SYSTEM_TIME_REG 0xA0206C
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index ad9bbca99213..7fd6fbfbc1b3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -138,6 +138,20 @@ static void iwl_mvm_roc_finished(struct iwl_mvm *mvm)
         schedule_work(&mvm->roc_done_wk);
 }
 
+static bool iwl_mvm_te_check_disconnect(struct iwl_mvm *mvm,
+                                        struct ieee80211_vif *vif,
+                                        const char *errmsg)
+{
+        if (vif->type != NL80211_IFTYPE_STATION)
+                return false;
+        if (vif->bss_conf.assoc && vif->bss_conf.dtim_period)
+                return false;
+        if (errmsg)
+                IWL_ERR(mvm, "%s\n", errmsg);
+        ieee80211_connection_loss(vif);
+        return true;
+}
+
 /*
  * Handles a FW notification for an event that is known to the driver.
  *
@@ -163,8 +177,13 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
          * P2P Device discoveribility, while there are other higher priority
          * events in the system).
          */
-        WARN_ONCE(!le32_to_cpu(notif->status),
-                  "Failed to schedule time event\n");
+        if (WARN_ONCE(!le32_to_cpu(notif->status),
+                      "Failed to schedule time event\n")) {
+                if (iwl_mvm_te_check_disconnect(mvm, te_data->vif, NULL)) {
+                        iwl_mvm_te_clear_data(mvm, te_data);
+                        return;
+                }
+        }
 
         if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_END) {
                 IWL_DEBUG_TE(mvm,
@@ -180,14 +199,8 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
                  * By now, we should have finished association
                  * and know the dtim period.
                  */
-                if (te_data->vif->type == NL80211_IFTYPE_STATION &&
-                    (!te_data->vif->bss_conf.assoc ||
-                     !te_data->vif->bss_conf.dtim_period)) {
-                        IWL_ERR(mvm,
-                                "No assocation and the time event is over already...\n");
-                        ieee80211_connection_loss(te_data->vif);
-                }
-
+                iwl_mvm_te_check_disconnect(mvm, te_data->vif,
+                        "No assocation and the time event is over already...");
                 iwl_mvm_te_clear_data(mvm, te_data);
         } else if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_START) {
                 te_data->running = true;
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index f600e68a410a..fd848cd1583e 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -888,14 +888,6 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
 
                 iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
                 if (hw_rfkill) {
-                        /*
-                         * Clear the interrupt in APMG if the NIC is going down.
-                         * Note that when the NIC exits RFkill (else branch), we
-                         * can't access prph and the NIC will be reset in
-                         * start_hw anyway.
-                         */
-                        iwl_write_prph(trans, APMG_RTC_INT_STT_REG,
-                                       APMG_RTC_INT_STT_RFKILL);
                         set_bit(STATUS_RFKILL, &trans_pcie->status);
                         if (test_and_clear_bit(STATUS_HCMD_ACTIVE,
                                                &trans_pcie->status))
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 96cfcdd39079..390e2f058aff 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1502,16 +1502,16 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         spin_lock_init(&trans_pcie->reg_lock);
         init_waitqueue_head(&trans_pcie->ucode_write_waitq);
 
-        /* W/A - seems to solve weird behavior. We need to remove this if we
-         * don't want to stay in L1 all the time. This wastes a lot of power */
-        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
-                               PCIE_LINK_STATE_CLKPM);
-
         if (pci_enable_device(pdev)) {
                 err = -ENODEV;
                 goto out_no_pci;
         }
 
+        /* W/A - seems to solve weird behavior. We need to remove this if we
+         * don't want to stay in L1 all the time. This wastes a lot of power */
+        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
+                               PCIE_LINK_STATE_CLKPM);
+
         pci_set_master(pdev);
 
         err = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 1f80ea5e29dd..1b41c8eda12d 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -6133,7 +6133,8 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK |
             IEEE80211_HW_AMPDU_AGGREGATION |
-            IEEE80211_HW_REPORTS_TX_ACK_STATUS;
+            IEEE80211_HW_REPORTS_TX_ACK_STATUS |
+            IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
 
         /*
          * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING for USB devices
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index 4941f201d6c8..b8ba1f925e75 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -98,10 +98,12 @@ static int zd1201_fw_upload(struct usb_device *dev, int apfw)
                 goto exit;
 
         err = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), 0x4,
-            USB_DIR_IN | 0x40, 0,0, &ret, sizeof(ret), ZD1201_FW_TIMEOUT);
+            USB_DIR_IN | 0x40, 0, 0, buf, sizeof(ret), ZD1201_FW_TIMEOUT);
         if (err < 0)
                 goto exit;
 
+        memcpy(&ret, buf, sizeof(ret));
+
         if (ret & 0x80) {
                 err = -EIO;
                 goto exit;
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 6bb7cf2de556..b10ba00cc3e6 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -392,6 +392,8 @@ static void __unflatten_device_tree(struct boot_param_header *blob,
         mem = (unsigned long)
                 dt_alloc(size + 4, __alignof__(struct device_node));
 
