Merge 3.0-rc2 into tty-linus

This is needed to catch the tty patch revert in the 3.0-rc2 tree.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

86 files changed, 925 insertions, 468 deletions

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index e6fc716aca45..f533f3375e24 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -192,7 +192,8 @@ static int sock_xmit(struct nbd_device *lo, int send, void *buf, int size,
                         if (lo->xmit_timeout)
                                 del_timer_sync(&ti);
                 } else
-                        result = kernel_recvmsg(sock, &msg, &iov, 1, size, 0);
+                        result = kernel_recvmsg(sock, &msg, &iov, 1, size,
+                                                msg.msg_flags);
 
                 if (signal_pending(current)) {
                         siginfo_t info;
@@ -753,9 +754,26 @@ static int __init nbd_init(void)
                 return -ENOMEM;
 
         part_shift = 0;
-        if (max_part > 0)
+        if (max_part > 0) {
                 part_shift = fls(max_part);
 
+                /*
+                 * Adjust max_part according to part_shift as it is exported
+                 * to user space so that user can know the max number of
+                 * partition kernel should be able to manage.
+                 *
+                 * Note that -1 is required because partition 0 is reserved
+                 * for the whole disk.
+                 */
+                max_part = (1UL << part_shift) - 1;
+        }
+
+        if ((1UL << part_shift) > DISK_MAX_PARTS)
+                return -EINVAL;
+
+        if (nbds_max > 1UL << (MINORBITS - part_shift))
+                return -EINVAL;
+
         for (i = 0; i < nbds_max; i++) {
                 struct gendisk *disk = alloc_disk(1 << part_shift);
                 if (!disk)
diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c
index a0aabd904a51..46b8136c31bb 100644
--- a/drivers/block/paride/pcd.c
+++ b/drivers/block/paride/pcd.c
@@ -321,7 +321,6 @@ static void pcd_init_units(void)
                 strcpy(disk->disk_name, cd->name);      /* umm... */
                 disk->fops = &pcd_bdops;
                 disk->flags = GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE;
-                disk->events = DISK_EVENT_MEDIA_CHANGE;
         }
 }
 
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 6ecf89cdf006..079c08808d8a 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -6,10 +6,13 @@
 #include <linux/virtio.h>
 #include <linux/virtio_blk.h>
 #include <linux/scatterlist.h>
+#include <linux/string_helpers.h>
+#include <scsi/scsi_cmnd.h>
 
 #define PART_BITS 4
 
 static int major, index;
+struct workqueue_struct *virtblk_wq;
 
 struct virtio_blk
 {
@@ -26,6 +29,9 @@ struct virtio_blk
 
         mempool_t *pool;
 
+        /* Process context for config space updates */
+        struct work_struct config_work;
+
         /* What host tells us, plus 2 for header & tailer. */
         unsigned int sg_elems;
 
@@ -141,7 +147,7 @@ static bool do_req(struct request_queue *q, struct virtio_blk *vblk,
         num = blk_rq_map_sg(q, vbr->req, vblk->sg + out);
 
         if (vbr->req->cmd_type == REQ_TYPE_BLOCK_PC) {
-                sg_set_buf(&vblk->sg[num + out + in++], vbr->req->sense, 96);
+                sg_set_buf(&vblk->sg[num + out + in++], vbr->req->sense, SCSI_SENSE_BUFFERSIZE);
                 sg_set_buf(&vblk->sg[num + out + in++], &vbr->in_hdr,
                            sizeof(vbr->in_hdr));
         }
@@ -291,6 +297,46 @@ static ssize_t virtblk_serial_show(struct device *dev,
 }
 DEVICE_ATTR(serial, S_IRUGO, virtblk_serial_show, NULL);
 
+static void virtblk_config_changed_work(struct work_struct *work)
+{
+        struct virtio_blk *vblk =
+                container_of(work, struct virtio_blk, config_work);
+        struct virtio_device *vdev = vblk->vdev;
+        struct request_queue *q = vblk->disk->queue;
+        char cap_str_2[10], cap_str_10[10];
+        u64 capacity, size;
+
+        /* Host must always specify the capacity. */
+        vdev->config->get(vdev, offsetof(struct virtio_blk_config, capacity),
+                          &capacity, sizeof(capacity));
+
+        /* If capacity is too big, truncate with warning. */
+        if ((sector_t)capacity != capacity) {
+                dev_warn(&vdev->dev, "Capacity %llu too large: truncating\n",
+                         (unsigned long long)capacity);
+                capacity = (sector_t)-1;
+        }
+
+        size = capacity * queue_logical_block_size(q);
+        string_get_size(size, STRING_UNITS_2, cap_str_2, sizeof(cap_str_2));
+        string_get_size(size, STRING_UNITS_10, cap_str_10, sizeof(cap_str_10));
+
+        dev_notice(&vdev->dev,
+                  "new size: %llu %d-byte logical blocks (%s/%s)\n",
+                  (unsigned long long)capacity,
+                  queue_logical_block_size(q),
+                  cap_str_10, cap_str_2);
+
+        set_capacity(vblk->disk, capacity);
+}
+
+static void virtblk_config_changed(struct virtio_device *vdev)
+{
+        struct virtio_blk *vblk = vdev->priv;
+
+        queue_work(virtblk_wq, &vblk->config_work);
+}
+
 static int __devinit virtblk_probe(struct virtio_device *vdev)
 {
         struct virtio_blk *vblk;
@@ -327,6 +373,7 @@ static int __devinit virtblk_probe(struct virtio_device *vdev)
         vblk->vdev = vdev;
         vblk->sg_elems = sg_elems;
         sg_init_table(vblk->sg, vblk->sg_elems);
+        INIT_WORK(&vblk->config_work, virtblk_config_changed_work);
 
         /* We expect one virtqueue, for output. */
         vblk->vq = virtio_find_single_vq(vdev, blk_done, "requests");
@@ -477,6 +524,8 @@ static void __devexit virtblk_remove(struct virtio_device *vdev)
 {
         struct virtio_blk *vblk = vdev->priv;
 
+        flush_work(&vblk->config_work);
+
         /* Nothing should be pending. */
         BUG_ON(!list_empty(&vblk->reqs));
 
@@ -508,27 +557,47 @@ static unsigned int features[] = {
  * Use __refdata to avoid this warning.
  */
 static struct virtio_driver __refdata virtio_blk = {
-        .feature_table = features,
-        .feature_table_size = ARRAY_SIZE(features),
-        .driver.name =  KBUILD_MODNAME,
-        .driver.owner = THIS_MODULE,
-        .id_table =     id_table,
-        .probe =        virtblk_probe,
-        .remove =       __devexit_p(virtblk_remove),
+        .feature_table          = features,
+        .feature_table_size     = ARRAY_SIZE(features),
+        .driver.name            = KBUILD_MODNAME,
+        .driver.owner           = THIS_MODULE,
+        .id_table               = id_table,
+        .probe                  = virtblk_probe,
+        .remove                 = __devexit_p(virtblk_remove),
+        .config_changed         = virtblk_config_changed,
 };
 
 static int __init init(void)
 {
+        int error;
+
+        virtblk_wq = alloc_workqueue("virtio-blk", 0, 0);
+        if (!virtblk_wq)
+                return -ENOMEM;
+
         major = register_blkdev(0, "virtblk");
-        if (major < 0)
-                return major;
-        return register_virtio_driver(&virtio_blk);
+        if (major < 0) {
+                error = major;
+                goto out_destroy_workqueue;
+        }
+
+        error = register_virtio_driver(&virtio_blk);
+        if (error)
+                goto out_unregister_blkdev;
+        return 0;
+
+out_unregister_blkdev:
+        unregister_blkdev(major, "virtblk");
+out_destroy_workqueue:
+        destroy_workqueue(virtblk_wq);
+        return error;
 }
 
 static void __exit fini(void)
 {
         unregister_blkdev(major, "virtblk");
         unregister_virtio_driver(&virtio_blk);
+        destroy_workqueue(virtblk_wq);
 }
 module_init(init);
 module_exit(fini);
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index c73910cc28c9..5cf2993a8338 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -809,11 +809,13 @@ static int __init xen_blkif_init(void)
  failed_init:
         kfree(blkbk->pending_reqs);
         kfree(blkbk->pending_grant_handles);
-        for (i = 0; i < mmap_pages; i++) {
-                if (blkbk->pending_pages[i])
-                        __free_page(blkbk->pending_pages[i]);
+        if (blkbk->pending_pages) {
+                for (i = 0; i < mmap_pages; i++) {
+                        if (blkbk->pending_pages[i])
+                                __free_page(blkbk->pending_pages[i]);
+                }
+                kfree(blkbk->pending_pages);
         }
-        kfree(blkbk->pending_pages);
         kfree(blkbk);
         blkbk = NULL;
         return rc;
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 34570823355b..6cc0db1bf522 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -357,14 +357,13 @@ static int xen_vbd_create(struct xen_blkif *blkif, blkif_vdev_t handle,
         }
 
         vbd->bdev = bdev;
-        vbd->size = vbd_sz(vbd);
-
         if (vbd->bdev->bd_disk == NULL) {
                 DPRINTK("xen_vbd_create: device %08x doesn't exist.\n",
                         vbd->pdevice);
                 xen_vbd_free(vbd);
                 return -ENOENT;
         }
+        vbd->size = vbd_sz(vbd);
 
         if (vbd->bdev->bd_disk->flags & GENHD_FL_CD || cdrom)
                 vbd->type |= VDISK_CDROM;
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index b3f01996318f..48ad2a7ab080 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -355,29 +355,24 @@ static void hci_uart_tty_wakeup(struct tty_struct *tty)
  *             flags        pointer to flags for data
  *             count        count of received data in bytes
  *     
- * Return Value:    Number of bytes received
+ * Return Value:    None
  */
-static unsigned int hci_uart_tty_receive(struct tty_struct *tty,
-                const u8 *data, char *flags, int count)
+static void hci_uart_tty_receive(struct tty_struct *tty, const u8 *data, char *flags, int count)
 {
         struct hci_uart *hu = (void *)tty->disc_data;
-        int received;
 
         if (!hu || tty != hu->tty)
-                return -ENODEV;
+                return;
 
         if (!test_bit(HCI_UART_PROTO_SET, &hu->flags))
-                return -EINVAL;
+                return;
 
         spin_lock(&hu->rx_lock);
-        received = hu->proto->recv(hu, (void *) data, count);
-        if (received > 0)
-                hu->hdev->stat.byte_rx += received;
+        hu->proto->recv(hu, (void *) data, count);
+        hu->hdev->stat.byte_rx += count;
         spin_unlock(&hu->rx_lock);
 
         tty_unthrottle(tty);
-
-        return received;
 }
 
 static int hci_uart_register_dev(struct hci_uart *hu)
diff --git a/drivers/cdrom/viocd.c b/drivers/cdrom/viocd.c
index ae15a4ddaa9b..7878da89d29e 100644
--- a/drivers/cdrom/viocd.c
+++ b/drivers/cdrom/viocd.c
@@ -627,7 +627,6 @@ static int viocd_probe(struct vio_dev *vdev, const struct vio_device_id *id)
         gendisk->fops = &viocd_fops;
         gendisk->flags = GENHD_FL_CD | GENHD_FL_REMOVABLE |
                          GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE;
-        gendisk->events = DISK_EVENT_MEDIA_CHANGE;
         set_capacity(gendisk, 0);
         gendisk->private_data = d;
         d->viocd_disk = gendisk;
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 838568a7dbf5..fb68b1295373 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1677,17 +1677,12 @@ static int __devinit virtcons_probe(struct virtio_device *vdev)
         portdev->config.max_nr_ports = 1;
         if (virtio_has_feature(vdev, VIRTIO_CONSOLE_F_MULTIPORT)) {
                 multiport = true;
-                vdev->features[0] |= 1 << VIRTIO_CONSOLE_F_MULTIPORT;
-
                 vdev->config->get(vdev, offsetof(struct virtio_console_config,
                                                  max_nr_ports),
                                   &portdev->config.max_nr_ports,
                                   sizeof(portdev->config.max_nr_ports));
         }
 
-        /* Let the Host know we support multiple ports.*/
-        vdev->config->finalize_features(vdev);
-
         err = init_vqs(portdev);
         if (err < 0) {
                 dev_err(&vdev->dev, "Error %d initializing vqs\n", err);
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index 036e5865eb40..dc7c033ef587 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -24,7 +24,6 @@
 #include <linux/ioport.h>
 #include <linux/io.h>
 #include <linux/clk.h>
-#include <linux/pm_runtime.h>
 #include <linux/irq.h>
 #include <linux/err.h>
 #include <linux/clocksource.h>
@@ -153,12 +152,10 @@ static int sh_cmt_enable(struct sh_cmt_priv *p, unsigned long *rate)
 {
         int ret;
 
-        /* wake up device and enable clock */
-        pm_runtime_get_sync(&p->pdev->dev);
+        /* enable clock */
         ret = clk_enable(p->clk);
         if (ret) {
                 dev_err(&p->pdev->dev, "cannot enable clock\n");
-                pm_runtime_put_sync(&p->pdev->dev);
                 return ret;
         }
 
@@ -190,9 +187,8 @@ static void sh_cmt_disable(struct sh_cmt_priv *p)
         /* disable interrupts in CMT block */
         sh_cmt_write(p, CMCSR, 0);
 
-        /* stop clock and mark device as idle */
+        /* stop clock */
         clk_disable(p->clk);
-        pm_runtime_put_sync(&p->pdev->dev);
 }
 
 /* private flags */
@@ -664,7 +660,6 @@ static int __devinit sh_cmt_probe(struct platform_device *pdev)
 
         if (p) {
                 dev_info(&pdev->dev, "kept as earlytimer\n");
-                pm_runtime_enable(&pdev->dev);
                 return 0;
         }
 
@@ -679,9 +674,6 @@ static int __devinit sh_cmt_probe(struct platform_device *pdev)
                 kfree(p);
                 platform_set_drvdata(pdev, NULL);
         }
-
-        if (!is_early_platform_device(pdev))
-                pm_runtime_enable(&pdev->dev);
         return ret;
 }
 
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index 17296288a205..808135768617 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -25,7 +25,6 @@
 #include <linux/delay.h>
 #include <linux/io.h>
 #include <linux/clk.h>
-#include <linux/pm_runtime.h>
 #include <linux/irq.h>
 #include <linux/err.h>
 #include <linux/clocksource.h>
@@ -110,12 +109,10 @@ static int sh_tmu_enable(struct sh_tmu_priv *p)
 {
         int ret;
 
-        /* wake up device and enable clock */
-        pm_runtime_get_sync(&p->pdev->dev);
+        /* enable clock */
         ret = clk_enable(p->clk);
         if (ret) {
                 dev_err(&p->pdev->dev, "cannot enable clock\n");
-                pm_runtime_put_sync(&p->pdev->dev);
                 return ret;
         }
 
@@ -144,9 +141,8 @@ static void sh_tmu_disable(struct sh_tmu_priv *p)
         /* disable interrupts in TMU block */
         sh_tmu_write(p, TCR, 0x0000);
 
-        /* stop clock and mark device as idle */
+        /* stop clock */
         clk_disable(p->clk);
-        pm_runtime_put_sync(&p->pdev->dev);
 }
 
 static void sh_tmu_set_next(struct sh_tmu_priv *p, unsigned long delta,
@@ -415,7 +411,6 @@ static int __devinit sh_tmu_probe(struct platform_device *pdev)
 
         if (p) {
                 dev_info(&pdev->dev, "kept as earlytimer\n");
-                pm_runtime_enable(&pdev->dev);
                 return 0;
         }
 
@@ -430,9 +425,6 @@ static int __devinit sh_tmu_probe(struct platform_device *pdev)
                 kfree(p);
                 platform_set_drvdata(pdev, NULL);
         }
-
-        if (!is_early_platform_device(pdev))
-                pm_runtime_enable(&pdev->dev);
         return ret;
 }
 
diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
index 636e40925b16..2a638f9f09a2 100644
--- a/drivers/dma/shdma.c
+++ b/drivers/dma/shdma.c
@@ -343,7 +343,7 @@ static int sh_dmae_alloc_chan_resources(struct dma_chan *chan)
 
                 dmae_set_dmars(sh_chan, cfg->mid_rid);
                 dmae_set_chcr(sh_chan, cfg->chcr);
-        } else if ((sh_dmae_readl(sh_chan, CHCR) & 0xf00) != 0x400) {
+        } else {
                 dmae_init(sh_chan);
         }
 
@@ -1144,6 +1144,8 @@ static int __init sh_dmae_probe(struct platform_device *pdev)
         /* platform data */
         shdev->pdata = pdata;
 
+        platform_set_drvdata(pdev, shdev);
+
         pm_runtime_enable(&pdev->dev);
         pm_runtime_get_sync(&pdev->dev);
 
@@ -1256,7 +1258,6 @@ static int __init sh_dmae_probe(struct platform_device *pdev)
 
         pm_runtime_put(&pdev->dev);
 
-        platform_set_drvdata(pdev, shdev);
         dma_async_device_register(&shdev->common);
 
         return err;
@@ -1278,6 +1279,8 @@ rst_err:
 
         if (dmars)
                 iounmap(shdev->dmars);
+
+        platform_set_drvdata(pdev, NULL);
 emapdmars:
         iounmap(shdev->chan_reg);
         synchronize_rcu();
@@ -1316,6 +1319,8 @@ static int __exit sh_dmae_remove(struct platform_device *pdev)
                 iounmap(shdev->dmars);
         iounmap(shdev->chan_reg);
 
+        platform_set_drvdata(pdev, NULL);
+
         synchronize_rcu();
         kfree(shdev);
 
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index de3d2465fe24..85e937984ff7 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -296,7 +296,7 @@ static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
                  * If the TjMax is not plausible, an assumption
                  * will be used
                  */
-                if (val > 80 && val < 120) {
+                if (val) {
                         dev_info(dev, "TjMax is %d C.\n", val);
                         return val * 1000;
                 }
@@ -304,24 +304,9 @@ static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
 
         /*
          * An assumption is made for early CPUs and unreadable MSR.
-         * NOTE: the given value may not be correct.
+         * NOTE: the calculated value may not be correct.
          */
-
-        switch (c->x86_model) {
-        case 0xe:
-        case 0xf:
-        case 0x16:
-        case 0x1a:
-                dev_warn(dev, "TjMax is assumed as 100 C!\n");
-                return 100000;
-        case 0x17:
-        case 0x1c:              /* Atom CPUs */
-                return adjust_tjmax(c, id, dev);
-        default:
-                dev_warn(dev, "CPU (model=0x%x) is not supported yet,"
-                        " using default TjMax of 100C.\n", c->x86_model);
-                return 100000;
-        }
+        return adjust_tjmax(c, id, dev);
 }
 
 static void __devinit get_ucode_rev_on_cpu(void *edx)
@@ -341,7 +326,7 @@ static int get_pkg_tjmax(unsigned int cpu, struct device *dev)
         err = rdmsr_safe_on_cpu(cpu, MSR_IA32_TEMPERATURE_TARGET, &eax, &edx);
         if (!err) {
                 val = (eax >> 16) & 0xff;
-                if (val > 80 && val < 120)
+                if (val)
                         return val * 1000;
         }
         dev_warn(dev, "Unable to read Pkg-TjMax from CPU:%u\n", cpu);
diff --git a/drivers/hwmon/max6642.c b/drivers/hwmon/max6642.c
index 0f9fc40379cd..e855d3b0bd1f 100644
--- a/drivers/hwmon/max6642.c
+++ b/drivers/hwmon/max6642.c
@@ -136,15 +136,29 @@ static int max6642_detect(struct i2c_client *client,
         if (man_id != 0x4D)
                 return -ENODEV;
 
+        /* sanity check */
+        if (i2c_smbus_read_byte_data(client, 0x04) != 0x4D
+            || i2c_smbus_read_byte_data(client, 0x06) != 0x4D
+            || i2c_smbus_read_byte_data(client, 0xff) != 0x4D)
+                return -ENODEV;
+
         /*
          * We read the config and status register, the 4 lower bits in the
          * config register should be zero and bit 5, 3, 1 and 0 should be
          * zero in the status register.
          */
         reg_config = i2c_smbus_read_byte_data(client, MAX6642_REG_R_CONFIG);
+        if ((reg_config & 0x0f) != 0x00)
+                return -ENODEV;
+
+        /* in between, another round of sanity checks */
+        if (i2c_smbus_read_byte_data(client, 0x04) != reg_config
+            || i2c_smbus_read_byte_data(client, 0x06) != reg_config
+            || i2c_smbus_read_byte_data(client, 0xff) != reg_config)
+                return -ENODEV;
+
         reg_status = i2c_smbus_read_byte_data(client, MAX6642_REG_R_STATUS);
-        if (((reg_config & 0x0f) != 0x00) ||
-            ((reg_status & 0x2b) != 0x00))
+        if ((reg_status & 0x2b) != 0x00)
                 return -ENODEV;
 
         strlcpy(info->type, "max6642", I2C_NAME_SIZE);
@@ -246,7 +260,7 @@ static SENSOR_DEVICE_ATTR_2(temp1_max, S_IWUSR | S_IRUGO, show_temp_max,
                             set_temp_max, 0, MAX6642_REG_W_LOCAL_HIGH);
 static SENSOR_DEVICE_ATTR_2(temp2_max, S_IWUSR | S_IRUGO, show_temp_max,
                             set_temp_max, 1, MAX6642_REG_W_REMOTE_HIGH);
-static SENSOR_DEVICE_ATTR(temp_fault, S_IRUGO, show_alarm, NULL, 2);
+static SENSOR_DEVICE_ATTR(temp2_fault, S_IRUGO, show_alarm, NULL, 2);
 static SENSOR_DEVICE_ATTR(temp1_max_alarm, S_IRUGO, show_alarm, NULL, 6);
 static SENSOR_DEVICE_ATTR(temp2_max_alarm, S_IRUGO, show_alarm, NULL, 4);
 
@@ -256,7 +270,7 @@ static struct attribute *max6642_attributes[] = {
         &sensor_dev_attr_temp1_max.dev_attr.attr,
         &sensor_dev_attr_temp2_max.dev_attr.attr,
 
-        &sensor_dev_attr_temp_fault.dev_attr.attr,
+        &sensor_dev_attr_temp2_fault.dev_attr.attr,
         &sensor_dev_attr_temp1_max_alarm.dev_attr.attr,
         &sensor_dev_attr_temp2_max_alarm.dev_attr.attr,
         NULL
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 6e5123b1d341..144d27261e43 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -1782,7 +1782,6 @@ static int ide_cd_probe(ide_drive_t *drive)
         ide_cd_read_toc(drive, &sense);
         g->fops = &idecd_ops;
         g->flags |= GENHD_FL_REMOVABLE | GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE;
-        g->events = DISK_EVENT_MEDIA_CHANGE;
         add_disk(g);
         return 0;
 
diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c
index f3698967edf6..8755f5f3ad37 100644
--- a/drivers/input/serio/serport.c
+++ b/drivers/input/serio/serport.c
@@ -120,21 +120,17 @@ static void serport_ldisc_close(struct tty_struct *tty)
  * 'interrupt' routine.
  */
 
-static unsigned int serport_ldisc_receive(struct tty_struct *tty,
-                const unsigned char *cp, char *fp, int count)
+static void serport_ldisc_receive(struct tty_struct *tty, const unsigned char *cp, char *fp, int count)
 {
         struct serport *serport = (struct serport*) tty->disc_data;
         unsigned long flags;
         unsigned int ch_flags;
-        int ret = 0;
         int i;
 
         spin_lock_irqsave(&serport->lock, flags);
 
-        if (!test_bit(SERPORT_ACTIVE, &serport->flags)) {
-                ret = -EINVAL;
+        if (!test_bit(SERPORT_ACTIVE, &serport->flags))
                 goto out;
-        }
 
         for (i = 0; i < count; i++) {
                 switch (fp[i]) {
@@ -156,8 +152,6 @@ static unsigned int serport_ldisc_receive(struct tty_struct *tty,
 
 out:
         spin_unlock_irqrestore(&serport->lock, flags);
-
-        return ret == 0 ? count : ret;
 }
 
 /*
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index 1d44d470897c..86a5c4f7775e 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -674,7 +674,7 @@ gigaset_tty_ioctl(struct tty_struct *tty, struct file *file,
  *      cflags  buffer containing error flags for received characters (ignored)
  *      count   number of received characters
  */
-static unsigned int
+static void
 gigaset_tty_receive(struct tty_struct *tty, const unsigned char *buf,
                     char *cflags, int count)
 {
@@ -683,12 +683,12 @@ gigaset_tty_receive(struct tty_struct *tty, const unsigned char *buf,
         struct inbuf_t *inbuf;
 
         if (!cs)
-                return -ENODEV;
+                return;
         inbuf = cs->inbuf;
         if (!inbuf) {
                 dev_err(cs->dev, "%s: no inbuf\n", __func__);
                 cs_put(cs);
-                return -EINVAL;
+                return;
         }
 
         tail = inbuf->tail;
@@ -725,8 +725,6 @@ gigaset_tty_receive(struct tty_struct *tty, const unsigned char *buf,
         gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
         gigaset_schedule_event(cs);
         cs_put(cs);
-
-        return count;
 }
 
 /*
diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
index b0c56313dbbb..8cebec5e85ee 100644
--- a/drivers/misc/kgdbts.c
+++ b/drivers/misc/kgdbts.c
@@ -304,7 +304,10 @@ static int check_and_rewind_pc(char *put_str, char *arg)
                 return 1;
         }
         /* Readjust the instruction pointer if needed */
-        instruction_pointer_set(&kgdbts_regs, ip + offset);
+        ip += offset;
+#ifdef GDB_ADJUSTS_BREAK_OFFSET
+        instruction_pointer_set(&kgdbts_regs, ip);
+#endif
         return 0;
 }
 
diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index 1a05fe08e2cb..f91f82eabda7 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -747,8 +747,8 @@ static void st_tty_close(struct tty_struct *tty)
         pr_debug("%s: done ", __func__);
 }
 
-static unsigned int st_tty_receive(struct tty_struct *tty,
-                const unsigned char *data, char *tty_flags, int count)
+static void st_tty_receive(struct tty_struct *tty, const unsigned char *data,
+                           char *tty_flags, int count)
 {
 #ifdef VERBOSE
         print_hex_dump(KERN_DEBUG, ">in>", DUMP_PREFIX_NONE,
@@ -761,8 +761,6 @@ static unsigned int st_tty_receive(struct tty_struct *tty,
          */
         st_recv(tty->disc_data, data, count);
         pr_debug("done %s", __func__);
-
-        return count;
 }
 
 /* wake-up function called in from the TTY layer
diff --git a/drivers/net/3c509.c b/drivers/net/3c509.c
index 5f25889e27ef..44b28b2d7003 100644
--- a/drivers/net/3c509.c
+++ b/drivers/net/3c509.c
@@ -185,7 +185,7 @@ static int max_interrupt_work = 10;
 static int nopnp;
 #endif
 
-static int el3_common_init(struct net_device *dev);
+static int __devinit el3_common_init(struct net_device *dev);
 static void el3_common_remove(struct net_device *dev);
 static ushort id_read_eeprom(int index);
 static ushort read_eeprom(int ioaddr, int index);
@@ -395,7 +395,7 @@ static struct isa_driver el3_isa_driver = {
 static int isa_registered;
 
 #ifdef CONFIG_PNP
-static const struct pnp_device_id el3_pnp_ids[] __devinitconst = {
+static struct pnp_device_id el3_pnp_ids[] = {
         { .id = "TCM5090" }, /* 3Com Etherlink III (TP) */
         { .id = "TCM5091" }, /* 3Com Etherlink III */
         { .id = "TCM5094" }, /* 3Com Etherlink III (combo) */
@@ -478,7 +478,7 @@ static int pnp_registered;
 #endif /* CONFIG_PNP */
 
 #ifdef CONFIG_EISA
-static const struct eisa_device_id el3_eisa_ids[] __devinitconst = {
+static struct eisa_device_id el3_eisa_ids[] = {
                 { "TCM5090" },
                 { "TCM5091" },
                 { "TCM5092" },
@@ -508,7 +508,7 @@ static int eisa_registered;
 #ifdef CONFIG_MCA
 static int el3_mca_probe(struct device *dev);
 
-static const short el3_mca_adapter_ids[] __devinitconst = {
+static short el3_mca_adapter_ids[] __initdata = {
                 0x627c,
                 0x627d,
                 0x62db,
@@ -517,7 +517,7 @@ static const short el3_mca_adapter_ids[] __devinitconst = {
                 0x0000
 };
 
-static const char *const el3_mca_adapter_names[] __devinitconst = {
+static char *el3_mca_adapter_names[] __initdata = {
                 "3Com 3c529 EtherLink III (10base2)",
                 "3Com 3c529 EtherLink III (10baseT)",
                 "3Com 3c529 EtherLink III (test mode)",
@@ -601,7 +601,7 @@ static void el3_common_remove (struct net_device *dev)
 }
 
 #ifdef CONFIG_MCA
-static int __devinit el3_mca_probe(struct device *device)
+static int __init el3_mca_probe(struct device *device)
 {
         /* Based on Erik Nygren's (nygren@mit.edu) 3c529 patch,
          * heavily modified by Chris Beauregard
@@ -671,7 +671,7 @@ static int __devinit el3_mca_probe(struct device *device)
 #endif /* CONFIG_MCA */
 
 #ifdef CONFIG_EISA
-static int __devinit el3_eisa_probe (struct device *device)
+static int __init el3_eisa_probe (struct device *device)
 {
         short i;
         int ioaddr, irq, if_port;
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 99f43d275442..8cc22568ebd3 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -901,14 +901,14 @@ static const struct dev_pm_ops vortex_pm_ops = {
 #endif /* !CONFIG_PM */
 
 #ifdef CONFIG_EISA
-static const struct eisa_device_id vortex_eisa_ids[] __devinitconst = {
+static struct eisa_device_id vortex_eisa_ids[] = {
         { "TCM5920", CH_3C592 },
         { "TCM5970", CH_3C597 },
         { "" }
 };
 MODULE_DEVICE_TABLE(eisa, vortex_eisa_ids);
 
-static int __devinit vortex_eisa_probe(struct device *device)
+static int __init vortex_eisa_probe(struct device *device)
 {
         void __iomem *ioaddr;
         struct eisa_device *edev;
diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index 73c7e03617ec..3df0c0f8b8bf 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -167,8 +167,8 @@ static inline void debugfs_tx(struct ser_device *ser, const u8 *data, int size)
 
 #endif
 
-static unsigned int ldisc_receive(struct tty_struct *tty,
-                const u8 *data, char *flags, int count)
+static void ldisc_receive(struct tty_struct *tty, const u8 *data,
+                        char *flags, int count)
 {
         struct sk_buff *skb = NULL;
         struct ser_device *ser;
@@ -215,8 +215,6 @@ static unsigned int ldisc_receive(struct tty_struct *tty,
         } else
                 ++ser->dev->stats.rx_dropped;
         update_tty_status(ser);
-
-        return count;
 }
 
 static int handle_tx(struct ser_device *ser)
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index d4990568baee..17678117ed69 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -923,7 +923,7 @@ static int __devinit flexcan_probe(struct platform_device *pdev)
         mem_size = resource_size(mem);
         if (!request_mem_region(mem->start, mem_size, pdev->name)) {
                 err = -EBUSY;
-                goto failed_req;
+                goto failed_get;
         }
 
         base = ioremap(mem->start, mem_size);
@@ -977,9 +977,8 @@ static int __devinit flexcan_probe(struct platform_device *pdev)
         iounmap(base);
  failed_map:
         release_mem_region(mem->start, mem_size);
- failed_req:
-        clk_put(clk);
  failed_get:
+        clk_put(clk);
  failed_clock:
         return err;
 }
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index 75622d54581f..1b49df6b2470 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -425,17 +425,16 @@ static void slc_setup(struct net_device *dev)
  * in parallel
  */
 
-static unsigned int slcan_receive_buf(struct tty_struct *tty,
+static void slcan_receive_buf(struct tty_struct *tty,
                               const unsigned char *cp, char *fp, int count)
 {
         struct slcan *sl = (struct slcan *) tty->disc_data;
-        int bytes = count;
 
         if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev))
-                return -ENODEV;
+                return;
 
         /* Read the characters out of the buffer */
-        while (bytes--) {
+        while (count--) {
                 if (fp && *fp++) {
                         if (!test_and_set_bit(SLF_ERROR, &sl->flags))
                                 sl->dev->stats.rx_errors++;
@@ -444,8 +443,6 @@ static unsigned int slcan_receive_buf(struct tty_struct *tty,
                 }
                 slcan_unesc(sl, *cp++);
         }
-
-        return count;
 }
 
 /************************************
diff --git a/drivers/net/davinci_emac.c b/drivers/net/davinci_emac.c
index 29a4f06fbfcf..dcc4a170b0f3 100644
--- a/drivers/net/davinci_emac.c
+++ b/drivers/net/davinci_emac.c
@@ -1781,8 +1781,8 @@ static int __devinit davinci_emac_probe(struct platform_device *pdev)
         ndev = alloc_etherdev(sizeof(struct emac_priv));
         if (!ndev) {
                 dev_err(&pdev->dev, "error allocating net_device\n");
-                clk_put(emac_clk);
-                return -ENOMEM;
+                rc = -ENOMEM;
+                goto free_clk;
         }
 
         platform_set_drvdata(pdev, ndev);
@@ -1796,7 +1796,8 @@ static int __devinit davinci_emac_probe(struct platform_device *pdev)
         pdata = pdev->dev.platform_data;
         if (!pdata) {
                 dev_err(&pdev->dev, "no platform data\n");
-                return -ENODEV;
+                rc = -ENODEV;
+                goto probe_quit;
         }
 
         /* MAC addr and PHY mask , RMII enable info from platform_data */
@@ -1929,8 +1930,9 @@ no_dma:
         iounmap(priv->remap_addr);
 
 probe_quit:
-        clk_put(emac_clk);
         free_netdev(ndev);
+free_clk:
+        clk_put(emac_clk);
         return rc;
 }
 
diff --git a/drivers/net/depca.c b/drivers/net/depca.c
index 17654059922d..8b0084d17c8c 100644
--- a/drivers/net/depca.c
+++ b/drivers/net/depca.c
@@ -331,18 +331,18 @@ static struct {
                          "DE422",\
                          ""}
 
-static const char* const depca_signature[] __devinitconst = DEPCA_SIGNATURE;
+static char* __initdata depca_signature[] = DEPCA_SIGNATURE;
 
 enum depca_type {
         DEPCA, de100, de101, de200, de201, de202, de210, de212, de422, unknown
 };
 
-static const char depca_string[] = "depca";
+static char depca_string[] = "depca";
 
 static int depca_device_remove (struct device *device);
 
 #ifdef CONFIG_EISA
-static const struct eisa_device_id depca_eisa_ids[] __devinitconst = {
+static struct eisa_device_id depca_eisa_ids[] = {
         { "DEC4220", de422 },
         { "" }
 };
@@ -367,19 +367,19 @@ static struct eisa_driver depca_eisa_driver = {
 #define DE210_ID 0x628d
 #define DE212_ID 0x6def
 
-static const short depca_mca_adapter_ids[] __devinitconst = {
+static short depca_mca_adapter_ids[] = {
         DE210_ID,
         DE212_ID,
         0x0000
 };
 
-static const char *depca_mca_adapter_name[] = {
+static char *depca_mca_adapter_name[] = {
         "DEC EtherWORKS MC Adapter (DE210)",
         "DEC EtherWORKS MC Adapter (DE212)",
         NULL
 };
 
-static const enum depca_type depca_mca_adapter_type[] = {
+static enum depca_type depca_mca_adapter_type[] = {
         de210,
         de212,
         0
@@ -541,9 +541,10 @@ static void SetMulticastFilter(struct net_device *dev);
 static int load_packet(struct net_device *dev, struct sk_buff *skb);
 static void depca_dbg_open(struct net_device *dev);
 
-static const u_char de1xx_irq[] __devinitconst = { 2, 3, 4, 5, 7, 9, 0 };
-static const u_char de2xx_irq[] __devinitconst = { 5, 9, 10, 11, 15, 0 };
-static const u_char de422_irq[] __devinitconst = { 5, 9, 10, 11, 0 };
+static u_char de1xx_irq[] __initdata = { 2, 3, 4, 5, 7, 9, 0 };
+static u_char de2xx_irq[] __initdata = { 5, 9, 10, 11, 15, 0 };
+static u_char de422_irq[] __initdata = { 5, 9, 10, 11, 0 };
+static u_char *depca_irq;
 
 static int irq;
 static int io;
@@ -579,7 +580,7 @@ static const struct net_device_ops depca_netdev_ops = {
         .ndo_validate_addr      = eth_validate_addr,
 };
 
-static int __devinit depca_hw_init (struct net_device *dev, struct device *device)
+static int __init depca_hw_init (struct net_device *dev, struct device *device)
 {
         struct depca_private *lp;
         int i, j, offset, netRAM, mem_len, status = 0;
@@ -747,7 +748,6 @@ static int __devinit depca_hw_init (struct net_device *dev, struct device *devic
         if (dev->irq < 2) {
                 unsigned char irqnum;
                 unsigned long irq_mask, delay;
-                const u_char *depca_irq;
 
                 irq_mask = probe_irq_on();
 
@@ -770,7 +770,6 @@ static int __devinit depca_hw_init (struct net_device *dev, struct device *devic
                         break;
 
                 default:
-                        depca_irq = NULL;
                         break;  /* Not reached */
                 }
 
@@ -1303,7 +1302,7 @@ static void SetMulticastFilter(struct net_device *dev)
         }
 }
 
-static int __devinit depca_common_init (u_long ioaddr, struct net_device **devp)
+static int __init depca_common_init (u_long ioaddr, struct net_device **devp)
 {
         int status = 0;
 
@@ -1334,7 +1333,7 @@ static int __devinit depca_common_init (u_long ioaddr, struct net_device **devp)
 /*
 ** Microchannel bus I/O device probe
 */
-static int __devinit depca_mca_probe(struct device *device)
+static int __init depca_mca_probe(struct device *device)
 {
         unsigned char pos[2];
         unsigned char where;
@@ -1458,7 +1457,7 @@ static int __devinit depca_mca_probe(struct device *device)
 ** ISA bus I/O device probe
 */
 
-static void __devinit depca_platform_probe (void)
+static void __init depca_platform_probe (void)
 {
         int i;
         struct platform_device *pldev;
@@ -1498,7 +1497,7 @@ static void __devinit depca_platform_probe (void)
         }
 }
 