+        memset((void *)mem, 0, size);
+
         ((__be32 *)mem)[size / 4] = cpu_to_be32(0xdeadbeef);
 
         pr_debug("  unflattening %lx...\n", mem);
diff --git a/drivers/pinctrl/pinctrl-sunxi.c b/drivers/pinctrl/pinctrl-sunxi.c
index c47fd1e5450b..94716c779800 100644
--- a/drivers/pinctrl/pinctrl-sunxi.c
+++ b/drivers/pinctrl/pinctrl-sunxi.c
@@ -278,6 +278,7 @@ static int sunxi_pconf_group_set(struct pinctrl_dev *pctldev,
 {
         struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
         struct sunxi_pinctrl_group *g = &pctl->groups[group];
+        unsigned long flags;
         u32 val, mask;
         u16 strength;
         u8 dlevel;
@@ -295,22 +296,35 @@ static int sunxi_pconf_group_set(struct pinctrl_dev *pctldev,
                  *   3: 40mA
                  */
                 dlevel = strength / 10 - 1;
+
+                spin_lock_irqsave(&pctl->lock, flags);
+
                 val = readl(pctl->membase + sunxi_dlevel_reg(g->pin));
                 mask = DLEVEL_PINS_MASK << sunxi_dlevel_offset(g->pin);
                 writel((val & ~mask) | dlevel << sunxi_dlevel_offset(g->pin),
                         pctl->membase + sunxi_dlevel_reg(g->pin));
+
+                spin_unlock_irqrestore(&pctl->lock, flags);
                 break;
         case PIN_CONFIG_BIAS_PULL_UP:
+                spin_lock_irqsave(&pctl->lock, flags);
+
                 val = readl(pctl->membase + sunxi_pull_reg(g->pin));
                 mask = PULL_PINS_MASK << sunxi_pull_offset(g->pin);
                 writel((val & ~mask) | 1 << sunxi_pull_offset(g->pin),
                         pctl->membase + sunxi_pull_reg(g->pin));
+
+                spin_unlock_irqrestore(&pctl->lock, flags);
                 break;
         case PIN_CONFIG_BIAS_PULL_DOWN:
+                spin_lock_irqsave(&pctl->lock, flags);
+
                 val = readl(pctl->membase + sunxi_pull_reg(g->pin));
                 mask = PULL_PINS_MASK << sunxi_pull_offset(g->pin);
                 writel((val & ~mask) | 2 << sunxi_pull_offset(g->pin),
                         pctl->membase + sunxi_pull_reg(g->pin));
+
+                spin_unlock_irqrestore(&pctl->lock, flags);
                 break;
         default:
                 break;
@@ -360,11 +374,17 @@ static void sunxi_pmx_set(struct pinctrl_dev *pctldev,
                                  u8 config)
 {
         struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
+        unsigned long flags;
+        u32 val, mask;
+
+        spin_lock_irqsave(&pctl->lock, flags);
 
-        u32 val = readl(pctl->membase + sunxi_mux_reg(pin));
-        u32 mask = MUX_PINS_MASK << sunxi_mux_offset(pin);
+        val = readl(pctl->membase + sunxi_mux_reg(pin));
+        mask = MUX_PINS_MASK << sunxi_mux_offset(pin);
         writel((val & ~mask) | config << sunxi_mux_offset(pin),
                 pctl->membase + sunxi_mux_reg(pin));
+
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 
 static int sunxi_pmx_enable(struct pinctrl_dev *pctldev,
@@ -464,8 +484,21 @@ static void sunxi_pinctrl_gpio_set(struct gpio_chip *chip,
         struct sunxi_pinctrl *pctl = dev_get_drvdata(chip->dev);
         u32 reg = sunxi_data_reg(offset);
         u8 index = sunxi_data_offset(offset);
+        unsigned long flags;
+        u32 regval;
+
+        spin_lock_irqsave(&pctl->lock, flags);
+
+        regval = readl(pctl->membase + reg);
 
-        writel((value & DATA_PINS_MASK) << index, pctl->membase + reg);
+        if (value)
+                regval |= BIT(index);
+        else
+                regval &= ~(BIT(index));
+
+        writel(regval, pctl->membase + reg);
+
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 
 static int sunxi_pinctrl_gpio_of_xlate(struct gpio_chip *gc,
@@ -526,6 +559,8 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d,
         struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
         u32 reg = sunxi_irq_cfg_reg(d->hwirq);
         u8 index = sunxi_irq_cfg_offset(d->hwirq);
+        unsigned long flags;
+        u32 regval;
         u8 mode;
 
         switch (type) {
@@ -548,7 +583,13 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d,
                 return -EINVAL;
         }
 
-        writel((mode & IRQ_CFG_IRQ_MASK) << index, pctl->membase + reg);
+        spin_lock_irqsave(&pctl->lock, flags);
+
+        regval = readl(pctl->membase + reg);
+        regval &= ~IRQ_CFG_IRQ_MASK;
+        writel(regval | (mode << index), pctl->membase + reg);
+
+        spin_unlock_irqrestore(&pctl->lock, flags);
 
         return 0;
 }
@@ -560,14 +601,19 @@ static void sunxi_pinctrl_irq_mask_ack(struct irq_data *d)
         u8 ctrl_idx = sunxi_irq_ctrl_offset(d->hwirq);
         u32 status_reg = sunxi_irq_status_reg(d->hwirq);
         u8 status_idx = sunxi_irq_status_offset(d->hwirq);
+        unsigned long flags;
         u32 val;
 
+        spin_lock_irqsave(&pctl->lock, flags);
+
         /* Mask the IRQ */
         val = readl(pctl->membase + ctrl_reg);
         writel(val & ~(1 << ctrl_idx), pctl->membase + ctrl_reg);
 
         /* Clear the IRQ */
         writel(1 << status_idx, pctl->membase + status_reg);
+
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 
 static void sunxi_pinctrl_irq_mask(struct irq_data *d)
@@ -575,11 +621,16 @@ static void sunxi_pinctrl_irq_mask(struct irq_data *d)
         struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
         u32 reg = sunxi_irq_ctrl_reg(d->hwirq);
         u8 idx = sunxi_irq_ctrl_offset(d->hwirq);
+        unsigned long flags;
         u32 val;
 
+        spin_lock_irqsave(&pctl->lock, flags);
+
         /* Mask the IRQ */
         val = readl(pctl->membase + reg);
         writel(val & ~(1 << idx), pctl->membase + reg);
+
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 
 static void sunxi_pinctrl_irq_unmask(struct irq_data *d)
@@ -588,6 +639,7 @@ static void sunxi_pinctrl_irq_unmask(struct irq_data *d)
         struct sunxi_desc_function *func;
         u32 reg = sunxi_irq_ctrl_reg(d->hwirq);
         u8 idx = sunxi_irq_ctrl_offset(d->hwirq);
+        unsigned long flags;
         u32 val;
 
         func = sunxi_pinctrl_desc_find_function_by_pin(pctl,
@@ -597,9 +649,13 @@ static void sunxi_pinctrl_irq_unmask(struct irq_data *d)
         /* Change muxing to INT mode */
         sunxi_pmx_set(pctl->pctl_dev, pctl->irq_array[d->hwirq], func->muxval);
 
+        spin_lock_irqsave(&pctl->lock, flags);
+
         /* Unmask the IRQ */
         val = readl(pctl->membase + reg);
         writel(val | (1 << idx), pctl->membase + reg);
+
+        spin_unlock_irqrestore(&pctl->lock, flags);
 }
 
 static struct irq_chip sunxi_pinctrl_irq_chip = {
@@ -752,6 +808,8 @@ static int sunxi_pinctrl_probe(struct platform_device *pdev)
                 return -ENOMEM;
         platform_set_drvdata(pdev, pctl);
 
+        spin_lock_init(&pctl->lock);
+
         pctl->membase = of_iomap(node, 0);
         if (!pctl->membase)
                 return -ENOMEM;
diff --git a/drivers/pinctrl/pinctrl-sunxi.h b/drivers/pinctrl/pinctrl-sunxi.h
index d68047d8f699..01c494f8a14f 100644
--- a/drivers/pinctrl/pinctrl-sunxi.h
+++ b/drivers/pinctrl/pinctrl-sunxi.h
@@ -14,6 +14,7 @@
 #define __PINCTRL_SUNXI_H
 
 #include <linux/kernel.h>
+#include <linux/spinlock.h>
 
 #define PA_BASE 0
 #define PB_BASE 32
@@ -407,6 +408,7 @@ struct sunxi_pinctrl {
         unsigned                        ngroups;
         int                             irq;
         int                             irq_array[SUNXI_IRQ_NUMBER];
+        spinlock_t                      lock;
         struct pinctrl_dev              *pctl_dev;
 };
 
diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c
index 0f9f8596b300..f9119525f557 100644
--- a/drivers/platform/olpc/olpc-ec.c
+++ b/drivers/platform/olpc/olpc-ec.c
@@ -330,7 +330,7 @@ static int __init olpc_ec_init_module(void)
         return platform_driver_register(&olpc_ec_plat_driver);
 }
 
-module_init(olpc_ec_init_module);
+arch_initcall(olpc_ec_init_module);
 
 MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 97bb05edcb5a..d6970f47ae72 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -53,7 +53,6 @@ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
 #define HPWMI_ALS_QUERY 0x3
 #define HPWMI_HARDWARE_QUERY 0x4
 #define HPWMI_WIRELESS_QUERY 0x5
-#define HPWMI_BIOS_QUERY 0x9
 #define HPWMI_HOTKEY_QUERY 0xc
 #define HPWMI_WIRELESS2_QUERY 0x1b
 #define HPWMI_POSTCODEERROR_QUERY 0x2a
@@ -293,19 +292,6 @@ static int hp_wmi_tablet_state(void)
         return (state & 0x4) ? 1 : 0;
 }
 
-static int hp_wmi_enable_hotkeys(void)
-{
-        int ret;
-        int query = 0x6e;
-
-        ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &query, sizeof(query),
-                                   0);
-
-        if (ret)
-                return -EINVAL;
-        return 0;
-}
-
 static int hp_wmi_set_block(void *data, bool blocked)
 {
         enum hp_wmi_radio r = (enum hp_wmi_radio) data;
@@ -1009,8 +995,6 @@ static int __init hp_wmi_init(void)
                 err = hp_wmi_input_setup();
                 if (err)
                         return err;
-
-                hp_wmi_enable_hotkeys();
         }
 
         if (bios_capable) {
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index 2ac045f27f10..3a1b6bf326a8 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -2440,7 +2440,10 @@ static ssize_t sony_nc_gfx_switch_status_show(struct device *dev,
         if (pos < 0)
                 return pos;
 
-        return snprintf(buffer, PAGE_SIZE, "%s\n", pos ? "speed" : "stamina");
+        return snprintf(buffer, PAGE_SIZE, "%s\n",
+                                        pos == SPEED ? "speed" :
+                                        pos == STAMINA ? "stamina" :
+                                        pos == AUTO ? "auto" : "unknown");
 }
 
 static int sony_nc_gfx_switch_setup(struct platform_device *pd,
@@ -4320,7 +4323,8 @@ static int sony_pic_add(struct acpi_device *device)
                 goto err_free_resources;
         }
 