-static enum depca_type __devinit depca_shmem_probe (ulong *mem_start)
+static enum depca_type __init depca_shmem_probe (ulong *mem_start)
 {
         u_long mem_base[] = DEPCA_RAM_BASE_ADDRESSES;
         enum depca_type adapter = unknown;
@@ -1559,7 +1558,7 @@ static int __devinit depca_isa_probe (struct platform_device *device)
 */
 
 #ifdef CONFIG_EISA
-static int __devinit depca_eisa_probe (struct device *device)
+static int __init depca_eisa_probe (struct device *device)
 {
         enum depca_type adapter = unknown;
         struct eisa_device *edev;
@@ -1630,7 +1629,7 @@ static int __devexit depca_device_remove (struct device *device)
 ** and Boot (readb) ROM. This will also give us a clue to the network RAM
 ** base address.
 */
-static int __devinit DepcaSignature(char *name, u_long base_addr)
+static int __init DepcaSignature(char *name, u_long base_addr)
 {
         u_int i, j, k;
         void __iomem *ptr;
diff --git a/drivers/net/dm9000.c b/drivers/net/dm9000.c
index fbaff3584bd4..ee597e676ee5 100644
--- a/drivers/net/dm9000.c
+++ b/drivers/net/dm9000.c
@@ -1157,9 +1157,6 @@ dm9000_open(struct net_device *dev)
 
         irqflags |= IRQF_SHARED;
 
-        if (request_irq(dev->irq, dm9000_interrupt, irqflags, dev->name, dev))
-                return -EAGAIN;
-
         /* GPIO0 on pre-activate PHY, Reg 1F is not set by reset */
         iow(db, DM9000_GPR, 0); /* REG_1F bit0 activate phyxcer */
         mdelay(1); /* delay needs by DM9000B */
@@ -1168,6 +1165,9 @@ dm9000_open(struct net_device *dev)
         dm9000_reset(db);
         dm9000_init_dm9000(dev);
 
+        if (request_irq(dev->irq, dm9000_interrupt, irqflags, dev->name, dev))
+                return -EAGAIN;
+
         /* Init driver variable */
         db->dbug_cnt = 0;
 
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 992089639ea4..3e5d0b6b6516 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -456,7 +456,7 @@ out:
  * a block of 6pack data has been received, which can now be decapsulated
  * and sent on to some IP layer for further processing.
  */
-static unsigned int sixpack_receive_buf(struct tty_struct *tty,
+static void sixpack_receive_buf(struct tty_struct *tty,
         const unsigned char *cp, char *fp, int count)
 {
         struct sixpack *sp;
@@ -464,11 +464,11 @@ static unsigned int sixpack_receive_buf(struct tty_struct *tty,
         int count1;
 
         if (!count)
-                return 0;
+                return;
 
         sp = sp_get(tty);
         if (!sp)
-                return -ENODEV;
+                return;
 
         memcpy(buf, cp, count < sizeof(buf) ? count : sizeof(buf));
 
@@ -487,8 +487,6 @@ static unsigned int sixpack_receive_buf(struct tty_struct *tty,
 
         sp_put(sp);
         tty_unthrottle(tty);
-
-        return count1;
 }
 
 /*
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index 0e4f23531140..4c628393c8b1 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -923,14 +923,13 @@ static long mkiss_compat_ioctl(struct tty_struct *tty, struct file *file,
  * a block of data has been received, which can now be decapsulated
  * and sent on to the AX.25 layer for further processing.
  */
-static unsigned int mkiss_receive_buf(struct tty_struct *tty,
-                const unsigned char *cp, char *fp, int count)
+static void mkiss_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+        char *fp, int count)
 {
         struct mkiss *ax = mkiss_get(tty);
-        int bytes = count;
 
         if (!ax)
-                return -ENODEV;
+                return;
 
         /*
          * Argh! mtu change time! - costs us the packet part received
@@ -940,7 +939,7 @@ static unsigned int mkiss_receive_buf(struct tty_struct *tty,
                 ax_changedmtu(ax);
 
         /* Read the characters out of the buffer */
-        while (bytes--) {
+        while (count--) {
                 if (fp != NULL && *fp++) {
                         if (!test_and_set_bit(AXF_ERROR, &ax->flags))
                                 ax->dev->stats.rx_errors++;
@@ -953,8 +952,6 @@ static unsigned int mkiss_receive_buf(struct tty_struct *tty,
 
         mkiss_put(ax);
         tty_unthrottle(tty);
-
-        return count;
 }
 
 /*
diff --git a/drivers/net/hp100.c b/drivers/net/hp100.c
index c52a1df5d922..8e10d2f6a5ad 100644
--- a/drivers/net/hp100.c
+++ b/drivers/net/hp100.c
@@ -188,14 +188,14 @@ struct hp100_private {
  *  variables
  */
 #ifdef CONFIG_ISA
-static const char *const hp100_isa_tbl[] __devinitconst = {
+static const char *hp100_isa_tbl[] = {
         "HWPF150", /* HP J2573 rev A */
         "HWP1950", /* HP J2573 */
 };
 #endif
 
 #ifdef CONFIG_EISA
-static const struct eisa_device_id hp100_eisa_tbl[] __devinitconst = {
+static struct eisa_device_id hp100_eisa_tbl[] = {
         { "HWPF180" }, /* HP J2577 rev A */
         { "HWP1920" }, /* HP 27248B */
         { "HWP1940" }, /* HP J2577 */
@@ -336,7 +336,7 @@ static __devinit const char *hp100_read_id(int ioaddr)
 }
 
 #ifdef CONFIG_ISA
-static __devinit int hp100_isa_probe1(struct net_device *dev, int ioaddr)
+static __init int hp100_isa_probe1(struct net_device *dev, int ioaddr)
 {
         const char *sig;
         int i;
@@ -372,7 +372,7 @@ static __devinit int hp100_isa_probe1(struct net_device *dev, int ioaddr)
  * EISA and PCI are handled by device infrastructure.
  */
 
-static int  __devinit hp100_isa_probe(struct net_device *dev, int addr)
+static int  __init hp100_isa_probe(struct net_device *dev, int addr)
 {
         int err = -ENODEV;
 
@@ -396,7 +396,7 @@ static int  __devinit hp100_isa_probe(struct net_device *dev, int addr)
 #endif /* CONFIG_ISA */
 
 #if !defined(MODULE) && defined(CONFIG_ISA)
-struct net_device * __devinit hp100_probe(int unit)
+struct net_device * __init hp100_probe(int unit)
 {
         struct net_device *dev = alloc_etherdev(sizeof(struct hp100_private));
         int err;
@@ -2843,7 +2843,7 @@ static void cleanup_dev(struct net_device *d)
 }
 
 #ifdef CONFIG_EISA
-static int __devinit hp100_eisa_probe (struct device *gendev)
+static int __init hp100_eisa_probe (struct device *gendev)
 {
         struct net_device *dev = alloc_etherdev(sizeof(struct hp100_private));
         struct eisa_device *edev = to_eisa_device(gendev);
diff --git a/drivers/net/ibmlana.c b/drivers/net/ibmlana.c
index 136d7544cc33..a7d6cad32953 100644
--- a/drivers/net/ibmlana.c
+++ b/drivers/net/ibmlana.c
@@ -895,12 +895,12 @@ static int ibmlana_irq;
 static int ibmlana_io;
 static int startslot;           /* counts through slots when probing multiple devices */
 
-static const short ibmlana_adapter_ids[] __devinitconst = {
+static short ibmlana_adapter_ids[] __initdata = {
         IBM_LANA_ID,
         0x0000
 };
 
-static const char *const ibmlana_adapter_names[] __devinitconst = {
+static char *ibmlana_adapter_names[] __devinitdata = {
         "IBM LAN Adapter/A",
         NULL
 };
diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
index 035861d8acb1..3352b2443e58 100644
--- a/drivers/net/irda/irtty-sir.c
+++ b/drivers/net/irda/irtty-sir.c
@@ -216,23 +216,23 @@ static int irtty_do_write(struct sir_dev *dev, const unsigned char *ptr, size_t
  * usbserial:   urb-complete-interrupt / softint
  */
 
-static unsigned int irtty_receive_buf(struct tty_struct *tty,
-                const unsigned char *cp, char *fp, int count)
+static void irtty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+                              char *fp, int count) 
 {
         struct sir_dev *dev;
         struct sirtty_cb *priv = tty->disc_data;
         int     i;
 
-        IRDA_ASSERT(priv != NULL, return -ENODEV;);
-        IRDA_ASSERT(priv->magic == IRTTY_MAGIC, return -EINVAL;);
+        IRDA_ASSERT(priv != NULL, return;);
+        IRDA_ASSERT(priv->magic == IRTTY_MAGIC, return;);
 
         if (unlikely(count==0))         /* yes, this happens */
-                return 0;
+                return;
 
         dev = priv->dev;
         if (!dev) {
                 IRDA_WARNING("%s(), not ready yet!\n", __func__);
-                return -ENODEV;
+                return;
         }
 
         for (i = 0; i < count; i++) {
@@ -242,13 +242,11 @@ static unsigned int irtty_receive_buf(struct tty_struct *tty,
                 if (fp && *fp++) { 
                         IRDA_DEBUG(0, "Framing or parity error!\n");
                         sirdev_receive(dev, NULL, 0);   /* notify sir_dev (updating stats) */
-                        return -EINVAL;
+                        return;
                 }
         }
 
         sirdev_receive(dev, cp, count);
-
-        return count;
 }
 
 /*
diff --git a/drivers/net/irda/smsc-ircc2.c b/drivers/net/irda/smsc-ircc2.c
index 69b5707db369..8800e1fe4129 100644
--- a/drivers/net/irda/smsc-ircc2.c
+++ b/drivers/net/irda/smsc-ircc2.c
@@ -222,19 +222,19 @@ static void smsc_ircc_set_transceiver_for_speed(struct smsc_ircc_cb *self, u32 s
 static void smsc_ircc_sir_wait_hw_transmitter_finish(struct smsc_ircc_cb *self);
 
 /* Probing */
-static int smsc_ircc_look_for_chips(void);
-static const struct smsc_chip * smsc_ircc_probe(unsigned short cfg_base, u8 reg, const struct smsc_chip *chip, char *type);
-static int smsc_superio_flat(const struct smsc_chip *chips, unsigned short cfg_base, char *type);
-static int smsc_superio_paged(const struct smsc_chip *chips, unsigned short cfg_base, char *type);
-static int smsc_superio_fdc(unsigned short cfg_base);
-static int smsc_superio_lpc(unsigned short cfg_base);
+static int __init smsc_ircc_look_for_chips(void);
+static const struct smsc_chip * __init smsc_ircc_probe(unsigned short cfg_base, u8 reg, const struct smsc_chip *chip, char *type);
+static int __init smsc_superio_flat(const struct smsc_chip *chips, unsigned short cfg_base, char *type);
+static int __init smsc_superio_paged(const struct smsc_chip *chips, unsigned short cfg_base, char *type);
+static int __init smsc_superio_fdc(unsigned short cfg_base);
+static int __init smsc_superio_lpc(unsigned short cfg_base);
 #ifdef CONFIG_PCI
-static int preconfigure_smsc_chip(struct smsc_ircc_subsystem_configuration *conf);
-static int preconfigure_through_82801(struct pci_dev *dev, struct smsc_ircc_subsystem_configuration *conf);
-static void preconfigure_ali_port(struct pci_dev *dev,
+static int __init preconfigure_smsc_chip(struct smsc_ircc_subsystem_configuration *conf);
+static int __init preconfigure_through_82801(struct pci_dev *dev, struct smsc_ircc_subsystem_configuration *conf);
+static void __init preconfigure_ali_port(struct pci_dev *dev,
                                          unsigned short port);
-static int preconfigure_through_ali(struct pci_dev *dev, struct smsc_ircc_subsystem_configuration *conf);
-static int smsc_ircc_preconfigure_subsystems(unsigned short ircc_cfg,
+static int __init preconfigure_through_ali(struct pci_dev *dev, struct smsc_ircc_subsystem_configuration *conf);
+static int __init smsc_ircc_preconfigure_subsystems(unsigned short ircc_cfg,
                                                     unsigned short ircc_fir,
                                                     unsigned short ircc_sir,
                                                     unsigned char ircc_dma,
@@ -366,7 +366,7 @@ static inline void register_bank(int iobase, int bank)
 }
 
 /* PNP hotplug support */
-static const struct pnp_device_id smsc_ircc_pnp_table[] __devinitconst = {
+static const struct pnp_device_id smsc_ircc_pnp_table[] = {
         { .id = "SMCf010", .driver_data = 0 },
         /* and presumably others */
         { }
@@ -515,7 +515,7 @@ static const struct net_device_ops smsc_ircc_netdev_ops = {
  *    Try to open driver instance
  *
  */
-static int __devinit smsc_ircc_open(unsigned int fir_base, unsigned int sir_base, u8 dma, u8 irq)
+static int __init smsc_ircc_open(unsigned int fir_base, unsigned int sir_base, u8 dma, u8 irq)
 {
         struct smsc_ircc_cb *self;
         struct net_device *dev;
@@ -2273,7 +2273,7 @@ static int __init smsc_superio_paged(const struct smsc_chip *chips, unsigned sho
 }
 
 
-static int __devinit smsc_access(unsigned short cfg_base, unsigned char reg)
+static int __init smsc_access(unsigned short cfg_base, unsigned char reg)
 {
         IRDA_DEBUG(1, "%s\n", __func__);
 
@@ -2281,7 +2281,7 @@ static int __devinit smsc_access(unsigned short cfg_base, unsigned char reg)
         return inb(cfg_base) != reg ? -1 : 0;
 }
 
-static const struct smsc_chip * __devinit smsc_ircc_probe(unsigned short cfg_base, u8 reg, const struct smsc_chip *chip, char *type)
+static const struct smsc_chip * __init smsc_ircc_probe(unsigned short cfg_base, u8 reg, const struct smsc_chip *chip, char *type)
 {
         u8 devid, xdevid, rev;
 
@@ -2406,7 +2406,7 @@ static int __init smsc_superio_lpc(unsigned short cfg_base)
 #ifdef CONFIG_PCI
 #define PCIID_VENDOR_INTEL 0x8086
 #define PCIID_VENDOR_ALI 0x10b9
-static const struct smsc_ircc_subsystem_configuration subsystem_configurations[] __devinitconst = {
+static struct smsc_ircc_subsystem_configuration subsystem_configurations[] __initdata = {
         /*
          * Subsystems needing entries:
          * 0x10b9:0x1533 0x103c:0x0850 HP nx9010 family
@@ -2532,7 +2532,7 @@ static const struct smsc_ircc_subsystem_configuration subsystem_configurations[]
  * (FIR port, SIR port, FIR DMA, FIR IRQ)
  * through the chip configuration port.
  */
-static int __devinit preconfigure_smsc_chip(struct
+static int __init preconfigure_smsc_chip(struct
                                          smsc_ircc_subsystem_configuration
                                          *conf)
 {
@@ -2633,7 +2633,7 @@ static int __devinit preconfigure_smsc_chip(struct
  * or Intel 82801DB/DBL (ICH4/ICH4-L) LPC Interface Bridge.
  * They all work the same way!
  */
-static int __devinit preconfigure_through_82801(struct pci_dev *dev,
+static int __init preconfigure_through_82801(struct pci_dev *dev,
                                              struct
                                              smsc_ircc_subsystem_configuration
                                              *conf)
@@ -2786,7 +2786,7 @@ static int __devinit preconfigure_through_82801(struct pci_dev *dev,
  * This is based on reverse-engineering since ALi does not
  * provide any data sheet for the 1533 chip.
  */
-static void __devinit preconfigure_ali_port(struct pci_dev *dev,
+static void __init preconfigure_ali_port(struct pci_dev *dev,
                                          unsigned short port)
 {
         unsigned char reg;
@@ -2824,7 +2824,7 @@ static void __devinit preconfigure_ali_port(struct pci_dev *dev,
         IRDA_MESSAGE("Activated ALi 1533 ISA bridge port 0x%04x.\n", port);
 }
 
-static int __devinit preconfigure_through_ali(struct pci_dev *dev,
+static int __init preconfigure_through_ali(struct pci_dev *dev,
                                            struct
                                            smsc_ircc_subsystem_configuration
                                            *conf)
@@ -2837,7 +2837,7 @@ static int __devinit preconfigure_through_ali(struct pci_dev *dev,
         return preconfigure_smsc_chip(conf);
 }
 
-static int __devinit smsc_ircc_preconfigure_subsystems(unsigned short ircc_cfg,
+static int __init smsc_ircc_preconfigure_subsystems(unsigned short ircc_cfg,
                                                     unsigned short ircc_fir,
                                                     unsigned short ircc_sir,
                                                     unsigned char ircc_dma,
@@ -2849,7 +2849,7 @@ static int __devinit smsc_ircc_preconfigure_subsystems(unsigned short ircc_cfg,
         int ret = 0;
 
         for_each_pci_dev(dev) {
-                const struct smsc_ircc_subsystem_configuration *conf;
+                struct smsc_ircc_subsystem_configuration *conf;
 
                 /*
                  * Cache the subsystem vendor/device:
diff --git a/drivers/net/ks8842.c b/drivers/net/ks8842.c
index 4d40626b3bfa..fc12ac0d9f2e 100644
--- a/drivers/net/ks8842.c
+++ b/drivers/net/ks8842.c
@@ -661,7 +661,7 @@ static void ks8842_rx_frame(struct net_device *netdev,
 
         /* check the status */
         if ((status & RXSR_VALID) && !(status & RXSR_ERROR)) {
-                struct sk_buff *skb = netdev_alloc_skb_ip_align(netdev, len);
+                struct sk_buff *skb = netdev_alloc_skb_ip_align(netdev, len + 3);
 
                 if (skb) {
 
diff --git a/drivers/net/ne3210.c b/drivers/net/ne3210.c
index e8984b0ca521..243ed2aee88e 100644
--- a/drivers/net/ne3210.c
+++ b/drivers/net/ne3210.c
@@ -80,20 +80,17 @@ static void ne3210_block_output(struct net_device *dev, int count, const unsigne
 
 #define NE3210_DEBUG    0x0
 
-static const unsigned char irq_map[] __devinitconst =
-        { 15, 12, 11, 10, 9, 7, 5, 3 };
-static const unsigned int shmem_map[] __devinitconst =
-        { 0xff0, 0xfe0, 0xfff0, 0xd8, 0xffe0, 0xffc0, 0xd0, 0x0 };
-static const char *const ifmap[] __devinitconst =
-        { "UTP", "?", "BNC", "AUI" };
-static const int ifmap_val[] __devinitconst = {
+static unsigned char irq_map[] __initdata = {15, 12, 11, 10, 9, 7, 5, 3};
+static unsigned int shmem_map[] __initdata = {0xff0, 0xfe0, 0xfff0, 0xd8, 0xffe0, 0xffc0, 0xd0, 0x0};
+static const char *ifmap[] __initdata = {"UTP", "?", "BNC", "AUI"};
+static int ifmap_val[] __initdata = {
                 IF_PORT_10BASET,
                 IF_PORT_UNKNOWN,
                 IF_PORT_10BASE2,
                 IF_PORT_AUI,
 };
 
-static int __devinit ne3210_eisa_probe (struct device *device)
+static int __init ne3210_eisa_probe (struct device *device)
 {
         unsigned long ioaddr, phys_mem;
         int i, retval, port_index;
@@ -316,7 +313,7 @@ static void ne3210_block_output(struct net_device *dev, int count,
         memcpy_toio(shmem, buf, count);
 }
 
-static const struct eisa_device_id ne3210_ids[] __devinitconst = {
+static struct eisa_device_id ne3210_ids[] = {
         { "EGL0101" },
         { "NVL1801" },
         { "" },
diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index 53872d7d7382..a1b82c9c67d2 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -340,7 +340,7 @@ ppp_asynctty_poll(struct tty_struct *tty, struct file *file, poll_table *wait)
 }
 
 /* May sleep, don't call from interrupt level or with interrupts disabled */
-static unsigned int
+static void
 ppp_asynctty_receive(struct tty_struct *tty, const unsigned char *buf,
                   char *cflags, int count)
 {
@@ -348,7 +348,7 @@ ppp_asynctty_receive(struct tty_struct *tty, const unsigned char *buf,
         unsigned long flags;
 
         if (!ap)
-                return -ENODEV;
+                return;
         spin_lock_irqsave(&ap->recv_lock, flags);
         ppp_async_input(ap, buf, cflags, count);
         spin_unlock_irqrestore(&ap->recv_lock, flags);
@@ -356,8 +356,6 @@ ppp_asynctty_receive(struct tty_struct *tty, const unsigned char *buf,
                 tasklet_schedule(&ap->tsk);
         ap_put(ap);
         tty_unthrottle(tty);
-
-        return count;
 }
 
 static void
diff --git a/drivers/net/ppp_synctty.c b/drivers/net/ppp_synctty.c
index 0815790a5cf9..2573f525f11c 100644
--- a/drivers/net/ppp_synctty.c
+++ b/drivers/net/ppp_synctty.c
@@ -381,7 +381,7 @@ ppp_sync_poll(struct tty_struct *tty, struct file *file, poll_table *wait)
 }
 
 /* May sleep, don't call from interrupt level or with interrupts disabled */
-static unsigned int
+static void
 ppp_sync_receive(struct tty_struct *tty, const unsigned char *buf,
                   char *cflags, int count)
 {
@@ -389,7 +389,7 @@ ppp_sync_receive(struct tty_struct *tty, const unsigned char *buf,
         unsigned long flags;
 
         if (!ap)
-                return -ENODEV;
+                return;
         spin_lock_irqsave(&ap->recv_lock, flags);
         ppp_sync_input(ap, buf, cflags, count);
         spin_unlock_irqrestore(&ap->recv_lock, flags);
@@ -397,8 +397,6 @@ ppp_sync_receive(struct tty_struct *tty, const unsigned char *buf,
                 tasklet_schedule(&ap->tsk);
         sp_put(ap);
         tty_unthrottle(tty);
-
-        return count;
 }
 
 static void
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index 584809c656d5..8ec1a9a0bb9a 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -670,17 +670,16 @@ static void sl_setup(struct net_device *dev)
  * in parallel
  */
 
-static unsigned int slip_receive_buf(struct tty_struct *tty,
-                const unsigned char *cp, char *fp, int count)
+static void slip_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+                                                        char *fp, int count)
 {
         struct slip *sl = tty->disc_data;
-        int bytes = count;
 
         if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev))
-                return -ENODEV;
+                return;
 
         /* Read the characters out of the buffer */
-        while (bytes--) {
+        while (count--) {
                 if (fp && *fp++) {
                         if (!test_and_set_bit(SLF_ERROR, &sl->flags))
                                 sl->dev->stats.rx_errors++;
@@ -694,8 +693,6 @@ static unsigned int slip_receive_buf(struct tty_struct *tty,
 #endif
                         slip_unesc(sl, *cp++);
         }
-
-        return count;
 }
 
 /************************************
diff --git a/drivers/net/smc-mca.c b/drivers/net/smc-mca.c
index 0f29f261fcfe..d07c39cb4daf 100644
--- a/drivers/net/smc-mca.c
+++ b/drivers/net/smc-mca.c
@@ -156,7 +156,7 @@ static const struct {
    { 14, 15 }
 };
 
-static const short smc_mca_adapter_ids[] __devinitconst = {
+static short smc_mca_adapter_ids[] __initdata = {
         0x61c8,
         0x61c9,
         0x6fc0,
@@ -168,7 +168,7 @@ static const short smc_mca_adapter_ids[] __devinitconst = {
         0x0000
 };
 
-static const char *const smc_mca_adapter_names[] __devinitconst = {
+static char *smc_mca_adapter_names[] __initdata = {
         "SMC Ethercard PLUS Elite/A BNC/AUI (WD8013EP/A)",
         "SMC Ethercard PLUS Elite/A UTP/AUI (WD8013WP/A)",
         "WD Ethercard PLUS/A (WD8003E/A or WD8003ET/A)",
@@ -199,7 +199,7 @@ static const struct net_device_ops ultramca_netdev_ops = {
 #endif
 };
 
-static int __devinit ultramca_probe(struct device *gen_dev)
+static int __init ultramca_probe(struct device *gen_dev)
 {
         unsigned short ioaddr;
         struct net_device *dev;
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index f4b01c638a33..a1f9f9eef37d 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -5774,7 +5774,7 @@ static void tg3_skb_error_unmap(struct tg3_napi *tnapi,
                          dma_unmap_addr(txb, mapping),
                          skb_headlen(skb),
                          PCI_DMA_TODEVICE);
-        for (i = 0; i <= last; i++) {
+        for (i = 0; i < last; i++) {
                 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 
                 entry = NEXT_TX(entry);
diff --git a/drivers/net/tokenring/madgemc.c b/drivers/net/tokenring/madgemc.c
index 1313aa1315f0..2bedc0ace812 100644
--- a/drivers/net/tokenring/madgemc.c
+++ b/drivers/net/tokenring/madgemc.c
@@ -727,7 +727,7 @@ static int __devexit madgemc_remove(struct device *device)
         return 0;
 }
 
-static const short madgemc_adapter_ids[] __devinitconst = {
+static short madgemc_adapter_ids[] __initdata = {
         0x002d,
         0x0000
 };
diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
index 45144d5bd11b..efaa1d69b720 100644
--- a/drivers/net/tulip/de4x5.c
+++ b/drivers/net/tulip/de4x5.c
@@ -1995,7 +1995,7 @@ SetMulticastFilter(struct net_device *dev)
 
 static u_char de4x5_irq[] = EISA_ALLOWED_IRQ_LIST;
 
-static int __devinit de4x5_eisa_probe (struct device *gendev)
+static int __init de4x5_eisa_probe (struct device *gendev)
 {
         struct eisa_device *edev;
         u_long iobase;
@@ -2097,7 +2097,7 @@ static int __devexit de4x5_eisa_remove (struct device *device)
         return 0;
 }
 
-static const struct eisa_device_id de4x5_eisa_ids[] __devinitconst = {
+static struct eisa_device_id de4x5_eisa_ids[] = {
         { "DEC4250", 0 },       /* 0 is the board name index... */
         { "" }
 };
diff --git a/drivers/net/usb/catc.c b/drivers/net/usb/catc.c
index d7221c4a5dcf..8056f8a27c6a 100644
--- a/drivers/net/usb/catc.c
+++ b/drivers/net/usb/catc.c
@@ -495,7 +495,7 @@ static void catc_ctrl_run(struct catc *catc)
         if (!q->dir && q->buf && q->len)
                 memcpy(catc->ctrl_buf, q->buf, q->len);
 
-        if ((status = usb_submit_urb(catc->ctrl_urb, GFP_KERNEL)))
+        if ((status = usb_submit_urb(catc->ctrl_urb, GFP_ATOMIC)))
                 err("submit(ctrl_urb) status %d", status);
 }
 
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index cdd3ae486109..f33ca6aa29e9 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -54,7 +54,7 @@
 #include <linux/usb/usbnet.h>
 #include <linux/usb/cdc.h>
 
-#define DRIVER_VERSION                          "24-May-2011"
+#define DRIVER_VERSION                          "01-June-2011"
 
 /* CDC NCM subclass 3.2.1 */
 #define USB_CDC_NCM_NDP16_LENGTH_MIN            0x10
@@ -1234,6 +1234,7 @@ static struct usb_driver cdc_ncm_driver = {
         .disconnect = cdc_ncm_disconnect,
         .suspend = usbnet_suspend,
         .resume = usbnet_resume,
+        .reset_resume = usbnet_resume,
         .supports_autosuspend = 1,
 };
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 0cb0b0632672..f6853247a620 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -609,7 +609,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
          * before it gets out of hand.  Naturally, this wastes entries. */
         if (capacity < 2+MAX_SKB_FRAGS) {
                 netif_stop_queue(dev);
-                if (unlikely(!virtqueue_enable_cb(vi->svq))) {
+                if (unlikely(!virtqueue_enable_cb_delayed(vi->svq))) {
                         /* More just got used, free them then recheck. */
                         capacity += free_old_xmit_skbs(vi);
                         if (capacity >= 2+MAX_SKB_FRAGS) {
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index 40398bf7d036..24297b274cd4 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -517,18 +517,17 @@ static int x25_asy_close(struct net_device *dev)
  * and sent on to some IP layer for further processing.
  */
 
-static unsigned int x25_asy_receive_buf(struct tty_struct *tty,
+static void x25_asy_receive_buf(struct tty_struct *tty,
                                 const unsigned char *cp, char *fp, int count)
 {
         struct x25_asy *sl = tty->disc_data;
-        int bytes = count;
 
         if (!sl || sl->magic != X25_ASY_MAGIC || !netif_running(sl->dev))
                 return;
 
 
         /* Read the characters out of the buffer */
-        while (bytes--) {
+        while (count--) {
                 if (fp && *fp++) {
                         if (!test_and_set_bit(SLF_ERROR, &sl->flags))
                                 sl->dev->stats.rx_errors++;
@@ -537,8 +536,6 @@ static unsigned int x25_asy_receive_buf(struct tty_struct *tty,
                 }
                 x25_asy_unesc(sl, *cp++);
         }
-
-        return count;
 }
 
 /*
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index d9ff8413ab9a..d9c08c619a3a 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -26,7 +26,6 @@ config ATH9K
 config ATH9K_PCI
         bool "Atheros ath9k PCI/PCIe bus support"
         depends on ATH9K && PCI
-        default PCI
         ---help---
           This option enables the PCI bus support in ath9k.
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index 015d97439935..2d4c0910295b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -829,7 +829,7 @@ static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
         if (AR_SREV_9271(ah)) {
                 if (!ar9285_hw_cl_cal(ah, chan))
                         return false;
-        } else if (AR_SREV_9285_12_OR_LATER(ah)) {
+        } else if (AR_SREV_9285(ah) && AR_SREV_9285_12_OR_LATER(ah)) {
                 if (!ar9285_hw_clc(ah, chan))
                         return false;
         } else {
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 0ca7635d0669..ff8150e46f0e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -4645,10 +4645,16 @@ static void ar9003_hw_set_power_per_rate_table(struct ath_hw *ah,
         case 1:
                 break;
         case 2:
-                scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+                if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
+                        scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+                else
+                        scaledPower = 0;
                 break;
         case 3:
-                scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+                if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
+                        scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+                else
+                        scaledPower = 0;
                 break;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index eee23ecd118a..892c48b15434 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -1381,3 +1381,25 @@ void ar9003_hw_bb_watchdog_dbg_info(struct ath_hw *ah)
                 "==== BB update: done ====\n\n");
 }
 EXPORT_SYMBOL(ar9003_hw_bb_watchdog_dbg_info);
+
+void ar9003_hw_disable_phy_restart(struct ath_hw *ah)
+{
+        u32 val;
+
+        /* While receiving unsupported rate frame rx state machine
+         * gets into a state 0xb and if phy_restart happens in that
+         * state, BB would go hang. If RXSM is in 0xb state after
+         * first bb panic, ensure to disable the phy_restart.
+         */
+        if (!((MS(ah->bb_watchdog_last_status,
+                  AR_PHY_WATCHDOG_RX_OFDM_SM) == 0xb) ||
+            ah->bb_hang_rx_ofdm))
+                return;
+
+        ah->bb_hang_rx_ofdm = true;
+        val = REG_READ(ah, AR_PHY_RESTART);
+        val &= ~AR_PHY_RESTART_ENA;
+
+        REG_WRITE(ah, AR_PHY_RESTART, val);
+}
+EXPORT_SYMBOL(ar9003_hw_disable_phy_restart);
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index 7856f0d4512d..343fc9f946db 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -524,10 +524,16 @@ static void ath9k_hw_set_ar9287_power_per_rate_table(struct ath_hw *ah,
         case 1:
                 break;
         case 2:
-                scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+                if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
+                        scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+                else
+                        scaledPower = 0;
                 break;
         case 3:
-                scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+                if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
+                        scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+                else
+                        scaledPower = 0;
                 break;
         }
         scaledPower = max((u16)0, scaledPower);
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 72543ce8f616..1be7c8bbef84 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1555,9 +1555,12 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (ah->btcoex_hw.enabled)
                 ath9k_hw_btcoex_enable(ah);
 
-        if (AR_SREV_9300_20_OR_LATER(ah))
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
                 ar9003_hw_bb_watchdog_config(ah);
 
+                ar9003_hw_disable_phy_restart(ah);
+        }
+
         ath9k_hw_apply_gpio_override(ah);
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 57435ce62792..4b157c53d1a8 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -842,6 +842,7 @@ struct ath_hw {
 
         u32 bb_watchdog_last_status;
         u32 bb_watchdog_timeout_ms; /* in ms, 0 to disable */
+        u8 bb_hang_rx_ofdm; /* true if bb hang due to rx_ofdm */
 
         unsigned int paprd_target_power;
         unsigned int paprd_training_power;
@@ -990,6 +991,7 @@ void ar9002_hw_enable_wep_aggregation(struct ath_hw *ah);
 void ar9003_hw_bb_watchdog_config(struct ath_hw *ah);
 void ar9003_hw_bb_watchdog_read(struct ath_hw *ah);
 void ar9003_hw_bb_watchdog_dbg_info(struct ath_hw *ah);
+void ar9003_hw_disable_phy_restart(struct ath_hw *ah);
 void ar9003_paprd_enable(struct ath_hw *ah, bool val);
 void ar9003_paprd_populate_single_table(struct ath_hw *ah,
                                         struct ath9k_hw_cal_data *caldata,
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index a198ee374b05..2ca351fe6d3c 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -670,7 +670,8 @@ void ath9k_tasklet(unsigned long data)
         u32 status = sc->intrstatus;
         u32 rxmask;
 
-        if (status & ATH9K_INT_FATAL) {
+        if ((status & ATH9K_INT_FATAL) ||
+            (status & ATH9K_INT_BB_WATCHDOG)) {
                 ath_reset(sc, true);
                 return;
         }
@@ -737,6 +738,7 @@ irqreturn_t ath_isr(int irq, void *dev)
 {
 #define SCHED_INTR (                            \
                 ATH9K_INT_FATAL |               \
+                ATH9K_INT_BB_WATCHDOG |         \
                 ATH9K_INT_RXORN |               \
                 ATH9K_INT_RXEOL |               \
                 ATH9K_INT_RX |                  \
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 17542214c93f..ba7f36ab0a74 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -689,7 +689,8 @@ static void ath_rc_rate_set_series(const struct ath_rate_table *rate_table,
 
         if (WLAN_RC_PHY_HT(rate_table->info[rix].phy)) {
                 rate->flags |= IEEE80211_TX_RC_MCS;
-                if (WLAN_RC_PHY_40(rate_table->info[rix].phy))
+                if (WLAN_RC_PHY_40(rate_table->info[rix].phy) &&
+                    conf_is_ht40(&txrc->hw->conf))
                         rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
                 if (WLAN_RC_PHY_SGI(rate_table->info[rix].phy))
                         rate->flags |= IEEE80211_TX_RC_SHORT_GI;
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 9ed65157bef5..05960ddde24e 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -3093,7 +3093,7 @@ static int b43_nphy_cal_tx_iq_lo(struct b43_wldev *dev,
         int freq;
         bool avoid = false;
         u8 length;
-        u16 tmp, core, type, count, max, numb, last, cmd;
+        u16 tmp, core, type, count, max, numb, last = 0, cmd;
         const u16 *table;
         bool phy6or5x;
 
diff --git a/drivers/net/wireless/iwlegacy/iwl-4965-lib.c b/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
index 7e5e85a017b5..a7a4739880dc 100644
--- a/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
+++ b/drivers/net/wireless/iwlegacy/iwl-4965-lib.c
@@ -628,11 +628,11 @@ void iwl4965_rx_reply_rx(struct iwl_priv *priv,
 
         /* rx_status carries information about the packet to mac80211 */
         rx_status.mactime = le64_to_cpu(phy_res->timestamp);
+        rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
+                                IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
         rx_status.freq =
                 ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel),
                                                         rx_status.band);
-        rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
-                                IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
         rx_status.rate_idx =
                 iwl4965_hwrate_to_mac80211_idx(rate_n_flags, rx_status.band);
         rx_status.flag = 0;
diff --git a/drivers/net/wireless/iwlegacy/iwl-4965.c b/drivers/net/wireless/iwlegacy/iwl-4965.c
index f5433c74b845..f9db25bb35c3 100644
--- a/drivers/net/wireless/iwlegacy/iwl-4965.c
+++ b/drivers/net/wireless/iwlegacy/iwl-4965.c
@@ -1543,7 +1543,7 @@ static void iwl4965_temperature_calib(struct iwl_priv *priv)
         s32 temp;
 
         temp = iwl4965_hw_get_temperature(priv);
-        if (temp < 0)
+        if (IWL_TX_POWER_TEMPERATURE_OUT_OF_RANGE(temp))
                 return;
 
         if (priv->temperature != temp) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index f8c710db6e6f..fda6fe08cf91 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -603,19 +603,27 @@ struct iwl_cfg iwl6050_2abg_cfg = {
         IWL_DEVICE_6050,
 };
 
+#define IWL_DEVICE_6150                                         \
+        .fw_name_pre = IWL6050_FW_PRE,                          \
+        .ucode_api_max = IWL6050_UCODE_API_MAX,                 \
+        .ucode_api_min = IWL6050_UCODE_API_MIN,                 \
+        .ops = &iwl6150_ops,                                    \
+        .eeprom_ver = EEPROM_6150_EEPROM_VERSION,               \
+        .eeprom_calib_ver = EEPROM_6150_TX_POWER_VERSION,       \
+        .base_params = &iwl6050_base_params,                    \
+        .need_dc_calib = true,                                  \
+        .led_mode = IWL_LED_BLINK,                              \
+        .internal_wimax_coex = true
+
 struct iwl_cfg iwl6150_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N + WiMAX 6150 BGN",
-        .fw_name_pre = IWL6050_FW_PRE,
-        .ucode_api_max = IWL6050_UCODE_API_MAX,
-        .ucode_api_min = IWL6050_UCODE_API_MIN,
-        .eeprom_ver = EEPROM_6150_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_6150_TX_POWER_VERSION,
-        .ops = &iwl6150_ops,
-        .base_params = &iwl6050_base_params,
+        IWL_DEVICE_6150,
         .ht_params = &iwl6000_ht_params,
-        .need_dc_calib = true,
-        .led_mode = IWL_LED_RF_STATE,
-        .internal_wimax_coex = true,
+};
+
+struct iwl_cfg iwl6150_bg_cfg = {
+        .name = "Intel(R) Centrino(R) Wireless-N + WiMAX 6150 BG",
+        IWL_DEVICE_6150,
 };
 
 struct iwl_cfg iwl6000_3agn_cfg = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 11c6c1169e78..a662adcb2adb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3831,11 +3831,11 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 
 /* 6150 WiFi/WiMax Series */
         {IWL_PCI_DEVICE(0x0885, 0x1305, iwl6150_bgn_cfg)},
-        {IWL_PCI_DEVICE(0x0885, 0x1306, iwl6150_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0885, 0x1307, iwl6150_bg_cfg)},
         {IWL_PCI_DEVICE(0x0885, 0x1325, iwl6150_bgn_cfg)},
-        {IWL_PCI_DEVICE(0x0885, 0x1326, iwl6150_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0885, 0x1327, iwl6150_bg_cfg)},
         {IWL_PCI_DEVICE(0x0886, 0x1315, iwl6150_bgn_cfg)},
-        {IWL_PCI_DEVICE(0x0886, 0x1316, iwl6150_bgn_cfg)},
+        {IWL_PCI_DEVICE(0x0886, 0x1317, iwl6150_bg_cfg)},
 