-        if (sonypi_compat_init())
+        result = sonypi_compat_init();
+        if (result)
                 goto err_remove_input;
 
         /* request io port */
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 1d4c8fe72752..c82fe65c4128 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -102,10 +102,13 @@ static void zfcp_erp_action_dismiss_port(struct zfcp_port *port)
 
         if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_INUSE)
                 zfcp_erp_action_dismiss(&port->erp_action);
-        else
-                shost_for_each_device(sdev, port->adapter->scsi_host)
+        else {
+                spin_lock(port->adapter->scsi_host->host_lock);
+                __shost_for_each_device(sdev, port->adapter->scsi_host)
                         if (sdev_to_zfcp(sdev)->port == port)
                                 zfcp_erp_action_dismiss_lun(sdev);
+                spin_unlock(port->adapter->scsi_host->host_lock);
+        }
 }
 
 static void zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *adapter)
@@ -592,9 +595,11 @@ static void _zfcp_erp_lun_reopen_all(struct zfcp_port *port, int clear,
 {
         struct scsi_device *sdev;
 
-        shost_for_each_device(sdev, port->adapter->scsi_host)
+        spin_lock(port->adapter->scsi_host->host_lock);
+        __shost_for_each_device(sdev, port->adapter->scsi_host)
                 if (sdev_to_zfcp(sdev)->port == port)
                         _zfcp_erp_lun_reopen(sdev, clear, id, 0);
+        spin_unlock(port->adapter->scsi_host->host_lock);
 }
 
 static void zfcp_erp_strategy_followup_failed(struct zfcp_erp_action *act)
@@ -1434,8 +1439,10 @@ void zfcp_erp_set_adapter_status(struct zfcp_adapter *adapter, u32 mask)
                 atomic_set_mask(common_mask, &port->status);
         read_unlock_irqrestore(&adapter->port_list_lock, flags);
 
-        shost_for_each_device(sdev, adapter->scsi_host)
+        spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
+        __shost_for_each_device(sdev, adapter->scsi_host)
                 atomic_set_mask(common_mask, &sdev_to_zfcp(sdev)->status);
+        spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
 }
 
 /**
@@ -1469,11 +1476,13 @@ void zfcp_erp_clear_adapter_status(struct zfcp_adapter *adapter, u32 mask)
         }
         read_unlock_irqrestore(&adapter->port_list_lock, flags);
 
-        shost_for_each_device(sdev, adapter->scsi_host) {
+        spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
+        __shost_for_each_device(sdev, adapter->scsi_host) {
                 atomic_clear_mask(common_mask, &sdev_to_zfcp(sdev)->status);
                 if (clear_counter)
                         atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0);
         }
+        spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
 }
 
 /**
@@ -1487,16 +1496,19 @@ void zfcp_erp_set_port_status(struct zfcp_port *port, u32 mask)
 {
         struct scsi_device *sdev;
         u32 common_mask = mask & ZFCP_COMMON_FLAGS;
+        unsigned long flags;
 
         atomic_set_mask(mask, &port->status);
 
         if (!common_mask)
                 return;
 
-        shost_for_each_device(sdev, port->adapter->scsi_host)
+        spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags);
+        __shost_for_each_device(sdev, port->adapter->scsi_host)
                 if (sdev_to_zfcp(sdev)->port == port)
                         atomic_set_mask(common_mask,
                                         &sdev_to_zfcp(sdev)->status);
+        spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags);
 }
 
 /**
@@ -1511,6 +1523,7 @@ void zfcp_erp_clear_port_status(struct zfcp_port *port, u32 mask)
         struct scsi_device *sdev;
         u32 common_mask = mask & ZFCP_COMMON_FLAGS;
         u32 clear_counter = mask & ZFCP_STATUS_COMMON_ERP_FAILED;
+        unsigned long flags;
 
         atomic_clear_mask(mask, &port->status);
 
@@ -1520,13 +1533,15 @@ void zfcp_erp_clear_port_status(struct zfcp_port *port, u32 mask)
         if (clear_counter)
                 atomic_set(&port->erp_counter, 0);
 
-        shost_for_each_device(sdev, port->adapter->scsi_host)
+        spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags);
+        __shost_for_each_device(sdev, port->adapter->scsi_host)
                 if (sdev_to_zfcp(sdev)->port == port) {
                         atomic_clear_mask(common_mask,
                                           &sdev_to_zfcp(sdev)->status);
                         if (clear_counter)
                                 atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0);
                 }
+        spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags);
 }
 
 /**
diff --git a/drivers/s390/scsi/zfcp_qdio.c b/drivers/s390/scsi/zfcp_qdio.c
index 665e3cfaaf85..de0598eaacd2 100644
--- a/drivers/s390/scsi/zfcp_qdio.c
+++ b/drivers/s390/scsi/zfcp_qdio.c
@@ -224,11 +224,9 @@ int zfcp_qdio_sbals_from_sg(struct zfcp_qdio *qdio, struct zfcp_qdio_req *q_req,
 
 static int zfcp_qdio_sbal_check(struct zfcp_qdio *qdio)
 {
-        spin_lock_irq(&qdio->req_q_lock);
         if (atomic_read(&qdio->req_q_free) ||
             !(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP))
                 return 1;
-        spin_unlock_irq(&qdio->req_q_lock);
         return 0;
 }
 
@@ -246,9 +244,8 @@ int zfcp_qdio_sbal_get(struct zfcp_qdio *qdio)
 {
         long ret;
 