 /* 1000 Series WiFi */
         {IWL_PCI_DEVICE(0x0083, 0x1205, iwl1000_bgn_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
index 2495fe7a58cb..d1716844002e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -89,6 +89,7 @@ extern struct iwl_cfg iwl6000_3agn_cfg;
 extern struct iwl_cfg iwl6050_2agn_cfg;
 extern struct iwl_cfg iwl6050_2abg_cfg;
 extern struct iwl_cfg iwl6150_bgn_cfg;
+extern struct iwl_cfg iwl6150_bg_cfg;
 extern struct iwl_cfg iwl1000_bgn_cfg;
 extern struct iwl_cfg iwl1000_bg_cfg;
 extern struct iwl_cfg iwl100_bgn_cfg;
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 84566db486d2..71c8f3fccfa1 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -994,6 +994,8 @@ static void lbs_submit_command(struct lbs_private *priv,
         cmd = cmdnode->cmdbuf;
 
         spin_lock_irqsave(&priv->driver_lock, flags);
+        priv->seqnum++;
+        cmd->seqnum = cpu_to_le16(priv->seqnum);
         priv->cur_cmd = cmdnode;
         spin_unlock_irqrestore(&priv->driver_lock, flags);
 
@@ -1621,11 +1623,9 @@ struct cmd_ctrl_node *__lbs_cmd_async(struct lbs_private *priv,
         /* Copy the incoming command to the buffer */
         memcpy(cmdnode->cmdbuf, in_cmd, in_cmd_size);
 
-        /* Set sequence number, clean result, move to buffer */
-        priv->seqnum++;
+        /* Set command, clean result, move to buffer */
         cmdnode->cmdbuf->command = cpu_to_le16(command);
         cmdnode->cmdbuf->size    = cpu_to_le16(in_cmd_size);
-        cmdnode->cmdbuf->seqnum  = cpu_to_le16(priv->seqnum);
         cmdnode->cmdbuf->result  = 0;
 
         lbs_deb_host("PREP_CMD: command 0x%04x\n", command);
diff --git a/drivers/net/wireless/mwifiex/sdio.h b/drivers/net/wireless/mwifiex/sdio.h
index a0e9bc5253e0..4e97e90aa399 100644
--- a/drivers/net/wireless/mwifiex/sdio.h
+++ b/drivers/net/wireless/mwifiex/sdio.h
@@ -167,8 +167,8 @@
 /* Rx unit register */
 #define CARD_RX_UNIT_REG                0x63
 
-/* Event header Len*/
-#define MWIFIEX_EVENT_HEADER_LEN           8
+/* Event header len w/o 4 bytes of interface header */
+#define MWIFIEX_EVENT_HEADER_LEN           4
 
 /* Max retry number of CMD53 write */
 #define MAX_WRITE_IOMEM_RETRY           2
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 9def1e5369a1..b2f8b8fd4d2d 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -166,7 +166,6 @@ config RT2800USB_RT35XX
 config RT2800USB_RT53XX
        bool "rt2800usb - Include support for rt53xx devices (EXPERIMENTAL)"
        depends on EXPERIMENTAL
-       default y
        ---help---
          This adds support for rt53xx wireless chipset family to the
          rt2800pci driver.
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index a40952845436..89100e7c553b 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -669,11 +669,6 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                                                          &rx_status,
                                                          (u8 *) pdesc, skb);
 
-                        pci_unmap_single(rtlpci->pdev,
-                                         *((dma_addr_t *) skb->cb),
-                                         rtlpci->rxbuffersize,
-                                         PCI_DMA_FROMDEVICE);
-
                         skb_put(skb, rtlpriv->cfg->ops->get_desc((u8 *) pdesc,
                                                          false,
                                                          HW_DESC_RXPKT_LEN));
@@ -690,6 +685,21 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         hdr = rtl_get_hdr(skb);
                         fc = rtl_get_fc(skb);
 
+                        /* try for new buffer - if allocation fails, drop
+                         * frame and reuse old buffer
+                         */
+                        new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
+                        if (unlikely(!new_skb)) {
+                                RT_TRACE(rtlpriv, (COMP_INTR | COMP_RECV),
+                                         DBG_DMESG,
+                                         ("can't alloc skb for rx\n"));
+                                goto done;
+                        }
+                        pci_unmap_single(rtlpci->pdev,
+                                         *((dma_addr_t *) skb->cb),
+                                         rtlpci->rxbuffersize,
+                                         PCI_DMA_FROMDEVICE);
+
                         if (!stats.crc || !stats.hwerror) {
                                 memcpy(IEEE80211_SKB_RXCB(skb), &rx_status,
                                        sizeof(rx_status));
@@ -758,15 +768,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                                 rtl_lps_leave(hw);
                         }
 
-                        new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
-                        if (unlikely(!new_skb)) {
-                                RT_TRACE(rtlpriv, (COMP_INTR | COMP_RECV),
-                                         DBG_DMESG,
-                                         ("can't alloc skb for rx\n"));
-                                goto done;
-                        }
                         skb = new_skb;
-                        /*skb->dev = dev; */
 
                         rtlpci->rx_ring[rx_queue_idx].rx_buf[rtlpci->
                                                              rx_ring
@@ -1113,6 +1115,13 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw)
 
                 rtlpci->rx_ring[rx_queue_idx].idx = 0;
 
+                /* If amsdu_8k is disabled, set buffersize to 4096. This
+                 * change will reduce memory fragmentation.
+                 */
+                if (rtlpci->rxbuffersize > 4096 &&
+                    rtlpriv->rtlhal.disable_amsdu_8k)
+                        rtlpci->rxbuffersize = 4096;
+
                 for (i = 0; i < rtlpci->rxringcount; i++) {
                         struct sk_buff *skb =
                             dev_alloc_skb(rtlpci->rxbuffersize);
diff --git a/drivers/net/wireless/wl12xx/conf.h b/drivers/net/wireless/wl12xx/conf.h
index 1ab6c86aac40..c83fefb6662f 100644
--- a/drivers/net/wireless/wl12xx/conf.h
+++ b/drivers/net/wireless/wl12xx/conf.h
@@ -1157,6 +1157,9 @@ struct conf_sched_scan_settings {
         /* time to wait on the channel for passive scans (in TUs) */
         u32 dwell_time_passive;
 
+        /* time to wait on the channel for DFS scans (in TUs) */
+        u32 dwell_time_dfs;
+
         /* number of probe requests to send on each channel in active scans */
         u8 num_probe_reqs;
 
diff --git a/drivers/net/wireless/wl12xx/main.c b/drivers/net/wireless/wl12xx/main.c
index bc00e52f6445..e6497dc669df 100644
--- a/drivers/net/wireless/wl12xx/main.c
+++ b/drivers/net/wireless/wl12xx/main.c
@@ -311,6 +311,7 @@ static struct conf_drv_settings default_conf = {
                 .min_dwell_time_active = 8,
                 .max_dwell_time_active = 30,
                 .dwell_time_passive    = 100,
+                .dwell_time_dfs        = 150,
                 .num_probe_reqs        = 2,
                 .rssi_threshold        = -90,
                 .snr_threshold         = 0,
diff --git a/drivers/net/wireless/wl12xx/scan.c b/drivers/net/wireless/wl12xx/scan.c
index f37e5a391976..56f76abc754d 100644
--- a/drivers/net/wireless/wl12xx/scan.c
+++ b/drivers/net/wireless/wl12xx/scan.c
@@ -331,16 +331,22 @@ wl1271_scan_get_sched_scan_channels(struct wl1271 *wl,
         struct conf_sched_scan_settings *c = &wl->conf.sched_scan;
         int i, j;
         u32 flags;
+        bool force_passive = !req->n_ssids;
 
         for (i = 0, j = start;
              i < req->n_channels && j < MAX_CHANNELS_ALL_BANDS;
              i++) {
                 flags = req->channels[i]->flags;
 
-                if (!(flags & IEEE80211_CHAN_DISABLED) &&
-                    ((flags & IEEE80211_CHAN_PASSIVE_SCAN) == passive) &&
-                    ((flags & IEEE80211_CHAN_RADAR) == radar) &&
-                    (req->channels[i]->band == band)) {
+                if (force_passive)
+                        flags |= IEEE80211_CHAN_PASSIVE_SCAN;
+
+                if ((req->channels[i]->band == band) &&
+                    !(flags & IEEE80211_CHAN_DISABLED) &&
+                    (!!(flags & IEEE80211_CHAN_RADAR) == radar) &&
+                    /* if radar is set, we ignore the passive flag */
+                    (radar ||
+                     !!(flags & IEEE80211_CHAN_PASSIVE_SCAN) == passive)) {
                         wl1271_debug(DEBUG_SCAN, "band %d, center_freq %d ",
                                      req->channels[i]->band,
                                      req->channels[i]->center_freq);
@@ -350,7 +356,12 @@ wl1271_scan_get_sched_scan_channels(struct wl1271 *wl,
                         wl1271_debug(DEBUG_SCAN, "max_power %d",
                                      req->channels[i]->max_power);
 
-                        if (flags & IEEE80211_CHAN_PASSIVE_SCAN) {
+                        if (flags & IEEE80211_CHAN_RADAR) {
+                                channels[j].flags |= SCAN_CHANNEL_FLAGS_DFS;
+                                channels[j].passive_duration =
+                                        cpu_to_le16(c->dwell_time_dfs);
+                        }
+                        else if (flags & IEEE80211_CHAN_PASSIVE_SCAN) {
                                 channels[j].passive_duration =
                                         cpu_to_le16(c->dwell_time_passive);
                         } else {
@@ -359,7 +370,7 @@ wl1271_scan_get_sched_scan_channels(struct wl1271 *wl,
                                 channels[j].max_duration =
                                         cpu_to_le16(c->max_dwell_time_active);
                         }
-                        channels[j].tx_power_att = req->channels[j]->max_power;
+                        channels[j].tx_power_att = req->channels[i]->max_power;
                         channels[j].channel = req->channels[i]->hw_value;
 
                         j++;
@@ -386,7 +397,11 @@ wl1271_scan_sched_scan_channels(struct wl1271 *wl,
                 wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels,
                                                     IEEE80211_BAND_2GHZ,
                                                     false, false, idx);
-        idx += cfg->active[0];
+        /*
+         * 5GHz channels always start at position 14, not immediately
+         * after the last 2.4GHz channel
+         */
+        idx = 14;
 
         cfg->passive[1] =
                 wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels,
@@ -394,22 +409,23 @@ wl1271_scan_sched_scan_channels(struct wl1271 *wl,
                                                     false, true, idx);
         idx += cfg->passive[1];
 
-        cfg->active[1] =
+        cfg->dfs =
                 wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels,
                                                     IEEE80211_BAND_5GHZ,
-                                                    false, false, 14);
-        idx += cfg->active[1];
+                                                    true, true, idx);
+        idx += cfg->dfs;
 
-        cfg->dfs =
+        cfg->active[1] =
                 wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels,
                                                     IEEE80211_BAND_5GHZ,
-                                                    true, false, idx);
-        idx += cfg->dfs;
+                                                    false, false, idx);
+        idx += cfg->active[1];
 
         wl1271_debug(DEBUG_SCAN, "    2.4GHz: active %d passive %d",
                      cfg->active[0], cfg->passive[0]);
         wl1271_debug(DEBUG_SCAN, "    5GHz: active %d passive %d",
                      cfg->active[1], cfg->passive[1]);
+        wl1271_debug(DEBUG_SCAN, "    DFS: %d", cfg->dfs);
 
         return idx;
 }
@@ -421,6 +437,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl,
         struct wl1271_cmd_sched_scan_config *cfg = NULL;
         struct conf_sched_scan_settings *c = &wl->conf.sched_scan;
         int i, total_channels, ret;
+        bool force_passive = !req->n_ssids;
 
         wl1271_debug(DEBUG_CMD, "cmd sched_scan scan config");
 
@@ -444,7 +461,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl,
         for (i = 0; i < SCAN_MAX_CYCLE_INTERVALS; i++)
                 cfg->intervals[i] = cpu_to_le32(req->interval);
 
-        if (req->ssids[0].ssid_len && req->ssids[0].ssid) {
+        if (!force_passive && req->ssids[0].ssid_len && req->ssids[0].ssid) {
                 cfg->filter_type = SCAN_SSID_FILTER_SPECIFIC;
                 cfg->ssid_len = req->ssids[0].ssid_len;
                 memcpy(cfg->ssid, req->ssids[0].ssid,
@@ -461,7 +478,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl,
                 goto out;
         }
 
-        if (cfg->active[0]) {
+        if (!force_passive && cfg->active[0]) {
                 ret = wl1271_cmd_build_probe_req(wl, req->ssids[0].ssid,
                                                  req->ssids[0].ssid_len,
                                                  ies->ie[IEEE80211_BAND_2GHZ],
@@ -473,7 +490,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl,
                 }
         }
 
-        if (cfg->active[1]) {
+        if (!force_passive && cfg->active[1]) {
                 ret = wl1271_cmd_build_probe_req(wl,  req->ssids[0].ssid,
                                                  req->ssids[0].ssid_len,
                                                  ies->ie[IEEE80211_BAND_5GHZ],
diff --git a/drivers/net/wireless/wl12xx/scan.h b/drivers/net/wireless/wl12xx/scan.h
index c83319579ca3..a0b6c5d67b07 100644
--- a/drivers/net/wireless/wl12xx/scan.h
+++ b/drivers/net/wireless/wl12xx/scan.h
@@ -137,6 +137,9 @@ enum {
         SCAN_BSS_TYPE_ANY,
 };
 
+#define SCAN_CHANNEL_FLAGS_DFS          BIT(0)
+#define SCAN_CHANNEL_FLAGS_DFS_ENABLED  BIT(1)
+
 struct conn_scan_ch_params {
         __le16 min_duration;
         __le16 max_duration;
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index 0e819943b9e4..631194d49828 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -1533,6 +1533,31 @@ static void __exit usb_exit(void)
 module_init(usb_init);
 module_exit(usb_exit);
 
+static int zd_ep_regs_out_msg(struct usb_device *udev, void *data, int len,
+                              int *actual_length, int timeout)
+{
+        /* In USB 2.0 mode EP_REGS_OUT endpoint is interrupt type. However in
+         * USB 1.1 mode endpoint is bulk. Select correct type URB by endpoint
+         * descriptor.
+         */
+        struct usb_host_endpoint *ep;
+        unsigned int pipe;
+
+        pipe = usb_sndintpipe(udev, EP_REGS_OUT);
+        ep = usb_pipe_endpoint(udev, pipe);
+        if (!ep)
+                return -EINVAL;
+
+        if (usb_endpoint_xfer_int(&ep->desc)) {
+                return usb_interrupt_msg(udev, pipe, data, len,
+                                         actual_length, timeout);
+        } else {
+                pipe = usb_sndbulkpipe(udev, EP_REGS_OUT);
+                return usb_bulk_msg(udev, pipe, data, len, actual_length,
+                                    timeout);
+        }
+}
+
 static int usb_int_regs_length(unsigned int count)
 {
         return sizeof(struct usb_int_regs) + count * sizeof(struct reg_data);
@@ -1648,15 +1673,14 @@ int zd_usb_ioread16v(struct zd_usb *usb, u16 *values,
 
         udev = zd_usb_to_usbdev(usb);
         prepare_read_regs_int(usb);
-        r = usb_interrupt_msg(udev, usb_sndintpipe(udev, EP_REGS_OUT),
-                              req, req_len, &actual_req_len, 50 /* ms */);
+        r = zd_ep_regs_out_msg(udev, req, req_len, &actual_req_len, 50 /*ms*/);
         if (r) {
                 dev_dbg_f(zd_usb_dev(usb),
-                        "error in usb_interrupt_msg(). Error number %d\n", r);
+                        "error in zd_ep_regs_out_msg(). Error number %d\n", r);
                 goto error;
         }
         if (req_len != actual_req_len) {
-                dev_dbg_f(zd_usb_dev(usb), "error in usb_interrupt_msg()\n"
+                dev_dbg_f(zd_usb_dev(usb), "error in zd_ep_regs_out_msg()\n"
                         " req_len %d != actual_req_len %d\n",
                         req_len, actual_req_len);
                 r = -EIO;
@@ -1818,9 +1842,17 @@ int zd_usb_iowrite16v_async(struct zd_usb *usb, const struct zd_ioreq16 *ioreqs,
                 rw->value = cpu_to_le16(ioreqs[i].value);
         }
 
-        usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT),
-                         req, req_len, iowrite16v_urb_complete, usb,
-                         ep->desc.bInterval);
+        /* In USB 2.0 mode endpoint is interrupt type. However in USB 1.1 mode
+         * endpoint is bulk. Select correct type URB by endpoint descriptor.
+         */
+        if (usb_endpoint_xfer_int(&ep->desc))
+                usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT),
+                                 req, req_len, iowrite16v_urb_complete, usb,
+                                 ep->desc.bInterval);
+        else
+                usb_fill_bulk_urb(urb, udev, usb_sndbulkpipe(udev, EP_REGS_OUT),
+                                  req, req_len, iowrite16v_urb_complete, usb);
+
         urb->transfer_flags |= URB_FREE_BUFFER;
 
         /* Submit previous URB */
@@ -1924,15 +1956,14 @@ int zd_usb_rfwrite(struct zd_usb *usb, u32 value, u8 bits)
         }
 
         udev = zd_usb_to_usbdev(usb);
-        r = usb_interrupt_msg(udev, usb_sndintpipe(udev, EP_REGS_OUT),
-                              req, req_len, &actual_req_len, 50 /* ms */);
+        r = zd_ep_regs_out_msg(udev, req, req_len, &actual_req_len, 50 /*ms*/);
         if (r) {
                 dev_dbg_f(zd_usb_dev(usb),
-                        "error in usb_interrupt_msg(). Error number %d\n", r);
+                        "error in zd_ep_regs_out_msg(). Error number %d\n", r);
                 goto out;
         }
         if (req_len != actual_req_len) {
-                dev_dbg_f(zd_usb_dev(usb), "error in usb_interrupt_msg()"
+                dev_dbg_f(zd_usb_dev(usb), "error in zd_ep_regs_out_msg()"
                         " req_len %d != actual_req_len %d\n",
                         req_len, actual_req_len);
                 r = -EIO;
diff --git a/drivers/pci/dmar.c b/drivers/pci/dmar.c
index 12e02bf92c4a..3dc9befa5aec 100644
--- a/drivers/pci/dmar.c
+++ b/drivers/pci/dmar.c
@@ -698,12 +698,7 @@ int __init detect_intel_iommu(void)
         {
 #ifdef CONFIG_INTR_REMAP
                 struct acpi_table_dmar *dmar;
-                /*
-                 * for now we will disable dma-remapping when interrupt
-                 * remapping is enabled.
-                 * When support for queued invalidation for IOTLB invalidation
-                 * is added, we will not need this any more.
-                 */
+
                 dmar = (struct acpi_table_dmar *) dmar_tbl;
                 if (ret && cpu_has_x2apic && dmar->flags & 0x1)
                         printk(KERN_INFO
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 6af6b628175b..59f17acf7f68 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -47,6 +47,8 @@
 #define ROOT_SIZE               VTD_PAGE_SIZE
 #define CONTEXT_SIZE            VTD_PAGE_SIZE
 
+#define IS_BRIDGE_HOST_DEVICE(pdev) \
+                            ((pdev->class >> 8) == PCI_CLASS_BRIDGE_HOST)
 #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
 #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
 #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
@@ -116,6 +118,11 @@ static inline unsigned long align_to_level(unsigned long pfn, int level)
         return (pfn + level_size(level) - 1) & level_mask(level);
 }
 
+static inline unsigned long lvl_to_nr_pages(unsigned int lvl)
+{
+        return  1 << ((lvl - 1) * LEVEL_STRIDE);
+}
+
 /* VT-d pages must always be _smaller_ than MM pages. Otherwise things
    are never going to work. */
 static inline unsigned long dma_to_mm_pfn(unsigned long dma_pfn)
@@ -143,6 +150,12 @@ static void __init check_tylersburg_isoch(void);
 static int rwbf_quirk;
 
 /*
+ * set to 1 to panic kernel if can't successfully enable VT-d
+ * (used when kernel is launched w/ TXT)
+ */
+static int force_on = 0;
+
+/*
  * 0: Present
  * 1-11: Reserved
  * 12-63: Context Ptr (12 - (haw-1))
@@ -338,6 +351,9 @@ struct dmar_domain {
         int             iommu_coherency;/* indicate coherency of iommu access */
         int             iommu_snooping; /* indicate snooping control feature*/
         int             iommu_count;    /* reference count of iommu */
+        int             iommu_superpage;/* Level of superpages supported:
+                                           0 == 4KiB (no superpages), 1 == 2MiB,
+                                           2 == 1GiB, 3 == 512GiB, 4 == 1TiB */
         spinlock_t      iommu_lock;     /* protect iommu set in domain */
         u64             max_addr;       /* maximum mapped address */
 };
@@ -387,6 +403,7 @@ int dmar_disabled = 1;
 static int dmar_map_gfx = 1;
 static int dmar_forcedac;
 static int intel_iommu_strict;
+static int intel_iommu_superpage = 1;
 
 #define DUMMY_DEVICE_DOMAIN_INFO ((struct device_domain_info *)(-1))
 static DEFINE_SPINLOCK(device_domain_lock);
@@ -417,6 +434,10 @@ static int __init intel_iommu_setup(char *str)
                         printk(KERN_INFO
                                 "Intel-IOMMU: disable batched IOTLB flush\n");
                         intel_iommu_strict = 1;
+                } else if (!strncmp(str, "sp_off", 6)) {
+                        printk(KERN_INFO
+                                "Intel-IOMMU: disable supported super page\n");
+                        intel_iommu_superpage = 0;
                 }
 
                 str += strcspn(str, ",");
@@ -555,11 +576,32 @@ static void domain_update_iommu_snooping(struct dmar_domain *domain)
         }
 }
 
+static void domain_update_iommu_superpage(struct dmar_domain *domain)
+{
+        int i, mask = 0xf;
+
+        if (!intel_iommu_superpage) {
+                domain->iommu_superpage = 0;
+                return;
+        }
+
+        domain->iommu_superpage = 4; /* 1TiB */
+
+        for_each_set_bit(i, &domain->iommu_bmp, g_num_of_iommus) {
+                mask |= cap_super_page_val(g_iommus[i]->cap);
+                if (!mask) {
+                        break;
+                }
+        }
+        domain->iommu_superpage = fls(mask);
+}
+
 /* Some capabilities may be different across iommus */
 static void domain_update_iommu_cap(struct dmar_domain *domain)
 {
         domain_update_iommu_coherency(domain);
         domain_update_iommu_snooping(domain);
+        domain_update_iommu_superpage(domain);
 }
 
 static struct intel_iommu *device_to_iommu(int segment, u8 bus, u8 devfn)
@@ -689,23 +731,31 @@ out:
 }
 
 static struct dma_pte *pfn_to_dma_pte(struct dmar_domain *domain,
-                                      unsigned long pfn)
+                                      unsigned long pfn, int large_level)
 {
         int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
         struct dma_pte *parent, *pte = NULL;
         int level = agaw_to_level(domain->agaw);
-        int offset;
+        int offset, target_level;
 
         BUG_ON(!domain->pgd);
         BUG_ON(addr_width < BITS_PER_LONG && pfn >> addr_width);
         parent = domain->pgd;
 
+        /* Search pte */
+        if (!large_level)
+                target_level = 1;
+        else
+                target_level = large_level;
+
         while (level > 0) {
                 void *tmp_page;
 
                 offset = pfn_level_offset(pfn, level);
                 pte = &parent[offset];
-                if (level == 1)
+                if (!large_level && (pte->val & DMA_PTE_LARGE_PAGE))
+                        break;
+                if (level == target_level)
                         break;
 
                 if (!dma_pte_present(pte)) {
@@ -733,10 +783,11 @@ static struct dma_pte *pfn_to_dma_pte(struct dmar_domain *domain,
         return pte;
 }
 
+
 /* return address's pte at specific level */
 static struct dma_pte *dma_pfn_level_pte(struct dmar_domain *domain,
                                          unsigned long pfn,
-                                         int level)
+                                         int level, int *large_page)
 {
         struct dma_pte *parent, *pte = NULL;
         int total = agaw_to_level(domain->agaw);
@@ -749,8 +800,16 @@ static struct dma_pte *dma_pfn_level_pte(struct dmar_domain *domain,
                 if (level == total)
                         return pte;
 
-                if (!dma_pte_present(pte))
+                if (!dma_pte_present(pte)) {
+                        *large_page = total;
                         break;
+                }
+
+                if (pte->val & DMA_PTE_LARGE_PAGE) {
+                        *large_page = total;
+                        return pte;
+                }
+
                 parent = phys_to_virt(dma_pte_addr(pte));
                 total--;
         }
@@ -763,6 +822,7 @@ static void dma_pte_clear_range(struct dmar_domain *domain,
                                 unsigned long last_pfn)
 {
         int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
+        unsigned int large_page = 1;
         struct dma_pte *first_pte, *pte;
 
         BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
@@ -771,14 +831,15 @@ static void dma_pte_clear_range(struct dmar_domain *domain,
 
         /* we don't need lock here; nobody else touches the iova range */
         do {
-                first_pte = pte = dma_pfn_level_pte(domain, start_pfn, 1);
+                large_page = 1;
+                first_pte = pte = dma_pfn_level_pte(domain, start_pfn, 1, &large_page);
                 if (!pte) {
-                        start_pfn = align_to_level(start_pfn + 1, 2);
+                        start_pfn = align_to_level(start_pfn + 1, large_page + 1);
                         continue;
                 }
-                do { 
+                do {
                         dma_clear_pte(pte);
-                        start_pfn++;
+                        start_pfn += lvl_to_nr_pages(large_page);
                         pte++;
                 } while (start_pfn <= last_pfn && !first_pte_in_page(pte));
 
@@ -798,6 +859,7 @@ static void dma_pte_free_pagetable(struct dmar_domain *domain,
         int total = agaw_to_level(domain->agaw);
         int level;
         unsigned long tmp;
+        int large_page = 2;
 
         BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
         BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
@@ -813,7 +875,10 @@ static void dma_pte_free_pagetable(struct dmar_domain *domain,
                         return;
 
                 do {
-                        first_pte = pte = dma_pfn_level_pte(domain, tmp, level);
+                        large_page = level;
+                        first_pte = pte = dma_pfn_level_pte(domain, tmp, level, &large_page);
+                        if (large_page > level)
+                                level = large_page + 1;
                         if (!pte) {
                                 tmp = align_to_level(tmp + 1, level + 1);
                                 continue;
@@ -1397,6 +1462,7 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
         else
                 domain->iommu_snooping = 0;
 
+        domain->iommu_superpage = fls(cap_super_page_val(iommu->cap));
         domain->iommu_count = 1;
         domain->nid = iommu->node;
 
@@ -1417,6 +1483,10 @@ static void domain_exit(struct dmar_domain *domain)
         if (!domain)
                 return;
 
+        /* Flush any lazy unmaps that may reference this domain */
+        if (!intel_iommu_strict)
+                flush_unmaps_timeout(0);
+
         domain_remove_dev_info(domain);
         /* destroy iovas */
         put_iova_domain(&domain->iovad);
@@ -1648,6 +1718,34 @@ static inline unsigned long aligned_nrpages(unsigned long host_addr,
         return PAGE_ALIGN(host_addr + size) >> VTD_PAGE_SHIFT;
 }
 
+/* Return largest possible superpage level for a given mapping */
+static inline int hardware_largepage_caps(struct dmar_domain *domain,
+                                          unsigned long iov_pfn,
+                                          unsigned long phy_pfn,
+                                          unsigned long pages)
+{
+        int support, level = 1;
+        unsigned long pfnmerge;
+
+        support = domain->iommu_superpage;
+
+        /* To use a large page, the virtual *and* physical addresses
+           must be aligned to 2MiB/1GiB/etc. Lower bits set in either
+           of them will mean we have to use smaller pages. So just
+           merge them and check both at once. */
+        pfnmerge = iov_pfn | phy_pfn;
+
+        while (support && !(pfnmerge & ~VTD_STRIDE_MASK)) {
+                pages >>= VTD_STRIDE_SHIFT;
+                if (!pages)
+                        break;
+                pfnmerge >>= VTD_STRIDE_SHIFT;
+                level++;
+                support--;
+        }
+        return level;
+}
+
 static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
                             struct scatterlist *sg, unsigned long phys_pfn,
                             unsigned long nr_pages, int prot)
@@ -1656,6 +1754,8 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
         phys_addr_t uninitialized_var(pteval);
         int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
         unsigned long sg_res;
+        unsigned int largepage_lvl = 0;
+        unsigned long lvl_pages = 0;
 
         BUG_ON(addr_width < BITS_PER_LONG && (iov_pfn + nr_pages - 1) >> addr_width);
 
@@ -1671,7 +1771,7 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
                 pteval = ((phys_addr_t)phys_pfn << VTD_PAGE_SHIFT) | prot;
         }
 
-        while (nr_pages--) {
+        while (nr_pages > 0) {
                 uint64_t tmp;
 
                 if (!sg_res) {
@@ -1679,11 +1779,21 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
                         sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + sg->offset;
                         sg->dma_length = sg->length;
                         pteval = page_to_phys(sg_page(sg)) | prot;
+                        phys_pfn = pteval >> VTD_PAGE_SHIFT;
                 }
+
                 if (!pte) {
-                        first_pte = pte = pfn_to_dma_pte(domain, iov_pfn);
+                        largepage_lvl = hardware_largepage_caps(domain, iov_pfn, phys_pfn, sg_res);
+
+                        first_pte = pte = pfn_to_dma_pte(domain, iov_pfn, largepage_lvl);
                         if (!pte)
                                 return -ENOMEM;
+                        /* It is large page*/
+                        if (largepage_lvl > 1)
+                                pteval |= DMA_PTE_LARGE_PAGE;
+                        else
+                                pteval &= ~(uint64_t)DMA_PTE_LARGE_PAGE;
+
                 }
                 /* We don't need lock here, nobody else
                  * touches the iova range
@@ -1699,16 +1809,38 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
                         }
                         WARN_ON(1);
                 }
+
+                lvl_pages = lvl_to_nr_pages(largepage_lvl);
+
+                BUG_ON(nr_pages < lvl_pages);
+                BUG_ON(sg_res < lvl_pages);
+
+                nr_pages -= lvl_pages;
+                iov_pfn += lvl_pages;
+                phys_pfn += lvl_pages;
+                pteval += lvl_pages * VTD_PAGE_SIZE;
+                sg_res -= lvl_pages;
+
+                /* If the next PTE would be the first in a new page, then we
+                   need to flush the cache on the entries we've just written.
+                   And then we'll need to recalculate 'pte', so clear it and
+                   let it get set again in the if (!pte) block above.
+
+                   If we're done (!nr_pages) we need to flush the cache too.
+
+                   Also if we've been setting superpages, we may need to
+                   recalculate 'pte' and switch back to smaller pages for the
+                   end of the mapping, if the trailing size is not enough to
+                   use another superpage (i.e. sg_res < lvl_pages). */
                 pte++;
-                if (!nr_pages || first_pte_in_page(pte)) {
+                if (!nr_pages || first_pte_in_page(pte) ||
+                    (largepage_lvl > 1 && sg_res < lvl_pages)) {
                         domain_flush_cache(domain, first_pte,
                                            (void *)pte - (void *)first_pte);
                         pte = NULL;
                 }
-                iov_pfn++;
-                pteval += VTD_PAGE_SIZE;
-                sg_res--;
-                if (!sg_res)
+
+                if (!sg_res && nr_pages)
                         sg = sg_next(sg);
         }
         return 0;
@@ -2016,7 +2148,7 @@ static inline int iommu_prepare_rmrr_dev(struct dmar_rmrr_unit *rmrr,
         if (pdev->dev.archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO)
                 return 0;
         return iommu_prepare_identity_map(pdev, rmrr->base_address,
-                rmrr->end_address + 1);
+                rmrr->end_address);
 }
 
 #ifdef CONFIG_DMAR_FLOPPY_WA
@@ -2030,7 +2162,7 @@ static inline void iommu_prepare_isa(void)
                 return;
 
         printk(KERN_INFO "IOMMU: Prepare 0-16MiB unity mapping for LPC\n");
-        ret = iommu_prepare_identity_map(pdev, 0, 16*1024*1024);
+        ret = iommu_prepare_identity_map(pdev, 0, 16*1024*1024 - 1);
 
         if (ret)
                 printk(KERN_ERR "IOMMU: Failed to create 0-16MiB identity map; "
@@ -2106,10 +2238,10 @@ static int identity_mapping(struct pci_dev *pdev)
         if (likely(!iommu_identity_mapping))
                 return 0;
 
+        info = pdev->dev.archdata.iommu;
+        if (info && info != DUMMY_DEVICE_DOMAIN_INFO)
+                return (info->domain == si_domain);
 
-        list_for_each_entry(info, &si_domain->devices, link)
-                if (info->dev == pdev)
-                        return 1;
         return 0;
 }
 
@@ -2187,8 +2319,19 @@ static int iommu_should_identity_map(struct pci_dev *pdev, int startup)
          * Assume that they will -- if they turn out not to be, then we can 
          * take them out of the 1:1 domain later.
          */
-        if (!startup)
-                return pdev->dma_mask > DMA_BIT_MASK(32);
+        if (!startup) {
+                /*
+                 * If the device's dma_mask is less than the system's memory
+                 * size then this is not a candidate for identity mapping.
+                 */
+                u64 dma_mask = pdev->dma_mask;
+
+                if (pdev->dev.coherent_dma_mask &&
+                    pdev->dev.coherent_dma_mask < dma_mask)
+                        dma_mask = pdev->dev.coherent_dma_mask;
+
+                return dma_mask >= dma_get_required_mask(&pdev->dev);
+        }
 
         return 1;
 }
@@ -2203,6 +2346,9 @@ static int __init iommu_prepare_static_identity_mapping(int hw)
                 return -EFAULT;
 
         for_each_pci_dev(pdev) {
+                /* Skip Host/PCI Bridge devices */
+                if (IS_BRIDGE_HOST_DEVICE(pdev))
+                        continue;
                 if (iommu_should_identity_map(pdev, 1)) {
                         printk(KERN_INFO "IOMMU: %s identity mapping for device %s\n",
                                hw ? "hardware" : "software", pci_name(pdev));
@@ -2218,7 +2364,7 @@ static int __init iommu_prepare_static_identity_mapping(int hw)
         return 0;
 }
 
-static int __init init_dmars(int force_on)
+static int __init init_dmars(void)
 {
         struct dmar_drhd_unit *drhd;
         struct dmar_rmrr_unit *rmrr;
@@ -2592,8 +2738,7 @@ static dma_addr_t __intel_map_single(struct device *hwdev, phys_addr_t paddr,
         iommu = domain_get_iommu(domain);
         size = aligned_nrpages(paddr, size);
 
-        iova = intel_alloc_iova(hwdev, domain, dma_to_mm_pfn(size),
-                                pdev->dma_mask);
+        iova = intel_alloc_iova(hwdev, domain, dma_to_mm_pfn(size), dma_mask);
         if (!iova)
                 goto error;
 
@@ -3118,7 +3263,17 @@ static int init_iommu_hw(void)
                 if (iommu->qi)
                         dmar_reenable_qi(iommu);
 
-        for_each_active_iommu(iommu, drhd) {
+        for_each_iommu(iommu, drhd) {
+                if (drhd->ignored) {
+                        /*
+                         * we always have to disable PMRs or DMA may fail on
+                         * this device
+                         */
+                        if (force_on)
+                                iommu_disable_protect_mem_regions(iommu);
+                        continue;
+                }
+        
                 iommu_flush_write_buffer(iommu);
 
                 iommu_set_root_entry(iommu);
@@ -3127,7 +3282,8 @@ static int init_iommu_hw(void)
                                            DMA_CCMD_GLOBAL_INVL);
                 iommu->flush.flush_iotlb(iommu, 0, 0, 0,
                                          DMA_TLB_GLOBAL_FLUSH);
-                iommu_enable_translation(iommu);
+                if (iommu_enable_translation(iommu))
+                        return 1;
                 iommu_disable_protect_mem_regions(iommu);
         }
 
@@ -3194,7 +3350,10 @@ static void iommu_resume(void)
         unsigned long flag;
 
         if (init_iommu_hw()) {
-                WARN(1, "IOMMU setup failed, DMAR can not resume!\n");
+                if (force_on)
+                        panic("tboot: IOMMU setup failed, DMAR can not resume!\n");
+                else
+                        WARN(1, "IOMMU setup failed, DMAR can not resume!\n");
                 return;
         }
 
@@ -3271,7 +3430,6 @@ static struct notifier_block device_nb = {
 int __init intel_iommu_init(void)
 {
         int ret = 0;
-        int force_on = 0;
 
         /* VT-d is required for a TXT/tboot launch, so enforce that */
         force_on = tboot_force_iommu();
@@ -3309,7 +3467,7 @@ int __init intel_iommu_init(void)
 
         init_no_remapping_devices();
 
-        ret = init_dmars(force_on);
+        ret = init_dmars();
         if (ret) {
                 if (force_on)
                         panic("tboot: Failed to initialize DMARs\n");
@@ -3380,8 +3538,8 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain,
         spin_lock_irqsave(&device_domain_lock, flags);
         list_for_each_safe(entry, tmp, &domain->devices) {
                 info = list_entry(entry, struct device_domain_info, link);
-                /* No need to compare PCI domain; it has to be the same */
-                if (info->bus == pdev->bus->number &&
+                if (info->segment == pci_domain_nr(pdev->bus) &&
+                    info->bus == pdev->bus->number &&
                     info->devfn == pdev->devfn) {
                         list_del(&info->link);
                         list_del(&info->global);
@@ -3419,10 +3577,13 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain,
                 domain_update_iommu_cap(domain);
                 spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags);
 