-        spin_unlock_irq(&qdio->req_q_lock);
-        ret = wait_event_interruptible_timeout(qdio->req_q_wq,
-                               zfcp_qdio_sbal_check(qdio), 5 * HZ);
+        ret = wait_event_interruptible_lock_irq_timeout(qdio->req_q_wq,
+                       zfcp_qdio_sbal_check(qdio), qdio->req_q_lock, 5 * HZ);
 
         if (!(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP))
                 return -EIO;
@@ -262,7 +259,6 @@ int zfcp_qdio_sbal_get(struct zfcp_qdio *qdio)
                 zfcp_erp_adapter_reopen(qdio->adapter, 0, "qdsbg_1");
         }
 
-        spin_lock_irq(&qdio->req_q_lock);
         return -EIO;
 }
 
diff --git a/drivers/s390/scsi/zfcp_sysfs.c b/drivers/s390/scsi/zfcp_sysfs.c
index 3f01bbf0609f..890639274bcf 100644
--- a/drivers/s390/scsi/zfcp_sysfs.c
+++ b/drivers/s390/scsi/zfcp_sysfs.c
@@ -27,6 +27,16 @@ static ssize_t zfcp_sysfs_##_feat##_##_name##_show(struct device *dev,	       \
 static ZFCP_DEV_ATTR(_feat, _name, S_IRUGO,                                    \
                      zfcp_sysfs_##_feat##_##_name##_show, NULL);
 
+#define ZFCP_DEFINE_ATTR_CONST(_feat, _name, _format, _value)                  \
+static ssize_t zfcp_sysfs_##_feat##_##_name##_show(struct device *dev,         \
+                                                   struct device_attribute *at,\
+                                                   char *buf)                  \
+{                                                                              \
+        return sprintf(buf, _format, _value);                                  \
+}                                                                              \
+static ZFCP_DEV_ATTR(_feat, _name, S_IRUGO,                                    \
+                     zfcp_sysfs_##_feat##_##_name##_show, NULL);
+
 #define ZFCP_DEFINE_A_ATTR(_name, _format, _value)                           \
 static ssize_t zfcp_sysfs_adapter_##_name##_show(struct device *dev,         \
                                                  struct device_attribute *at,\
@@ -75,6 +85,8 @@ ZFCP_DEFINE_ATTR(zfcp_unit, unit, in_recovery, "%d\n",
 ZFCP_DEFINE_ATTR(zfcp_unit, unit, access_denied, "%d\n",
                  (zfcp_unit_sdev_status(unit) &
                   ZFCP_STATUS_COMMON_ACCESS_DENIED) != 0);
+ZFCP_DEFINE_ATTR_CONST(unit, access_shared, "%d\n", 0);
+ZFCP_DEFINE_ATTR_CONST(unit, access_readonly, "%d\n", 0);
 
 static ssize_t zfcp_sysfs_port_failed_show(struct device *dev,
                                            struct device_attribute *attr,
@@ -347,6 +359,8 @@ static struct attribute *zfcp_unit_attrs[] = {
         &dev_attr_unit_in_recovery.attr,
         &dev_attr_unit_status.attr,
         &dev_attr_unit_access_denied.attr,
+        &dev_attr_unit_access_shared.attr,
+        &dev_attr_unit_access_readonly.attr,
         NULL
 };
 static struct attribute_group zfcp_unit_attr_group = {
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 48b2918e0d65..92ff027746f2 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1353,7 +1353,6 @@ config SCSI_LPFC
         tristate "Emulex LightPulse Fibre Channel Support"
         depends on PCI && SCSI
         select SCSI_FC_ATTRS
-        select GENERIC_CSUM
         select CRC_T10DIF
         help
           This lpfc driver supports the Emulex LightPulse
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index 5456f5c73593..4a2195752198 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -221,7 +221,7 @@ static void init_default_table_values(struct pm8001_hba_info *pm8001_ha)
         pm8001_ha->main_cfg_tbl.pm8001_tbl.fatal_err_interrupt          = 0x01;
         for (i = 0; i < PM8001_MAX_INB_NUM; i++) {
                 pm8001_ha->inbnd_q_tbl[i].element_pri_size_cnt  =
-                        PM8001_MPI_QUEUE | (64 << 16) | (0x00<<30);
+                        PM8001_MPI_QUEUE | (pm8001_ha->iomb_size << 16) | (0x00<<30);
                 pm8001_ha->inbnd_q_tbl[i].upper_base_addr       =
                         pm8001_ha->memoryMap.region[IB + i].phys_addr_hi;
                 pm8001_ha->inbnd_q_tbl[i].lower_base_addr       =
@@ -247,7 +247,7 @@ static void init_default_table_values(struct pm8001_hba_info *pm8001_ha)
         }
         for (i = 0; i < PM8001_MAX_OUTB_NUM; i++) {
                 pm8001_ha->outbnd_q_tbl[i].element_size_cnt     =
-                        PM8001_MPI_QUEUE | (64 << 16) | (0x01<<30);
+                        PM8001_MPI_QUEUE | (pm8001_ha->iomb_size << 16) | (0x01<<30);
                 pm8001_ha->outbnd_q_tbl[i].upper_base_addr      =
                         pm8001_ha->memoryMap.region[OB + i].phys_addr_hi;
                 pm8001_ha->outbnd_q_tbl[i].lower_base_addr      =
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index 7f77210f5cf3..9f91030211e8 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -275,7 +275,7 @@ static void init_default_table_values(struct pm8001_hba_info *pm8001_ha)
 