-                spin_lock_irqsave(&iommu->lock, tmp_flags);
-                clear_bit(domain->id, iommu->domain_ids);
-                iommu->domains[domain->id] = NULL;
-                spin_unlock_irqrestore(&iommu->lock, tmp_flags);
+                if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
+                    !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY)) {
+                        spin_lock_irqsave(&iommu->lock, tmp_flags);
+                        clear_bit(domain->id, iommu->domain_ids);
+                        iommu->domains[domain->id] = NULL;
+                        spin_unlock_irqrestore(&iommu->lock, tmp_flags);
+                }
         }
 
         spin_unlock_irqrestore(&device_domain_lock, flags);
@@ -3505,6 +3666,7 @@ static int md_domain_init(struct dmar_domain *domain, int guest_width)
         domain->iommu_count = 0;
         domain->iommu_coherency = 0;
         domain->iommu_snooping = 0;
+        domain->iommu_superpage = 0;
         domain->max_addr = 0;
         domain->nid = -1;
 
@@ -3720,7 +3882,7 @@ static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain,
         struct dma_pte *pte;
         u64 phys = 0;
 
-        pte = pfn_to_dma_pte(dmar_domain, iova >> VTD_PAGE_SHIFT);
+        pte = pfn_to_dma_pte(dmar_domain, iova >> VTD_PAGE_SHIFT, 0);
         if (pte)
                 phys = dma_pte_addr(pte);
 
diff --git a/drivers/pci/iova.c b/drivers/pci/iova.c
index 9606e599a475..c5c274ab5c5a 100644
--- a/drivers/pci/iova.c
+++ b/drivers/pci/iova.c
@@ -63,8 +63,16 @@ __cached_rbnode_delete_update(struct iova_domain *iovad, struct iova *free)
         curr = iovad->cached32_node;
         cached_iova = container_of(curr, struct iova, node);
 
-        if (free->pfn_lo >= cached_iova->pfn_lo)
-                iovad->cached32_node = rb_next(&free->node);
+        if (free->pfn_lo >= cached_iova->pfn_lo) {
+                struct rb_node *node = rb_next(&free->node);
+                struct iova *iova = container_of(node, struct iova, node);
+
+                /* only cache if it's below 32bit pfn */
+                if (node && iova->pfn_lo < iovad->dma_32bit_pfn)
+                        iovad->cached32_node = node;
+                else
+                        iovad->cached32_node = NULL;
+        }
 }
 
 /* Computes the padding size required, to make the
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 58584dc0724a..44e8ca398efa 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -297,7 +297,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
                 kfree(sdev);
                 goto out;
         }
-
+        blk_get_queue(sdev->request_queue);
         sdev->request_queue->queuedata = sdev;
         scsi_adjust_queue_depth(sdev, 0, sdev->host->cmd_per_lun);
 
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index e63912510fb9..e0bd3f790fca 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -322,6 +322,7 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
                 kfree(evt);
         }
 
+        blk_put_queue(sdev->request_queue);
         /* NULL queue means the device can't be used */
         sdev->request_queue = NULL;
 
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index a4c42a75a3bf..09e8c7d53af3 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2128,8 +2128,8 @@ static void gsmld_detach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)
         gsm->tty = NULL;
 }
 
-static unsigned int gsmld_receive_buf(struct tty_struct *tty,
-                const unsigned char *cp, char *fp, int count)
+static void gsmld_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+                              char *fp, int count)
 {
         struct gsm_mux *gsm = tty->disc_data;
         const unsigned char *dp;
@@ -2162,8 +2162,6 @@ static unsigned int gsmld_receive_buf(struct tty_struct *tty,
         }
         /* FASYNC if needed ? */
         /* If clogged call tty_throttle(tty); */
-
-        return count;
 }
 
 /**
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index cac666314aef..cea56033b34c 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -188,8 +188,8 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp,
                                     poll_table *wait);
 static int n_hdlc_tty_open(struct tty_struct *tty);
 static void n_hdlc_tty_close(struct tty_struct *tty);
-static unsigned int n_hdlc_tty_receive(struct tty_struct *tty,
-                const __u8 *cp, char *fp, int count);
+static void n_hdlc_tty_receive(struct tty_struct *tty, const __u8 *cp,
+                               char *fp, int count);
 static void n_hdlc_tty_wakeup(struct tty_struct *tty);
 
 #define bset(p,b)       ((p)[(b) >> 5] |= (1 << ((b) & 0x1f)))
@@ -509,8 +509,8 @@ static void n_hdlc_tty_wakeup(struct tty_struct *tty)
  * Called by tty low level driver when receive data is available. Data is
  * interpreted as one HDLC frame.
  */
-static unsigned int n_hdlc_tty_receive(struct tty_struct *tty,
-                const __u8 *data, char *flags, int count)
+static void n_hdlc_tty_receive(struct tty_struct *tty, const __u8 *data,
+                               char *flags, int count)
 {
         register struct n_hdlc *n_hdlc = tty2n_hdlc (tty);
         register struct n_hdlc_buf *buf;
@@ -521,20 +521,20 @@ static unsigned int n_hdlc_tty_receive(struct tty_struct *tty,
                 
         /* This can happen if stuff comes in on the backup tty */
         if (!n_hdlc || tty != n_hdlc->tty)
-                return -ENODEV;
+                return;
                 
         /* verify line is using HDLC discipline */
         if (n_hdlc->magic != HDLC_MAGIC) {
                 printk("%s(%d) line not using HDLC discipline\n",
                         __FILE__,__LINE__);
-                return -EINVAL;
+                return;
         }
         
         if ( count>maxframe ) {
                 if (debuglevel >= DEBUG_LEVEL_INFO)     
                         printk("%s(%d) rx count>maxframesize, data discarded\n",
                                __FILE__,__LINE__);
-                return -EINVAL;
+                return;
         }
 
         /* get a free HDLC buffer */    
@@ -550,7 +550,7 @@ static unsigned int n_hdlc_tty_receive(struct tty_struct *tty,
                 if (debuglevel >= DEBUG_LEVEL_INFO)     
                         printk("%s(%d) no more rx buffers, data discarded\n",
                                __FILE__,__LINE__);
-                return -EINVAL;
+                return;
         }
                 
         /* copy received data to HDLC buffer */
@@ -565,8 +565,6 @@ static unsigned int n_hdlc_tty_receive(struct tty_struct *tty,
         if (n_hdlc->tty->fasync != NULL)
                 kill_fasync (&n_hdlc->tty->fasync, SIGIO, POLL_IN);
 
-        return count;
-
 }       /* end of n_hdlc_tty_receive() */
 
 /**
diff --git a/drivers/tty/n_r3964.c b/drivers/tty/n_r3964.c
index a4bc39c21a43..5c6c31459a2f 100644
--- a/drivers/tty/n_r3964.c
+++ b/drivers/tty/n_r3964.c
@@ -139,8 +139,8 @@ static int r3964_ioctl(struct tty_struct *tty, struct file *file,
 static void r3964_set_termios(struct tty_struct *tty, struct ktermios *old);
 static unsigned int r3964_poll(struct tty_struct *tty, struct file *file,
                 struct poll_table_struct *wait);
-static unsigned int r3964_receive_buf(struct tty_struct *tty,
-                const unsigned char *cp, char *fp, int count);
+static void r3964_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+                char *fp, int count);
 
 static struct tty_ldisc_ops tty_ldisc_N_R3964 = {
         .owner = THIS_MODULE,
@@ -1239,8 +1239,8 @@ static unsigned int r3964_poll(struct tty_struct *tty, struct file *file,
         return result;
 }
 
-static unsigned int r3964_receive_buf(struct tty_struct *tty,
-                const unsigned char *cp, char *fp, int count)
+static void r3964_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+                        char *fp, int count)
 {
         struct r3964_info *pInfo = tty->disc_data;
         const unsigned char *p;
@@ -1257,8 +1257,6 @@ static unsigned int r3964_receive_buf(struct tty_struct *tty,
                 }
 
         }
-
-        return count;
 }
 
 MODULE_LICENSE("GPL");
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 95d0a9c2dd13..0ad32888091c 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -81,6 +81,38 @@ static inline int tty_put_user(struct tty_struct *tty, unsigned char x,
         return put_user(x, ptr);
 }
 
+/**
+ *      n_tty_set__room -       receive space
+ *      @tty: terminal
+ *
+ *      Called by the driver to find out how much data it is
+ *      permitted to feed to the line discipline without any being lost
+ *      and thus to manage flow control. Not serialized. Answers for the
+ *      "instant".
+ */
+
+static void n_tty_set_room(struct tty_struct *tty)
+{
+        /* tty->read_cnt is not read locked ? */
+        int     left = N_TTY_BUF_SIZE - tty->read_cnt - 1;
+        int old_left;
+
+        /*
+         * If we are doing input canonicalization, and there are no
+         * pending newlines, let characters through without limit, so
+         * that erase characters will be handled.  Other excess
+         * characters will be beeped.
+         */
+        if (left <= 0)
+                left = tty->icanon && !tty->canon_data;
+        old_left = tty->receive_room;
+        tty->receive_room = left;
+
+        /* Did this open up the receive buffer? We may need to flip */
+        if (left && !old_left)
+                schedule_work(&tty->buf.work);
+}
+
 static void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
 {
         if (tty->read_cnt < N_TTY_BUF_SIZE) {
@@ -152,6 +184,7 @@ static void reset_buffer_flags(struct tty_struct *tty)
 
         tty->canon_head = tty->canon_data = tty->erasing = 0;
         memset(&tty->read_flags, 0, sizeof tty->read_flags);
+        n_tty_set_room(tty);
         check_unthrottle(tty);
 }
 
@@ -1327,19 +1360,17 @@ static void n_tty_write_wakeup(struct tty_struct *tty)
  *      calls one at a time and in order (or using flush_to_ldisc)
  */
 
-static unsigned int n_tty_receive_buf(struct tty_struct *tty,
-                const unsigned char *cp, char *fp, int count)
+static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+                              char *fp, int count)
 {
         const unsigned char *p;
         char *f, flags = TTY_NORMAL;
         int     i;
         char    buf[64];
         unsigned long cpuflags;
-        int left;
-        int ret = 0;
 
         if (!tty->read_buf)
-                return 0;
+                return;
 
         if (tty->real_raw) {
                 spin_lock_irqsave(&tty->read_lock, cpuflags);
@@ -1349,7 +1380,6 @@ static unsigned int n_tty_receive_buf(struct tty_struct *tty,
                 memcpy(tty->read_buf + tty->read_head, cp, i);
                 tty->read_head = (tty->read_head + i) & (N_TTY_BUF_SIZE-1);
                 tty->read_cnt += i;
-                ret += i;
                 cp += i;
                 count -= i;
 
@@ -1359,10 +1389,8 @@ static unsigned int n_tty_receive_buf(struct tty_struct *tty,
                 memcpy(tty->read_buf + tty->read_head, cp, i);
                 tty->read_head = (tty->read_head + i) & (N_TTY_BUF_SIZE-1);
                 tty->read_cnt += i;
-                ret += i;
                 spin_unlock_irqrestore(&tty->read_lock, cpuflags);
         } else {
-                ret = count;
                 for (i = count, p = cp, f = fp; i; i--, p++) {
                         if (f)
                                 flags = *f++;
@@ -1390,6 +1418,8 @@ static unsigned int n_tty_receive_buf(struct tty_struct *tty,
                         tty->ops->flush_chars(tty);
         }
 
+        n_tty_set_room(tty);
+
         if ((!tty->icanon && (tty->read_cnt >= tty->minimum_to_wake)) ||
                 L_EXTPROC(tty)) {
                 kill_fasync(&tty->fasync, SIGIO, POLL_IN);
@@ -1402,12 +1432,8 @@ static unsigned int n_tty_receive_buf(struct tty_struct *tty,
          * mode.  We don't want to throttle the driver if we're in
          * canonical mode and don't have a newline yet!
          */
-        left = N_TTY_BUF_SIZE - tty->read_cnt - 1;
-
-        if (left < TTY_THRESHOLD_THROTTLE)
+        if (tty->receive_room < TTY_THRESHOLD_THROTTLE)
                 tty_throttle(tty);
-
-        return ret;
 }
 
 int is_ignored(int sig)
@@ -1451,6 +1477,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
         if (test_bit(TTY_HW_COOK_IN, &tty->flags)) {
                 tty->raw = 1;
                 tty->real_raw = 1;
+                n_tty_set_room(tty);
                 return;
         }
         if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
@@ -1503,6 +1530,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
                 else
                         tty->real_raw = 0;
         }
+        n_tty_set_room(tty);
         /* The termios change make the tty ready for I/O */
         wake_up_interruptible(&tty->write_wait);
         wake_up_interruptible(&tty->read_wait);
@@ -1784,6 +1812,8 @@ do_it_again:
                                 retval = -ERESTARTSYS;
                                 break;
                         }
+                        /* FIXME: does n_tty_set_room need locking ? */
+                        n_tty_set_room(tty);
                         timeout = schedule_timeout(timeout);
                         continue;
                 }
@@ -1855,8 +1885,10 @@ do_it_again:
                  * longer than TTY_THRESHOLD_UNTHROTTLE in canonical mode,
                  * we won't get any more characters.
                  */
-                if (n_tty_chars_in_buffer(tty) <= TTY_THRESHOLD_UNTHROTTLE)
+                if (n_tty_chars_in_buffer(tty) <= TTY_THRESHOLD_UNTHROTTLE) {
+                        n_tty_set_room(tty);
                         check_unthrottle(tty);
+                }
 
                 if (b - buf >= minimum)
                         break;
@@ -1878,6 +1910,7 @@ do_it_again:
         } else if (test_and_clear_bit(TTY_PUSH, &tty->flags))
                  goto do_it_again;
 
+        n_tty_set_room(tty);
         return retval;
 }
 
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 46de2e075dac..f1a7918d71aa 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -416,7 +416,6 @@ static void flush_to_ldisc(struct work_struct *work)
                 struct tty_buffer *head, *tail = tty->buf.tail;
                 int seen_tail = 0;
                 while ((head = tty->buf.head) != NULL) {
-                        int copied;
                         int count;
                         char *char_buf;
                         unsigned char *flag_buf;
@@ -443,19 +442,17 @@ static void flush_to_ldisc(struct work_struct *work)
                            line discipline as we want to empty the queue */
                         if (test_bit(TTY_FLUSHPENDING, &tty->flags))
                                 break;
+                        if (!tty->receive_room || seen_tail)
+                                break;
+                        if (count > tty->receive_room)
+                                count = tty->receive_room;
                         char_buf = head->char_buf_ptr + head->read;
                         flag_buf = head->flag_buf_ptr + head->read;
+                        head->read += count;
                         spin_unlock_irqrestore(&tty->buf.lock, flags);
-                        copied = disc->ops->receive_buf(tty, char_buf,
+                        disc->ops->receive_buf(tty, char_buf,
                                                         flag_buf, count);
                         spin_lock_irqsave(&tty->buf.lock, flags);
-
-                        head->read += copied;
-
-                        if (copied == 0 || seen_tail) {
-                                schedule_work(&tty->buf.work);
-                                break;
-                        }
                 }
                 clear_bit(TTY_FLUSHING, &tty->flags);
         }
diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
index 67b1d0d7c8ac..fb864e7fcd13 100644
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -332,7 +332,8 @@ int paste_selection(struct tty_struct *tty)
                         continue;
                 }
                 count = sel_buffer_lth - pasted;
-                count = tty->ldisc->ops->receive_buf(tty, sel_buffer + pasted,
+                count = min(count, tty->receive_room);
+                tty->ldisc->ops->receive_buf(tty, sel_buffer + pasted,
                                                                 NULL, count);
                 pasted += count;
         }
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 2f7c76a85e53..e224a92baa16 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -144,7 +144,7 @@ static void handle_tx(struct vhost_net *net)
         }
 
         mutex_lock(&vq->mutex);
-        vhost_disable_notify(vq);
+        vhost_disable_notify(&net->dev, vq);
 
         if (wmem < sock->sk->sk_sndbuf / 2)
                 tx_poll_stop(net);
@@ -166,8 +166,8 @@ static void handle_tx(struct vhost_net *net)
                                 set_bit(SOCK_ASYNC_NOSPACE, &sock->flags);
                                 break;
                         }
-                        if (unlikely(vhost_enable_notify(vq))) {
-                                vhost_disable_notify(vq);
+                        if (unlikely(vhost_enable_notify(&net->dev, vq))) {
+                                vhost_disable_notify(&net->dev, vq);
                                 continue;
                         }
                         break;
@@ -315,7 +315,7 @@ static void handle_rx(struct vhost_net *net)
                 return;
 
         mutex_lock(&vq->mutex);
-        vhost_disable_notify(vq);
+        vhost_disable_notify(&net->dev, vq);
         vhost_hlen = vq->vhost_hlen;
         sock_hlen = vq->sock_hlen;
 
@@ -334,10 +334,10 @@ static void handle_rx(struct vhost_net *net)
                         break;
                 /* OK, now we need to know about added descriptors. */
                 if (!headcount) {
-                        if (unlikely(vhost_enable_notify(vq))) {
+                        if (unlikely(vhost_enable_notify(&net->dev, vq))) {
                                 /* They have slipped one in as we were
                                  * doing that: check again. */
-                                vhost_disable_notify(vq);
+                                vhost_disable_notify(&net->dev, vq);
                                 continue;
                         }
                         /* Nothing new?  Wait for eventfd to tell us
diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index 099f30230d06..734e1d74ad80 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -49,7 +49,7 @@ static void handle_vq(struct vhost_test *n)
                 return;
 
         mutex_lock(&vq->mutex);
-        vhost_disable_notify(vq);
+        vhost_disable_notify(&n->dev, vq);
 
         for (;;) {
                 head = vhost_get_vq_desc(&n->dev, vq, vq->iov,
@@ -61,8 +61,8 @@ static void handle_vq(struct vhost_test *n)
                         break;
                 /* Nothing new?  Wait for eventfd to tell us they refilled. */
                 if (head == vq->num) {
-                        if (unlikely(vhost_enable_notify(vq))) {
-                                vhost_disable_notify(vq);
+                        if (unlikely(vhost_enable_notify(&n->dev, vq))) {
+                                vhost_disable_notify(&n->dev, vq);
                                 continue;
                         }
                         break;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 7aa4eea930f1..ea966b356352 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -37,6 +37,9 @@ enum {
         VHOST_MEMORY_F_LOG = 0x1,
 };
 
+#define vhost_used_event(vq) ((u16 __user *)&vq->avail->ring[vq->num])
+#define vhost_avail_event(vq) ((u16 __user *)&vq->used->ring[vq->num])
+
 static void vhost_poll_func(struct file *file, wait_queue_head_t *wqh,
                             poll_table *pt)
 {
@@ -161,6 +164,8 @@ static void vhost_vq_reset(struct vhost_dev *dev,
         vq->last_avail_idx = 0;
         vq->avail_idx = 0;
         vq->last_used_idx = 0;
+        vq->signalled_used = 0;
+        vq->signalled_used_valid = false;
         vq->used_flags = 0;
         vq->log_used = false;
         vq->log_addr = -1ull;
@@ -489,16 +494,17 @@ static int memory_access_ok(struct vhost_dev *d, struct vhost_memory *mem,
         return 1;
 }
 