         for (i = 0; i < PM8001_MAX_SPCV_INB_NUM; i++) {
                 pm8001_ha->inbnd_q_tbl[i].element_pri_size_cnt  =
-                        PM8001_MPI_QUEUE | (64 << 16) | (0x00<<30);
+                        PM8001_MPI_QUEUE | (pm8001_ha->iomb_size << 16) | (0x00<<30);
                 pm8001_ha->inbnd_q_tbl[i].upper_base_addr       =
                         pm8001_ha->memoryMap.region[IB + i].phys_addr_hi;
                 pm8001_ha->inbnd_q_tbl[i].lower_base_addr       =
@@ -301,7 +301,7 @@ static void init_default_table_values(struct pm8001_hba_info *pm8001_ha)
         }
         for (i = 0; i < PM8001_MAX_SPCV_OUTB_NUM; i++) {
                 pm8001_ha->outbnd_q_tbl[i].element_size_cnt     =
-                        PM8001_MPI_QUEUE | (64 << 16) | (0x01<<30);
+                        PM8001_MPI_QUEUE | (pm8001_ha->iomb_size << 16) | (0x01<<30);
                 pm8001_ha->outbnd_q_tbl[i].upper_base_addr      =
                         pm8001_ha->memoryMap.region[OB + i].phys_addr_hi;
                 pm8001_ha->outbnd_q_tbl[i].lower_base_addr      =
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index e25eba5713c1..b3b5125faa72 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -482,7 +482,7 @@ int comedi_device_attach(struct comedi_device *dev, struct comedi_devconfig *it)
                 ret = comedi_device_postconfig(dev);
         if (ret < 0) {
                 comedi_device_detach(dev);
-                module_put(dev->driver->module);
+                module_put(driv->module);
         }
         /* On success, the driver module count has been incremented. */
         return ret;
diff --git a/drivers/tty/hvc/hvsi_lib.c b/drivers/tty/hvc/hvsi_lib.c
index 3396eb9d57a3..ac2767100df5 100644
--- a/drivers/tty/hvc/hvsi_lib.c
+++ b/drivers/tty/hvc/hvsi_lib.c
@@ -341,8 +341,8 @@ void hvsilib_establish(struct hvsi_priv *pv)
 
         pr_devel("HVSI@%x:   ... waiting handshake\n", pv->termno);
 
-        /* Try for up to 200s */
-        for (timeout = 0; timeout < 20; timeout++) {
+        /* Try for up to 400ms */
+        for (timeout = 0; timeout < 40; timeout++) {
                 if (pv->established)
                         goto established;
                 if (!hvsi_get_packet(pv))
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 609dbc2f7151..83b4ef4dfcf8 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1119,11 +1119,11 @@ static int usbtmc_probe(struct usb_interface *intf,
         /* Determine if it is a Rigol or not */
         data->rigol_quirk = 0;
         dev_dbg(&intf->dev, "Trying to find if device Vendor 0x%04X Product 0x%04X has the RIGOL quirk\n",
-                data->usb_dev->descriptor.idVendor,
-                data->usb_dev->descriptor.idProduct);
+                le16_to_cpu(data->usb_dev->descriptor.idVendor),
+                le16_to_cpu(data->usb_dev->descriptor.idProduct));
         for(n = 0; usbtmc_id_quirk[n].idVendor > 0; n++) {
-                if ((usbtmc_id_quirk[n].idVendor == data->usb_dev->descriptor.idVendor) &&
-                    (usbtmc_id_quirk[n].idProduct == data->usb_dev->descriptor.idProduct)) {
+                if ((usbtmc_id_quirk[n].idVendor == le16_to_cpu(data->usb_dev->descriptor.idVendor)) &&
+                    (usbtmc_id_quirk[n].idProduct == le16_to_cpu(data->usb_dev->descriptor.idProduct))) {
                         dev_dbg(&intf->dev, "Setting this device as having the RIGOL quirk\n");
                         data->rigol_quirk = 1;
                         break;
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index a63598895077..5b44cd47da5b 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -78,6 +78,12 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x04d8, 0x000c), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
 
+        /* CarrolTouch 4000U */
+        { USB_DEVICE(0x04e7, 0x0009), .driver_info = USB_QUIRK_RESET_RESUME },
+
+        /* CarrolTouch 4500U */
+        { USB_DEVICE(0x04e7, 0x0030), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* Samsung Android phone modem - ID conflict with SPH-I500 */
         { USB_DEVICE(0x04e8, 0x6601), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index f80d0330d548..8e3c878f38cf 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1391,21 +1391,20 @@ iso_stream_schedule (
 
                 /* Behind the scheduling threshold? */
                 if (unlikely(start < next)) {
+                        unsigned now2 = (now - base) & (mod - 1);
 
                         /* USB_ISO_ASAP: Round up to the first available slot */
                         if (urb->transfer_flags & URB_ISO_ASAP)
                                 start += (next - start + period - 1) & -period;
 
                         /*
-                         * Not ASAP: Use the next slot in the stream.  If
-                         * the entire URB falls before the threshold, fail.
+                         * Not ASAP: Use the next slot in the stream,
+                         * no matter what.
                          */
-                        else if (start + span - period < next) {
-                                ehci_dbg(ehci, "iso urb late %p (%u+%u < %u)\n",
+                        else if (start + span - period < now2) {
+                                ehci_dbg(ehci, "iso underrun %p (%u+%u < %u)\n",
                                                 urb, start + base,
-                                                span - period, next + base);
-                                status = -EXDEV;
-                                goto fail;
+                                                span - period, now2 + base);
                         }
                 }
 
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index 08613e241894..279b04910f00 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -304,6 +304,13 @@ static int __init ohci_pci_init(void)
         pr_info("%s: " DRIVER_DESC "\n", hcd_name);
 
         ohci_init_driver(&ohci_pci_hc_driver, &pci_overrides);
+
+#ifdef  CONFIG_PM
+        /* Entries for the PCI suspend/resume callbacks are special */
+        ohci_pci_hc_driver.pci_suspend = ohci_suspend;
+        ohci_pci_hc_driver.pci_resume = ohci_resume;
+#endif
+
         return pci_register_driver(&ohci_pci_driver);
 }
 module_init(ohci_pci_init);
diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
index eb3c8c142fa9..eeb27208c0d1 100644
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -830,7 +830,7 @@ static int adu_probe(struct usb_interface *interface,
 
         /* let the user know what node this device is now attached to */
         dev_info(&interface->dev, "ADU%d %s now attached to /dev/usb/adutux%d\n",
-                 udev->descriptor.idProduct, dev->serial_number,
+                 le16_to_cpu(udev->descriptor.idProduct), dev->serial_number,
                  (dev->minor - ADU_MINOR_BASE));
 exit:
         dbg(2, " %s : leave, return value %p (dev)", __func__, dev);
diff --git a/drivers/usb/phy/phy-fsl-usb.h b/drivers/usb/phy/phy-fsl-usb.h
index ca266280895d..e1859b8ef567 100644
--- a/drivers/usb/phy/phy-fsl-usb.h
+++ b/drivers/usb/phy/phy-fsl-usb.h
@@ -15,7 +15,7 @@
  * 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
-#include "otg_fsm.h"
+#include "phy-fsm-usb.h"
 #include <linux/usb/otg.h>
 #include <linux/ioctl.h>
 
diff --git a/drivers/usb/phy/phy-fsm-usb.c b/drivers/usb/phy/phy-fsm-usb.c
index c520b3548e7c..7f4596606e18 100644
--- a/drivers/usb/phy/phy-fsm-usb.c
+++ b/drivers/usb/phy/phy-fsm-usb.c
@@ -29,7 +29,7 @@
 #include <linux/usb/gadget.h>
 #include <linux/usb/otg.h>
 
-#include "phy-otg-fsm.h"
+#include "phy-fsm-usb.h"
 
 /* Change USB protocol when there is a protocol change */
 static int otg_set_protocol(struct otg_fsm *fsm, int protocol)
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 5a979729f8ec..58c17fdc85eb 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -2303,7 +2303,7 @@ static int keyspan_startup(struct usb_serial *serial)
         if (d_details == NULL) {
                 dev_err(&serial->dev->dev, "%s - unknown product id %x\n",
                     __func__, le16_to_cpu(serial->dev->descriptor.idProduct));
-                return 1;
+                return -ENODEV;
         }
 
         /* Setup private data for serial driver */
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 51da424327b0..b01300164fc0 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -90,6 +90,7 @@ struct urbtracker {
         struct list_head        urblist_entry;
         struct kref             ref_count;
         struct urb              *urb;
+        struct usb_ctrlrequest  *setup;
 };
 
 enum mos7715_pp_modes {
@@ -271,6 +272,7 @@ static void destroy_urbtracker(struct kref *kref)
         struct mos7715_parport *mos_parport = urbtrack->mos_parport;
 
         usb_free_urb(urbtrack->urb);
+        kfree(urbtrack->setup);
         kfree(urbtrack);
         kref_put(&mos_parport->ref_count, destroy_mos_parport);
 }
@@ -355,7 +357,6 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
         struct urbtracker *urbtrack;
         int ret_val;
         unsigned long flags;
-        struct usb_ctrlrequest setup;
         struct usb_serial *serial = mos_parport->serial;
         struct usb_device *usbdev = serial->dev;
 
@@ -373,14 +374,20 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
                 kfree(urbtrack);
                 return -ENOMEM;
         }
-        setup.bRequestType = (__u8)0x40;
-        setup.bRequest = (__u8)0x0e;
-        setup.wValue = get_reg_value(reg, dummy);
-        setup.wIndex = get_reg_index(reg);
-        setup.wLength = 0;
+        urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
+        if (!urbtrack->setup) {
+                usb_free_urb(urbtrack->urb);
+                kfree(urbtrack);
+                return -ENOMEM;
+        }
+        urbtrack->setup->bRequestType = (__u8)0x40;
+        urbtrack->setup->bRequest = (__u8)0x0e;
+        urbtrack->setup->wValue = get_reg_value(reg, dummy);
+        urbtrack->setup->wIndex = get_reg_index(reg);
+        urbtrack->setup->wLength = 0;
         usb_fill_control_urb(urbtrack->urb, usbdev,
                              usb_sndctrlpipe(usbdev, 0),
-                             (unsigned char *)&setup,
+                             (unsigned char *)urbtrack->setup,
                              NULL, 0, async_complete, urbtrack);
         kref_init(&urbtrack->ref_count);
         INIT_LIST_HEAD(&urbtrack->urblist_entry);
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index d953d674f222..3bac4693c038 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -2193,7 +2193,7 @@ static int mos7810_check(struct usb_serial *serial)
 static int mos7840_probe(struct usb_serial *serial,
                                 const struct usb_device_id *id)
 {
-        u16 product = serial->dev->descriptor.idProduct;
+        u16 product = le16_to_cpu(serial->dev->descriptor.idProduct);
         u8 *buf;
         int device_type;
 