-static int vq_access_ok(unsigned int num,
+static int vq_access_ok(struct vhost_dev *d, unsigned int num,
                         struct vring_desc __user *desc,
                         struct vring_avail __user *avail,
                         struct vring_used __user *used)
 {
+        size_t s = vhost_has_feature(d, VIRTIO_RING_F_EVENT_IDX) ? 2 : 0;
         return access_ok(VERIFY_READ, desc, num * sizeof *desc) &&
                access_ok(VERIFY_READ, avail,
-                         sizeof *avail + num * sizeof *avail->ring) &&
+                         sizeof *avail + num * sizeof *avail->ring + s) &&
                access_ok(VERIFY_WRITE, used,
-                        sizeof *used + num * sizeof *used->ring);
+                        sizeof *used + num * sizeof *used->ring + s);
 }
 
 /* Can we log writes? */
@@ -514,9 +520,11 @@ int vhost_log_access_ok(struct vhost_dev *dev)
 
 /* Verify access for write logging. */
 /* Caller should have vq mutex and device mutex */
-static int vq_log_access_ok(struct vhost_virtqueue *vq, void __user *log_base)
+static int vq_log_access_ok(struct vhost_dev *d, struct vhost_virtqueue *vq,
+                            void __user *log_base)
 {
         struct vhost_memory *mp;
+        size_t s = vhost_has_feature(d, VIRTIO_RING_F_EVENT_IDX) ? 2 : 0;
 
         mp = rcu_dereference_protected(vq->dev->memory,
                                        lockdep_is_held(&vq->mutex));
@@ -524,15 +532,15 @@ static int vq_log_access_ok(struct vhost_virtqueue *vq, void __user *log_base)
                             vhost_has_feature(vq->dev, VHOST_F_LOG_ALL)) &&
                 (!vq->log_used || log_access_ok(log_base, vq->log_addr,
                                         sizeof *vq->used +
-                                        vq->num * sizeof *vq->used->ring));
+                                        vq->num * sizeof *vq->used->ring + s));
 }
 
 /* Can we start vq? */
 /* Caller should have vq mutex and device mutex */
 int vhost_vq_access_ok(struct vhost_virtqueue *vq)
 {
-        return vq_access_ok(vq->num, vq->desc, vq->avail, vq->used) &&
-                vq_log_access_ok(vq, vq->log_base);
+        return vq_access_ok(vq->dev, vq->num, vq->desc, vq->avail, vq->used) &&
+                vq_log_access_ok(vq->dev, vq, vq->log_base);
 }
 
 static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
@@ -577,6 +585,7 @@ static int init_used(struct vhost_virtqueue *vq,
 
         if (r)
                 return r;
+        vq->signalled_used_valid = false;
         return get_user(vq->last_used_idx, &used->idx);
 }
 
@@ -674,7 +683,7 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
                  * If it is not, we don't as size might not have been setup.
                  * We will verify when backend is configured. */
                 if (vq->private_data) {
-                        if (!vq_access_ok(vq->num,
+                        if (!vq_access_ok(d, vq->num,
                                 (void __user *)(unsigned long)a.desc_user_addr,
                                 (void __user *)(unsigned long)a.avail_user_addr,
                                 (void __user *)(unsigned long)a.used_user_addr)) {
@@ -818,7 +827,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, unsigned long arg)
                         vq = d->vqs + i;
                         mutex_lock(&vq->mutex);
                         /* If ring is inactive, will check when it's enabled. */
-                        if (vq->private_data && !vq_log_access_ok(vq, base))
+                        if (vq->private_data && !vq_log_access_ok(d, vq, base))
                                 r = -EFAULT;
                         else
                                 vq->log_base = base;
@@ -1219,6 +1228,10 @@ int vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
 
         /* On success, increment avail index. */
         vq->last_avail_idx++;
+
+        /* Assume notifications from guest are disabled at this point,
+         * if they aren't we would need to update avail_event index. */
+        BUG_ON(!(vq->used_flags & VRING_USED_F_NO_NOTIFY));
         return head;
 }
 
@@ -1267,6 +1280,12 @@ int vhost_add_used(struct vhost_virtqueue *vq, unsigned int head, int len)
                         eventfd_signal(vq->log_ctx, 1);
         }
         vq->last_used_idx++;
+        /* If the driver never bothers to signal in a very long while,
+         * used index might wrap around. If that happens, invalidate
+         * signalled_used index we stored. TODO: make sure driver
+         * signals at least once in 2^16 and remove this. */
+        if (unlikely(vq->last_used_idx == vq->signalled_used))
+                vq->signalled_used_valid = false;
         return 0;
 }
 
@@ -1275,6 +1294,7 @@ static int __vhost_add_used_n(struct vhost_virtqueue *vq,
                             unsigned count)
 {
         struct vring_used_elem __user *used;
+        u16 old, new;
         int start;
 
         start = vq->last_used_idx % vq->num;
@@ -1292,7 +1312,14 @@ static int __vhost_add_used_n(struct vhost_virtqueue *vq,
                            ((void __user *)used - (void __user *)vq->used),
                           count * sizeof *used);
         }
-        vq->last_used_idx += count;
+        old = vq->last_used_idx;
+        new = (vq->last_used_idx += count);
+        /* If the driver never bothers to signal in a very long while,
+         * used index might wrap around. If that happens, invalidate
+         * signalled_used index we stored. TODO: make sure driver
+         * signals at least once in 2^16 and remove this. */
+        if (unlikely((u16)(new - vq->signalled_used) < (u16)(new - old)))
+                vq->signalled_used_valid = false;
         return 0;
 }
 
@@ -1331,29 +1358,47 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads,
         return r;
 }
 
-/* This actually signals the guest, using eventfd. */
-void vhost_signal(struct vhost_dev *dev, struct vhost_virtqueue *vq)
+static bool vhost_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 {
-        __u16 flags;
-
+        __u16 old, new, event;
+        bool v;
         /* Flush out used index updates. This is paired
          * with the barrier that the Guest executes when enabling
          * interrupts. */
         smp_mb();
 
-        if (__get_user(flags, &vq->avail->flags)) {
-                vq_err(vq, "Failed to get flags");
-                return;
+        if (vhost_has_feature(dev, VIRTIO_F_NOTIFY_ON_EMPTY) &&
+            unlikely(vq->avail_idx == vq->last_avail_idx))
+                return true;
+
+        if (!vhost_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) {
+                __u16 flags;
+                if (__get_user(flags, &vq->avail->flags)) {
+                        vq_err(vq, "Failed to get flags");
+                        return true;
+                }
+                return !(flags & VRING_AVAIL_F_NO_INTERRUPT);
         }
+        old = vq->signalled_used;
+        v = vq->signalled_used_valid;
+        new = vq->signalled_used = vq->last_used_idx;
+        vq->signalled_used_valid = true;
 
-        /* If they don't want an interrupt, don't signal, unless empty. */
-        if ((flags & VRING_AVAIL_F_NO_INTERRUPT) &&
-            (vq->avail_idx != vq->last_avail_idx ||
-             !vhost_has_feature(dev, VIRTIO_F_NOTIFY_ON_EMPTY)))
-                return;
+        if (unlikely(!v))
+                return true;
 
+        if (get_user(event, vhost_used_event(vq))) {
+                vq_err(vq, "Failed to get used event idx");
+                return true;
+        }
+        return vring_need_event(event, new, old);
+}
+
+/* This actually signals the guest, using eventfd. */
+void vhost_signal(struct vhost_dev *dev, struct vhost_virtqueue *vq)
+{
         /* Signal the Guest tell them we used something up. */
-        if (vq->call_ctx)
+        if (vq->call_ctx && vhost_notify(dev, vq))
                 eventfd_signal(vq->call_ctx, 1);
 }
 
@@ -1376,7 +1421,7 @@ void vhost_add_used_and_signal_n(struct vhost_dev *dev,
 }
 
 /* OK, now we need to know about added descriptors. */
-bool vhost_enable_notify(struct vhost_virtqueue *vq)
+bool vhost_enable_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 {
         u16 avail_idx;
         int r;
@@ -1384,11 +1429,34 @@ bool vhost_enable_notify(struct vhost_virtqueue *vq)
         if (!(vq->used_flags & VRING_USED_F_NO_NOTIFY))
                 return false;
         vq->used_flags &= ~VRING_USED_F_NO_NOTIFY;
-        r = put_user(vq->used_flags, &vq->used->flags);
-        if (r) {
-                vq_err(vq, "Failed to enable notification at %p: %d\n",
-                       &vq->used->flags, r);
-                return false;
+        if (!vhost_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) {
+                r = put_user(vq->used_flags, &vq->used->flags);
+                if (r) {
+                        vq_err(vq, "Failed to enable notification at %p: %d\n",
+                               &vq->used->flags, r);
+                        return false;
+                }
+        } else {
+                r = put_user(vq->avail_idx, vhost_avail_event(vq));
+                if (r) {
+                        vq_err(vq, "Failed to update avail event index at %p: %d\n",
+                               vhost_avail_event(vq), r);
+                        return false;
+                }
+        }
+        if (unlikely(vq->log_used)) {
+                void __user *used;
+                /* Make sure data is seen before log. */
+                smp_wmb();
+                used = vhost_has_feature(dev, VIRTIO_RING_F_EVENT_IDX) ?
+                        &vq->used->flags : vhost_avail_event(vq);
+                /* Log used flags or event index entry write. Both are 16 bit
+                 * fields. */
+                log_write(vq->log_base, vq->log_addr +
+                           (used - (void __user *)vq->used),
+                          sizeof(u16));
+                if (vq->log_ctx)
+                        eventfd_signal(vq->log_ctx, 1);
         }
         /* They could have slipped one in as we were doing that: make
          * sure it's written, then check again. */
@@ -1404,15 +1472,17 @@ bool vhost_enable_notify(struct vhost_virtqueue *vq)
 }
 
 /* We don't need to be notified again. */
-void vhost_disable_notify(struct vhost_virtqueue *vq)
+void vhost_disable_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 {
         int r;
 
         if (vq->used_flags & VRING_USED_F_NO_NOTIFY)
                 return;
         vq->used_flags |= VRING_USED_F_NO_NOTIFY;
-        r = put_user(vq->used_flags, &vq->used->flags);
-        if (r)
-                vq_err(vq, "Failed to enable notification at %p: %d\n",
-                       &vq->used->flags, r);
+        if (!vhost_has_feature(dev, VIRTIO_RING_F_EVENT_IDX)) {
+                r = put_user(vq->used_flags, &vq->used->flags);
+                if (r)
+                        vq_err(vq, "Failed to enable notification at %p: %d\n",
+                               &vq->used->flags, r);
+        }
 }
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index b3363ae38518..8e03379dd30f 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -84,6 +84,12 @@ struct vhost_virtqueue {
         /* Used flags */
         u16 used_flags;
 
+        /* Last used index value we have signalled on */
+        u16 signalled_used;
+
+        /* Last used index value we have signalled on */
+        bool signalled_used_valid;
+
         /* Log writes to used structure. */
         bool log_used;
         u64 log_addr;
@@ -149,8 +155,8 @@ void vhost_add_used_and_signal(struct vhost_dev *, struct vhost_virtqueue *,
 void vhost_add_used_and_signal_n(struct vhost_dev *, struct vhost_virtqueue *,
                                struct vring_used_elem *heads, unsigned count);
 void vhost_signal(struct vhost_dev *, struct vhost_virtqueue *);
-void vhost_disable_notify(struct vhost_virtqueue *);
-bool vhost_enable_notify(struct vhost_virtqueue *);
+void vhost_disable_notify(struct vhost_dev *, struct vhost_virtqueue *);
+bool vhost_enable_notify(struct vhost_dev *, struct vhost_virtqueue *);
 
 int vhost_log_write(struct vhost_virtqueue *vq, struct vhost_log *log,
                     unsigned int log_num, u64 len);
@@ -162,11 +168,12 @@ int vhost_log_write(struct vhost_virtqueue *vq, struct vhost_log *log,
         } while (0)
 
 enum {
-        VHOST_FEATURES = (1 << VIRTIO_F_NOTIFY_ON_EMPTY) |
-                         (1 << VIRTIO_RING_F_INDIRECT_DESC) |
-                         (1 << VHOST_F_LOG_ALL) |
-                         (1 << VHOST_NET_F_VIRTIO_NET_HDR) |
-                         (1 << VIRTIO_NET_F_MRG_RXBUF),
+        VHOST_FEATURES = (1ULL << VIRTIO_F_NOTIFY_ON_EMPTY) |
+                         (1ULL << VIRTIO_RING_F_INDIRECT_DESC) |
+                         (1ULL << VIRTIO_RING_F_EVENT_IDX) |
+                         (1ULL << VHOST_F_LOG_ALL) |
+                         (1ULL << VHOST_NET_F_VIRTIO_NET_HDR) |
+                         (1ULL << VIRTIO_NET_F_MRG_RXBUF),
 };
 
 static inline int vhost_has_feature(struct vhost_dev *dev, int bit)
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 0f1da45ba47d..e058ace2a4ad 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -40,9 +40,6 @@ struct virtio_balloon
         /* Waiting for host to ack the pages we released. */
         struct completion acked;
 
-        /* Do we have to tell Host *before* we reuse pages? */
-        bool tell_host_first;
-
         /* The pages we've told the Host we're not using. */
         unsigned int num_pages;
         struct list_head pages;
@@ -151,13 +148,14 @@ static void leak_balloon(struct virtio_balloon *vb, size_t num)
                 vb->num_pages--;
         }
 
-        if (vb->tell_host_first) {
-                tell_host(vb, vb->deflate_vq);
-                release_pages_by_pfn(vb->pfns, vb->num_pfns);
-        } else {
-                release_pages_by_pfn(vb->pfns, vb->num_pfns);
-                tell_host(vb, vb->deflate_vq);
-        }
+
+        /*
+         * Note that if
+         * virtio_has_feature(vdev, VIRTIO_BALLOON_F_MUST_TELL_HOST);
+         * is true, we *have* to do it in this order
+         */
+        tell_host(vb, vb->deflate_vq);
+        release_pages_by_pfn(vb->pfns, vb->num_pfns);
 }
 
 static inline void update_stat(struct virtio_balloon *vb, int idx,
@@ -325,9 +323,6 @@ static int virtballoon_probe(struct virtio_device *vdev)
                 goto out_del_vqs;
         }
 
-        vb->tell_host_first
-                = virtio_has_feature(vdev, VIRTIO_BALLOON_F_MUST_TELL_HOST);
-
         return 0;
 
 out_del_vqs:
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index b0043fb26a4d..68b9136847af 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -82,6 +82,9 @@ struct vring_virtqueue
         /* Host supports indirect buffers */
         bool indirect;
 
+        /* Host publishes avail event idx */
+        bool event;
+
         /* Number of free buffers */
         unsigned int num_free;
         /* Head of free buffer list. */
@@ -237,18 +240,22 @@ EXPORT_SYMBOL_GPL(virtqueue_add_buf_gfp);
 void virtqueue_kick(struct virtqueue *_vq)
 {
         struct vring_virtqueue *vq = to_vvq(_vq);
+        u16 new, old;
         START_USE(vq);
         /* Descriptors and available array need to be set before we expose the
          * new available array entries. */
         virtio_wmb();
 
-        vq->vring.avail->idx += vq->num_added;
+        old = vq->vring.avail->idx;
+        new = vq->vring.avail->idx = old + vq->num_added;
         vq->num_added = 0;
 
         /* Need to update avail index before checking if we should notify */
         virtio_mb();
 
-        if (!(vq->vring.used->flags & VRING_USED_F_NO_NOTIFY))
+        if (vq->event ?
+            vring_need_event(vring_avail_event(&vq->vring), new, old) :
+            !(vq->vring.used->flags & VRING_USED_F_NO_NOTIFY))
                 /* Prod other side to tell it about changes. */
                 vq->notify(&vq->vq);
 
@@ -324,6 +331,14 @@ void *virtqueue_get_buf(struct virtqueue *_vq, unsigned int *len)
         ret = vq->data[i];
         detach_buf(vq, i);
         vq->last_used_idx++;
+        /* If we expect an interrupt for the next entry, tell host
+         * by writing event index and flush out the write before
+         * the read in the next get_buf call. */
+        if (!(vq->vring.avail->flags & VRING_AVAIL_F_NO_INTERRUPT)) {
+                vring_used_event(&vq->vring) = vq->last_used_idx;
+                virtio_mb();
+        }
+
         END_USE(vq);
         return ret;
 }
@@ -345,7 +360,11 @@ bool virtqueue_enable_cb(struct virtqueue *_vq)
 
         /* We optimistically turn back on interrupts, then check if there was
          * more to do. */
+        /* Depending on the VIRTIO_RING_F_EVENT_IDX feature, we need to
+         * either clear the flags bit or point the event index at the next
+         * entry. Always do both to keep code simple. */
         vq->vring.avail->flags &= ~VRING_AVAIL_F_NO_INTERRUPT;
+        vring_used_event(&vq->vring) = vq->last_used_idx;
         virtio_mb();
         if (unlikely(more_used(vq))) {
                 END_USE(vq);
@@ -357,6 +376,33 @@ bool virtqueue_enable_cb(struct virtqueue *_vq)
 }
 EXPORT_SYMBOL_GPL(virtqueue_enable_cb);
 
+bool virtqueue_enable_cb_delayed(struct virtqueue *_vq)
+{
+        struct vring_virtqueue *vq = to_vvq(_vq);
+        u16 bufs;
+
+        START_USE(vq);
+
+        /* We optimistically turn back on interrupts, then check if there was
+         * more to do. */
+        /* Depending on the VIRTIO_RING_F_USED_EVENT_IDX feature, we need to
+         * either clear the flags bit or point the event index at the next
+         * entry. Always do both to keep code simple. */
+        vq->vring.avail->flags &= ~VRING_AVAIL_F_NO_INTERRUPT;
+        /* TODO: tune this threshold */
+        bufs = (u16)(vq->vring.avail->idx - vq->last_used_idx) * 3 / 4;
+        vring_used_event(&vq->vring) = vq->last_used_idx + bufs;
+        virtio_mb();
+        if (unlikely((u16)(vq->vring.used->idx - vq->last_used_idx) > bufs)) {
+                END_USE(vq);
+                return false;
+        }
+
+        END_USE(vq);
+        return true;
+}
+EXPORT_SYMBOL_GPL(virtqueue_enable_cb_delayed);
+
 void *virtqueue_detach_unused_buf(struct virtqueue *_vq)
 {
         struct vring_virtqueue *vq = to_vvq(_vq);
@@ -438,6 +484,7 @@ struct virtqueue *vring_new_virtqueue(unsigned int num,
 #endif
 
         vq->indirect = virtio_has_feature(vdev, VIRTIO_RING_F_INDIRECT_DESC);
+        vq->event = virtio_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX);
 
         /* No callback?  Tell other side not to bother us. */
         if (!callback)
@@ -472,6 +519,8 @@ void vring_transport_features(struct virtio_device *vdev)
                 switch (i) {
                 case VIRTIO_RING_F_INDIRECT_DESC:
                         break;
+                case VIRTIO_RING_F_EVENT_IDX:
+                        break;
                 default:
                         /* We don't understand this bit. */
                         clear_bit(i, vdev->features);