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 375b5a400b6f..5c9f9b1d7736 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1536,14 +1536,15 @@ static int ti_download_firmware(struct ti_device *tdev)
         char buf[32];
 
         /* try ID specific firmware first, then try generic firmware */
-        sprintf(buf, "ti_usb-v%04x-p%04x.fw", dev->descriptor.idVendor,
-            dev->descriptor.idProduct);
+        sprintf(buf, "ti_usb-v%04x-p%04x.fw",
+                        le16_to_cpu(dev->descriptor.idVendor),
+                        le16_to_cpu(dev->descriptor.idProduct));
         status = request_firmware(&fw_p, buf, &dev->dev);
 
         if (status != 0) {
                 buf[0] = '\0';
-                if (dev->descriptor.idVendor == MTS_VENDOR_ID) {
-                        switch (dev->descriptor.idProduct) {
+                if (le16_to_cpu(dev->descriptor.idVendor) == MTS_VENDOR_ID) {
+                        switch (le16_to_cpu(dev->descriptor.idProduct)) {
                         case MTS_CDMA_PRODUCT_ID:
                                 strcpy(buf, "mts_cdma.fw");
                                 break;
diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index 8257d30c4072..85365784040b 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -291,18 +291,18 @@ static void usb_wwan_indat_callback(struct urb *urb)
                         tty_flip_buffer_push(&port->port);
                 } else
                         dev_dbg(dev, "%s: empty read urb received\n", __func__);
-
-                /* Resubmit urb so we continue receiving */
-                err = usb_submit_urb(urb, GFP_ATOMIC);
-                if (err) {
-                        if (err != -EPERM) {
-                                dev_err(dev, "%s: resubmit read urb failed. (%d)\n", __func__, err);
-                                /* busy also in error unless we are killed */
-                                usb_mark_last_busy(port->serial->dev);
-                        }
-                } else {
+        }
+        /* Resubmit urb so we continue receiving */
+        err = usb_submit_urb(urb, GFP_ATOMIC);
+        if (err) {
+                if (err != -EPERM) {
+                        dev_err(dev, "%s: resubmit read urb failed. (%d)\n",
+                                __func__, err);
+                        /* busy also in error unless we are killed */
                         usb_mark_last_busy(port->serial->dev);
                 }
+        } else {
+                usb_mark_last_busy(port->serial->dev);
         }
 }
 
diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index 16968c899493..d3493ca0525d 100644
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -1226,6 +1226,12 @@ int wa_urb_dequeue(struct wahc *wa, struct urb *urb)
         }
         spin_lock_irqsave(&xfer->lock, flags);
         rpipe = xfer->ep->hcpriv;
+        if (rpipe == NULL) {
+                pr_debug("%s: xfer id 0x%08X has no RPIPE.  %s",
+                        __func__, wa_xfer_id(xfer),
+                        "Probably already aborted.\n" );
+                goto out_unlock;
+        }
         /* Check the delayed list -> if there, release and complete */
         spin_lock_irqsave(&wa->xfer_list_lock, flags2);
         if (!list_empty(&xfer->list_node) && xfer->seg == NULL)
@@ -1644,8 +1650,7 @@ static void wa_xfer_result_cb(struct urb *urb)
                         break;
                 }
                 usb_status = xfer_result->bTransferStatus & 0x3f;
-                if (usb_status == WA_XFER_STATUS_ABORTED
-                    || usb_status == WA_XFER_STATUS_NOT_FOUND)
+                if (usb_status == WA_XFER_STATUS_NOT_FOUND)
                         /* taken care of already */
                         break;
                 xfer_id = xfer_result->dwTransferID;
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index a58ac435a9a4..5e8be462aed5 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -348,7 +348,7 @@ static void init_evtchn_cpu_bindings(void)
 
         for_each_possible_cpu(i)
                 memset(per_cpu(cpu_evtchn_mask, i),
-                       (i == 0) ? ~0 : 0, sizeof(*per_cpu(cpu_evtchn_mask, i)));
+                       (i == 0) ? ~0 : 0, NR_EVENT_CHANNELS/8);
 }
 
 static inline void clear_evtchn(int port)
@@ -1493,8 +1493,10 @@ void rebind_evtchn_irq(int evtchn, int irq)
 /* Rebind an evtchn so that it gets delivered to a specific cpu */
 static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
 {
+        struct shared_info *s = HYPERVISOR_shared_info;
         struct evtchn_bind_vcpu bind_vcpu;
         int evtchn = evtchn_from_irq(irq);
+        int masked;
 
         if (!VALID_EVTCHN(evtchn))
                 return -1;
@@ -1511,6 +1513,12 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
         bind_vcpu.vcpu = tcpu;
 
         /*
+         * Mask the event while changing the VCPU binding to prevent
+         * it being delivered on an unexpected VCPU.
+         */
+        masked = sync_test_and_set_bit(evtchn, BM(s->evtchn_mask));
+
+        /*
          * If this fails, it usually just indicates that we're dealing with a
          * virq or IPI channel, which don't actually need to be rebound. Ignore
          * it, but don't do the xenlinux-level rebind in that case.
@@ -1518,6 +1526,9 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
         if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0)
                 bind_evtchn_to_cpu(evtchn, tcpu);
 
+        if (!masked)
+                unmask_evtchn(evtchn);
+
         return 0;
 }